Disassembly of File: EKD2W95.EXE
Code Offset = 00000400, Code Size = 0004A400
Data Offset = 0004AC00, Data Size = 00007A00

Number of Objects = 0006 (dec), Imagebase = 00400000h

   Object01: .text    RVA: 00001000 Offset: 00000400 Size: 0004A400 Flags: 60000020
   Object02: .rdata   RVA: 0004C000 Offset: 0004A800 Size: 00000400 Flags: 40000040
   Object03: .data    RVA: 0004D000 Offset: 0004AC00 Size: 00007A00 Flags: C0000040
   Object04: .idata   RVA: 00077000 Offset: 00052600 Size: 00000E00 Flags: C0000040
   Object05: .rsrc    RVA: 00078000 Offset: 00053400 Size: 00004000 Flags: 40000040
   Object06: .reloc   RVA: 0007C000 Offset: 00057400 Size: 00004400 Flags: 42000040


+++++++++++++++++++ MENU INFORMATION ++++++++++++++++++

Number of Menus =    5 (decimal)


APPMENU

      (F) {Popup}
                      [ID=9C46h]
           X           [ID=9C47h]
           8_(X)     [ID=9C41h]

      (O) {Popup}
            {Popup}
                
I         [ID=9C4Ch]
                            [ID=9C4Dh]
                n           [ID=9C4Eh]
                            [ID=9C4Fh]

           oP {Popup}
                            [ID=9C52h]
                s           [ID=9C53h]

           H {Popup}
                            [ID=9C54h]
                s           [ID=9C55h]

           Ɨr {Popup}
                           [ID=9C91h]
                           [ID=9C92h]
                           [ID=9C93h]
                           [ID=9C94h]
                           [ID=9C95h]
                           [ID=9C96h]
                           [ID=9C97h]
                           [ID=9C98h]

           ;' {Popup}
                320x240     [ID=9C51h]
                640x480     [ID=9C50h]

           IMn {Popup}
                            [ID=9C83h]
                s           [ID=9C84h]

           ť(I) {Popup}
                fť(B)     [ID=9C42h]
                Eł(I)     [ID=9C45h]

           H,ť(V)     [ID=9C89h]


CONVMENU

      CONV {Popup}
           BMP>CHIP    [ID=9CBDh]


HEXMENU

      (F) {Popup}
                      [ID=9C46h]
           8_        [ID=9CDDh]

      (O) {Popup}
              _      [ID=9C72h]
           ;          [ID=9C73h]
           oP {Popup}
                            [ID=9C7Eh]
                s           [ID=9C7Fh]

           H {Popup}
                            [ID=9C80h]
                s           [ID=9C81h]

            {Popup}
                          [ID=9C77h]
                          [ID=9C78h]
                          [ID=9C79h]
                          [ID=9C7Ah]
                          [ID=9C7Bh]

           w {Popup}
                           [ID=9C48h]
                -           [ID=9C49h]
                '           [ID=9C4Ah]
                            [ID=9C4Bh]

            {Popup}
                          [ID=9C75h]
                
          [ID=9C76h]

           L {Popup}
                          [ID=9C7Ch]
                
          [ID=9C7Dh]

           IMn {Popup}
                            [ID=9C83h]
                s           [ID=9C84h]

           w>: {Popup}
                            [ID=9CAEh]
                s           [ID=9CAFh]

           ť(I) {Popup}
                h {Popup}
                               [ID=9CD6h]
                     L          [ID=9CD7h]

                fť {Popup}
                               [ID=9CD8h]
                     L          [ID=9CD9h]

                :)        [ID=9CDAh]
                )a        [ID=9CDBh]

           H,ť(V)     [ID=9C89h]


MAPMENU

      ATR {Popup}
           LOAD        [ID=9CB1h]
           INIT        [ID=9CB4h]
                      [ID=9CBFh]
           0         [ID=9CC0h]
           1         [ID=9CC1h]
           2         [ID=9CC2h]
           3         [ID=9CC3h]
           Mn0       [ID=9CC7h]
           Mn1       [ID=9CC8h]
           Mn2       [ID=9CC9h]
           Mn3       [ID=9CCAh]
           _ݽc        [ID=9CA5h]
           PUT {Popup}
                ON          [ID=9C68h]
                OFF         [ID=9C69h]

            {Popup}

      MAP {Popup}
           LOAD        [ID=9CB3h]
           SAVE        [ID=9C6Ch]
           INIT        [ID=9C70h]
            {Popup}
                            [ID=9CA6h]
                            [ID=9CB0h]

           BG {Popup}
                LOAD        [ID=9CB2h]
                PUT {Popup}
                     ON          [ID=9C6Ah]
                     OFF         [ID=9C6Bh]

                DISP {Popup}
                     GAME VIEW   [ID=9CBBh]
                     INP         [ID=9CA4h]

                DEBUG {Popup}
                     SSC STATUS  [ID=9CC4h]


OBJMENU

      BMP {Popup}
           LOAD        [ID=9CB5h]
           INIT        [ID=9CB8h]

      OBJ {Popup}
           LOAD        [ID=9CB6h]
           SAVE        [ID=9CB7h]
           INIT        [ID=9CAEh]

      DEBUG {Popup}
           OM          [ID=9CB9h]
           OMF         [ID=9CBAh]
           LOCATION    [ID=9CC5h]
           [        [ID=9CC6h]

+++++++++++++++++ DIALOG INFORMATION ++++++++++++++++++

Number of Dialogs =    3 (decimal)

Name:    APPVERSION, # of Controls=006, Caption:"	T  for Windows95 H,ť", ClassName:""
     001 - ControlID:0001, Control Class:"BUTTON" Control Text:"OK" 
     002 - ControlID:FFFF, Control Class:"STATIC" Control Text:"	T  for Windows95" 
     003 - ControlID:FFFF, Control Class:"STATIC" Control Text:"VERSION 1.0" 
     004 - ControlID:FFFF, Control Class:"STATIC" Control Text:"Copyright(C)" 
     005 - ControlID:FFFF, Control Class:"STATIC" Control Text:"" 
     006 - ControlID:FFFF, Control Class:"STATIC" Control Text:"" 
Name: DialogID_009C, # of Controls=002, Caption:"", ClassName:""
     001 - ControlID:0001, Control Class:"BUTTON" Control Text:"OK" 
     002 - ControlID:0002, Control Class:"BUTTON" Control Text:"" 
Name: DialogID_009D, # of Controls=002, Caption:"", ClassName:""
     001 - ControlID:0001, Control Class:"BUTTON" Control Text:"OK" 
     002 - ControlID:0002, Control Class:"BUTTON" Control Text:"" 

+++++++++++++++++++ IMPORTED FUNCTIONS ++++++++++++++++++
Number of Imported Modules =    5 (decimal)

   Import Module 001: KERNEL32.dll
   Import Module 002: USER32.dll
   Import Module 003: GDI32.dll
   Import Module 004: WINMM.dll
   Import Module 005: comdlg32.dll

+++++++++++++++++++ IMPORT MODULE DETAILS +++++++++++++++

   Import Module 001: KERNEL32.dll

 Addr:00077506 hint(0197) Name: OpenFile
 Addr:00077512 hint(00CE) Name: GetDriveTypeA
 Addr:000774E2 hint(0264) Name: _lwrite
 Addr:000774FC hint(025F) Name: _lclose
 Addr:000774EC hint(01F2) Name: SetErrorMode
 Addr:00077900 hint(00EB) Name: GetModuleHandleA
 Addr:00077A3C hint(01FA) Name: SetHandleCount
 Addr:000778D6 hint(024F) Name: WriteFile
 Addr:00077AB4 hint(016F) Name: IsBadWritePtr
 Addr:00077A86 hint(0211) Name: SetUnhandledExceptionFilter
 Addr:00077A7A hint(0159) Name: HeapFree
 Addr:00077AA4 hint(016C) Name: IsBadReadPtr
 Addr:00077A6C hint(0155) Name: HeapCreate
 Addr:00077A5C hint(0116) Name: GetStdHandle
 Addr:000778CA hint(01B8) Name: ReadFile
 Addr:00077A30 hint(00F6) Name: GetOEMCP
 Addr:00077A26 hint(0092) Name: GetACP
 Addr:00077A1A hint(0098) Name: GetCPInfo
 Addr:00077B0A hint(0206) Name: SetStdHandle
 Addr:00077AF6 hint(0083) Name: FlushFileBuffers
 Addr:00077AE6 hint(0178) Name: LoadLibraryA
 Addr:00077AD4 hint(0103) Name: GetProcAddress
 Addr:00077AC4 hint(0169) Name: IsBadCodePtr
 Addr:0007781E hint(0138) Name: GetVersionExA
 Addr:0007782E hint(0147) Name: GlobalFree
 Addr:0007783C hint(0151) Name: GlobalUnlock
 Addr:0007784C hint(014B) Name: GlobalLock
 Addr:0007785A hint(0140) Name: GlobalAlloc
 Addr:00077868 hint(0130) Name: GetTickCount
 Addr:00077878 hint(0062) Name: ExitProcess
 Addr:00077886 hint(00C2) Name: GetCurrentDirectoryA
 Addr:0007789E hint(002B) Name: CreateFileA
 Addr:000778AC hint(0016) Name: CloseHandle
 Addr:000778BA hint(00E1) Name: GetLastError
 Addr:00077A04 hint(0242) Name: WideCharToMultiByte
 Addr:00077946 hint(015C) Name: HeapReAlloc
 Addr:00077A4E hint(00DC) Name: GetFileType
 Addr:000778E2 hint(01F8) Name: SetFilePointer
 Addr:000778F4 hint(01C7) Name: RtlUnwind
 Addr:000774D8 hint(0263) Name: _lread
 Addr:00077914 hint(0114) Name: GetStartupInfoA
 Addr:00077926 hint(009F) Name: GetCommandLineA
 Addr:00077938 hint(0137) Name: GetVersion
 Addr:0007799E hint(008B) Name: FreeEnvironmentStringsA
 Addr:00077954 hint(015D) Name: HeapSize
 Addr:00077960 hint(0153) Name: HeapAlloc
 Addr:0007796C hint(0226) Name: UnhandledExceptionFilter
 Addr:00077988 hint(00E9) Name: GetModuleFileNameA
 Addr:000779B8 hint(00D0) Name: GetEnvironmentStrings
 Addr:000779D0 hint(008C) Name: FreeEnvironmentStringsW
 Addr:000779EA hint(00D2) Name: GetEnvironmentStringsW

   Import Module 002: USER32.dll

 Addr:000776A8 hint(00A9) Name: EnableMenuItem
 Addr:000776BA hint(011F) Name: GetSubMenu
 Addr:00077750 hint(022E) Name: UnhookWindowsHookEx
 Addr:0007777A hint(0139) Name: GetWindowThreadProcessId
 Addr:000776D8 hint(00CD) Name: GetActiveWindow
 Addr:00077766 hint(020E) Name: SetWindowsHookExA
 Addr:0007771E hint(00DC) Name: GetClientRect
 Addr:0007773E hint(0148) Name: InvalidateRect
 Addr:0007772E hint(0237) Name: UpdateWindow
 Addr:000776EA hint(0010) Name: CallNextHookEx
 Addr:0007770C hint(0033) Name: ClientToScreen
 Addr:000776FC hint(0207) Name: SetWindowPos
 Addr:000776C8 hint(002D) Name: CheckMenuItem
 Addr:00077676 hint(0085) Name: DestroyMenu
 Addr:00077684 hint(00A0) Name: DrawMenuBar
 Addr:00077530 hint(0188) Name: MessageBoxA
 Addr:0007754E hint(024B) Name: wvsprintfA
 Addr:0007753E hint(01A3) Name: PostMessageA
 Addr:00077568 hint(0243) Name: WinHelpA
 Addr:00077B1A hint(0216) Name: ShowWindow
 Addr:00077B28 hint(008C) Name: DispatchMessageA
 Addr:00077B3C hint(022C) Name: TranslateMessage
 Addr:00077B50 hint(01A1) Name: PeekMessageA
 Addr:00077B60 hint(01BF) Name: ScreenToClient
 Addr:00077B72 hint(00E5) Name: GetCursorPos
 Addr:00077B82 hint(0123) Name: GetSystemMetrics
 Addr:00077B96 hint(021C) Name: SystemParametersInfoA
 Addr:00077BAE hint(0190) Name: MoveWindow
 Addr:00077BBC hint(0133) Name: GetWindowRect
 Addr:00077BCC hint(00AF) Name: EndPaint
 Addr:00077BD8 hint(0009) Name: BeginPaint
 Addr:00077BE6 hint(01A5) Name: PostQuitMessage
 Addr:00077BF8 hint(007D) Name: DefWindowProcA
 Addr:00077C0A hint(0086) Name: DestroyWindow
 Addr:0007769C hint(0172) Name: LoadMenuA
 Addr:00077692 hint(01E7) Name: SetMenu
 Addr:00077574 hint(008A) Name: DialogBoxParamA
 Addr:0007755C hint(00AD) Name: EndDialog
 Addr:00077662 hint(0105) Name: GetMenuItemCount
 Addr:00077656 hint(01D8) Name: SetCursor
 Addr:0007764C hint(0101) Name: GetMenu
 Addr:0007763C hint(010A) Name: GetMenuState
 Addr:0007762C hint(0083) Name: DestroyCursor
 Addr:0007761E hint(00C6) Name: FindWindowA
 Addr:00077612 hint(0159) Name: IsIconic
 Addr:00077602 hint(01C6) Name: SendMessageA
 Addr:000775EC hint(0100) Name: GetLastActivePopup
 Addr:000775D8 hint(000A) Name: BringWindowToTop
 Addr:000775D0 hint(00E6) Name: GetDC
 Addr:000775C4 hint(01B9) Name: ReleaseDC
 Addr:000775B8 hint(016B) Name: LoadIconA
 Addr:000775A6 hint(01AB) Name: RegisterClassA
 Addr:00077594 hint(0052) Name: CreateWindowExA
 Addr:00077586 hint(0167) Name: LoadCursorA

   Import Module 003: GDI32.dll

 Addr:00077D04 hint(0143) Name: SetBkMode
 Addr:000777A2 hint(00BC) Name: GetDeviceCaps
 Addr:00077CF4 hint(0163) Name: SetTextColor
 Addr:00077C1A hint(0129) Name: RealizePalette
 Addr:00077C2C hint(013D) Name: SelectPalette
 Addr:00077C50 hint(0046) Name: DeleteObject
 Addr:00077D86 hint(00F0) Name: GetSystemPaletteEntries
 Addr:00077D76 hint(0035) Name: CreatePalette
 Addr:00077D62 hint(0148) Name: SetDIBColorTable
 Addr:00077D54 hint(00DE) Name: GetObjectA
 Addr:00077D40 hint(0024) Name: CreateDIBSection
 Addr:00077D2C hint(015F) Name: SetStretchBltMode
 Addr:00077D1A hint(0006) Name: AnimatePalette
 Addr:00077D10 hint(0115) Name: PatBlt
 Addr:00077C60 hint(00FF) Name: GetTextMetricsA
 Addr:00077C3C hint(00E3) Name: GetPaletteEntries
 Addr:00077CE8 hint(0174) Name: TextOutA
 Addr:00077CDC hint(00BB) Name: GetDIBits
 Addr:00077CD2 hint(000A) Name: BitBlt
 Addr:00077CC6 hint(0043) Name: DeleteDC
 Addr:00077CB8 hint(002B) Name: CreateFontA
 Addr:00077CA2 hint(001F) Name: CreateCompatibleDC
 Addr:00077C90 hint(0025) Name: CreateDIBitmap
 Addr:00077C82 hint(0152) Name: SetMapMode
 Addr:00077C72 hint(013C) Name: SelectObject

   Import Module 004: WINMM.dll

 Addr:000777BC hint(002F) Name: mciSendCommandA
 Addr:000777CE hint(008D) Name: sndPlaySoundA
 Addr:00077DA0 hint(0094) Name: timeGetTime

   Import Module 005: comdlg32.dll

 Addr:000777E8 hint(0009) Name: GetOpenFileNameA
 Addr:000777FC hint(000B) Name: GetSaveFileNameA

+++++++++++++++++++ EXPORTED FUNCTIONS ++++++++++++++++++
Number of Exported Functions = 0000 (decimal)




+++++++++++++++++++ ASSEMBLY CODE LISTING ++++++++++++++++++
//********************** Start of Code in Object .text **************
Program Entry Point = 00448470 (EKD2W95.EXE File Offset:00092C70)


:00401000 55                      push ebp
:00401001 8BEC                    mov ebp, esp
:00401003 53                      push ebx
:00401004 56                      push esi
:00401005 57                      push edi
:00401006 8B4508                  mov eax, dword ptr [ebp+08]
:00401009 50                      push eax
:0040100A B900AA4600              mov ecx, 0046AA00
:0040100F E80C080000              call 00401820
:00401014 E900000000              jmp 00401019

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401014(U)
|
:00401019 5F                      pop edi
:0040101A 5E                      pop esi
:0040101B 5B                      pop ebx
:0040101C C9                      leave
:0040101D C3                      ret



* Referenced by a CALL at Addresses:
|:0040107F   , :004010BE   , :0040F9D5   , :0042578C   , :00425B0D   
|:00425CE1   , :00433AC8   , :00437D76   , :00438129   
|
:0040101E 55                      push ebp
:0040101F 8BEC                    mov ebp, esp
:00401021 53                      push ebx
:00401022 56                      push esi
:00401023 57                      push edi
:00401024 B900AA4600              mov ecx, 0046AA00
:00401029 E822080000              call 00401850
:0040102E E900000000              jmp 00401033

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040102E(U)
|
:00401033 5F                      pop edi
:00401034 5E                      pop esi
:00401035 5B                      pop ebx
:00401036 C9                      leave
:00401037 C3                      ret



* Referenced by a CALL at Address:
|:004010E9   
|
:00401038 55                      push ebp
:00401039 8BEC                    mov ebp, esp
:0040103B 83EC04                  sub esp, 00000004
:0040103E 53                      push ebx
:0040103F 56                      push esi
:00401040 57                      push edi
:00401041 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00401044 E827080000              call 00401870
:00401049 8B4508                  mov eax, dword ptr [ebp+08]
:0040104C 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040104F 8D0C8500A74600          lea ecx, dword ptr [4*eax+0046A700]
:00401056 E875080000              call 004018D0
:0040105B 50                      push eax
:0040105C 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0040105F E82C080000              call 00401890
:00401064 33C0                    xor eax, eax
:00401066 8A45FD                  mov al, byte ptr [ebp-03]
:00401069 C1E003                  shl eax, 03
:0040106C E900000000              jmp 00401071

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040106C(U)
|
:00401071 5F                      pop edi
:00401072 5E                      pop esi
:00401073 5B                      pop ebx
:00401074 C9                      leave
:00401075 C3                      ret



* Referenced by a CALL at Addresses:
|:00401185   , :0042BE4A   , :00430372   , :004303AE   , :00432267   
|:0043264C   
|
:00401076 55                      push ebp
:00401077 8BEC                    mov ebp, esp
:00401079 83EC18                  sub esp, 00000018
:0040107C 53                      push ebx
:0040107D 56                      push esi
:0040107E 57                      push edi
:0040107F E89AFFFFFF              call 0040101E
:00401084 33C9                    xor ecx, ecx
:00401086 8AC8                    mov cl, al
:00401088 83F902                  cmp ecx, 00000002
:0040108B 0F852D000000            jne 004010BE
:00401091 837D0803                cmp dword ptr [ebp+08], 00000003
:00401095 0F851E000000            jne 004010B9
:0040109B 8B4510                  mov eax, dword ptr [ebp+10]
:0040109E 50                      push eax
:0040109F E8D84F0100              call 0041607C
:004010A4 83C404                  add esp, 00000004
:004010A7 3DF0000000              cmp eax, 000000F0
:004010AC 0F8E07000000            jle 004010B9
:004010B2 C7450804000000          mov [ebp+08], 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00401095(C), :004010AC(C)
|
:004010B9 E945000000              jmp 00401103

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040108B(C)
|
:004010BE E85BFFFFFF              call 0040101E
:004010C3 33C9                    xor ecx, ecx
:004010C5 8AC8                    mov cl, al
:004010C7 83F901                  cmp ecx, 00000001
:004010CA 0F8533000000            jne 00401103
:004010D0 837D0803                cmp dword ptr [ebp+08], 00000003
:004010D4 0F8529000000            jne 00401103
:004010DA B9D0A64600              mov ecx, 0046A6D0
:004010DF E80C080000              call 004018F0
:004010E4 33C9                    xor ecx, ecx
:004010E6 8AC8                    mov cl, al
:004010E8 51                      push ecx
:004010E9 E84AFFFFFF              call 00401038
:004010EE 83C404                  add esp, 00000004
:004010F1 3DF0000000              cmp eax, 000000F0
:004010F6 0F8607000000            jbe 00401103
:004010FC C7450804000000          mov [ebp+08], 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004010B9(U), :004010CA(C), :004010D4(C), :004010F6(C)
|
:00401103 8B4508                  mov eax, dword ptr [ebp+08]
:00401106 C1E004                  shl eax, 04
:00401109 0510D14400              add eax, 0044D110
:0040110E 8945FC                  mov dword ptr [ebp-04], eax
:00401111 8B45FC                  mov eax, dword ptr [ebp-04]
:00401114 8B00                    mov eax, dword ptr [eax]
:00401116 8945F4                  mov dword ptr [ebp-0C], eax
:00401119 8345FC04                add dword ptr [ebp-04], 00000004
:0040111D 8B45FC                  mov eax, dword ptr [ebp-04]
:00401120 8B00                    mov eax, dword ptr [eax]
:00401122 8945EC                  mov dword ptr [ebp-14], eax
:00401125 8345FC04                add dword ptr [ebp-04], 00000004
:00401129 8B45FC                  mov eax, dword ptr [ebp-04]
:0040112C 8B00                    mov eax, dword ptr [eax]
:0040112E 8945F8                  mov dword ptr [ebp-08], eax
:00401131 8345FC04                add dword ptr [ebp-04], 00000004
:00401135 8B45FC                  mov eax, dword ptr [ebp-04]
:00401138 8B00                    mov eax, dword ptr [eax]
:0040113A 8945F0                  mov dword ptr [ebp-10], eax
:0040113D 8B4514                  mov eax, dword ptr [ebp+14]
:00401140 50                      push eax
:00401141 8B4510                  mov eax, dword ptr [ebp+10]
:00401144 50                      push eax
:00401145 8B450C                  mov eax, dword ptr [ebp+0C]
:00401148 50                      push eax
:00401149 8B45F0                  mov eax, dword ptr [ebp-10]
:0040114C 50                      push eax
:0040114D 8B45F8                  mov eax, dword ptr [ebp-08]
:00401150 50                      push eax
:00401151 8B45EC                  mov eax, dword ptr [ebp-14]
:00401154 50                      push eax
:00401155 8B45F4                  mov eax, dword ptr [ebp-0C]
:00401158 50                      push eax
:00401159 E812680300              call 00437970
:0040115E 83C41C                  add esp, 0000001C
:00401161 8945E8                  mov dword ptr [ebp-18], eax
:00401164 8B45E8                  mov eax, dword ptr [ebp-18]
:00401167 E900000000              jmp 0040116C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401167(U)
|
:0040116C 5F                      pop edi
:0040116D 5E                      pop esi
:0040116E 5B                      pop ebx
:0040116F C9                      leave
:00401170 C3                      ret



* Referenced by a CALL at Addresses:
|:00415A8A   , :00415D08   , :00436D37   , :00436D7C   , :00436EEB   
|
:00401171 55                      push ebp
:00401172 8BEC                    mov ebp, esp
:00401174 53                      push ebx
:00401175 56                      push esi
:00401176 57                      push edi
:00401177 8B4510                  mov eax, dword ptr [ebp+10]
:0040117A 50                      push eax
:0040117B 8B450C                  mov eax, dword ptr [ebp+0C]
:0040117E 50                      push eax
:0040117F 8B4508                  mov eax, dword ptr [ebp+08]
:00401182 50                      push eax
:00401183 6A03                    push 00000003
:00401185 E8ECFEFFFF              call 00401076
:0040118A 83C410                  add esp, 00000010
:0040118D E900000000              jmp 00401192

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040118D(U)
|
:00401192 5F                      pop edi
:00401193 5E                      pop esi
:00401194 5B                      pop ebx
:00401195 C9                      leave
:00401196 C3                      ret



* Referenced by a CALL at Addresses:
|:00401203   , :00426C66   , :00434D70   , :00434E25   , :00434E51   
|:00434EBD   , :00434F12   , :00435039   
|
:00401197 55                      push ebp
:00401198 8BEC                    mov ebp, esp
:0040119A 53                      push ebx
:0040119B 56                      push esi
:0040119C 57                      push edi
:0040119D E860050000              call 00401702
:004011A2 6A0C                    push 0000000C
:004011A4 BB16000000              mov ebx, 00000016
:004011A9 8B4508                  mov eax, dword ptr [ebp+08]
:004011AC 50                      push eax
:004011AD E8F8610400              call 004473AA
:004011B2 83C404                  add esp, 00000004
:004011B5 2BD8                    sub ebx, eax
:004011B7 C1EB01                  shr ebx, 01
:004011BA 83C324                  add ebx, 00000024
:004011BD 53                      push ebx
:004011BE B910BC4600              mov ecx, 0046BC10
:004011C3 E83FEA0100              call 0041FC07
:004011C8 8B4508                  mov eax, dword ptr [ebp+08]
:004011CB 50                      push eax

* Possible StringData Ref from Data Obj ->"M4C7%s"
                                  |
:004011CC 6860D14400              push 0044D160
:004011D1 6810BC4600              push 0046BC10
:004011D6 E848F90100              call 00420B23
:004011DB 83C40C                  add esp, 0000000C
:004011DE E900000000              jmp 004011E3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004011DE(U)
|
:004011E3 5F                      pop edi
:004011E4 5E                      pop esi
:004011E5 5B                      pop ebx
:004011E6 C9                      leave
:004011E7 C3                      ret



* Referenced by a CALL at Address:
|:00430598   
|
:004011E8 55                      push ebp
:004011E9 8BEC                    mov ebp, esp
:004011EB 53                      push ebx
:004011EC 56                      push esi
:004011ED 57                      push edi
:004011EE 8B4508                  mov eax, dword ptr [ebp+08]
:004011F1 50                      push eax
:004011F2 6858CF4600              push 0046CF58
:004011F7 E8D1610400              call 004473CD
:004011FC 83C408                  add esp, 00000008
:004011FF 8B4508                  mov eax, dword ptr [ebp+08]
:00401202 50                      push eax
:00401203 E88FFFFFFF              call 00401197
:00401208 83C404                  add esp, 00000004
:0040120B 33C0                    xor eax, eax
:0040120D E900000000              jmp 00401212

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040120D(U)
|
:00401212 5F                      pop edi
:00401213 5E                      pop esi
:00401214 5B                      pop ebx
:00401215 C9                      leave
:00401216 C3                      ret



* Referenced by a CALL at Addresses:
|:004017ED   , :0040F301   , :0040F781   , :00417868   , :00425612   
|:00435882   , :00436ED6   
|
:00401217 55                      push ebp
:00401218 8BEC                    mov ebp, esp
:0040121A 83EC04                  sub esp, 00000004
:0040121D 53                      push ebx
:0040121E 56                      push esi
:0040121F 57                      push edi
:00401220 B9D0A64600              mov ecx, 0046A6D0
:00401225 E8C6060000              call 004018F0
:0040122A 50                      push eax
:0040122B E822DC0100              call 0041EE52
:00401230 83C404                  add esp, 00000004
:00401233 8BC8                    mov ecx, eax
:00401235 E8D6060000              call 00401910
:0040123A 8945FC                  mov dword ptr [ebp-04], eax
:0040123D E8E8040000              call 0040172A
:00401242 6A0C                    push 0000000C
:00401244 BB06000000              mov ebx, 00000006
:00401249 8B45FC                  mov eax, dword ptr [ebp-04]
:0040124C 50                      push eax
:0040124D E858610400              call 004473AA
:00401252 83C404                  add esp, 00000004
:00401255 2BD8                    sub ebx, eax
:00401257 C1EB01                  shr ebx, 01
:0040125A 83C33D                  add ebx, 0000003D
:0040125D 53                      push ebx
:0040125E B910BC4600              mov ecx, 0046BC10
:00401263 E89FE90100              call 0041FC07
:00401268 8B45FC                  mov eax, dword ptr [ebp-04]
:0040126B 50                      push eax

* Possible StringData Ref from Data Obj ->"C7M4%s"
                                  |
:0040126C 686CD14400              push 0044D16C
:00401271 6810BC4600              push 0046BC10
:00401276 E8A8F80100              call 00420B23
:0040127B 83C40C                  add esp, 0000000C
:0040127E E900000000              jmp 00401283

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040127E(U)
|
:00401283 5F                      pop edi
:00401284 5E                      pop esi
:00401285 5B                      pop ebx
:00401286 C9                      leave
:00401287 C3                      ret



* Referenced by a CALL at Addresses:
|:0040F721   , :0040F78D   , :0040F847   
|
:00401288 55                      push ebp
:00401289 8BEC                    mov ebp, esp
:0040128B 83EC10                  sub esp, 00000010
:0040128E 53                      push ebx
:0040128F 56                      push esi
:00401290 57                      push edi
:00401291 C745FCFFFF0000          mov [ebp-04], 0000FFFF
:00401298 833D7853450002          cmp dword ptr [00455378], 00000002
:0040129F 0F8429010000            je 004013CE
:004012A5 8B4508                  mov eax, dword ptr [ebp+08]
:004012A8 8945F4                  mov dword ptr [ebp-0C], eax
:004012AB E952000000              jmp 00401302

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401306(C)
|
:004012B0 B9B0C44600              mov ecx, 0046C4B0
:004012B5 E8BFDD0200              call 0042F079
:004012BA 8945FC                  mov dword ptr [ebp-04], eax
:004012BD E963000000              jmp 00401325

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401310(C)
|
:004012C2 8B450C                  mov eax, dword ptr [ebp+0C]
:004012C5 50                      push eax
:004012C6 B9B0C44600              mov ecx, 0046C4B0
:004012CB E879DE0200              call 0042F149
:004012D0 8945FC                  mov dword ptr [ebp-04], eax
:004012D3 E94D000000              jmp 00401325

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040131A(C)
|
:004012D8 8B450C                  mov eax, dword ptr [ebp+0C]
:004012DB 50                      push eax
:004012DC B900AA4600              mov ecx, 0046AA00
:004012E1 E84A060000              call 00401930
:004012E6 33C9                    xor ecx, ecx
:004012E8 8AC8                    mov cl, al
:004012EA 51                      push ecx
:004012EB B9B0C44600              mov ecx, 0046C4B0
:004012F0 E804E00200              call 0042F2F9
:004012F5 8945FC                  mov dword ptr [ebp-04], eax
:004012F8 E928000000              jmp 00401325
:004012FD E923000000              jmp 00401325

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004012AB(U)
|
:00401302 837DF400                cmp dword ptr [ebp-0C], 00000000
:00401306 0F84A4FFFFFF            je 004012B0
:0040130C 837DF401                cmp dword ptr [ebp-0C], 00000001
:00401310 0F84ACFFFFFF            je 004012C2
:00401316 837DF402                cmp dword ptr [ebp-0C], 00000002
:0040131A 0F84B8FFFFFF            je 004012D8
:00401320 E900000000              jmp 00401325

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004012BD(U), :004012D3(U), :004012F8(U), :004012FD(U), :00401320(U)
|
:00401325 817DFCFFFF0000          cmp dword ptr [ebp-04], 0000FFFF
:0040132C 0F849C000000            je 004013CE
:00401332 8B45FC                  mov eax, dword ptr [ebp-04]
:00401335 50                      push eax
:00401336 B9B0C44600              mov ecx, 0046C4B0
:0040133B E848E80200              call 0042FB88
:00401340 8945F8                  mov dword ptr [ebp-08], eax
:00401343 8B45F8                  mov eax, dword ptr [ebp-08]
:00401346 8945F0                  mov dword ptr [ebp-10], eax
:00401349 E942000000              jmp 00401390
:0040134E 830D7853450002          or dword ptr [00455378], 00000002
:00401355 E890010000              call 004014EA
:0040135A E969000000              jmp 004013C8
:0040135F E964000000              jmp 004013C8
:00401364 E95F000000              jmp 004013C8
:00401369 E95A000000              jmp 004013C8
:0040136E 830D7853450020          or dword ptr [00455378], 00000020
:00401375 E94E000000              jmp 004013C8
:0040137A 830D7853450004          or dword ptr [00455378], 00000004
:00401381 E942000000              jmp 004013C8
:00401386 E93D000000              jmp 004013C8
:0040138B E938000000              jmp 004013C8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401349(U)
|
:00401390 837DF008                cmp dword ptr [ebp-10], 00000008
:00401394 0F872E000000            ja 004013C8
:0040139A 8B45F0                  mov eax, dword ptr [ebp-10]
:0040139D FF2485A4134000          jmp dword ptr [4*eax+004013A4]

:004013A4 69134000                DWORD 00401369
:004013A8 5F134000                DWORD 0040135F
:004013AC 4E134000                DWORD 0040134E
:004013B0 86134000                DWORD 00401386
:004013B4 64134000                DWORD 00401364
:004013B8 64134000                DWORD 00401364
:004013BC 86134000                DWORD 00401386
:004013C0 6E134000                DWORD 0040136E
:004013C4 7A134000                DWORD 0040137A



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040135A(U), :0040135F(U), :00401364(U), :00401369(U), :00401375(U)
|:00401381(U), :00401386(U), :0040138B(U), :00401394(C)
|
:004013C8 8B45F8                  mov eax, dword ptr [ebp-08]
:004013CB 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040129F(C), :0040132C(C)
|
:004013CE 8B45FC                  mov eax, dword ptr [ebp-04]
:004013D1 E900000000              jmp 004013D6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004013D1(U)
|
:004013D6 5F                      pop edi
:004013D7 5E                      pop esi
:004013D8 5B                      pop ebx
:004013D9 C9                      leave
:004013DA C3                      ret



* Referenced by a CALL at Address:
|:00401559   
|
:004013DB 55                      push ebp
:004013DC 8BEC                    mov ebp, esp
:004013DE 83EC08                  sub esp, 00000008
:004013E1 53                      push ebx
:004013E2 56                      push esi
:004013E3 57                      push edi
:004013E4 8D4DF8                  lea ecx, dword ptr [ebp-08]
:004013E7 E884040000              call 00401870
:004013EC C745FC00AA4600          mov [ebp-04], 0046AA00
:004013F3 6A01                    push 00000001
:004013F5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004013F8 E823040000              call 00401820
:004013FD 6A01                    push 00000001
:004013FF E8FCFBFFFF              call 00401000
:00401404 83C404                  add esp, 00000004
:00401407 6A00                    push 00000000
:00401409 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040140C E83F050000              call 00401950
:00401411 6A0D                    push 0000000D
:00401413 6A0B                    push 0000000B
:00401415 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00401418 E863050000              call 00401980
:0040141D 830D7853450002          or dword ptr [00455378], 00000002
:00401424 33C0                    xor eax, eax
:00401426 E900000000              jmp 0040142B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401426(U)
|
:0040142B 5F                      pop edi
:0040142C 5E                      pop esi
:0040142D 5B                      pop ebx
:0040142E C9                      leave
:0040142F C3                      ret



* Referenced by a CALL at Address:
|:0040152A   
|
:00401430 55                      push ebp
:00401431 8BEC                    mov ebp, esp
:00401433 83EC08                  sub esp, 00000008
:00401436 53                      push ebx
:00401437 56                      push esi
:00401438 57                      push edi
:00401439 8D4DF8                  lea ecx, dword ptr [ebp-08]
:0040143C E82F040000              call 00401870
:00401441 C745FC00AA4600          mov [ebp-04], 0046AA00
:00401448 6A03                    push 00000003
:0040144A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040144D E8CE030000              call 00401820
:00401452 8B4508                  mov eax, dword ptr [ebp+08]
:00401455 50                      push eax
:00401456 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00401459 E882050000              call 004019E0
:0040145E 8B4508                  mov eax, dword ptr [ebp+08]
:00401461 50                      push eax
:00401462 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00401465 E846050000              call 004019B0
:0040146A 6A0D                    push 0000000D
:0040146C 6A0B                    push 0000000B
:0040146E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00401471 E80A050000              call 00401980
:00401476 830D7853450002          or dword ptr [00455378], 00000002
:0040147D 33C0                    xor eax, eax
:0040147F E900000000              jmp 00401484

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040147F(U)
|
:00401484 5F                      pop edi
:00401485 5E                      pop esi
:00401486 5B                      pop ebx
:00401487 C9                      leave
:00401488 C3                      ret



* Referenced by a CALL at Address:
|:0040154C   
|
:00401489 55                      push ebp
:0040148A 8BEC                    mov ebp, esp
:0040148C 83EC08                  sub esp, 00000008
:0040148F 53                      push ebx
:00401490 56                      push esi
:00401491 57                      push edi
:00401492 8D4DF8                  lea ecx, dword ptr [ebp-08]
:00401495 E8D6030000              call 00401870
:0040149A C745FC00AA4600          mov [ebp-04], 0046AA00
:004014A1 6A00                    push 00000000
:004014A3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004014A6 E875030000              call 00401820
:004014AB 8B4508                  mov eax, dword ptr [ebp+08]
:004014AE 50                      push eax
:004014AF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004014B2 E829050000              call 004019E0
:004014B7 6A00                    push 00000000
:004014B9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004014BC E88F040000              call 00401950
:004014C1 6A01                    push 00000001
:004014C3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004014C6 E845050000              call 00401A10
:004014CB 6A0D                    push 0000000D
:004014CD 6A0B                    push 0000000B
:004014CF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004014D2 E8A9040000              call 00401980
:004014D7 830D7853450002          or dword ptr [00455378], 00000002
:004014DE 33C0                    xor eax, eax
:004014E0 E900000000              jmp 004014E5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004014E0(U)
|
:004014E5 5F                      pop edi
:004014E6 5E                      pop esi
:004014E7 5B                      pop ebx
:004014E8 C9                      leave
:004014E9 C3                      ret



* Referenced by a CALL at Addresses:
|:00401355   , :0040EC71   , :00415536   , :004256EC   
|
:004014EA 55                      push ebp
:004014EB 8BEC                    mov ebp, esp
:004014ED 83EC28                  sub esp, 00000028
:004014F0 53                      push ebx
:004014F1 56                      push esi
:004014F2 57                      push edi
:004014F3 8D45E8                  lea eax, dword ptr [ebp-18]
:004014F6 50                      push eax
:004014F7 B9B0C44600              mov ecx, 0046C4B0
:004014FC E83F050000              call 00401A40
:00401501 8B45F8                  mov eax, dword ptr [ebp-08]
:00401504 8945DC                  mov dword ptr [ebp-24], eax
:00401507 8B45DC                  mov eax, dword ptr [ebp-24]
:0040150A C1E80C                  shr eax, 0C
:0040150D 8945E4                  mov dword ptr [ebp-1C], eax
:00401510 8B45DC                  mov eax, dword ptr [ebp-24]
:00401513 25FF0F0000              and eax, 00000FFF
:00401518 8945E0                  mov dword ptr [ebp-20], eax
:0040151B 8B45E4                  mov eax, dword ptr [ebp-1C]
:0040151E 8945D8                  mov dword ptr [ebp-28], eax
:00401521 E942000000              jmp 00401568
:00401526 8B45E0                  mov eax, dword ptr [ebp-20]
:00401529 50                      push eax
:0040152A E801FFFFFF              call 00401430
:0040152F 83C404                  add esp, 00000004
:00401532 E955000000              jmp 0040158C
:00401537 8B45E0                  mov eax, dword ptr [ebp-20]
:0040153A 50                      push eax
:0040153B E8303D0100              call 00415270
:00401540 83C404                  add esp, 00000004
:00401543 E944000000              jmp 0040158C
:00401548 8B45E0                  mov eax, dword ptr [ebp-20]
:0040154B 50                      push eax
:0040154C E838FFFFFF              call 00401489
:00401551 83C404                  add esp, 00000004
:00401554 E933000000              jmp 0040158C
:00401559 E87DFEFFFF              call 004013DB
:0040155E E929000000              jmp 0040158C
:00401563 E924000000              jmp 0040158C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401521(U)
|
:00401568 837DD803                cmp dword ptr [ebp-28], 00000003
:0040156C 0F871A000000            ja 0040158C
:00401572 8B45D8                  mov eax, dword ptr [ebp-28]
:00401575 FF24857C154000          jmp dword ptr [4*eax+0040157C]

:0040157C 48154000                DWORD 00401548
:00401580 59154000                DWORD 00401559
:00401584 37154000                DWORD 00401537
:00401588 26154000                DWORD 00401526



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00401532(U), :00401543(U), :00401554(U), :0040155E(U), :00401563(U)
|:0040156C(C)
|
:0040158C 8B45DC                  mov eax, dword ptr [ebp-24]
:0040158F 50                      push eax
:00401590 B900AA4600              mov ecx, 0046AA00
:00401595 E896030000              call 00401930
:0040159A 33C9                    xor ecx, ecx
:0040159C 8AC8                    mov cl, al
:0040159E 51                      push ecx
:0040159F B9B0C44600              mov ecx, 0046C4B0
:004015A4 E866E40200              call 0042FA0F
:004015A9 6A00                    push 00000000
:004015AB B900AA4600              mov ecx, 0046AA00
:004015B0 E85B040000              call 00401A10
:004015B5 E900000000              jmp 004015BA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004015B5(U)
|
:004015BA 5F                      pop edi
:004015BB 5E                      pop esi
:004015BC 5B                      pop ebx
:004015BD C9                      leave
:004015BE C3                      ret



* Referenced by a CALL at Address:
|:00430BEC   
|
:004015BF 55                      push ebp
:004015C0 8BEC                    mov ebp, esp
:004015C2 83EC0C                  sub esp, 0000000C
:004015C5 53                      push ebx
:004015C6 56                      push esi
:004015C7 57                      push edi
:004015C8 8B4508                  mov eax, dword ptr [ebp+08]
:004015CB C1F80C                  sar eax, 0C
:004015CE 8945F8                  mov dword ptr [ebp-08], eax
:004015D1 8B4508                  mov eax, dword ptr [ebp+08]
:004015D4 25FF0F0000              and eax, 00000FFF
:004015D9 8945F4                  mov dword ptr [ebp-0C], eax
:004015DC B800AA4600              mov eax, 0046AA00
:004015E1 83C00A                  add eax, 0000000A
:004015E4 8945FC                  mov dword ptr [ebp-04], eax
:004015E7 8B45F8                  mov eax, dword ptr [ebp-08]
:004015EA 50                      push eax
:004015EB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004015EE E82D020000              call 00401820
:004015F3 8B45F4                  mov eax, dword ptr [ebp-0C]
:004015F6 50                      push eax
:004015F7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004015FA E8E1030000              call 004019E0
:004015FF 8B4510                  mov eax, dword ptr [ebp+10]
:00401602 50                      push eax
:00401603 8B450C                  mov eax, dword ptr [ebp+0C]
:00401606 50                      push eax
:00401607 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040160A E871030000              call 00401980
:0040160F 6A01                    push 00000001
:00401611 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00401614 E8C7040000              call 00401AE0
:00401619 33C0                    xor eax, eax
:0040161B E900000000              jmp 00401620

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040161B(U)
|
:00401620 5F                      pop edi
:00401621 5E                      pop esi
:00401622 5B                      pop ebx
:00401623 C9                      leave
:00401624 C3                      ret



* Referenced by a CALL at Addresses:
|:004016EE   , :0040F5AA   , :0040F6B1   
|
:00401625 55                      push ebp
:00401626 8BEC                    mov ebp, esp
:00401628 83EC10                  sub esp, 00000010
:0040162B 53                      push ebx
:0040162C 56                      push esi
:0040162D 57                      push edi
:0040162E 8B4508                  mov eax, dword ptr [ebp+08]
:00401631 C1E803                  shr eax, 03
:00401634 8945F8                  mov dword ptr [ebp-08], eax
:00401637 8B4508                  mov eax, dword ptr [ebp+08]
:0040163A 83E007                  and eax, 00000007
:0040163D 8945FC                  mov dword ptr [ebp-04], eax
:00401640 C745F080000000          mov [ebp-10], 00000080
:00401647 8A4DFC                  mov cl, byte ptr [ebp-04]
:0040164A D36DF0                  shr dword ptr [ebp-10], cl
:0040164D 8B45F8                  mov eax, dword ptr [ebp-08]
:00401650 50                      push eax
:00401651 B9D0A64600              mov ecx, 0046A6D0
:00401656 E8E5040000              call 00401B40
:0040165B 33C9                    xor ecx, ecx
:0040165D 8AC8                    mov cl, al
:0040165F 894DF4                  mov dword ptr [ebp-0C], ecx
:00401662 837D0C00                cmp dword ptr [ebp+0C], 00000000
:00401666 0F841C000000            je 00401688
:0040166C 8B45F0                  mov eax, dword ptr [ebp-10]
:0040166F F7D0                    not eax
:00401671 2345F4                  and eax, dword ptr [ebp-0C]
:00401674 50                      push eax
:00401675 8B45F8                  mov eax, dword ptr [ebp-08]
:00401678 50                      push eax
:00401679 B9D0A64600              mov ecx, 0046A6D0
:0040167E E88D040000              call 00401B10
:00401683 E90B000000              jmp 00401693

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401666(C)
|
:00401688 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040168B 2345F0                  and eax, dword ptr [ebp-10]
:0040168E E907000000              jmp 0040169A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401683(U)
|
:00401693 33C0                    xor eax, eax
:00401695 E900000000              jmp 0040169A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040168E(U), :00401695(U)
|
:0040169A 5F                      pop edi
:0040169B 5E                      pop esi
:0040169C 5B                      pop ebx
:0040169D C9                      leave
:0040169E C3                      ret



* Referenced by a CALL at Addresses:
|:004164CF   , :00430C33   , :00430C81   
|
:0040169F 55                      push ebp
:004016A0 8BEC                    mov ebp, esp
:004016A2 83EC04                  sub esp, 00000004
:004016A5 53                      push ebx
:004016A6 56                      push esi
:004016A7 57                      push edi
:004016A8 837D08FF                cmp dword ptr [ebp+08], FFFFFFFF
:004016AC 0F8536000000            jne 004016E8
:004016B2 C745FC00000000          mov [ebp-04], 00000000
:004016B9 E903000000              jmp 004016C1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004016DE(U)
|
:004016BE FF45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004016B9(U)
|
:004016C1 837DFC08                cmp dword ptr [ebp-04], 00000008
:004016C5 0F8318000000            jnb 004016E3
:004016CB 68FF000000              push 000000FF
:004016D0 8B45FC                  mov eax, dword ptr [ebp-04]
:004016D3 50                      push eax
:004016D4 B9D0A64600              mov ecx, 0046A6D0
:004016D9 E832040000              call 00401B10
:004016DE E9DBFFFFFF              jmp 004016BE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004016C5(C)
|
:004016E3 E90E000000              jmp 004016F6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004016AC(C)
|
:004016E8 6A01                    push 00000001
:004016EA 8B4508                  mov eax, dword ptr [ebp+08]
:004016ED 50                      push eax
:004016EE E832FFFFFF              call 00401625
:004016F3 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004016E3(U)
|
:004016F6 33C0                    xor eax, eax
:004016F8 E900000000              jmp 004016FD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004016F8(U)
|
:004016FD 5F                      pop edi
:004016FE 5E                      pop esi
:004016FF 5B                      pop ebx
:00401700 C9                      leave
:00401701 C3                      ret



* Referenced by a CALL at Addresses:
|:0040119D   , :004033C9   , :00403405   , :00434D2B   , :00443C24   
|
:00401702 55                      push ebp
:00401703 8BEC                    mov ebp, esp
:00401705 53                      push ebx
:00401706 56                      push esi
:00401707 57                      push edi
:00401708 6A0A                    push 0000000A
:0040170A 6A10                    push 00000010
:0040170C 68C0000000              push 000000C0
:00401711 6A0C                    push 0000000C
:00401713 6818010000              push 00000118
:00401718 E8ED5A0200              call 0042720A
:0040171D 83C414                  add esp, 00000014
:00401720 E900000000              jmp 00401725

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401720(U)
|
:00401725 5F                      pop edi
:00401726 5E                      pop esi
:00401727 5B                      pop ebx
:00401728 C9                      leave
:00401729 C3                      ret



* Referenced by a CALL at Addresses:
|:0040123D   , :004348B5   , :0043AEC7   , :0043BD41   , :0043BE32   
|:0043E594   , :00442824   
|
:0040172A 55                      push ebp
:0040172B 8BEC                    mov ebp, esp
:0040172D 53                      push ebx
:0040172E 56                      push esi
:0040172F 57                      push edi
:00401730 6A0A                    push 0000000A
:00401732 6A10                    push 00000010
:00401734 6A40                    push 00000040
:00401736 6A0C                    push 0000000C
:00401738 68E0010000              push 000001E0
:0040173D E8C85A0200              call 0042720A
:00401742 83C414                  add esp, 00000014
:00401745 E900000000              jmp 0040174A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401745(U)
|
:0040174A 5F                      pop edi
:0040174B 5E                      pop esi
:0040174C 5B                      pop ebx
:0040174D C9                      leave
:0040174E C3                      ret



* Referenced by a CALL at Addresses:
|:0040F976   , :00416CA2   , :00425617   , :0043E68F   , :0044015A   
|:00442829   , :00442EEA   
|
:0040174F 55                      push ebp
:00401750 8BEC                    mov ebp, esp
:00401752 53                      push ebx
:00401753 56                      push esi
:00401754 57                      push edi
:00401755 6A0A                    push 0000000A
:00401757 6A10                    push 00000010
:00401759 6A40                    push 00000040
:0040175B 6A0C                    push 0000000C
:0040175D 6830020000              push 00000230
:00401762 E8A35A0200              call 0042720A
:00401767 83C414                  add esp, 00000014
:0040176A E900000000              jmp 0040176F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040176A(U)
|
:0040176F 5F                      pop edi
:00401770 5E                      pop esi
:00401771 5B                      pop ebx
:00401772 C9                      leave
:00401773 C3                      ret



* Referenced by a CALL at Address:
|:00431909   
|
:00401774 55                      push ebp
:00401775 8BEC                    mov ebp, esp
:00401777 83EC04                  sub esp, 00000004
:0040177A 53                      push ebx
:0040177B 56                      push esi
:0040177C 57                      push edi
:0040177D 8B4508                  mov eax, dword ptr [ebp+08]
:00401780 50                      push eax
:00401781 E8F1D70100              call 0041EF77
:00401786 83C404                  add esp, 00000004
:00401789 8945FC                  mov dword ptr [ebp-04], eax
:0040178C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040178F E8DC030000              call 00401B70
:00401794 3D00020000              cmp eax, 00000200
:00401799 0F850C000000            jne 004017AB
:0040179F 8B450C                  mov eax, dword ptr [ebp+0C]
:004017A2 50                      push eax
:004017A3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004017A6 E8F5030000              call 00401BA0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401799(C)
|
:004017AB 33C0                    xor eax, eax
:004017AD E900000000              jmp 004017B2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004017AD(U)
|
:004017B2 5F                      pop edi
:004017B3 5E                      pop esi
:004017B4 5B                      pop ebx
:004017B5 C9                      leave
:004017B6 C3                      ret



* Referenced by a CALL at Address:
|:004318C1   
|
:004017B7 55                      push ebp
:004017B8 8BEC                    mov ebp, esp
:004017BA 83EC08                  sub esp, 00000008
:004017BD 53                      push ebx
:004017BE 56                      push esi
:004017BF 57                      push edi
:004017C0 8B4508                  mov eax, dword ptr [ebp+08]
:004017C3 8945F8                  mov dword ptr [ebp-08], eax
:004017C6 8B45F8                  mov eax, dword ptr [ebp-08]
:004017C9 25FF0F0000              and eax, 00000FFF
:004017CE 8945FC                  mov dword ptr [ebp-04], eax
:004017D1 8B45FC                  mov eax, dword ptr [ebp-04]
:004017D4 50                      push eax
:004017D5 B9D0A64600              mov ecx, 0046A6D0
:004017DA E8F1030000              call 00401BD0
:004017DF 8B45FC                  mov eax, dword ptr [ebp-04]
:004017E2 50                      push eax
:004017E3 B900AA4600              mov ecx, 0046AA00
:004017E8 E8C3010000              call 004019B0
:004017ED E825FAFFFF              call 00401217
:004017F2 33C0                    xor eax, eax
:004017F4 E900000000              jmp 004017F9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004017F4(U)
|
:004017F9 5F                      pop edi
:004017FA 5E                      pop esi
:004017FB 5B                      pop ebx
:004017FC C9                      leave
:004017FD C3                      ret



* Referenced by a CALL at Addresses:
|:004304EA   , :004305E3   
|
:004017FE 55                      push ebp
:004017FF 8BEC                    mov ebp, esp
:00401801 53                      push ebx
:00401802 56                      push esi
:00401803 57                      push edi
:00401804 8B4508                  mov eax, dword ptr [ebp+08]
:00401807 50                      push eax
:00401808 6A03                    push 00000003
:0040180A E826770300              call 00438F35
:0040180F 83C408                  add esp, 00000008
:00401812 33C0                    xor eax, eax
:00401814 E900000000              jmp 00401819

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401814(U)
|
:00401819 5F                      pop edi
:0040181A 5E                      pop esi
:0040181B 5B                      pop ebx
:0040181C C9                      leave
:0040181D C3                      ret


:0040181E CC                      int 03
:0040181F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040100F   , :004013F8   , :0040144D   , :004014A6   , :004015EE   
|:0040EB6F   , :0040F81B   , :00415285   , :00415E17   , :00425504   
|:00433AE4   , :00433B1D   
|
:00401820 55                      push ebp
:00401821 8BEC                    mov ebp, esp
:00401823 83EC04                  sub esp, 00000004
:00401826 53                      push ebx
:00401827 56                      push esi
:00401828 57                      push edi
:00401829 894DFC                  mov dword ptr [ebp-04], ecx
:0040182C 8A4508                  mov al, byte ptr [ebp+08]
:0040182F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00401832 884105                  mov byte ptr [ecx+05], al
:00401835 E900000000              jmp 0040183A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401835(U)
|
:0040183A 5F                      pop edi
:0040183B 5E                      pop esi
:0040183C 5B                      pop ebx
:0040183D C9                      leave
:0040183E C20400                  ret 0004


:00401841 CC                      int 03
:00401842 CC                      int 03
:00401843 CC                      int 03
:00401844 CC                      int 03
:00401845 CC                      int 03
:00401846 CC                      int 03
:00401847 CC                      int 03
:00401848 CC                      int 03
:00401849 CC                      int 03
:0040184A CC                      int 03
:0040184B CC                      int 03
:0040184C CC                      int 03
:0040184D CC                      int 03
:0040184E CC                      int 03
:0040184F CC                      int 03

* Referenced by a CALL at Addresses:
|:00401029   , :0040EB63   , :0040F150   , :004164F6   , :0041778F   
|:004177E7   , :00425589   , :004255DA   , :00427C40   , :00437686   
|
:00401850 55                      push ebp
:00401851 8BEC                    mov ebp, esp
:00401853 83EC04                  sub esp, 00000004
:00401856 53                      push ebx
:00401857 56                      push esi
:00401858 57                      push edi
:00401859 894DFC                  mov dword ptr [ebp-04], ecx
:0040185C 8B45FC                  mov eax, dword ptr [ebp-04]
:0040185F 8A4005                  mov al, byte ptr [eax+05]
:00401862 E900000000              jmp 00401867

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401862(U)
|
:00401867 5F                      pop edi
:00401868 5E                      pop esi
:00401869 5B                      pop ebx
:0040186A C9                      leave
:0040186B C3                      ret


:0040186C CC                      int 03
:0040186D CC                      int 03
:0040186E CC                      int 03
:0040186F CC                      int 03

* Referenced by a CALL at Addresses:
|:00401044   , :004013E7   , :0040143C   , :00401495   , :0040475B   
|:00404763   , :00404B4E   , :00404D7D   , :0040DD22   , :0040ECED   
|:0040ECF5   , :0040F458   , :00419170   , :0041919F   , :00419238   
|:0041967D   , :0041A0A2   , :0041A19C   , :0041AA52   , :0041AA5A   
|:0041AF70   , :0041AF78   , :0041B726   , :0041D469   , :0041D53D   
|:0041D545   , :0041DB29   , :0041DB31   , :0041DFB9   , :0041F1EF   
|:0041F1FA   , :0041F332   , :00421FCB   , :00421FD5   , :00422221   
|:004225AB   , :00422F16   , :00423068   , :00423245   , :00424503   
|:00427B22   , :00427D55   , :00427F04   , :00428906   , :00428C66   
|:00429052   , :0042C32D   , :0042C4E4   , :0042DF12   , :0042DF1D   
|:00432B32   , :00432B92   , :00438F6A   , :00438F72   , :0043A730   
|:0043A7A8   , :0043A7CF   , :0043A8EF   , :0043A916   , :0043AC5F   
|:0043BDA1   , :0043CF0B   , :0043ED62   , :0043ED6D   , :0043ED78   
|:0043EEBB   , :00442B63   
|
:00401870 55                      push ebp
:00401871 8BEC                    mov ebp, esp
:00401873 83EC04                  sub esp, 00000004
:00401876 53                      push ebx
:00401877 56                      push esi
:00401878 57                      push edi
:00401879 894DFC                  mov dword ptr [ebp-04], ecx
:0040187C E900000000              jmp 00401881

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040187C(U)
|
:00401881 8B45FC                  mov eax, dword ptr [ebp-04]
:00401884 5F                      pop edi
:00401885 5E                      pop esi
:00401886 5B                      pop ebx
:00401887 C9                      leave
:00401888 C3                      ret


:00401889 CC                      int 03
:0040188A CC                      int 03
:0040188B CC                      int 03
:0040188C CC                      int 03
:0040188D CC                      int 03
:0040188E CC                      int 03
:0040188F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040105F   , :00404786   , :004047B1   , :004047E4   , :0040489F   
|:004048C6   , :00404B9A   , :00404DC9   , :0040ED10   , :0040ED2B   
|:0040F4BB   , :0041926B   , :00419698   , :004198BC   , :0041A29F   
|:0041A2CF   , :0041AAAC   , :0041AB50   , :0041AC51   , :0041B2D2   
|:0041B83E   , :0041B993   , :0041BA12   , :0041BA26   , :0041BC2E   
|:0041BC44   , :0041BC56   , :0041BC69   , :0041BCD9   , :0041BD1F   
|:0041D416   , :0041D4A0   , :0041D568   , :0041D597   , :0041D62D   
|:0041D68F   , :0041D6D4   , :0041D781   , :0041D82B   , :0041D8C3   
|:0041DC54   , :0041E013   , :0041E043   , :0041E200   , :00422281   
|:00422604   , :00422F49   , :0042309B   , :00423271   , :004242B0   
|:0042451F   , :00427D85   , :00428E33   , :00428E4C   , :0042A094   
|:0042C373   , :0042C4A3   , :0042C6D8   , :00432355   , :00432506   
|:004337B8   , :0043A89D   , :0043AA0A   , :0043AC8E   , :0043AD0A   
|:0043ADF9   , :0043D01F   , :00442DA2   
|
:00401890 55                      push ebp
:00401891 8BEC                    mov ebp, esp
:00401893 83EC04                  sub esp, 00000004
:00401896 53                      push ebx
:00401897 56                      push esi
:00401898 57                      push edi
:00401899 894DFC                  mov dword ptr [ebp-04], ecx
:0040189C 8B4508                  mov eax, dword ptr [ebp+08]
:0040189F 8A00                    mov al, byte ptr [eax]
:004018A1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004018A4 8801                    mov byte ptr [ecx], al
:004018A6 8B4508                  mov eax, dword ptr [ebp+08]
:004018A9 8A4001                  mov al, byte ptr [eax+01]
:004018AC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004018AF 884101                  mov byte ptr [ecx+01], al
:004018B2 8B45FC                  mov eax, dword ptr [ebp-04]
:004018B5 E900000000              jmp 004018BA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004018B5(U)
|
:004018BA 5F                      pop edi
:004018BB 5E                      pop esi
:004018BC 5B                      pop ebx
:004018BD C9                      leave
:004018BE C20400                  ret 0004


:004018C1 CC                      int 03
:004018C2 CC                      int 03
:004018C3 CC                      int 03
:004018C4 CC                      int 03
:004018C5 CC                      int 03
:004018C6 CC                      int 03
:004018C7 CC                      int 03
:004018C8 CC                      int 03
:004018C9 CC                      int 03
:004018CA CC                      int 03
:004018CB CC                      int 03
:004018CC CC                      int 03
:004018CD CC                      int 03
:004018CE CC                      int 03
:004018CF CC                      int 03

* Referenced by a CALL at Addresses:
|:00401056   , :0040ED07   , :0040ED22   , :0040F4B2   
|
:004018D0 55                      push ebp
:004018D1 8BEC                    mov ebp, esp
:004018D3 83EC04                  sub esp, 00000004
:004018D6 53                      push ebx
:004018D7 56                      push esi
:004018D8 57                      push edi
:004018D9 894DFC                  mov dword ptr [ebp-04], ecx
:004018DC 8B45FC                  mov eax, dword ptr [ebp-04]
:004018DF 83C009                  add eax, 00000009
:004018E2 E900000000              jmp 004018E7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004018E2(U)
|
:004018E7 5F                      pop edi
:004018E8 5E                      pop esi
:004018E9 5B                      pop ebx
:004018EA C9                      leave
:004018EB C3                      ret


:004018EC CC                      int 03
:004018ED CC                      int 03
:004018EE CC                      int 03
:004018EF CC                      int 03

* Referenced by a CALL at Addresses:
|:004010DF   , :00401225   , :0040F0F6   , :0040F5CE   , :0040F775   
|:0040FC55   , :0040FCE5   
|
:004018F0 55                      push ebp
:004018F1 8BEC                    mov ebp, esp
:004018F3 83EC04                  sub esp, 00000004
:004018F6 53                      push ebx
:004018F7 56                      push esi
:004018F8 57                      push edi
:004018F9 894DFC                  mov dword ptr [ebp-04], ecx
:004018FC 8B45FC                  mov eax, dword ptr [ebp-04]
:004018FF 8A4014                  mov al, byte ptr [eax+14]
:00401902 E900000000              jmp 00401907

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401902(U)
|
:00401907 5F                      pop edi
:00401908 5E                      pop esi
:00401909 5B                      pop ebx
:0040190A C9                      leave
:0040190B C3                      ret


:0040190C CC                      int 03
:0040190D CC                      int 03
:0040190E CC                      int 03
:0040190F CC                      int 03

* Referenced by a CALL at Addresses:
|:00401235   , :0041EEAA   
|
:00401910 55                      push ebp
:00401911 8BEC                    mov ebp, esp
:00401913 83EC04                  sub esp, 00000004
:00401916 53                      push ebx
:00401917 56                      push esi
:00401918 57                      push edi
:00401919 894DFC                  mov dword ptr [ebp-04], ecx
:0040191C 8B45FC                  mov eax, dword ptr [ebp-04]
:0040191F E900000000              jmp 00401924

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040191F(U)
|
:00401924 5F                      pop edi
:00401925 5E                      pop esi
:00401926 5B                      pop ebx
:00401927 C9                      leave
:00401928 C3                      ret


:00401929 CC                      int 03
:0040192A CC                      int 03
:0040192B CC                      int 03
:0040192C CC                      int 03
:0040192D CC                      int 03
:0040192E CC                      int 03
:0040192F CC                      int 03

* Referenced by a CALL at Addresses:
|:004012E1   , :00409FC4   , :0040B483   , :0040EBFF   , :0040F179   
|:0040F332   , :00414A9A   , :004154AD   , :00415734   , :00415986   
|:004177B6   , :004255B2   , :00436D04   , :00436D49   
|
:00401930 55                      push ebp
:00401931 8BEC                    mov ebp, esp
:00401933 83EC04                  sub esp, 00000004
:00401936 53                      push ebx
:00401937 56                      push esi
:00401938 57                      push edi
:00401939 894DFC                  mov dword ptr [ebp-04], ecx
:0040193C 8B45FC                  mov eax, dword ptr [ebp-04]
:0040193F 8A4004                  mov al, byte ptr [eax+04]
:00401942 E900000000              jmp 00401947

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401942(U)
|
:00401947 5F                      pop edi
:00401948 5E                      pop esi
:00401949 5B                      pop ebx
:0040194A C9                      leave
:0040194B C3                      ret


:0040194C CC                      int 03
:0040194D CC                      int 03
:0040194E CC                      int 03
:0040194F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040140C   , :004014BC   , :0040F825   , :0040FC35   , :0040FC89   
|:0040FCC5   , :0040FD04   , :0041529B   , :00415DE5   , :00415E21   
|
:00401950 55                      push ebp
:00401951 8BEC                    mov ebp, esp
:00401953 83EC04                  sub esp, 00000004
:00401956 53                      push ebx
:00401957 56                      push esi
:00401958 57                      push edi
:00401959 894DFC                  mov dword ptr [ebp-04], ecx
:0040195C 8A4508                  mov al, byte ptr [ebp+08]
:0040195F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00401962 884108                  mov byte ptr [ecx+08], al
:00401965 E900000000              jmp 0040196A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401965(U)
|
:0040196A 5F                      pop edi
:0040196B 5E                      pop esi
:0040196C 5B                      pop ebx
:0040196D C9                      leave
:0040196E C20400                  ret 0004


:00401971 CC                      int 03
:00401972 CC                      int 03
:00401973 CC                      int 03
:00401974 CC                      int 03
:00401975 CC                      int 03
:00401976 CC                      int 03
:00401977 CC                      int 03
:00401978 CC                      int 03
:00401979 CC                      int 03
:0040197A CC                      int 03
:0040197B CC                      int 03
:0040197C CC                      int 03
:0040197D CC                      int 03
:0040197E CC                      int 03
:0040197F CC                      int 03

* Referenced by a CALL at Addresses:
|:00401418   , :00401471   , :004014D2   , :0040160A   , :0040F83B   
|:0040FCFA   , :0040FDBC   
|
:00401980 55                      push ebp
:00401981 8BEC                    mov ebp, esp
:00401983 83EC04                  sub esp, 00000004
:00401986 53                      push ebx
:00401987 56                      push esi
:00401988 57                      push edi
:00401989 894DFC                  mov dword ptr [ebp-04], ecx
:0040198C 8A4508                  mov al, byte ptr [ebp+08]
:0040198F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00401992 8801                    mov byte ptr [ecx], al
:00401994 8A450C                  mov al, byte ptr [ebp+0C]
:00401997 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040199A 884101                  mov byte ptr [ecx+01], al
:0040199D E900000000              jmp 004019A2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040199D(U)
|
:004019A2 5F                      pop edi
:004019A3 5E                      pop esi
:004019A4 5B                      pop ebx
:004019A5 C9                      leave
:004019A6 C20800                  ret 0008


:004019A9 CC                      int 03
:004019AA CC                      int 03
:004019AB CC                      int 03
:004019AC CC                      int 03
:004019AD CC                      int 03
:004019AE CC                      int 03
:004019AF CC                      int 03

* Referenced by a CALL at Addresses:
|:00401465   , :004017E8   , :0040F76B   , :0040FC5E   , :0040FCEE   
|
:004019B0 55                      push ebp
:004019B1 8BEC                    mov ebp, esp
:004019B3 83EC04                  sub esp, 00000004
:004019B6 53                      push ebx
:004019B7 56                      push esi
:004019B8 57                      push edi
:004019B9 894DFC                  mov dword ptr [ebp-04], ecx
:004019BC 8A4508                  mov al, byte ptr [ebp+08]
:004019BF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004019C2 884104                  mov byte ptr [ecx+04], al
:004019C5 E900000000              jmp 004019CA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004019C5(U)
|
:004019CA 5F                      pop edi
:004019CB 5E                      pop esi
:004019CC 5B                      pop ebx
:004019CD C9                      leave
:004019CE C20400                  ret 0004


:004019D1 CC                      int 03
:004019D2 CC                      int 03
:004019D3 CC                      int 03
:004019D4 CC                      int 03
:004019D5 CC                      int 03
:004019D6 CC                      int 03
:004019D7 CC                      int 03
:004019D8 CC                      int 03
:004019D9 CC                      int 03
:004019DA CC                      int 03
:004019DB CC                      int 03
:004019DC CC                      int 03
:004019DD CC                      int 03
:004019DE CC                      int 03
:004019DF CC                      int 03

* Referenced by a CALL at Addresses:
|:00401459   , :004014B2   , :004015FA   , :0040EB83   , :0040F811   
|:0040FC6B   , :0040FD10   , :00415291   
|
:004019E0 55                      push ebp
:004019E1 8BEC                    mov ebp, esp
:004019E3 83EC04                  sub esp, 00000004
:004019E6 53                      push ebx
:004019E7 56                      push esi
:004019E8 57                      push edi
:004019E9 894DFC                  mov dword ptr [ebp-04], ecx
:004019EC 8A4508                  mov al, byte ptr [ebp+08]
:004019EF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004019F2 884106                  mov byte ptr [ecx+06], al
:004019F5 E900000000              jmp 004019FA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004019F5(U)
|
:004019FA 5F                      pop edi
:004019FB 5E                      pop esi
:004019FC 5B                      pop ebx
:004019FD C9                      leave
:004019FE C20400                  ret 0004


:00401A01 CC                      int 03
:00401A02 CC                      int 03
:00401A03 CC                      int 03
:00401A04 CC                      int 03
:00401A05 CC                      int 03
:00401A06 CC                      int 03
:00401A07 CC                      int 03
:00401A08 CC                      int 03
:00401A09 CC                      int 03
:00401A0A CC                      int 03
:00401A0B CC                      int 03
:00401A0C CC                      int 03
:00401A0D CC                      int 03
:00401A0E CC                      int 03
:00401A0F CC                      int 03

* Referenced by a CALL at Addresses:
|:004014C6   , :004015B0   , :0040F82F   , :0040FC3F   , :0040FC7F   
|:0040FCCF   , :004152A5   , :00415DDB   , :00415E2B   , :00416D71   
|:00417759   
|
:00401A10 55                      push ebp
:00401A11 8BEC                    mov ebp, esp
:00401A13 83EC04                  sub esp, 00000004
:00401A16 53                      push ebx
:00401A17 56                      push esi
:00401A18 57                      push edi
:00401A19 894DFC                  mov dword ptr [ebp-04], ecx
:00401A1C 8A4508                  mov al, byte ptr [ebp+08]
:00401A1F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00401A22 884107                  mov byte ptr [ecx+07], al
:00401A25 E900000000              jmp 00401A2A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401A25(U)
|
:00401A2A 5F                      pop edi
:00401A2B 5E                      pop esi
:00401A2C 5B                      pop ebx
:00401A2D C9                      leave
:00401A2E C20400                  ret 0004


:00401A31 CC                      int 03
:00401A32 CC                      int 03
:00401A33 CC                      int 03
:00401A34 CC                      int 03
:00401A35 CC                      int 03
:00401A36 CC                      int 03
:00401A37 CC                      int 03
:00401A38 CC                      int 03
:00401A39 CC                      int 03
:00401A3A CC                      int 03
:00401A3B CC                      int 03
:00401A3C CC                      int 03
:00401A3D CC                      int 03
:00401A3E CC                      int 03
:00401A3F CC                      int 03

* Referenced by a CALL at Addresses:
|:004014FC   , :00409F54   , :0040AE81   , :0040B3D2   , :00443A8B   
|
:00401A40 55                      push ebp
:00401A41 8BEC                    mov ebp, esp
:00401A43 83EC04                  sub esp, 00000004
:00401A46 53                      push ebx
:00401A47 56                      push esi
:00401A48 57                      push edi
:00401A49 894DFC                  mov dword ptr [ebp-04], ecx
:00401A4C 8B45FC                  mov eax, dword ptr [ebp-04]
:00401A4F 8B00                    mov eax, dword ptr [eax]
:00401A51 8B4D08                  mov ecx, dword ptr [ebp+08]
:00401A54 8901                    mov dword ptr [ecx], eax
:00401A56 8B45FC                  mov eax, dword ptr [ebp-04]
:00401A59 8B4004                  mov eax, dword ptr [eax+04]
:00401A5C 8B4D08                  mov ecx, dword ptr [ebp+08]
:00401A5F 894104                  mov dword ptr [ecx+04], eax
:00401A62 8B45FC                  mov eax, dword ptr [ebp-04]
:00401A65 8B4008                  mov eax, dword ptr [eax+08]
:00401A68 8B4D08                  mov ecx, dword ptr [ebp+08]
:00401A6B 894108                  mov dword ptr [ecx+08], eax
:00401A6E 8B45FC                  mov eax, dword ptr [ebp-04]
:00401A71 8B400C                  mov eax, dword ptr [eax+0C]
:00401A74 8B4D08                  mov ecx, dword ptr [ebp+08]
:00401A77 89410C                  mov dword ptr [ecx+0C], eax
:00401A7A 8B45FC                  mov eax, dword ptr [ebp-04]
:00401A7D 33C9                    xor ecx, ecx
:00401A7F 668B4812                mov cx, word ptr [eax+12]
:00401A83 8B4508                  mov eax, dword ptr [ebp+08]
:00401A86 894810                  mov dword ptr [eax+10], ecx
:00401A89 8B45FC                  mov eax, dword ptr [ebp-04]
:00401A8C 8B400C                  mov eax, dword ptr [eax+0C]
:00401A8F 50                      push eax
:00401A90 8B45FC                  mov eax, dword ptr [ebp-04]
:00401A93 8B4008                  mov eax, dword ptr [eax+08]
:00401A96 50                      push eax
:00401A97 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00401A9A 83C114                  add ecx, 00000014
:00401A9D E839C60200              call 0042E0DB
:00401AA2 A880                    test al, 80
:00401AA4 0F840F000000            je 00401AB9
:00401AAA 8B4508                  mov eax, dword ptr [ebp+08]
:00401AAD C7401401000000          mov [eax+14], 00000001
:00401AB4 E90A000000              jmp 00401AC3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401AA4(C)
|
:00401AB9 8B4508                  mov eax, dword ptr [ebp+08]
:00401ABC C7401400000000          mov [eax+14], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401AB4(U)
|
:00401AC3 33C0                    xor eax, eax
:00401AC5 E900000000              jmp 00401ACA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401AC5(U)
|
:00401ACA 5F                      pop edi
:00401ACB 5E                      pop esi
:00401ACC 5B                      pop ebx
:00401ACD C9                      leave
:00401ACE C20400                  ret 0004


:00401AD1 CC                      int 03
:00401AD2 CC                      int 03
:00401AD3 CC                      int 03
:00401AD4 CC                      int 03
:00401AD5 CC                      int 03
:00401AD6 CC                      int 03
:00401AD7 CC                      int 03
:00401AD8 CC                      int 03
:00401AD9 CC                      int 03
:00401ADA CC                      int 03
:00401ADB CC                      int 03
:00401ADC CC                      int 03
:00401ADD CC                      int 03
:00401ADE CC                      int 03
:00401ADF CC                      int 03

* Referenced by a CALL at Addresses:
|:00401614   , :0040FC2B   , :0040FCBB   , :00415DD1   , :00415E35   
|
:00401AE0 55                      push ebp
:00401AE1 8BEC                    mov ebp, esp
:00401AE3 83EC04                  sub esp, 00000004
:00401AE6 53                      push ebx
:00401AE7 56                      push esi
:00401AE8 57                      push edi
:00401AE9 894DFC                  mov dword ptr [ebp-04], ecx
:00401AEC 8A4508                  mov al, byte ptr [ebp+08]
:00401AEF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00401AF2 884109                  mov byte ptr [ecx+09], al
:00401AF5 E900000000              jmp 00401AFA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401AF5(U)
|
:00401AFA 5F                      pop edi
:00401AFB 5E                      pop esi
:00401AFC 5B                      pop ebx
:00401AFD C9                      leave
:00401AFE C20400                  ret 0004


:00401B01 CC                      int 03
:00401B02 CC                      int 03
:00401B03 CC                      int 03
:00401B04 CC                      int 03
:00401B05 CC                      int 03
:00401B06 CC                      int 03
:00401B07 CC                      int 03
:00401B08 CC                      int 03
:00401B09 CC                      int 03
:00401B0A CC                      int 03
:00401B0B CC                      int 03
:00401B0C CC                      int 03
:00401B0D CC                      int 03
:00401B0E CC                      int 03
:00401B0F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040167E   , :004016D9   
|
:00401B10 55                      push ebp
:00401B11 8BEC                    mov ebp, esp
:00401B13 83EC04                  sub esp, 00000004
:00401B16 53                      push ebx
:00401B17 56                      push esi
:00401B18 57                      push edi
:00401B19 894DFC                  mov dword ptr [ebp-04], ecx
:00401B1C 8A450C                  mov al, byte ptr [ebp+0C]
:00401B1F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00401B22 8B55FC                  mov edx, dword ptr [ebp-04]
:00401B25 88441127                mov byte ptr [ecx+edx+27], al
:00401B29 E900000000              jmp 00401B2E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401B29(U)
|
:00401B2E 5F                      pop edi
:00401B2F 5E                      pop esi
:00401B30 5B                      pop ebx
:00401B31 C9                      leave
:00401B32 C20800                  ret 0008


:00401B35 CC                      int 03
:00401B36 CC                      int 03
:00401B37 CC                      int 03
:00401B38 CC                      int 03
:00401B39 CC                      int 03
:00401B3A CC                      int 03
:00401B3B CC                      int 03
:00401B3C CC                      int 03
:00401B3D CC                      int 03
:00401B3E CC                      int 03
:00401B3F CC                      int 03

* Referenced by a CALL at Address:
|:00401656   
|
:00401B40 55                      push ebp
:00401B41 8BEC                    mov ebp, esp
:00401B43 83EC04                  sub esp, 00000004
:00401B46 53                      push ebx
:00401B47 56                      push esi
:00401B48 57                      push edi
:00401B49 894DFC                  mov dword ptr [ebp-04], ecx
:00401B4C 8B4508                  mov eax, dword ptr [ebp+08]
:00401B4F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00401B52 8A440827                mov al, byte ptr [eax+ecx+27]
:00401B56 E900000000              jmp 00401B5B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401B56(U)
|
:00401B5B 5F                      pop edi
:00401B5C 5E                      pop esi
:00401B5D 5B                      pop ebx
:00401B5E C9                      leave
:00401B5F C20400                  ret 0004


:00401B62 CC                      int 03
:00401B63 CC                      int 03
:00401B64 CC                      int 03
:00401B65 CC                      int 03
:00401B66 CC                      int 03
:00401B67 CC                      int 03
:00401B68 CC                      int 03
:00401B69 CC                      int 03
:00401B6A CC                      int 03
:00401B6B CC                      int 03
:00401B6C CC                      int 03
:00401B6D CC                      int 03
:00401B6E CC                      int 03
:00401B6F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040178F   , :00414DDC   , :00415118   , :00437A8C   
|
:00401B70 55                      push ebp
:00401B71 8BEC                    mov ebp, esp
:00401B73 83EC04                  sub esp, 00000004
:00401B76 53                      push ebx
:00401B77 56                      push esi
:00401B78 57                      push edi
:00401B79 894DFC                  mov dword ptr [ebp-04], ecx
:00401B7C 8B45FC                  mov eax, dword ptr [ebp-04]
:00401B7F 33C9                    xor ecx, ecx
:00401B81 668B08                  mov cx, word ptr [eax]
:00401B84 81E100FE0000            and ecx, 0000FE00
:00401B8A 8BC1                    mov eax, ecx
:00401B8C E900000000              jmp 00401B91

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401B8C(U)
|
:00401B91 5F                      pop edi
:00401B92 5E                      pop esi
:00401B93 5B                      pop ebx
:00401B94 C9                      leave
:00401B95 C3                      ret


:00401B96 CC                      int 03
:00401B97 CC                      int 03
:00401B98 CC                      int 03
:00401B99 CC                      int 03
:00401B9A CC                      int 03
:00401B9B CC                      int 03
:00401B9C CC                      int 03
:00401B9D CC                      int 03
:00401B9E CC                      int 03
:00401B9F CC                      int 03

* Referenced by a CALL at Address:
|:004017A6   
|
:00401BA0 55                      push ebp
:00401BA1 8BEC                    mov ebp, esp
:00401BA3 83EC04                  sub esp, 00000004
:00401BA6 53                      push ebx
:00401BA7 56                      push esi
:00401BA8 57                      push edi
:00401BA9 894DFC                  mov dword ptr [ebp-04], ecx
:00401BAC 8A4508                  mov al, byte ptr [ebp+08]
:00401BAF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00401BB2 884123                  mov byte ptr [ecx+23], al
:00401BB5 E900000000              jmp 00401BBA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401BB5(U)
|
:00401BBA 5F                      pop edi
:00401BBB 5E                      pop esi
:00401BBC 5B                      pop ebx
:00401BBD C9                      leave
:00401BBE C20400                  ret 0004


:00401BC1 CC                      int 03
:00401BC2 CC                      int 03
:00401BC3 CC                      int 03
:00401BC4 CC                      int 03
:00401BC5 CC                      int 03
:00401BC6 CC                      int 03
:00401BC7 CC                      int 03
:00401BC8 CC                      int 03
:00401BC9 CC                      int 03
:00401BCA CC                      int 03
:00401BCB CC                      int 03
:00401BCC CC                      int 03
:00401BCD CC                      int 03
:00401BCE CC                      int 03
:00401BCF CC                      int 03

* Referenced by a CALL at Addresses:
|:004017DA   , :0040F7EE   
|
:00401BD0 55                      push ebp
:00401BD1 8BEC                    mov ebp, esp
:00401BD3 83EC04                  sub esp, 00000004
:00401BD6 53                      push ebx
:00401BD7 56                      push esi
:00401BD8 57                      push edi
:00401BD9 894DFC                  mov dword ptr [ebp-04], ecx
:00401BDC 8A4508                  mov al, byte ptr [ebp+08]
:00401BDF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00401BE2 884114                  mov byte ptr [ecx+14], al
:00401BE5 E900000000              jmp 00401BEA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401BE5(U)
|
:00401BEA 5F                      pop edi
:00401BEB 5E                      pop esi
:00401BEC 5B                      pop ebx
:00401BED C9                      leave
:00401BEE C20400                  ret 0004


:00401BF1 CC                      int 03
:00401BF2 CC                      int 03
:00401BF3 CC                      int 03
:00401BF4 CC                      int 03
:00401BF5 CC                      int 03
:00401BF6 CC                      int 03
:00401BF7 CC                      int 03
:00401BF8 CC                      int 03
:00401BF9 CC                      int 03
:00401BFA CC                      int 03
:00401BFB CC                      int 03
:00401BFC CC                      int 03
:00401BFD CC                      int 03
:00401BFE CC                      int 03
:00401BFF CC                      int 03
:00401C00 55                      push ebp
:00401C01 8BEC                    mov ebp, esp
:00401C03 53                      push ebx
:00401C04 56                      push esi
:00401C05 57                      push edi
:00401C06 E80A000000              call 00401C15
:00401C0B E900000000              jmp 00401C10

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401C0B(U)
|
:00401C10 5F                      pop edi
:00401C11 5E                      pop esi
:00401C12 5B                      pop ebx
:00401C13 C9                      leave
:00401C14 C3                      ret



* Referenced by a CALL at Address:
|:00401C06   
|
:00401C15 55                      push ebp
:00401C16 8BEC                    mov ebp, esp
:00401C18 53                      push ebx
:00401C19 56                      push esi
:00401C1A 57                      push edi
:00401C1B B988534500              mov ecx, 00455388
:00401C20 E8CB030000              call 00401FF0
:00401C25 E900000000              jmp 00401C2A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401C25(U)
|
:00401C2A 5F                      pop edi
:00401C2B 5E                      pop esi
:00401C2C 5B                      pop ebx
:00401C2D C9                      leave
:00401C2E C3                      ret



* Referenced by a CALL at Address:
|:00425527   
|
:00401C2F 55                      push ebp
:00401C30 8BEC                    mov ebp, esp
:00401C32 83EC08                  sub esp, 00000008
:00401C35 53                      push ebx
:00401C36 56                      push esi
:00401C37 57                      push edi
:00401C38 894DF8                  mov dword ptr [ebp-08], ecx
:00401C3B B9C0524700              mov ecx, 004752C0
:00401C40 E80B040000              call 00402050
:00401C45 8945FC                  mov dword ptr [ebp-04], eax
:00401C48 837DFCFF                cmp dword ptr [ebp-04], FFFFFFFF
:00401C4C 0F8429000000            je 00401C7B
:00401C52 8B45F8                  mov eax, dword ptr [ebp-08]
:00401C55 8B4008                  mov eax, dword ptr [eax+08]
:00401C58 50                      push eax
:00401C59 8B45F8                  mov eax, dword ptr [ebp-08]
:00401C5C 8B4004                  mov eax, dword ptr [eax+04]
:00401C5F 50                      push eax
:00401C60 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00401C63 E8EA000000              call 00401D52
:00401C68 8B45F8                  mov eax, dword ptr [ebp-08]
:00401C6B C7400C00000000          mov [eax+0C], 00000000
:00401C72 8B45F8                  mov eax, dword ptr [ebp-08]
:00401C75 C70000000000            mov dword ptr [eax], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401C4C(C)
|
:00401C7B 8B45FC                  mov eax, dword ptr [ebp-04]
:00401C7E E900000000              jmp 00401C83

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401C7E(U)
|
:00401C83 5F                      pop edi
:00401C84 5E                      pop esi
:00401C85 5B                      pop ebx
:00401C86 C9                      leave
:00401C87 C3                      ret



* Referenced by a CALL at Addresses:
|:004211A3   , :00421327   , :00421412   , :00421974   , :00421BF7   
|:00437CB9   , :00437CE6   , :00438412   , :0043870E   , :00438982   
|:004393B8   
|
:00401C88 55                      push ebp
:00401C89 8BEC                    mov ebp, esp
:00401C8B 83EC04                  sub esp, 00000004
:00401C8E 53                      push ebx
:00401C8F 56                      push esi
:00401C90 57                      push edi
:00401C91 894DFC                  mov dword ptr [ebp-04], ecx
:00401C94 8B45FC                  mov eax, dword ptr [ebp-04]
:00401C97 833800                  cmp dword ptr [eax], 00000000
:00401C9A 0F8513000000            jne 00401CB3
:00401CA0 B9C0524700              mov ecx, 004752C0
:00401CA5 E8FA570400              call 004474A4
:00401CAA 8B45FC                  mov eax, dword ptr [ebp-04]
:00401CAD C70001000000            mov dword ptr [eax], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401C9A(C)
|
:00401CB3 E900000000              jmp 00401CB8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401CB3(U)
|
:00401CB8 5F                      pop edi
:00401CB9 5E                      pop esi
:00401CBA 5B                      pop ebx
:00401CBB C9                      leave
:00401CBC C3                      ret


:00401CBD 55                      push ebp
:00401CBE 8BEC                    mov ebp, esp
:00401CC0 83EC04                  sub esp, 00000004
:00401CC3 53                      push ebx
:00401CC4 56                      push esi
:00401CC5 57                      push edi
:00401CC6 894DFC                  mov dword ptr [ebp-04], ecx
:00401CC9 8B45FC                  mov eax, dword ptr [ebp-04]
:00401CCC 833800                  cmp dword ptr [eax], 00000000
:00401CCF 0F8413000000            je 00401CE8
:00401CD5 B9C0524700              mov ecx, 004752C0
:00401CDA E8DC570400              call 004474BB
:00401CDF 8B45FC                  mov eax, dword ptr [ebp-04]
:00401CE2 C70000000000            mov dword ptr [eax], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401CCF(C)
|
:00401CE8 E900000000              jmp 00401CED

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401CE8(U)
|
:00401CED 5F                      pop edi
:00401CEE 5E                      pop esi
:00401CEF 5B                      pop ebx
:00401CF0 C9                      leave
:00401CF1 C3                      ret



* Referenced by a CALL at Addresses:
|:0040304B   , :0040F8AE   , :00410B36   , :0041391D   , :00416009   
|:004210E6   , :0042127A   , :004218CB   , :00421B77   , :00435590   
|:00435BCD   , :00436155   , :0043800F   , :004384E0   , :0043878A   
|:0043917B   , :0043A6F5   , :0043CDA1   
|
:00401CF2 55                      push ebp
:00401CF3 8BEC                    mov ebp, esp
:00401CF5 83EC0C                  sub esp, 0000000C
:00401CF8 53                      push ebx
:00401CF9 56                      push esi
:00401CFA 57                      push edi
:00401CFB 894DF4                  mov dword ptr [ebp-0C], ecx
:00401CFE 8D45F8                  lea eax, dword ptr [ebp-08]
:00401D01 50                      push eax
:00401D02 8D45FC                  lea eax, dword ptr [ebp-04]
:00401D05 50                      push eax
:00401D06 B9C0524700              mov ecx, 004752C0
:00401D0B E8F0570400              call 00447500
:00401D10 833D482F450000          cmp dword ptr [00452F48], 00000000
:00401D17 0F8417000000            je 00401D34
:00401D1D 8B45FC                  mov eax, dword ptr [ebp-04]
:00401D20 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00401D23 894104                  mov dword ptr [ecx+04], eax
:00401D26 8B45F8                  mov eax, dword ptr [ebp-08]
:00401D29 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00401D2C 894108                  mov dword ptr [ecx+08], eax
:00401D2F E914000000              jmp 00401D48

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401D17(C)
|
:00401D34 8B45F4                  mov eax, dword ptr [ebp-0C]
:00401D37 C7400400000000          mov [eax+04], 00000000
:00401D3E 8B45F4                  mov eax, dword ptr [ebp-0C]
:00401D41 C7400800000000          mov [eax+08], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401D2F(U)
|
:00401D48 E900000000              jmp 00401D4D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401D48(U)
|
:00401D4D 5F                      pop edi
:00401D4E 5E                      pop esi
:00401D4F 5B                      pop ebx
:00401D50 C9                      leave
:00401D51 C3                      ret



* Referenced by a CALL at Address:
|:00401C63   
|
:00401D52 55                      push ebp
:00401D53 8BEC                    mov ebp, esp
:00401D55 83EC04                  sub esp, 00000004
:00401D58 53                      push ebx
:00401D59 56                      push esi
:00401D5A 57                      push edi
:00401D5B 894DFC                  mov dword ptr [ebp-04], ecx
:00401D5E 8B450C                  mov eax, dword ptr [ebp+0C]
:00401D61 50                      push eax
:00401D62 8B4508                  mov eax, dword ptr [ebp+08]
:00401D65 50                      push eax
:00401D66 B9C0524700              mov ecx, 004752C0
:00401D6B E800030000              call 00402070
:00401D70 E900000000              jmp 00401D75

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401D70(U)
|
:00401D75 5F                      pop edi
:00401D76 5E                      pop esi
:00401D77 5B                      pop ebx
:00401D78 C9                      leave
:00401D79 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:00401DCB   , :00403345   , :0040D086   , :0041DAA8   , :00421156   
|:00421268   , :004218FA   , :00438470   , :00438724   , :0043ACA9   
|:0043AD5B   , :0043AD6D   , :0043B770   , :0043BD17   , :0043C589   
|:00440129   , :00442EF4   
|
:00401D7C 55                      push ebp
:00401D7D 8BEC                    mov ebp, esp
:00401D7F 83EC04                  sub esp, 00000004
:00401D82 53                      push ebx
:00401D83 56                      push esi
:00401D84 57                      push edi
:00401D85 894DFC                  mov dword ptr [ebp-04], ecx
:00401D88 B9C0524700              mov ecx, 004752C0
:00401D8D E88D570400              call 0044751F
:00401D92 E900000000              jmp 00401D97

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401D92(U)
|
:00401D97 5F                      pop edi
:00401D98 5E                      pop esi
:00401D99 5B                      pop ebx
:00401D9A C9                      leave
:00401D9B C3                      ret



* Referenced by a CALL at Addresses:
|:00401DE5   , :00403380   , :0040CF7D   , :004389EB   , :004395E0   
|:0043AE03   , :0043BCEC   , :0043C5C8   , :0044292B   , :00442FAA   
|:00443046   , :00443FE0   
|
:00401D9C 55                      push ebp
:00401D9D 8BEC                    mov ebp, esp
:00401D9F 83EC04                  sub esp, 00000004
:00401DA2 53                      push ebx
:00401DA3 56                      push esi
:00401DA4 57                      push edi
:00401DA5 894DFC                  mov dword ptr [ebp-04], ecx
:00401DA8 B9C0524700              mov ecx, 004752C0
:00401DAD E892570400              call 00447544
:00401DB2 E900000000              jmp 00401DB7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401DB2(U)
|
:00401DB7 5F                      pop edi
:00401DB8 5E                      pop esi
:00401DB9 5B                      pop ebx
:00401DBA C9                      leave
:00401DBB C3                      ret



* Referenced by a CALL at Addresses:
|:0040F913   , :004361A8   , :0043740C   , :00437488   
|
:00401DBC 55                      push ebp
:00401DBD 8BEC                    mov ebp, esp
:00401DBF 83EC04                  sub esp, 00000004
:00401DC2 53                      push ebx
:00401DC3 56                      push esi
:00401DC4 57                      push edi
:00401DC5 894DFC                  mov dword ptr [ebp-04], ecx
:00401DC8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00401DCB E8ACFFFFFF              call 00401D7C
:00401DD0 85C0                    test eax, eax
:00401DD2 0F840A000000            je 00401DE2
:00401DD8 B801000000              mov eax, 00000001
:00401DDD E921000000              jmp 00401E03

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401DD2(C)
|
:00401DE2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00401DE5 E8B2FFFFFF              call 00401D9C
:00401DEA 85C0                    test eax, eax
:00401DEC 0F840A000000            je 00401DFC
:00401DF2 B802000000              mov eax, 00000002
:00401DF7 E907000000              jmp 00401E03

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401DEC(C)
|
:00401DFC 33C0                    xor eax, eax
:00401DFE E900000000              jmp 00401E03

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00401DDD(U), :00401DF7(U), :00401DFE(U)
|
:00401E03 5F                      pop edi
:00401E04 5E                      pop esi
:00401E05 5B                      pop ebx
:00401E06 C9                      leave
:00401E07 C3                      ret



* Referenced by a CALL at Addresses:
|:00401F6F   , :0040F348   , :004346DB   
|
:00401E08 55                      push ebp
:00401E09 8BEC                    mov ebp, esp
:00401E0B 83EC04                  sub esp, 00000004
:00401E0E 53                      push ebx
:00401E0F 56                      push esi
:00401E10 57                      push edi
:00401E11 894DFC                  mov dword ptr [ebp-04], ecx
:00401E14 8B4508                  mov eax, dword ptr [ebp+08]
:00401E17 50                      push eax
:00401E18 6860090000              push 00000960
:00401E1D 6A04                    push 00000004
:00401E1F 6A00                    push 00000000
:00401E21 6800200000              push 00002000
:00401E26 B968F94600              mov ecx, 0046F968
:00401E2B E8F0580400              call 00447720
:00401E30 50                      push eax
:00401E31 E82D560400              call 00447463
:00401E36 83C40C                  add esp, 0000000C
:00401E39 E900000000              jmp 00401E3E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401E39(U)
|
:00401E3E 5F                      pop edi
:00401E3F 5E                      pop esi
:00401E40 5B                      pop ebx
:00401E41 C9                      leave
:00401E42 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0040F35F   , :0040F39F   , :0040F437   , :0040F50F   , :004346F2   
|:00434732   , :00434795   , :004347FB   , :00434846   
|
:00401E45 55                      push ebp
:00401E46 8BEC                    mov ebp, esp
:00401E48 83EC10                  sub esp, 00000010
:00401E4B 53                      push ebx
:00401E4C 56                      push esi
:00401E4D 57                      push edi
:00401E4E 894DF0                  mov dword ptr [ebp-10], ecx
:00401E51 6A04                    push 00000004
:00401E53 6A00                    push 00000000
:00401E55 8B450C                  mov eax, dword ptr [ebp+0C]
:00401E58 8D0480                  lea eax, dword ptr [eax+4*eax]
:00401E5B C1E004                  shl eax, 04
:00401E5E 034508                  add eax, dword ptr [ebp+08]
:00401E61 0500200000              add eax, 00002000
:00401E66 50                      push eax
:00401E67 B968F94600              mov ecx, 0046F968
:00401E6C E8AF580400              call 00447720
:00401E71 8945FC                  mov dword ptr [ebp-04], eax
:00401E74 C745F400000000          mov [ebp-0C], 00000000
:00401E7B E903000000              jmp 00401E83

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401EC5(U)
|
:00401E80 FF45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401E7B(U)
|
:00401E83 8B4514                  mov eax, dword ptr [ebp+14]
:00401E86 3945F4                  cmp dword ptr [ebp-0C], eax
:00401E89 0F833B000000            jnb 00401ECA
:00401E8F C745F800000000          mov [ebp-08], 00000000
:00401E96 E903000000              jmp 00401E9E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401EB5(U)
|
:00401E9B FF45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401E96(U)
|
:00401E9E 8B4510                  mov eax, dword ptr [ebp+10]
:00401EA1 3945F8                  cmp dword ptr [ebp-08], eax
:00401EA4 0F8310000000            jnb 00401EBA
:00401EAA 8A4518                  mov al, byte ptr [ebp+18]
:00401EAD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00401EB0 8801                    mov byte ptr [ecx], al
:00401EB2 FF45FC                  inc [ebp-04]
:00401EB5 E9E1FFFFFF              jmp 00401E9B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401EA4(C)
|
:00401EBA B850000000              mov eax, 00000050
:00401EBF 2B4510                  sub eax, dword ptr [ebp+10]
:00401EC2 0145FC                  add dword ptr [ebp-04], eax
:00401EC5 E9B6FFFFFF              jmp 00401E80

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401E89(C)
|
:00401ECA E900000000              jmp 00401ECF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401ECA(U)
|
:00401ECF 5F                      pop edi
:00401ED0 5E                      pop esi
:00401ED1 5B                      pop ebx
:00401ED2 C9                      leave
:00401ED3 C21400                  ret 0014



* Referenced by a CALL at Addresses:
|:0040F8B8   , :00434CE1   , :00435BD7   , :0043615F   
|
:00401ED6 55                      push ebp
:00401ED7 8BEC                    mov ebp, esp
:00401ED9 83EC10                  sub esp, 00000010
:00401EDC 53                      push ebx
:00401EDD 56                      push esi
:00401EDE 57                      push edi
:00401EDF 894DF0                  mov dword ptr [ebp-10], ecx
:00401EE2 8B45F0                  mov eax, dword ptr [ebp-10]
:00401EE5 8B4004                  mov eax, dword ptr [eax+04]
:00401EE8 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00401EEB 2B4110                  sub eax, dword ptr [ecx+10]
:00401EEE C1E803                  shr eax, 03
:00401EF1 8945F8                  mov dword ptr [ebp-08], eax
:00401EF4 8B45F0                  mov eax, dword ptr [ebp-10]
:00401EF7 8B4008                  mov eax, dword ptr [eax+08]
:00401EFA 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00401EFD 2B4114                  sub eax, dword ptr [ecx+14]
:00401F00 C1E804                  shr eax, 04
:00401F03 8945F4                  mov dword ptr [ebp-0C], eax
:00401F06 6A04                    push 00000004
:00401F08 6A00                    push 00000000
:00401F0A 8B45F4                  mov eax, dword ptr [ebp-0C]
:00401F0D 8D0480                  lea eax, dword ptr [eax+4*eax]
:00401F10 C1E004                  shl eax, 04
:00401F13 0345F8                  add eax, dword ptr [ebp-08]
:00401F16 0500200000              add eax, 00002000
:00401F1B 50                      push eax
:00401F1C B968F94600              mov ecx, 0046F968
:00401F21 E8FA570400              call 00447720
:00401F26 8945FC                  mov dword ptr [ebp-04], eax
:00401F29 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00401F2C 8A01                    mov al, byte ptr [ecx]
:00401F2E E900000000              jmp 00401F33

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401F2E(U)
|
:00401F33 5F                      pop edi
:00401F34 5E                      pop esi
:00401F35 5B                      pop ebx
:00401F36 C9                      leave
:00401F37 C3                      ret



* Referenced by a CALL at Address:
|:00433AC3   
|
:00401F38 55                      push ebp
:00401F39 8BEC                    mov ebp, esp
:00401F3B 83EC04                  sub esp, 00000004
:00401F3E 53                      push ebx
:00401F3F 56                      push esi
:00401F40 57                      push edi
:00401F41 894DFC                  mov dword ptr [ebp-04], ecx
:00401F44 6860090000              push 00000960
:00401F49 6808494500              push 00454908
:00401F4E 6A04                    push 00000004
:00401F50 6A00                    push 00000000
:00401F52 6800200000              push 00002000
:00401F57 B968F94600              mov ecx, 0046F968
:00401F5C E8BF570400              call 00447720
:00401F61 50                      push eax
:00401F62 E8E6540400              call 0044744D
:00401F67 83C40C                  add esp, 0000000C
:00401F6A 6A00                    push 00000000
:00401F6C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00401F6F E894FEFFFF              call 00401E08
:00401F74 E900000000              jmp 00401F79

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401F74(U)
|
:00401F79 5F                      pop edi
:00401F7A 5E                      pop esi
:00401F7B 5B                      pop ebx
:00401F7C C9                      leave
:00401F7D C3                      ret



* Referenced by a CALL at Address:
|:00433B27   
|
:00401F7E 55                      push ebp
:00401F7F 8BEC                    mov ebp, esp
:00401F81 83EC04                  sub esp, 00000004
:00401F84 53                      push ebx
:00401F85 56                      push esi
:00401F86 57                      push edi
:00401F87 894DFC                  mov dword ptr [ebp-04], ecx
:00401F8A 6860090000              push 00000960
:00401F8F 6A04                    push 00000004
:00401F91 6A00                    push 00000000
:00401F93 6800200000              push 00002000
:00401F98 B968F94600              mov ecx, 0046F968
:00401F9D E87E570400              call 00447720
:00401FA2 50                      push eax
:00401FA3 6808494500              push 00454908
:00401FA8 E8A0540400              call 0044744D
:00401FAD 83C40C                  add esp, 0000000C
:00401FB0 E900000000              jmp 00401FB5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401FB0(U)
|
:00401FB5 5F                      pop edi
:00401FB6 5E                      pop esi
:00401FB7 5B                      pop ebx
:00401FB8 C9                      leave
:00401FB9 C3                      ret


:00401FBA 55                      push ebp
:00401FBB 8BEC                    mov ebp, esp
:00401FBD 83EC04                  sub esp, 00000004
:00401FC0 53                      push ebx
:00401FC1 56                      push esi
:00401FC2 57                      push edi
:00401FC3 894DFC                  mov dword ptr [ebp-04], ecx
:00401FC6 8B4508                  mov eax, dword ptr [ebp+08]
:00401FC9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00401FCC 894110                  mov dword ptr [ecx+10], eax
:00401FCF 8B450C                  mov eax, dword ptr [ebp+0C]
:00401FD2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00401FD5 894114                  mov dword ptr [ecx+14], eax
:00401FD8 E900000000              jmp 00401FDD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401FD8(U)
|
:00401FDD 5F                      pop edi
:00401FDE 5E                      pop esi
:00401FDF 5B                      pop ebx
:00401FE0 C9                      leave
:00401FE1 C20800                  ret 0008


:00401FE4 CC                      int 03
:00401FE5 CC                      int 03
:00401FE6 CC                      int 03
:00401FE7 CC                      int 03
:00401FE8 CC                      int 03
:00401FE9 CC                      int 03
:00401FEA CC                      int 03
:00401FEB CC                      int 03
:00401FEC CC                      int 03
:00401FED CC                      int 03
:00401FEE CC                      int 03
:00401FEF CC                      int 03

* Referenced by a CALL at Address:
|:00401C20   
|
:00401FF0 55                      push ebp
:00401FF1 8BEC                    mov ebp, esp
:00401FF3 83EC04                  sub esp, 00000004
:00401FF6 53                      push ebx
:00401FF7 56                      push esi
:00401FF8 57                      push edi
:00401FF9 894DFC                  mov dword ptr [ebp-04], ecx
:00401FFC 8B45FC                  mov eax, dword ptr [ebp-04]
:00401FFF C70000000000            mov dword ptr [eax], 00000000
:00402005 8B45FC                  mov eax, dword ptr [ebp-04]
:00402008 C7400440010000          mov [eax+04], 00000140
:0040200F 8B45FC                  mov eax, dword ptr [ebp-04]
:00402012 C74008F0000000          mov [eax+08], 000000F0
:00402019 8B45FC                  mov eax, dword ptr [ebp-04]
:0040201C C7400C00000000          mov [eax+0C], 00000000
:00402023 8B45FC                  mov eax, dword ptr [ebp-04]
:00402026 C7401000000000          mov [eax+10], 00000000
:0040202D 8B45FC                  mov eax, dword ptr [ebp-04]
:00402030 C7401400000000          mov [eax+14], 00000000
:00402037 E900000000              jmp 0040203C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402037(U)
|
:0040203C 8B45FC                  mov eax, dword ptr [ebp-04]
:0040203F 5F                      pop edi
:00402040 5E                      pop esi
:00402041 5B                      pop ebx
:00402042 C9                      leave
:00402043 C3                      ret


:00402044 CC                      int 03
:00402045 CC                      int 03
:00402046 CC                      int 03
:00402047 CC                      int 03
:00402048 CC                      int 03
:00402049 CC                      int 03
:0040204A CC                      int 03
:0040204B CC                      int 03
:0040204C CC                      int 03
:0040204D CC                      int 03
:0040204E CC                      int 03
:0040204F CC                      int 03

* Referenced by a CALL at Address:
|:00401C40   
|
:00402050 55                      push ebp
:00402051 8BEC                    mov ebp, esp
:00402053 83EC04                  sub esp, 00000004
:00402056 53                      push ebx
:00402057 56                      push esi
:00402058 57                      push edi
:00402059 894DFC                  mov dword ptr [ebp-04], ecx
:0040205C E80E550400              call 0044756F
:00402061 E900000000              jmp 00402066

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402061(U)
|
:00402066 5F                      pop edi
:00402067 5E                      pop esi
:00402068 5B                      pop ebx
:00402069 C9                      leave
:0040206A C3                      ret


:0040206B CC                      int 03
:0040206C CC                      int 03
:0040206D CC                      int 03
:0040206E CC                      int 03
:0040206F CC                      int 03

* Referenced by a CALL at Address:
|:00401D6B   
|
:00402070 55                      push ebp
:00402071 8BEC                    mov ebp, esp
:00402073 83EC04                  sub esp, 00000004
:00402076 53                      push ebx
:00402077 56                      push esi
:00402078 57                      push edi
:00402079 894DFC                  mov dword ptr [ebp-04], ecx
:0040207C 8B450C                  mov eax, dword ptr [ebp+0C]
:0040207F 50                      push eax
:00402080 8B4508                  mov eax, dword ptr [ebp+08]
:00402083 50                      push eax
:00402084 E82B550400              call 004475B4
:00402089 83C408                  add esp, 00000008
:0040208C E900000000              jmp 00402091

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040208C(U)
|
:00402091 5F                      pop edi
:00402092 5E                      pop esi
:00402093 5B                      pop ebx
:00402094 C9                      leave
:00402095 C20800                  ret 0008


:00402098 CC                      int 03
:00402099 CC                      int 03
:0040209A CC                      int 03
:0040209B CC                      int 03
:0040209C CC                      int 03
:0040209D CC                      int 03
:0040209E CC                      int 03
:0040209F CC                      int 03
:004020A0 55                      push ebp
:004020A1 8BEC                    mov ebp, esp
:004020A3 53                      push ebx
:004020A4 56                      push esi
:004020A5 57                      push edi
:004020A6 E80A000000              call 004020B5
:004020AB E900000000              jmp 004020B0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004020AB(U)
|
:004020B0 5F                      pop edi
:004020B1 5E                      pop esi
:004020B2 5B                      pop ebx
:004020B3 C9                      leave
:004020B4 C3                      ret



* Referenced by a CALL at Address:
|:004020A6   
|
:004020B5 55                      push ebp
:004020B6 8BEC                    mov ebp, esp
:004020B8 53                      push ebx
:004020B9 56                      push esi
:004020BA 57                      push edi
:004020BB 6870184000              push 00401870
:004020C0 6A06                    push 00000006
:004020C2 6A02                    push 00000002
:004020C4 68A0534500              push 004553A0
:004020C9 E8E26F0000              call 004090B0
:004020CE E900000000              jmp 004020D3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004020CE(U)
|
:004020D3 5F                      pop edi
:004020D4 5E                      pop esi
:004020D5 5B                      pop ebx
:004020D6 C9                      leave
:004020D7 C3                      ret



* Referenced by a CALL at Addresses:
|:0040450A   , :004046A1   , :0040480C   , :0041C1E0   
|
:004020D8 55                      push ebp
:004020D9 8BEC                    mov ebp, esp
:004020DB 83EC0C                  sub esp, 0000000C
:004020DE 53                      push ebx
:004020DF 56                      push esi
:004020E0 57                      push edi
:004020E1 B968F94600              mov ecx, 0046F968
:004020E6 E8F56F0000              call 004090E0
:004020EB 8945F4                  mov dword ptr [ebp-0C], eax
:004020EE 8B45F4                  mov eax, dword ptr [ebp-0C]
:004020F1 C60000                  mov byte ptr [eax], 00
:004020F4 33C0                    xor eax, eax
:004020F6 8A4510                  mov al, byte ptr [ebp+10]
:004020F9 85C0                    test eax, eax
:004020FB 0F851E000000            jne 0040211F

* Possible StringData Ref from Data Obj ->"ֻе"
                                  |
:00402101 68DCDC4400              push 0044DCDC
:00402106 6A04                    push 00000004
:00402108 6A00                    push 00000000
:0040210A 6A00                    push 00000000
:0040210C B968F94600              mov ecx, 0046F968
:00402111 E80A560400              call 00447720
:00402116 50                      push eax
:00402117 E8D4520400              call 004473F0
:0040211C 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004020FB(C)
|
:0040211F C645FC00                mov [ebp-04], 00
:00402123 E903000000              jmp 0040212B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004021CA(U)
|
:00402128 FE45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402123(U)
|
:0040212B 33C0                    xor eax, eax
:0040212D 8A45FC                  mov al, byte ptr [ebp-04]
:00402130 83F804                  cmp eax, 00000004
:00402133 0F8D96000000            jnl 004021CF
:00402139 33C0                    xor eax, eax
:0040213B 8A4508                  mov al, byte ptr [ebp+08]
:0040213E 33C9                    xor ecx, ecx
:00402140 8A4DFC                  mov cl, byte ptr [ebp-04]
:00402143 8A848110D34400          mov al, byte ptr [ecx+4*eax+0044D310]
:0040214A 8845F8                  mov byte ptr [ebp-08], al
:0040214D 33C0                    xor eax, eax
:0040214F 8A45F8                  mov al, byte ptr [ebp-08]
:00402152 3DFF000000              cmp eax, 000000FF
:00402157 0F8451000000            je 004021AE
:0040215D 33C0                    xor eax, eax
:0040215F 8A4510                  mov al, byte ptr [ebp+10]
:00402162 85C0                    test eax, eax
:00402164 0F8544000000            jne 004021AE
:0040216A 33C0                    xor eax, eax
:0040216C 8A45F8                  mov al, byte ptr [ebp-08]
:0040216F 8B048568324500          mov eax, dword ptr [4*eax+00453268]
:00402176 50                      push eax
:00402177 6A04                    push 00000004
:00402179 6A00                    push 00000000
:0040217B 6A00                    push 00000000
:0040217D B968F94600              mov ecx, 0046F968
:00402182 E899550400              call 00447720
:00402187 50                      push eax
:00402188 E863520400              call 004473F0
:0040218D 83C408                  add esp, 00000008

* Possible StringData Ref from Data Obj ->""
                                  |
:00402190 68E8DC4400              push 0044DCE8
:00402195 6A04                    push 00000004
:00402197 6A00                    push 00000000
:00402199 6A00                    push 00000000
:0040219B B968F94600              mov ecx, 0046F968
:004021A0 E87B550400              call 00447720
:004021A5 50                      push eax
:004021A6 E845520400              call 004473F0
:004021AB 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00402157(C), :00402164(C)
|
:004021AE 33C0                    xor eax, eax
:004021B0 8A450C                  mov al, byte ptr [ebp+0C]
:004021B3 33C9                    xor ecx, ecx
:004021B5 8A4DF8                  mov cl, byte ptr [ebp-08]
:004021B8 3BC1                    cmp eax, ecx
:004021BA 0F850A000000            jne 004021CA
:004021C0 B801000000              mov eax, 00000001
:004021C5 E94C000000              jmp 00402216

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004021BA(C)
|
:004021CA E959FFFFFF              jmp 00402128

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402133(C)
|
:004021CF 33C0                    xor eax, eax
:004021D1 8A4510                  mov al, byte ptr [ebp+10]
:004021D4 85C0                    test eax, eax
:004021D6 0F8533000000            jne 0040220F

* Possible StringData Ref from Data Obj ->"
ĳϲִУ"
                                  |
:004021DC 68ECDC4400              push 0044DCEC
:004021E1 6A04                    push 00000004
:004021E3 6A00                    push 00000000
:004021E5 6A00                    push 00000000
:004021E7 B968F94600              mov ecx, 0046F968
:004021EC E82F550400              call 00447720
:004021F1 50                      push eax
:004021F2 E8F9510400              call 004473F0
:004021F7 83C408                  add esp, 00000008
:004021FA B968F94600              mov ecx, 0046F968
:004021FF E8DC6E0000              call 004090E0
:00402204 50                      push eax
:00402205 6A00                    push 00000000
:00402207 E8296D0300              call 00438F35
:0040220C 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004021D6(C)
|
:0040220F 33C0                    xor eax, eax
:00402211 E900000000              jmp 00402216

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004021C5(U), :00402211(U)
|
:00402216 5F                      pop edi
:00402217 5E                      pop esi
:00402218 5B                      pop ebx
:00402219 C9                      leave
:0040221A C3                      ret



* Referenced by a CALL at Addresses:
|:00405077   , :004056CE   , :0040584C   , :00405A98   , :00405C16   
|:00405E5F   , :00405FE5   , :00406245   , :004063D5   , :004065CD   
|:004067C0   , :00407CAD   , :004237E4   , :00423871   
|
:0040221B 55                      push ebp
:0040221C 8BEC                    mov ebp, esp
:0040221E 83EC18                  sub esp, 00000018
:00402221 53                      push ebx
:00402222 56                      push esi
:00402223 57                      push edi
:00402224 33C0                    xor eax, eax
:00402226 8A4508                  mov al, byte ptr [ebp+08]
:00402229 8BC8                    mov ecx, eax
:0040222B 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040222E C1E003                  shl eax, 03
:00402231 2BC1                    sub eax, ecx
:00402233 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00402239 E8F26E0000              call 00409130
:0040223E 8D0440                  lea eax, dword ptr [eax+2*eax]
:00402241 03C0                    add eax, eax
:00402243 8D04C0                  lea eax, dword ptr [eax+8*eax]
:00402246 05E8564500              add eax, 004556E8
:0040224B 8945F0                  mov dword ptr [ebp-10], eax
:0040224E 33C0                    xor eax, eax
:00402250 8A450C                  mov al, byte ptr [ebp+0C]
:00402253 8BC8                    mov ecx, eax
:00402255 8D0440                  lea eax, dword ptr [eax+2*eax]
:00402258 C1E003                  shl eax, 03
:0040225B 2BC1                    sub eax, ecx
:0040225D 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00402263 E8C86E0000              call 00409130
:00402268 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040226B 03C0                    add eax, eax
:0040226D 8D04C0                  lea eax, dword ptr [eax+8*eax]
:00402270 05E8564500              add eax, 004556E8
:00402275 8945F4                  mov dword ptr [ebp-0C], eax
:00402278 C745F801000000          mov [ebp-08], 00000001
:0040227F C645EC01                mov [ebp-14], 01
:00402283 6A08                    push 00000008
:00402285 33C0                    xor eax, eax
:00402287 8A450C                  mov al, byte ptr [ebp+0C]
:0040228A 8BC8                    mov ecx, eax
:0040228C 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040228F C1E003                  shl eax, 03
:00402292 2BC1                    sub eax, ecx
:00402294 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0040229A E8B16E0000              call 00409150
:0040229F 85C0                    test eax, eax
:004022A1 0F8404000000            je 004022AB
:004022A7 C645EC02                mov [ebp-14], 02

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004022A1(C)
|
:004022AB C645FC00                mov [ebp-04], 00
:004022AF E903000000              jmp 004022B7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040233F(U)
|
:004022B4 FE45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004022AF(U)
|
:004022B7 33C0                    xor eax, eax
:004022B9 8A45FC                  mov al, byte ptr [ebp-04]
:004022BC 33C9                    xor ecx, ecx
:004022BE 8A4DEC                  mov cl, byte ptr [ebp-14]
:004022C1 3BC1                    cmp eax, ecx
:004022C3 0F8D7B000000            jnl 00402344
:004022C9 837DF800                cmp dword ptr [ebp-08], 00000000
:004022CD 0F8471000000            je 00402344
:004022D3 33C0                    xor eax, eax
:004022D5 8A4514                  mov al, byte ptr [ebp+14]
:004022D8 83F802                  cmp eax, 00000002
:004022DB 0F855E000000            jne 0040233F
:004022E1 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004022E4 E8276E0000              call 00409110
:004022E9 33C9                    xor ecx, ecx
:004022EB 8AC8                    mov cl, al
:004022ED 51                      push ecx
:004022EE E835500400              call 00447328
:004022F3 83C404                  add esp, 00000004
:004022F6 8BD8                    mov ebx, eax
:004022F8 895DE8                  mov dword ptr [ebp-18], ebx
:004022FB 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004022FE E80D6E0000              call 00409110
:00402303 33C9                    xor ecx, ecx
:00402305 8AC8                    mov cl, al
:00402307 33DB                    xor ebx, ebx
:00402309 8A5D10                  mov bl, byte ptr [ebp+10]
:0040230C 8BC1                    mov eax, ecx
:0040230E 99                      cdq
:0040230F F7FB                    idiv ebx
:00402311 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00402314 3BC8                    cmp ecx, eax
:00402316 0F8323000000            jnb 0040233F
:0040231C 33C0                    xor eax, eax
:0040231E 8A4518                  mov al, byte ptr [ebp+18]
:00402321 85C0                    test eax, eax
:00402323 0F840F000000            je 00402338

* Possible StringData Ref from Data Obj ->"ʧˡ"
                                  |
:00402329 6800DD4400              push 0044DD00
:0040232E 6A00                    push 00000000
:00402330 E8006C0300              call 00438F35
:00402335 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402323(C)
|
:00402338 C745F800000000          mov [ebp-08], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004022DB(C), :00402316(C)
|
:0040233F E970FFFFFF              jmp 004022B4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004022C3(C), :004022CD(C)
|
:00402344 8B45F8                  mov eax, dword ptr [ebp-08]
:00402347 E900000000              jmp 0040234C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402347(U)
|
:0040234C 5F                      pop edi
:0040234D 5E                      pop esi
:0040234E 5B                      pop ebx
:0040234F C9                      leave
:00402350 C3                      ret



* Referenced by a CALL at Addresses:
|:00406BED   , :0041CFBB   
|
:00402351 55                      push ebp
:00402352 8BEC                    mov ebp, esp
:00402354 83EC18                  sub esp, 00000018
:00402357 53                      push ebx
:00402358 56                      push esi
:00402359 57                      push edi
:0040235A 33C0                    xor eax, eax
:0040235C 8A4508                  mov al, byte ptr [ebp+08]
:0040235F 8BC8                    mov ecx, eax
:00402361 8D0440                  lea eax, dword ptr [eax+2*eax]
:00402364 C1E003                  shl eax, 03
:00402367 2BC1                    sub eax, ecx
:00402369 0598C04600              add eax, 0046C098
:0040236E 8945F0                  mov dword ptr [ebp-10], eax
:00402371 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00402374 E8B76D0000              call 00409130
:00402379 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040237C 03C0                    add eax, eax
:0040237E 8D04C0                  lea eax, dword ptr [eax+8*eax]
:00402381 05E8564500              add eax, 004556E8
:00402386 8945F8                  mov dword ptr [ebp-08], eax
:00402389 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040238C E86F6E0000              call 00409200
:00402391 668B00                  mov ax, word ptr [eax]
:00402394 668945FC                mov word ptr [ebp-04], ax
:00402398 33C0                    xor eax, eax
:0040239A 8A450C                  mov al, byte ptr [ebp+0C]
:0040239D 85C0                    test eax, eax
:0040239F 0F8509000000            jne 004023AE
:004023A5 C645F414                mov [ebp-0C], 14
:004023A9 E91B000000              jmp 004023C9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040239F(C)
|
:004023AE 33C0                    xor eax, eax
:004023B0 8A450C                  mov al, byte ptr [ebp+0C]
:004023B3 83F801                  cmp eax, 00000001
:004023B6 0F8509000000            jne 004023C5
:004023BC C645F428                mov [ebp-0C], 28
:004023C0 E904000000              jmp 004023C9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004023B6(C)
|
:004023C5 C645F450                mov [ebp-0C], 50

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004023A9(U), :004023C0(U)
|
:004023C9 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004023CC E88F6E0000              call 00409260
:004023D1 33DB                    xor ebx, ebx
:004023D3 8AD8                    mov bl, al
:004023D5 33C0                    xor eax, eax
:004023D7 8A45F4                  mov al, byte ptr [ebp-0C]
:004023DA 03D8                    add ebx, eax
:004023DC 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004023DF E8FC6D0000              call 004091E0
:004023E4 33C9                    xor ecx, ecx
:004023E6 8AC8                    mov cl, al
:004023E8 3BD9                    cmp ebx, ecx
:004023EA 0F8E1D000000            jle 0040240D
:004023F0 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004023F3 E8E86D0000              call 004091E0
:004023F8 33DB                    xor ebx, ebx
:004023FA 8AD8                    mov bl, al
:004023FC 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004023FF E85C6E0000              call 00409260
:00402404 33C9                    xor ecx, ecx
:00402406 8AC8                    mov cl, al
:00402408 2BD9                    sub ebx, ecx
:0040240A 885DF4                  mov byte ptr [ebp-0C], bl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004023EA(C)
|
:0040240D 33C0                    xor eax, eax
:0040240F 8A4510                  mov al, byte ptr [ebp+10]
:00402412 85C0                    test eax, eax
:00402414 0F8435010000            je 0040254F
:0040241A 6A00                    push 00000000
:0040241C 6A06                    push 00000006
:0040241E 33C0                    xor eax, eax
:00402420 8A45FD                  mov al, byte ptr [ebp-03]
:00402423 8D0440                  lea eax, dword ptr [eax+2*eax]
:00402426 50                      push eax
:00402427 33C0                    xor eax, eax
:00402429 8A45FC                  mov al, byte ptr [ebp-04]
:0040242C 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040242F 50                      push eax
:00402430 B900FB4600              mov ecx, 0046FB00
:00402435 E806C60300              call 0043EA40
:0040243A B9D0A64600              mov ecx, 0046A6D0
:0040243F E83C6D0000              call 00409180
:00402444 F6C401                  test ah, 01
:00402447 0F8538000000            jne 00402485
:0040244D C645EC00                mov [ebp-14], 00
:00402451 E903000000              jmp 00402459

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040247B(U)
|
:00402456 FE45EC                  inc [ebp-14]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402451(U)
|
:00402459 33C0                    xor eax, eax
:0040245B 8A45EC                  mov al, byte ptr [ebp-14]
:0040245E 83F803                  cmp eax, 00000003
:00402461 0F8D19000000            jnl 00402480
:00402467 6A0E                    push 0000000E
:00402469 33C0                    xor eax, eax
:0040246B 8A45F4                  mov al, byte ptr [ebp-0C]
:0040246E 50                      push eax
:0040246F 8B4508                  mov eax, dword ptr [ebp+08]
:00402472 50                      push eax
:00402473 E8EB760300              call 00439B63
:00402478 83C40C                  add esp, 0000000C
:0040247B E9D6FFFFFF              jmp 00402456

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402461(C)
|
:00402480 E9CA000000              jmp 0040254F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402447(C)
|
:00402485 8B4508                  mov eax, dword ptr [ebp+08]
:00402488 50                      push eax
:00402489 8D45E8                  lea eax, dword ptr [ebp-18]
:0040248C 50                      push eax
:0040248D E82F790300              call 00439DC1
:00402492 83C408                  add esp, 00000008
:00402495 33C0                    xor eax, eax
:00402497 8A4508                  mov al, byte ptr [ebp+08]
:0040249A 8BC8                    mov ecx, eax
:0040249C 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040249F C1E003                  shl eax, 03
:004024A2 2BC1                    sub eax, ecx
:004024A4 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004024AA E8716D0000              call 00409220
:004024AF 85C0                    test eax, eax
:004024B1 0F8409000000            je 004024C0
:004024B7 C645E80E                mov [ebp-18], 0E
:004024BB E904000000              jmp 004024C4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004024B1(C)
|
:004024C0 C645E82A                mov [ebp-18], 2A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004024BB(U)
|
:004024C4 33C0                    xor eax, eax
:004024C6 A0BDFC4600              mov al, byte ptr [0046FCBD]
:004024CB 03C0                    add eax, eax
:004024CD 83C006                  add eax, 00000006
:004024D0 50                      push eax
:004024D1 B9B0FA4600              mov ecx, 0046FAB0
:004024D6 E8D56C0000              call 004091B0
:004024DB 8B4508                  mov eax, dword ptr [ebp+08]
:004024DE 50                      push eax
:004024DF 8B45E8                  mov eax, dword ptr [ebp-18]
:004024E2 50                      push eax
:004024E3 E83E790300              call 00439E26
:004024E8 83C408                  add esp, 00000008
:004024EB E8D84E0300              call 004373C8
:004024F0 6A01                    push 00000001
:004024F2 E8C4500300              call 004375BB
:004024F7 83C404                  add esp, 00000004
:004024FA 33C0                    xor eax, eax
:004024FC A0BDFC4600              mov al, byte ptr [0046FCBD]
:00402501 03C0                    add eax, eax
:00402503 83C006                  add eax, 00000006
:00402506 50                      push eax
:00402507 B9B0FA4600              mov ecx, 0046FAB0
:0040250C E89F6C0000              call 004091B0
:00402511 6881000000              push 00000081
:00402516 33C0                    xor eax, eax
:00402518 8A45F4                  mov al, byte ptr [ebp-0C]
:0040251B 50                      push eax
:0040251C 8B4508                  mov eax, dword ptr [ebp+08]
:0040251F 50                      push eax
:00402520 8B45E8                  mov eax, dword ptr [ebp-18]
:00402523 50                      push eax
:00402524 E8457C0300              call 0043A16E
:00402529 83C410                  add esp, 00000010
:0040252C E8974E0300              call 004373C8
:00402531 6A01                    push 00000001
:00402533 E883500300              call 004375BB
:00402538 83C404                  add esp, 00000004
:0040253B 6A09                    push 00000009
:0040253D 6A21                    push 00000021
:0040253F 8B45E9                  mov eax, dword ptr [ebp-17]
:00402542 50                      push eax
:00402543 6A06                    push 00000006
:00402545 B900FB4600              mov ecx, 0046FB00
:0040254A E8DE850300              call 0043AB2D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00402414(C), :00402480(U)
|
:0040254F 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00402552 E8096D0000              call 00409260
:00402557 33C9                    xor ecx, ecx
:00402559 8AC8                    mov cl, al
:0040255B 33C0                    xor eax, eax
:0040255D 8A45F4                  mov al, byte ptr [ebp-0C]
:00402560 03C8                    add ecx, eax
:00402562 51                      push ecx
:00402563 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00402566 E8DA7E0200              call 0042A445
:0040256B 8A45F4                  mov al, byte ptr [ebp-0C]
:0040256E E900000000              jmp 00402573

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040256E(U)
|
:00402573 5F                      pop edi
:00402574 5E                      pop esi
:00402575 5B                      pop ebx
:00402576 C9                      leave
:00402577 C3                      ret



* Referenced by a CALL at Address:
|:00442F76   
|
:00402578 55                      push ebp
:00402579 8BEC                    mov ebp, esp
:0040257B 81EC8C030000            sub esp, 0000038C
:00402581 53                      push ebx
:00402582 56                      push esi
:00402583 57                      push edi
:00402584 898D78FCFFFF            mov dword ptr [ebp+FFFFFC78], ecx
:0040258A 8B8578FCFFFF            mov eax, dword ptr [ebp+FFFFFC78]
:00402590 668B4005                mov ax, word ptr [eax+05]
:00402594 668985D4FCFFFF          mov word ptr [ebp+FFFFFCD4], ax
:0040259B C785B4FCFFFF00000000    mov dword ptr [ebp+FFFFFCB4], 00000000
:004025A5 C785F4FCFFFF00000000    mov dword ptr [ebp+FFFFFCF4], 00000000
:004025AF B9D0A64600              mov ecx, 0046A6D0
:004025B4 E8C76B0000              call 00409180
:004025B9 8985F8FCFFFF            mov dword ptr [ebp+FFFFFCF8], eax
:004025BF C685D8FCFFFF00          mov byte ptr [ebp+FFFFFCD8], 00
:004025C6 C68538FFFFFF00          mov byte ptr [ebp+FFFFFF38], 00
:004025CD C685F0FCFFFF04          mov byte ptr [ebp+FFFFFCF0], 04
:004025D4 B900FB4600              mov ecx, 0046FB00
:004025D9 E8A8800300              call 0043A686
:004025DE 6A20                    push 00000020
:004025E0 8B8D78FCFFFF            mov ecx, dword ptr [ebp+FFFFFC78]
:004025E6 E8756D0000              call 00409360
:004025EB 85C0                    test eax, eax
:004025ED 0F841A000000            je 0040260D
:004025F3 8B8D78FCFFFF            mov ecx, dword ptr [ebp+FFFFFC78]
:004025F9 E81CB50100              call 0041DB1A
:004025FE 85C0                    test eax, eax
:00402600 0F8507000000            jne 0040260D
:00402606 33C0                    xor eax, eax
:00402608 E932080000              jmp 00402E3F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004025ED(C), :00402600(C)
|
:0040260D 8B8578FCFFFF            mov eax, dword ptr [ebp+FFFFFC78]
:00402613 8B00                    mov eax, dword ptr [eax]
:00402615 50                      push eax
:00402616 B988C04600              mov ecx, 0046C088
:0040261B E8806D0000              call 004093A0
:00402620 8B8D78FCFFFF            mov ecx, dword ptr [ebp+FFFFFC78]
:00402626 E8756C0000              call 004092A0
:0040262B 8885ECFCFFFF            mov byte ptr [ebp+FFFFFCEC], al
:00402631 C685E0FCFFFF00          mov byte ptr [ebp+FFFFFCE0], 00
:00402638 C685CCFCFFFF00          mov byte ptr [ebp+FFFFFCCC], 00
:0040263F 6A00                    push 00000000
:00402641 8B8D78FCFFFF            mov ecx, dword ptr [ebp+FFFFFC78]
:00402647 E8227D0200              call 0042A36E
:0040264C 50                      push eax
:0040264D 8B8578FCFFFF            mov eax, dword ptr [ebp+FFFFFC78]
:00402653 8A4004                  mov al, byte ptr [eax+04]
:00402656 50                      push eax
:00402657 E8E8070000              call 00402E44
:0040265C 83C40C                  add esp, 0000000C
:0040265F 33C9                    xor ecx, ecx
:00402661 8AC8                    mov cl, al
:00402663 85C9                    test ecx, ecx
:00402665 0F8416000000            je 00402681
:0040266B 33C0                    xor eax, eax
:0040266D 8A85CCFCFFFF            mov al, byte ptr [ebp+FFFFFCCC]
:00402673 C68405E4FCFFFF01        mov byte ptr [ebp+eax-0000031C], 01
:0040267B FE85CCFCFFFF            inc byte ptr [ebp+FFFFFCCC]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402665(C)
|
:00402681 C685D0FCFFFF00          mov byte ptr [ebp+FFFFFCD0], 00
:00402688 E906000000              jmp 00402693

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402724(U)
|
:0040268D FE85D0FCFFFF            inc byte ptr [ebp+FFFFFCD0]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402688(U)
|
:00402693 33C0                    xor eax, eax
:00402695 8A85D0FCFFFF            mov al, byte ptr [ebp+FFFFFCD0]
:0040269B 83F830                  cmp eax, 00000030
:0040269E 0F8D85000000            jnl 00402729
:004026A4 33C0                    xor eax, eax
:004026A6 8A85D0FCFFFF            mov al, byte ptr [ebp+FFFFFCD0]
:004026AC 8D0480                  lea eax, dword ptr [eax+4*eax]
:004026AF 33C9                    xor ecx, ecx
:004026B1 8A8DECFCFFFF            mov cl, byte ptr [ebp+FFFFFCEC]
:004026B7 33D2                    xor edx, edx
:004026B9 8A94C118D34400          mov dl, byte ptr [ecx+8*eax+0044D318]
:004026C0 85D2                    test edx, edx
:004026C2 0F845C000000            je 00402724
:004026C8 8B8578FCFFFF            mov eax, dword ptr [ebp+FFFFFC78]
:004026CE 8B00                    mov eax, dword ptr [eax]
:004026D0 8D0440                  lea eax, dword ptr [eax+2*eax]
:004026D3 03C0                    add eax, eax
:004026D5 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:004026DC E89F6B0000              call 00409280
:004026E1 33C9                    xor ecx, ecx
:004026E3 8AC8                    mov cl, al
:004026E5 33C0                    xor eax, eax
:004026E7 8A85D0FCFFFF            mov al, byte ptr [ebp+FFFFFCD0]
:004026ED 8D0480                  lea eax, dword ptr [eax+4*eax]
:004026F0 33D2                    xor edx, edx
:004026F2 8A95ECFCFFFF            mov dl, byte ptr [ebp+FFFFFCEC]
:004026F8 33DB                    xor ebx, ebx
:004026FA 8A9CC218D34400          mov bl, byte ptr [edx+8*eax+0044D318]
:00402701 3BCB                    cmp ecx, ebx
:00402703 0F8C1B000000            jl 00402724
:00402709 33C0                    xor eax, eax
:0040270B 8A85CCFCFFFF            mov al, byte ptr [ebp+FFFFFCCC]
:00402711 C68405E4FCFFFF02        mov byte ptr [ebp+eax-0000031C], 02
:00402719 FE85CCFCFFFF            inc byte ptr [ebp+FFFFFCCC]
:0040271F E905000000              jmp 00402729

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004026C2(C), :00402703(C)
|
:00402724 E964FFFFFF              jmp 0040268D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040269E(C), :0040271F(U)
|
:00402729 8B8578FCFFFF            mov eax, dword ptr [ebp+FFFFFC78]
:0040272F 8B00                    mov eax, dword ptr [eax]
:00402731 8D0440                  lea eax, dword ptr [eax+2*eax]
:00402734 03C0                    add eax, eax
:00402736 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:0040273D E846A50000              call 0040CC88
:00402742 33C9                    xor ecx, ecx
:00402744 8AC8                    mov cl, al
:00402746 85C9                    test ecx, ecx
:00402748 0F8416000000            je 00402764
:0040274E 33C0                    xor eax, eax
:00402750 8A85CCFCFFFF            mov al, byte ptr [ebp+FFFFFCCC]
:00402756 C68405E4FCFFFF03        mov byte ptr [ebp+eax-0000031C], 03
:0040275E FE85CCFCFFFF            inc byte ptr [ebp+FFFFFCCC]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402748(C)
|
:00402764 33C0                    xor eax, eax
:00402766 8A85CCFCFFFF            mov al, byte ptr [ebp+FFFFFCCC]
:0040276C C68405E4FCFFFF04        mov byte ptr [ebp+eax-0000031C], 04
:00402774 FE85CCFCFFFF            inc byte ptr [ebp+FFFFFCCC]
:0040277A 33C0                    xor eax, eax
:0040277C 8A85CCFCFFFF            mov al, byte ptr [ebp+FFFFFCCC]
:00402782 C68405E4FCFFFF05        mov byte ptr [ebp+eax-0000031C], 05
:0040278A FE85CCFCFFFF            inc byte ptr [ebp+FFFFFCCC]
:00402790 33C0                    xor eax, eax
:00402792 8A85CCFCFFFF            mov al, byte ptr [ebp+FFFFFCCC]
:00402798 C68405E4FCFFFFFF        mov byte ptr [ebp+eax-0000031C], FF
:004027A0 C685D0FCFFFF00          mov byte ptr [ebp+FFFFFCD0], 00
:004027A7 E906000000              jmp 004027B2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004027F6(U)
|
:004027AC FE85D0FCFFFF            inc byte ptr [ebp+FFFFFCD0]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004027A7(U)
|
:004027B2 33C0                    xor eax, eax
:004027B4 8A85D0FCFFFF            mov al, byte ptr [ebp+FFFFFCD0]
:004027BA 33C9                    xor ecx, ecx
:004027BC 8A8C05E4FCFFFF          mov cl, byte ptr [ebp+eax-0000031C]
:004027C3 81F9FF000000            cmp ecx, 000000FF
:004027C9 0F842C000000            je 004027FB
:004027CF 33C0                    xor eax, eax
:004027D1 8A85D0FCFFFF            mov al, byte ptr [ebp+FFFFFCD0]
:004027D7 33C9                    xor ecx, ecx
:004027D9 8A8C05E4FCFFFF          mov cl, byte ptr [ebp+eax-0000031C]
:004027E0 8B048D78D14400          mov eax, dword ptr [4*ecx+0044D178]
:004027E7 33C9                    xor ecx, ecx
:004027E9 8A8DD0FCFFFF            mov cl, byte ptr [ebp+FFFFFCD0]
:004027EF 89848D1CFFFFFF          mov dword ptr [ebp+4*ecx-000000E4], eax
:004027F6 E9B1FFFFFF              jmp 004027AC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004027C9(C)
|
:004027FB 33C0                    xor eax, eax
:004027FD 8A85D0FCFFFF            mov al, byte ptr [ebp+FFFFFCD0]
:00402803 C784851CFFFFFF00000000  mov dword ptr [ebp+4*eax-000000E4], 00000000
:0040280E C685BCFCFFFF00          mov byte ptr [ebp+FFFFFCBC], 00
:00402815 8B8578FCFFFF            mov eax, dword ptr [ebp+FFFFFC78]
:0040281B 8A4006                  mov al, byte ptr [eax+06]
:0040281E 50                      push eax
:0040281F 8B8578FCFFFF            mov eax, dword ptr [ebp+FFFFFC78]
:00402825 8A4005                  mov al, byte ptr [eax+05]
:00402828 50                      push eax
:00402829 B900FB4600              mov ecx, 0046FB00
:0040282E E80EC00300              call 0043E841

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402DCA(U)
|
:00402833 6880000000              push 00000080
:00402838 8B8D78FCFFFF            mov ecx, dword ptr [ebp+FFFFFC78]
:0040283E E81D6B0000              call 00409360
:00402843 85C0                    test eax, eax
:00402845 0F8584050000            jne 00402DCF
:0040284B 33C0                    xor eax, eax
:0040284D 8A85BCFCFFFF            mov al, byte ptr [ebp+FFFFFCBC]
:00402853 3DFF000000              cmp eax, 000000FF
:00402858 0F8471050000            je 00402DCF
:0040285E 6A00                    push 00000000
:00402860 6A00                    push 00000000
:00402862 6A00                    push 00000000
:00402864 8D851CFFFFFF            lea eax, dword ptr [ebp+FFFFFF1C]
:0040286A 50                      push eax
:0040286B B900FB4600              mov ecx, 0046FB00
:00402870 E8F2C00300              call 0043E967
:00402875 8885BCFCFFFF            mov byte ptr [ebp+FFFFFCBC], al
:0040287B 33C0                    xor eax, eax
:0040287D 8A85BCFCFFFF            mov al, byte ptr [ebp+FFFFFCBC]
:00402883 3DFF000000              cmp eax, 000000FF
:00402888 0F8432050000            je 00402DC0
:0040288E 33C0                    xor eax, eax
:00402890 8A85BCFCFFFF            mov al, byte ptr [ebp+FFFFFCBC]
:00402896 33C9                    xor ecx, ecx
:00402898 8A8C05E4FCFFFF          mov cl, byte ptr [ebp+eax-0000031C]
:0040289F 898D74FCFFFF            mov dword ptr [ebp+FFFFFC74], ecx
:004028A5 E999040000              jmp 00402D43
:004028AA 8B8D78FCFFFF            mov ecx, dword ptr [ebp+FFFFFC78]
:004028B0 E8B9B00100              call 0041D96E
:004028B5 E9D1040000              jmp 00402D8B
:004028BA 8D853CFFFFFF            lea eax, dword ptr [ebp+FFFFFF3C]
:004028C0 89857CFCFFFF            mov dword ptr [ebp+FFFFFC7C], eax
:004028C6 C685E0FCFFFF00          mov byte ptr [ebp+FFFFFCE0], 00
:004028CD 8B8578FCFFFF            mov eax, dword ptr [ebp+FFFFFC78]
:004028D3 33C9                    xor ecx, ecx
:004028D5 8A4816                  mov cl, byte ptr [eax+16]
:004028D8 F6C104                  test cl, 04
:004028DB 0F8414000000            je 004028F5

* Possible StringData Ref from Data Obj ->"ԲִС"
                                  |
:004028E1 6810DD4400              push 0044DD10
:004028E6 6A00                    push 00000000
:004028E8 E848660300              call 00438F35
:004028ED 83C408                  add esp, 00000008
:004028F0 E996040000              jmp 00402D8B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004028DB(C)
|
:004028F5 8D85FCFCFFFF            lea eax, dword ptr [ebp+FFFFFCFC]
:004028FB 8985B8FCFFFF            mov dword ptr [ebp+FFFFFCB8], eax
:00402901 C685C8FCFFFF00          mov byte ptr [ebp+FFFFFCC8], 00
:00402908 E906000000              jmp 00402913

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402A83(U)
|
:0040290D FE85C8FCFFFF            inc byte ptr [ebp+FFFFFCC8]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402908(U)
|
:00402913 33C0                    xor eax, eax
:00402915 8A85C8FCFFFF            mov al, byte ptr [ebp+FFFFFCC8]
:0040291B 83F830                  cmp eax, 00000030
:0040291E 0F8D64010000            jnl 00402A88
:00402924 33C0                    xor eax, eax
:00402926 8A85C8FCFFFF            mov al, byte ptr [ebp+FFFFFCC8]
:0040292C 8B0485F0D14400          mov eax, dword ptr [4*eax+0044D1F0]
:00402933 50                      push eax
:00402934 E8714A0400              call 004473AA
:00402939 83C404                  add esp, 00000004
:0040293C 8885DCFCFFFF            mov byte ptr [ebp+FFFFFCDC], al
:00402942 33C0                    xor eax, eax
:00402944 8A85C8FCFFFF            mov al, byte ptr [ebp+FFFFFCC8]
:0040294A 8D0480                  lea eax, dword ptr [eax+4*eax]
:0040294D C6844530FDFFFF00        mov byte ptr [ebp+2*eax-000002D0], 00
:00402955 33C0                    xor eax, eax
:00402957 8A85DCFCFFFF            mov al, byte ptr [ebp+FFFFFCDC]
:0040295D 83F804                  cmp eax, 00000004
:00402960 0F8520000000            jne 00402986

* Possible StringData Ref from Data Obj ->" "
                                  |
:00402966 6820DD4400              push 0044DD20
:0040296B 33C0                    xor eax, eax
:0040296D 8A85C8FCFFFF            mov al, byte ptr [ebp+FFFFFCC8]
:00402973 8D0480                  lea eax, dword ptr [eax+4*eax]
:00402976 8D844530FDFFFF          lea eax, dword ptr [ebp+2*eax-000002D0]
:0040297D 50                      push eax
:0040297E E84A4A0400              call 004473CD
:00402983 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402960(C)
|
:00402986 33C0                    xor eax, eax
:00402988 8A85C8FCFFFF            mov al, byte ptr [ebp+FFFFFCC8]
:0040298E 8B0485F0D14400          mov eax, dword ptr [4*eax+0044D1F0]
:00402995 50                      push eax
:00402996 33C0                    xor eax, eax
:00402998 8A85C8FCFFFF            mov al, byte ptr [ebp+FFFFFCC8]
:0040299E 8D0480                  lea eax, dword ptr [eax+4*eax]
:004029A1 8D844530FDFFFF          lea eax, dword ptr [ebp+2*eax-000002D0]
:004029A8 50                      push eax
:004029A9 E8424A0400              call 004473F0
:004029AE 83C408                  add esp, 00000008
:004029B1 33C0                    xor eax, eax
:004029B3 8A85DCFCFFFF            mov al, byte ptr [ebp+FFFFFCDC]
:004029B9 83F804                  cmp eax, 00000004
:004029BC 0F8520000000            jne 004029E2

* Possible StringData Ref from Data Obj ->" "
                                  |
:004029C2 6824DD4400              push 0044DD24
:004029C7 33C0                    xor eax, eax
:004029C9 8A85C8FCFFFF            mov al, byte ptr [ebp+FFFFFCC8]
:004029CF 8D0480                  lea eax, dword ptr [eax+4*eax]
:004029D2 8D844530FDFFFF          lea eax, dword ptr [ebp+2*eax-000002D0]
:004029D9 50                      push eax
:004029DA E8114A0400              call 004473F0
:004029DF 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004029BC(C)
|

* Possible StringData Ref from Data Obj ->" "
                                  |
:004029E2 6828DD4400              push 0044DD28
:004029E7 33C0                    xor eax, eax
:004029E9 8A85C8FCFFFF            mov al, byte ptr [ebp+FFFFFCC8]
:004029EF 8D0480                  lea eax, dword ptr [eax+4*eax]
:004029F2 8D844530FDFFFF          lea eax, dword ptr [ebp+2*eax-000002D0]
:004029F9 50                      push eax
:004029FA E8F1490400              call 004473F0
:004029FF 83C408                  add esp, 00000008
:00402A02 C685C0FCFFFF00          mov byte ptr [ebp+FFFFFCC0], 00
:00402A09 33C0                    xor eax, eax
:00402A0B 8A85C8FCFFFF            mov al, byte ptr [ebp+FFFFFCC8]
:00402A11 33C9                    xor ecx, ecx
:00402A13 8A88E0D24400            mov cl, byte ptr [eax+0044D2E0]
:00402A19 51                      push ecx
:00402A1A 8D85C0FCFFFF            lea eax, dword ptr [ebp+FFFFFCC0]
:00402A20 50                      push eax
:00402A21 E8C4600300              call 00438AEA
:00402A26 83C408                  add esp, 00000008
:00402A29 8D85C0FCFFFF            lea eax, dword ptr [ebp+FFFFFCC0]
:00402A2F 50                      push eax
:00402A30 E875490400              call 004473AA
:00402A35 83C404                  add esp, 00000004
:00402A38 83F801                  cmp eax, 00000001
:00402A3B 0F8520000000            jne 00402A61

* Possible StringData Ref from Data Obj ->" "
                                  |
:00402A41 682CDD4400              push 0044DD2C
:00402A46 33C0                    xor eax, eax
:00402A48 8A85C8FCFFFF            mov al, byte ptr [ebp+FFFFFCC8]
:00402A4E 8D0480                  lea eax, dword ptr [eax+4*eax]
:00402A51 8D844530FDFFFF          lea eax, dword ptr [ebp+2*eax-000002D0]
:00402A58 50                      push eax
:00402A59 E892490400              call 004473F0
:00402A5E 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402A3B(C)
|
:00402A61 8D85C0FCFFFF            lea eax, dword ptr [ebp+FFFFFCC0]
:00402A67 50                      push eax
:00402A68 33C0                    xor eax, eax
:00402A6A 8A85C8FCFFFF            mov al, byte ptr [ebp+FFFFFCC8]
:00402A70 8D0480                  lea eax, dword ptr [eax+4*eax]
:00402A73 8D844530FDFFFF          lea eax, dword ptr [ebp+2*eax-000002D0]
:00402A7A 50                      push eax
:00402A7B E870490400              call 004473F0
:00402A80 83C408                  add esp, 00000008
:00402A83 E985FEFFFF              jmp 0040290D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040291E(C)
|
:00402A88 C685C8FCFFFF00          mov byte ptr [ebp+FFFFFCC8], 00
:00402A8F E906000000              jmp 00402A9A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402BC6(U)
|
:00402A94 FE85C8FCFFFF            inc byte ptr [ebp+FFFFFCC8]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402A8F(U)
|
:00402A9A 33C0                    xor eax, eax
:00402A9C 8A85C8FCFFFF            mov al, byte ptr [ebp+FFFFFCC8]
:00402AA2 83F830                  cmp eax, 00000030
:00402AA5 0F8D20010000            jnl 00402BCB
:00402AAB 33C0                    xor eax, eax
:00402AAD 8A85ECFCFFFF            mov al, byte ptr [ebp+FFFFFCEC]
:00402AB3 33C9                    xor ecx, ecx
:00402AB5 8A8DC8FCFFFF            mov cl, byte ptr [ebp+FFFFFCC8]
:00402ABB 8D0C89                  lea ecx, dword ptr [ecx+4*ecx]
:00402ABE 33D2                    xor edx, edx
:00402AC0 8A94C818D34400          mov dl, byte ptr [eax+8*ecx+0044D318]
:00402AC7 85D2                    test edx, edx
:00402AC9 0F84EB000000            je 00402BBA
:00402ACF 8B8578FCFFFF            mov eax, dword ptr [ebp+FFFFFC78]
:00402AD5 8B00                    mov eax, dword ptr [eax]
:00402AD7 8D0440                  lea eax, dword ptr [eax+2*eax]
:00402ADA 03C0                    add eax, eax
:00402ADC 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:00402AE3 E898670000              call 00409280
:00402AE8 33C9                    xor ecx, ecx
:00402AEA 8AC8                    mov cl, al
:00402AEC 33C0                    xor eax, eax
:00402AEE 8A85ECFCFFFF            mov al, byte ptr [ebp+FFFFFCEC]
:00402AF4 33D2                    xor edx, edx
:00402AF6 8A95C8FCFFFF            mov dl, byte ptr [ebp+FFFFFCC8]
:00402AFC 8D1492                  lea edx, dword ptr [edx+4*edx]
:00402AFF 33DB                    xor ebx, ebx
:00402B01 8A9CD018D34400          mov bl, byte ptr [eax+8*edx+0044D318]
:00402B08 3BCB                    cmp ecx, ebx
:00402B0A 0F8CAA000000            jl 00402BBA
:00402B10 33C0                    xor eax, eax
:00402B12 8A85C8FCFFFF            mov al, byte ptr [ebp+FFFFFCC8]
:00402B18 33C9                    xor ecx, ecx
:00402B1A 8A88E0D24400            mov cl, byte ptr [eax+0044D2E0]
:00402B20 8B8578FCFFFF            mov eax, dword ptr [ebp+FFFFFC78]
:00402B26 33D2                    xor edx, edx
:00402B28 8A5013                  mov dl, byte ptr [eax+13]
:00402B2B 3BCA                    cmp ecx, edx
:00402B2D 0F8F28000000            jg 00402B5B
:00402B33 33C0                    xor eax, eax
:00402B35 8A85C8FCFFFF            mov al, byte ptr [ebp+FFFFFCC8]
:00402B3B 83F806                  cmp eax, 00000006
:00402B3E 0F8D2B000000            jnl 00402B6F
:00402B44 B998FC4600              mov ecx, 0046FC98
:00402B49 E8C7110400              call 00443D15
:00402B4E 33C9                    xor ecx, ecx
:00402B50 8AC8                    mov cl, al
:00402B52 83F902                  cmp ecx, 00000002
:00402B55 0F8514000000            jne 00402B6F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402B2D(C)
|
:00402B5B 8B85B8FCFFFF            mov eax, dword ptr [ebp+FFFFFCB8]
:00402B61 C60001                  mov byte ptr [eax], 01
:00402B64 FF85B8FCFFFF            inc dword ptr [ebp+FFFFFCB8]
:00402B6A E90F000000              jmp 00402B7E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00402B3E(C), :00402B55(C)
|
:00402B6F 8B85B8FCFFFF            mov eax, dword ptr [ebp+FFFFFCB8]
:00402B75 C60000                  mov byte ptr [eax], 00
:00402B78 FF85B8FCFFFF            inc dword ptr [ebp+FFFFFCB8]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402B6A(U)
|
:00402B7E 33C0                    xor eax, eax
:00402B80 8A85C8FCFFFF            mov al, byte ptr [ebp+FFFFFCC8]
:00402B86 8D0480                  lea eax, dword ptr [eax+4*eax]
:00402B89 8D844530FDFFFF          lea eax, dword ptr [ebp+2*eax-000002D0]
:00402B90 8B8D7CFCFFFF            mov ecx, dword ptr [ebp+FFFFFC7C]
:00402B96 8901                    mov dword ptr [ecx], eax
:00402B98 83857CFCFFFF04          add dword ptr [ebp+FFFFFC7C], 00000004
:00402B9F 8A85C8FCFFFF            mov al, byte ptr [ebp+FFFFFCC8]
:00402BA5 33C9                    xor ecx, ecx
:00402BA7 8A8DE0FCFFFF            mov cl, byte ptr [ebp+FFFFFCE0]
:00402BAD 88840D80FCFFFF          mov byte ptr [ebp+ecx-00000380], al
:00402BB4 FE85E0FCFFFF            inc byte ptr [ebp+FFFFFCE0]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00402AC9(C), :00402B0A(C)
|
:00402BBA 8B857CFCFFFF            mov eax, dword ptr [ebp+FFFFFC7C]
:00402BC0 C70000000000            mov dword ptr [eax], 00000000
:00402BC6 E9C9FEFFFF              jmp 00402A94

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402AA5(C)
|
:00402BCB 33C0                    xor eax, eax
:00402BCD 8A85E0FCFFFF            mov al, byte ptr [ebp+FFFFFCE0]
:00402BD3 85C0                    test eax, eax
:00402BD5 0F8EA5000000            jle 00402C80
:00402BDB C685D8FCFFFF00          mov byte ptr [ebp+FFFFFCD8], 00
:00402BE2 C68538FFFFFF00          mov byte ptr [ebp+FFFFFF38], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402C76(U)
|
:00402BE9 6880000000              push 00000080
:00402BEE 8B8D78FCFFFF            mov ecx, dword ptr [ebp+FFFFFC78]
:00402BF4 E867670000              call 00409360
:00402BF9 85C0                    test eax, eax
:00402BFB 0F857A000000            jne 00402C7B
:00402C01 33C0                    xor eax, eax
:00402C03 8A85D8FCFFFF            mov al, byte ptr [ebp+FFFFFCD8]
:00402C09 3DFF000000              cmp eax, 000000FF
:00402C0E 0F8467000000            je 00402C7B
:00402C14 8D8538FFFFFF            lea eax, dword ptr [ebp+FFFFFF38]
:00402C1A 50                      push eax
:00402C1B 8D85FCFCFFFF            lea eax, dword ptr [ebp+FFFFFCFC]
:00402C21 50                      push eax
:00402C22 68A0000000              push 000000A0
:00402C27 8D853CFFFFFF            lea eax, dword ptr [ebp+FFFFFF3C]
:00402C2D 50                      push eax
:00402C2E B900FB4600              mov ecx, 0046FB00
:00402C33 E82FBD0300              call 0043E967
:00402C38 8885D8FCFFFF            mov byte ptr [ebp+FFFFFCD8], al
:00402C3E B900FB4600              mov ecx, 0046FB00
:00402C43 E890BD0300              call 0043E9D8
:00402C48 33C0                    xor eax, eax
:00402C4A 8A85D8FCFFFF            mov al, byte ptr [ebp+FFFFFCD8]
:00402C50 3DFF000000              cmp eax, 000000FF
:00402C55 0F841B000000            je 00402C76
:00402C5B 33C0                    xor eax, eax
:00402C5D 8A85D8FCFFFF            mov al, byte ptr [ebp+FFFFFCD8]
:00402C63 8B840580FCFFFF          mov eax, dword ptr [ebp+eax-00000380]
:00402C6A 50                      push eax
:00402C6B 8B8D78FCFFFF            mov ecx, dword ptr [ebp+FFFFFC78]
:00402C71 E8B5510000              call 00407E2B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402C55(C)
|
:00402C76 E96EFFFFFF              jmp 00402BE9

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00402BFB(C), :00402C0E(C)
|
:00402C7B E90F000000              jmp 00402C8F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402BD5(C)
|

* Possible StringData Ref from Data Obj ->"ûпִеĲԡ"
                                  |
:00402C80 6830DD4400              push 0044DD30
:00402C85 6A00                    push 00000000
:00402C87 E8A9620300              call 00438F35
:00402C8C 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402C7B(U)
|
:00402C8F E9F7000000              jmp 00402D8B
:00402C94 8B8D78FCFFFF            mov ecx, dword ptr [ebp+FFFFFC78]
:00402C9A E84A040000              call 004030E9
:00402C9F E9E7000000              jmp 00402D8B
:00402CA4 6880000000              push 00000080
:00402CA9 8B8D78FCFFFF            mov ecx, dword ptr [ebp+FFFFFC78]
:00402CAF E810B10200              call 0042DDC4
:00402CB4 E9D2000000              jmp 00402D8B
:00402CB9 6A00                    push 00000000
:00402CBB B9B0C44600              mov ecx, 0046C4B0
:00402CC0 E816CC0200              call 0042F8DB
:00402CC5 6880000000              push 00000080
:00402CCA 8B8D78FCFFFF            mov ecx, dword ptr [ebp+FFFFFC78]
:00402CD0 E8EFB00200              call 0042DDC4
:00402CD5 E9B1000000              jmp 00402D8B

* Possible StringData Ref from Data Obj ->"Ϯ"
                                  |
:00402CDA 6848DD4400              push 0044DD48
:00402CDF 6A02                    push 00000002
:00402CE1 E84F620300              call 00438F35
:00402CE6 83C408                  add esp, 00000008
:00402CE9 8985F4FCFFFF            mov dword ptr [ebp+FFFFFCF4], eax
:00402CEF 83BDF4FCFFFF00          cmp dword ptr [ebp+FFFFFCF4], 00000000
:00402CF6 0F8418000000            je 00402D14
:00402CFC 6A20                    push 00000020
:00402CFE 8B8D78FCFFFF            mov ecx, dword ptr [ebp+FFFFFC78]
:00402D04 E8BBB00200              call 0042DDC4
:00402D09 8B8D78FCFFFF            mov ecx, dword ptr [ebp+FFFFFC78]
:00402D0F E8AB910200              call 0042BEBF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402CF6(C)
|
:00402D14 E972000000              jmp 00402D8B
:00402D19 6A00                    push 00000000
:00402D1B 8B8578FCFFFF            mov eax, dword ptr [ebp+FFFFFC78]
:00402D21 8B00                    mov eax, dword ptr [eax]
:00402D23 8D0440                  lea eax, dword ptr [eax+2*eax]
:00402D26 03C0                    add eax, eax
:00402D28 8D04C0                  lea eax, dword ptr [eax+8*eax]
:00402D2B 05E8564500              add eax, 004556E8
:00402D30 50                      push eax
:00402D31 E82EC20300              call 0043EF64
:00402D36 83C408                  add esp, 00000008
:00402D39 E94D000000              jmp 00402D8B
:00402D3E E948000000              jmp 00402D8B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004028A5(U)
|
:00402D43 FF8D74FCFFFF            dec dword ptr [ebp+FFFFFC74]
:00402D49 83BD74FCFFFF09          cmp dword ptr [ebp+FFFFFC74], 00000009
:00402D50 0F8735000000            ja 00402D8B
:00402D56 8B8574FCFFFF            mov eax, dword ptr [ebp+FFFFFC74]
:00402D5C FF2485632D4000          jmp dword ptr [4*eax+00402D63]

:00402D63 AA284000                DWORD 004028AA
:00402D67 BA284000                DWORD 004028BA
:00402D6B 942C4000                DWORD 00402C94
:00402D6F 192D4000                DWORD 00402D19
:00402D73 A42C4000                DWORD 00402CA4
:00402D77 B92C4000                DWORD 00402CB9
:00402D7B B92C4000                DWORD 00402CB9
:00402D7F B92C4000                DWORD 00402CB9
:00402D83 AA284000                DWORD 004028AA
:00402D87 DA2C4000                DWORD 00402CDA



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004028B5(U), :004028F0(U), :00402C8F(U), :00402C9F(U), :00402CB4(U)
|:00402CD5(U), :00402D14(U), :00402D39(U), :00402D3E(U), :00402D50(C)
|
:00402D8B 6880000000              push 00000080
:00402D90 8B8D78FCFFFF            mov ecx, dword ptr [ebp+FFFFFC78]
:00402D96 E8C5650000              call 00409360
:00402D9B 85C0                    test eax, eax
:00402D9D 0F841D000000            je 00402DC0
:00402DA3 6A18                    push 00000018
:00402DA5 6A27                    push 00000027
:00402DA7 6A00                    push 00000000
:00402DA9 6A00                    push 00000000
:00402DAB B900FB4600              mov ecx, 0046FB00
:00402DB0 E8787D0300              call 0043AB2D
:00402DB5 8B8D78FCFFFF            mov ecx, dword ptr [ebp+FFFFFC78]
:00402DBB E806970200              call 0042C4C6

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00402888(C), :00402D9D(C)
|
:00402DC0 B900FB4600              mov ecx, 0046FB00
:00402DC5 E80EBC0300              call 0043E9D8
:00402DCA E964FAFFFF              jmp 00402833

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00402845(C), :00402858(C)
|
:00402DCF 33C0                    xor eax, eax
:00402DD1 8A85BCFCFFFF            mov al, byte ptr [ebp+FFFFFCBC]
:00402DD7 3DFF000000              cmp eax, 000000FF
:00402DDC 0F8521000000            jne 00402E03
:00402DE2 6A40                    push 00000040
:00402DE4 8B8D78FCFFFF            mov ecx, dword ptr [ebp+FFFFFC78]
:00402DEA E841650000              call 00409330
:00402DEF 6A00                    push 00000000
:00402DF1 8D85D4FCFFFF            lea eax, dword ptr [ebp+FFFFFCD4]
:00402DF7 50                      push eax
:00402DF8 8B8D78FCFFFF            mov ecx, dword ptr [ebp+FFFFFC78]
:00402DFE E8ED640000              call 004092F0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402DDC(C)
|
:00402E03 33C0                    xor eax, eax
:00402E05 8A85BCFCFFFF            mov al, byte ptr [ebp+FFFFFCBC]
:00402E0B 3DFF000000              cmp eax, 000000FF
:00402E10 0F8422000000            je 00402E38
:00402E16 6880000000              push 00000080
:00402E1B 8B8D78FCFFFF            mov ecx, dword ptr [ebp+FFFFFC78]
:00402E21 E83A650000              call 00409360
:00402E26 85C0                    test eax, eax
:00402E28 0F840A000000            je 00402E38
:00402E2E B801000000              mov eax, 00000001
:00402E33 E902000000              jmp 00402E3A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00402E10(C), :00402E28(C)
|
:00402E38 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402E33(U)
|
:00402E3A E900000000              jmp 00402E3F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00402608(U), :00402E3A(U)
|
:00402E3F 5F                      pop edi
:00402E40 5E                      pop esi
:00402E41 5B                      pop ebx
:00402E42 C9                      leave
:00402E43 C3                      ret



* Referenced by a CALL at Address:
|:00402657   
|
:00402E44 55                      push ebp
:00402E45 8BEC                    mov ebp, esp
:00402E47 83EC0C                  sub esp, 0000000C
:00402E4A 53                      push ebx
:00402E4B 56                      push esi
:00402E4C 57                      push edi
:00402E4D 33C0                    xor eax, eax
:00402E4F 8A4508                  mov al, byte ptr [ebp+08]
:00402E52 8BC8                    mov ecx, eax
:00402E54 8D0440                  lea eax, dword ptr [eax+2*eax]
:00402E57 C1E003                  shl eax, 03
:00402E5A 2BC1                    sub eax, ecx
:00402E5C 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00402E62 E869650000              call 004093D0
:00402E67 33C9                    xor ecx, ecx
:00402E69 8AC8                    mov cl, al
:00402E6B 83F907                  cmp ecx, 00000007
:00402E6E 0F8419000000            je 00402E8D
:00402E74 33C0                    xor eax, eax
:00402E76 A0A4354500              mov al, byte ptr [004535A4]
:00402E7B A804                    test al, 04
:00402E7D 0F850A000000            jne 00402E8D
:00402E83 A0BCA64600              mov al, byte ptr [0046A6BC]
:00402E88 E972000000              jmp 00402EFF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00402E6E(C), :00402E7D(C)
|
:00402E8D C745F401000000          mov [ebp-0C], 00000001
:00402E94 33C0                    xor eax, eax
:00402E96 8A4508                  mov al, byte ptr [ebp+08]
:00402E99 8BC8                    mov ecx, eax
:00402E9B 8D0440                  lea eax, dword ptr [eax+2*eax]
:00402E9E C1E003                  shl eax, 03
:00402EA1 2BC1                    sub eax, ecx
:00402EA3 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00402EA9 E852630000              call 00409200
:00402EAE 668B00                  mov ax, word ptr [eax]
:00402EB1 668945FC                mov word ptr [ebp-04], ax
:00402EB5 6A00                    push 00000000
:00402EB7 8B4510                  mov eax, dword ptr [ebp+10]
:00402EBA 50                      push eax
:00402EBB 8B450C                  mov eax, dword ptr [ebp+0C]
:00402EBE 50                      push eax
:00402EBF 8D45FC                  lea eax, dword ptr [ebp-04]
:00402EC2 50                      push eax
:00402EC3 33C0                    xor eax, eax
:00402EC5 8A4508                  mov al, byte ptr [ebp+08]
:00402EC8 8BC8                    mov ecx, eax
:00402ECA 8D0440                  lea eax, dword ptr [eax+2*eax]
:00402ECD C1E003                  shl eax, 03
:00402ED0 2BC1                    sub eax, ecx
:00402ED2 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00402ED8 E8F4680100              call 004197D1
:00402EDD 8845F8                  mov byte ptr [ebp-08], al
:00402EE0 33C0                    xor eax, eax
:00402EE2 8A45F8                  mov al, byte ptr [ebp-08]
:00402EE5 3DFF000000              cmp eax, 000000FF
:00402EEA 0F8507000000            jne 00402EF7
:00402EF0 C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402EEA(C)
|
:00402EF7 8A45F4                  mov al, byte ptr [ebp-0C]
:00402EFA E900000000              jmp 00402EFF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00402E88(U), :00402EFA(U)
|
:00402EFF 5F                      pop edi
:00402F00 5E                      pop esi
:00402F01 5B                      pop ebx
:00402F02 C9                      leave
:00402F03 C3                      ret



* Referenced by a CALL at Addresses:
|:004031CB   , :0040CF63   
|
:00402F04 55                      push ebp
:00402F05 8BEC                    mov ebp, esp
:00402F07 83EC08                  sub esp, 00000008
:00402F0A 53                      push ebx
:00402F0B 56                      push esi
:00402F0C 57                      push edi
:00402F0D 8D4DF8                  lea ecx, dword ptr [ebp-08]
:00402F10 E8DB640000              call 004093F0
:00402F15 6A04                    push 00000004
:00402F17 6A00                    push 00000000
:00402F19 6A00                    push 00000000
:00402F1B B968F94600              mov ecx, 0046F968
:00402F20 E8FB470400              call 00447720
:00402F25 8945FC                  mov dword ptr [ebp-04], eax
:00402F28 A1442F4500              mov eax, dword ptr [00452F44]
:00402F2D 50                      push eax

* Possible StringData Ref from Data Obj ->"C:ITEM.E2"
                                  |
:00402F2E 68482C4500              push 00452C48
:00402F33 8D4DF8                  lea ecx, dword ptr [ebp-08]
:00402F36 E87C460400              call 004475B7
:00402F3B 6800F30000              push 0000F300
:00402F40 8B45FC                  mov eax, dword ptr [ebp-04]
:00402F43 50                      push eax
:00402F44 6A00                    push 00000000
:00402F46 8D4DF8                  lea ecx, dword ptr [ebp-08]
:00402F49 E802650000              call 00409450
:00402F4E 8D4DF8                  lea ecx, dword ptr [ebp-08]
:00402F51 E8CA640000              call 00409420
:00402F56 E900000000              jmp 00402F5B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402F56(U)
|
:00402F5B 5F                      pop edi
:00402F5C 5E                      pop esi
:00402F5D 5B                      pop ebx
:00402F5E C9                      leave
:00402F5F C3                      ret



* Referenced by a CALL at Addresses:
|:0040332C   , :0040CF70   
|
:00402F60 55                      push ebp
:00402F61 8BEC                    mov ebp, esp
:00402F63 83EC14                  sub esp, 00000014
:00402F66 53                      push ebx
:00402F67 56                      push esi
:00402F68 57                      push edi
:00402F69 C745FC00000000          mov [ebp-04], 00000000
:00402F70 E903000000              jmp 00402F78

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402FDF(U)
|
:00402F75 FF45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402F70(U)
|
:00402F78 8B450C                  mov eax, dword ptr [ebp+0C]
:00402F7B 3945FC                  cmp dword ptr [ebp-04], eax
:00402F7E 0F8360000000            jnb 00402FE4
:00402F84 B905000000              mov ecx, 00000005
:00402F89 8B45FC                  mov eax, dword ptr [ebp-04]
:00402F8C 2BD2                    sub edx, edx
:00402F8E F7F1                    div ecx
:00402F90 8955F0                  mov dword ptr [ebp-10], edx
:00402F93 B905000000              mov ecx, 00000005
:00402F98 8B45FC                  mov eax, dword ptr [ebp-04]
:00402F9B 2BD2                    sub edx, edx
:00402F9D F7F1                    div ecx
:00402F9F 8945EC                  mov dword ptr [ebp-14], eax
:00402FA2 8B45F0                  mov eax, dword ptr [ebp-10]
:00402FA5 C1E004                  shl eax, 04
:00402FA8 8D0440                  lea eax, dword ptr [eax+2*eax]
:00402FAB 05C8000000              add eax, 000000C8
:00402FB0 8945F8                  mov dword ptr [ebp-08], eax
:00402FB3 8B45EC                  mov eax, dword ptr [ebp-14]
:00402FB6 C1E004                  shl eax, 04
:00402FB9 8D0440                  lea eax, dword ptr [eax+2*eax]
:00402FBC 0590000000              add eax, 00000090
:00402FC1 8945F4                  mov dword ptr [ebp-0C], eax
:00402FC4 8B4508                  mov eax, dword ptr [ebp+08]
:00402FC7 33C9                    xor ecx, ecx
:00402FC9 8A08                    mov cl, byte ptr [eax]
:00402FCB 51                      push ecx
:00402FCC 8B45F4                  mov eax, dword ptr [ebp-0C]
:00402FCF 50                      push eax
:00402FD0 8B45F8                  mov eax, dword ptr [ebp-08]
:00402FD3 50                      push eax
:00402FD4 E815000000              call 00402FEE
:00402FD9 83C40C                  add esp, 0000000C
:00402FDC FF4508                  inc [ebp+08]
:00402FDF E991FFFFFF              jmp 00402F75

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402F7E(C)
|
:00402FE4 E900000000              jmp 00402FE9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402FE4(U)
|
:00402FE9 5F                      pop edi
:00402FEA 5E                      pop esi
:00402FEB 5B                      pop ebx
:00402FEC C9                      leave
:00402FED C3                      ret



* Referenced by a CALL at Address:
|:00402FD4   
|
:00402FEE 55                      push ebp
:00402FEF 8BEC                    mov ebp, esp
:00402FF1 83EC04                  sub esp, 00000004
:00402FF4 53                      push ebx
:00402FF5 56                      push esi
:00402FF6 57                      push edi
:00402FF7 6A04                    push 00000004
:00402FF9 6A00                    push 00000000
:00402FFB 8B4510                  mov eax, dword ptr [ebp+10]
:00402FFE 50                      push eax
:00402FFF E836910000              call 0040C13A
:00403004 83C404                  add esp, 00000004
:00403007 33C9                    xor ecx, ecx
:00403009 8AC8                    mov cl, al
:0040300B 8D0CC9                  lea ecx, dword ptr [ecx+8*ecx]
:0040300E C1E108                  shl ecx, 08
:00403011 51                      push ecx
:00403012 B968F94600              mov ecx, 0046F968
:00403017 E804470400              call 00447720
:0040301C 8945FC                  mov dword ptr [ebp-04], eax
:0040301F 8B45FC                  mov eax, dword ptr [ebp-04]
:00403022 50                      push eax
:00403023 8B450C                  mov eax, dword ptr [ebp+0C]
:00403026 50                      push eax
:00403027 8B4508                  mov eax, dword ptr [ebp+08]
:0040302A 50                      push eax
:0040302B E810100300              call 00434040
:00403030 83C40C                  add esp, 0000000C
:00403033 E900000000              jmp 00403038

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403033(U)
|
:00403038 5F                      pop edi
:00403039 5E                      pop esi
:0040303A 5B                      pop ebx
:0040303B C9                      leave
:0040303C C3                      ret



* Referenced by a CALL at Addresses:
|:004033A8   , :0040CFAE   
|
:0040303D 55                      push ebp
:0040303E 8BEC                    mov ebp, esp
:00403040 83EC0C                  sub esp, 0000000C
:00403043 53                      push ebx
:00403044 56                      push esi
:00403045 57                      push edi
:00403046 B988534500              mov ecx, 00455388
:0040304B E8A2ECFFFF              call 00401CF2
:00403050 B988534500              mov ecx, 00455388
:00403055 E846640000              call 004094A0
:0040305A 8945FC                  mov dword ptr [ebp-04], eax
:0040305D B988534500              mov ecx, 00455388
:00403062 E859640000              call 004094C0
:00403067 8945F8                  mov dword ptr [ebp-08], eax
:0040306A 817DFCC8000000          cmp dword ptr [ebp-04], 000000C8
:00403071 0F8C27000000            jl 0040309E
:00403077 817DFCB8010000          cmp dword ptr [ebp-04], 000001B8
:0040307E 0F8D1A000000            jnl 0040309E
:00403084 817DF890000000          cmp dword ptr [ebp-08], 00000090
:0040308B 0F8C0D000000            jl 0040309E
:00403091 817DF820010000          cmp dword ptr [ebp-08], 00000120
:00403098 0F8C0C000000            jl 004030AA

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00403071(C), :0040307E(C), :0040308B(C)
|
:0040309E C745F4FF000000          mov [ebp-0C], 000000FF
:004030A5 E932000000              jmp 004030DC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403098(C)
|
:004030AA 8B45FC                  mov eax, dword ptr [ebp-04]
:004030AD B930000000              mov ecx, 00000030
:004030B2 2DC8000000              sub eax, 000000C8
:004030B7 99                      cdq
:004030B8 F7F9                    idiv ecx
:004030BA 8945FC                  mov dword ptr [ebp-04], eax
:004030BD 8B45F8                  mov eax, dword ptr [ebp-08]
:004030C0 B930000000              mov ecx, 00000030
:004030C5 2D90000000              sub eax, 00000090
:004030CA 99                      cdq
:004030CB F7F9                    idiv ecx
:004030CD 8945F8                  mov dword ptr [ebp-08], eax
:004030D0 8B45F8                  mov eax, dword ptr [ebp-08]
:004030D3 8D0480                  lea eax, dword ptr [eax+4*eax]
:004030D6 0345FC                  add eax, dword ptr [ebp-04]
:004030D9 8945F4                  mov dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004030A5(U)
|
:004030DC 8B45F4                  mov eax, dword ptr [ebp-0C]
:004030DF E900000000              jmp 004030E4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004030DF(U)
|
:004030E4 5F                      pop edi
:004030E5 5E                      pop esi
:004030E6 5B                      pop ebx
:004030E7 C9                      leave
:004030E8 C3                      ret



* Referenced by a CALL at Address:
|:00402C9A   
|
:004030E9 55                      push ebp
:004030EA 8BEC                    mov ebp, esp
:004030EC 81ECC0000000            sub esp, 000000C0
:004030F2 53                      push ebx
:004030F3 56                      push esi
:004030F4 57                      push edi
:004030F5 898D44FFFFFF            mov dword ptr [ebp+FFFFFF44], ecx
:004030FB C6458000                mov [ebp-80], 00
:004030FF C7857CFFFFFF00000000    mov dword ptr [ebp+FFFFFF7C], 00000000
:00403109 E906000000              jmp 00403114

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040319E(U)
|
:0040310E FF857CFFFFFF            inc dword ptr [ebp+FFFFFF7C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403109(U)
|
:00403114 83BD7CFFFFFF0F          cmp dword ptr [ebp+FFFFFF7C], 0000000F
:0040311B 0F8382000000            jnb 004031A3
:00403121 8B857CFFFFFF            mov eax, dword ptr [ebp+FFFFFF7C]
:00403127 50                      push eax
:00403128 8B8544FFFFFF            mov eax, dword ptr [ebp+FFFFFF44]
:0040312E 8B00                    mov eax, dword ptr [eax]
:00403130 8D0440                  lea eax, dword ptr [eax+2*eax]
:00403133 03C0                    add eax, eax
:00403135 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:0040313C E8BF630000              call 00409500
:00403141 888568FFFFFF            mov byte ptr [ebp+FFFFFF68], al
:00403147 33C0                    xor eax, eax
:00403149 8A8568FFFFFF            mov al, byte ptr [ebp+FFFFFF68]
:0040314F 3DFF000000              cmp eax, 000000FF
:00403154 0F8437000000            je 00403191
:0040315A 33C0                    xor eax, eax
:0040315C 8A8568FFFFFF            mov al, byte ptr [ebp+FFFFFF68]
:00403162 8BC8                    mov ecx, eax
:00403164 C1E004                  shl eax, 04
:00403167 8D8C0818AA4600          lea ecx, dword ptr [eax+ecx+0046AA18]
:0040316E E8ED630000              call 00409560
:00403173 33C9                    xor ecx, ecx
:00403175 8A4D80                  mov cl, byte ptr [ebp-80]
:00403178 89448D84                mov dword ptr [ebp+4*ecx-7C], eax
:0040317C 8A8568FFFFFF            mov al, byte ptr [ebp+FFFFFF68]
:00403182 33C9                    xor ecx, ecx
:00403184 8A4D80                  mov cl, byte ptr [ebp-80]
:00403187 88840D6CFFFFFF          mov byte ptr [ebp+ecx-00000094], al
:0040318E FE4580                  inc [ebp-80]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403154(C)
|
:00403191 33C0                    xor eax, eax
:00403193 8A4580                  mov al, byte ptr [ebp-80]
:00403196 C744858400000000        mov [ebp+4*eax-7C], 00000000
:0040319E E96BFFFFFF              jmp 0040310E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040311B(C)
|
:004031A3 33C0                    xor eax, eax
:004031A5 8A4580                  mov al, byte ptr [ebp-80]
:004031A8 85C0                    test eax, eax
:004031AA 0F8514000000            jne 004031C4

* Possible StringData Ref from Data Obj ->"ûеߡ"
                                  |
:004031B0 6858DD4400              push 0044DD58
:004031B5 6A00                    push 00000000
:004031B7 E8795D0300              call 00438F35
:004031BC 83C408                  add esp, 00000008
:004031BF E992060000              jmp 00403856

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004031AA(C)
|
:004031C4 C68564FFFFFF00          mov byte ptr [ebp+FFFFFF64], 00
:004031CB E834FDFFFF              call 00402F04

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403851(U)
|
:004031D0 33C0                    xor eax, eax
:004031D2 8A8564FFFFFF            mov al, byte ptr [ebp+FFFFFF64]
:004031D8 3DFF000000              cmp eax, 000000FF
:004031DD 0F8473060000            je 00403856
:004031E3 6880000000              push 00000080
:004031E8 8B8D44FFFFFF            mov ecx, dword ptr [ebp+FFFFFF44]
:004031EE E86D610000              call 00409360
:004031F3 85C0                    test eax, eax
:004031F5 0F855B060000            jne 00403856
:004031FB 6A00                    push 00000000
:004031FD 6A00                    push 00000000
:004031FF 6A00                    push 00000000

* Possible Indirect StringData Ref from Data Obj ->"ʹ"
                                  |
:00403201 6890D14400              push 0044D190
:00403206 B900FB4600              mov ecx, 0046FB00
:0040320B E857B70300              call 0043E967
:00403210 888564FFFFFF            mov byte ptr [ebp+FFFFFF64], al
:00403216 33C0                    xor eax, eax
:00403218 8A8564FFFFFF            mov al, byte ptr [ebp+FFFFFF64]
:0040321E 3DFF000000              cmp eax, 000000FF
:00403223 0F850F000000            jne 00403238
:00403229 B900FB4600              mov ecx, 0046FB00
:0040322E E8A5B70300              call 0043E9D8
:00403233 E91E060000              jmp 00403856

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403223(C)
|
:00403238 6A18                    push 00000018
:0040323A 6A27                    push 00000027
:0040323C 6A00                    push 00000000
:0040323E 6A00                    push 00000000
:00403240 B900FB4600              mov ecx, 0046FB00
:00403245 E8E3780300              call 0043AB2D
:0040324A C78560FFFFFFB8000000    mov dword ptr [ebp+FFFFFF60], 000000B8
:00403254 C7855CFFFFFF70000000    mov dword ptr [ebp+FFFFFF5C], 00000070
:0040325E C68558FFFFFF00          mov byte ptr [ebp+FFFFFF58], 00
:00403265 33C0                    xor eax, eax
:00403267 8A8558FFFFFF            mov al, byte ptr [ebp+FFFFFF58]
:0040326D 3DFF000000              cmp eax, 000000FF
:00403272 0F84BD050000            je 00403835
:00403278 6880000000              push 00000080
:0040327D 8B8D44FFFFFF            mov ecx, dword ptr [ebp+FFFFFF44]
:00403283 E8D8600000              call 00409360
:00403288 85C0                    test eax, eax
:0040328A 0F85A5050000            jne 00403835
:00403290 C7854CFFFFFF01000000    mov dword ptr [ebp+FFFFFF4C], 00000001
:0040329A E8F83C0200              call 00426F97
:0040329F 68C0000000              push 000000C0
:004032A4 6810010000              push 00000110
:004032A9 8B855CFFFFFF            mov eax, dword ptr [ebp+FFFFFF5C]
:004032AF 50                      push eax
:004032B0 8B8560FFFFFF            mov eax, dword ptr [ebp+FFFFFF60]
:004032B6 50                      push eax
:004032B7 E8D6710300              call 0043A492
:004032BC 83C410                  add esp, 00000010
:004032BF 6A04                    push 00000004
:004032C1 B910BC4600              mov ecx, 0046BC10
:004032C6 E8B6CB0100              call 0041FE81
:004032CB 8B855CFFFFFF            mov eax, dword ptr [ebp+FFFFFF5C]
:004032D1 83C008                  add eax, 00000008
:004032D4 50                      push eax
:004032D5 BB06000000              mov ebx, 00000006
:004032DA 8B8D44FFFFFF            mov ecx, dword ptr [ebp+FFFFFF44]
:004032E0 E89B620000              call 00409580
:004032E5 50                      push eax
:004032E6 E8BF400400              call 004473AA
:004032EB 83C404                  add esp, 00000004
:004032EE 2BD8                    sub ebx, eax
:004032F0 C1EB01                  shr ebx, 01
:004032F3 83C325                  add ebx, 00000025
:004032F6 53                      push ebx
:004032F7 B910BC4600              mov ecx, 0046BC10
:004032FC E806C90100              call 0041FC07
:00403301 8B8D44FFFFFF            mov ecx, dword ptr [ebp+FFFFFF44]
:00403307 E874620000              call 00409580
:0040330C 50                      push eax

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:0040330D 6868DD4400              push 0044DD68
:00403312 6810BC4600              push 0046BC10
:00403317 E807D80100              call 00420B23
:0040331C 83C40C                  add esp, 0000000C
:0040331F 33C0                    xor eax, eax
:00403321 8A4580                  mov al, byte ptr [ebp-80]
:00403324 50                      push eax
:00403325 8D856CFFFFFF            lea eax, dword ptr [ebp+FFFFFF6C]
:0040332B 50                      push eax
:0040332C E82FFCFFFF              call 00402F60
:00403331 83C408                  add esp, 00000008
:00403334 E87E3C0200              call 00426FB7
:00403339 C6059CDA4400FF          mov byte ptr [0044DA9C], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004034B3(U)
|
:00403340 B988534500              mov ecx, 00455388
:00403345 E832EAFFFF              call 00401D7C
:0040334A 85C0                    test eax, eax
:0040334C 0F8429000000            je 0040337B
:00403352 33C0                    xor eax, eax
:00403354 8A4580                  mov al, byte ptr [ebp-80]
:00403357 48                      dec eax
:00403358 33C9                    xor ecx, ecx
:0040335A 8A8D58FFFFFF            mov cl, byte ptr [ebp+FFFFFF58]
:00403360 3BC1                    cmp eax, ecx
:00403362 0F8D50010000            jnl 004034B8
:00403368 33C0                    xor eax, eax
:0040336A 8A8558FFFFFF            mov al, byte ptr [ebp+FFFFFF58]
:00403370 3DFF000000              cmp eax, 000000FF
:00403375 0F843D010000            je 004034B8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040334C(C)
|
:0040337B B988534500              mov ecx, 00455388
:00403380 E817EAFFFF              call 00401D9C
:00403385 85C0                    test eax, eax
:00403387 0F841B000000            je 004033A8
:0040338D 6A01                    push 00000001
:0040338F B994A64600              mov ecx, 0046A694
:00403394 E88B5C0100              call 00419024
:00403399 C7854CFFFFFF00000000    mov dword ptr [ebp+FFFFFF4C], 00000000
:004033A3 E910010000              jmp 004034B8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403387(C)
|
:004033A8 E890FCFFFF              call 0040303D
:004033AD 888558FFFFFF            mov byte ptr [ebp+FFFFFF58], al
:004033B3 33C0                    xor eax, eax
:004033B5 8A4580                  mov al, byte ptr [ebp-80]
:004033B8 48                      dec eax
:004033B9 33C9                    xor ecx, ecx
:004033BB 8A8D58FFFFFF            mov cl, byte ptr [ebp+FFFFFF58]
:004033C1 3BC1                    cmp eax, ecx
:004033C3 0F8D11000000            jnl 004033DA
:004033C9 E834E3FFFF              call 00401702
:004033CE C6059CDA4400FF          mov byte ptr [0044DA9C], FF
:004033D5 E9D9000000              jmp 004034B3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004033C3(C)
|
:004033DA 33C0                    xor eax, eax
:004033DC 8A8558FFFFFF            mov al, byte ptr [ebp+FFFFFF58]
:004033E2 3DFF000000              cmp eax, 000000FF
:004033E7 0F84C6000000            je 004034B3
:004033ED 33C0                    xor eax, eax
:004033EF 8A8558FFFFFF            mov al, byte ptr [ebp+FFFFFF58]
:004033F5 33C9                    xor ecx, ecx
:004033F7 8A0D9CDA4400            mov cl, byte ptr [0044DA9C]
:004033FD 3BC1                    cmp eax, ecx
:004033FF 0F84AE000000            je 004034B3
:00403405 E8F8E2FFFF              call 00401702
:0040340A 6A00                    push 00000000
:0040340C B910BC4600              mov ecx, 0046BC10
:00403411 E86BCA0100              call 0041FE81
:00403416 6A07                    push 00000007
:00403418 B910BC4600              mov ecx, 0046BC10
:0040341D E8B1C80100              call 0041FCD3
:00403422 6A00                    push 00000000
:00403424 B910BC4600              mov ecx, 0046BC10
:00403429 E8A2C90100              call 0041FDD0
:0040342E 6A0C                    push 0000000C
:00403430 BB16000000              mov ebx, 00000016
:00403435 33C0                    xor eax, eax
:00403437 8A8558FFFFFF            mov al, byte ptr [ebp+FFFFFF58]
:0040343D 33C9                    xor ecx, ecx
:0040343F 8A8C056CFFFFFF          mov cl, byte ptr [ebp+eax-00000094]
:00403446 8BC1                    mov eax, ecx
:00403448 C1E104                  shl ecx, 04
:0040344B 8D8C0118AA4600          lea ecx, dword ptr [ecx+eax+0046AA18]
:00403452 E809610000              call 00409560
:00403457 50                      push eax
:00403458 E84D3F0400              call 004473AA
:0040345D 83C404                  add esp, 00000004
:00403460 2BD8                    sub ebx, eax
:00403462 C1EB01                  shr ebx, 01
:00403465 83C324                  add ebx, 00000024
:00403468 53                      push ebx
:00403469 B910BC4600              mov ecx, 0046BC10
:0040346E E894C70100              call 0041FC07
:00403473 33C0                    xor eax, eax
:00403475 8A8558FFFFFF            mov al, byte ptr [ebp+FFFFFF58]
:0040347B 33C9                    xor ecx, ecx
:0040347D 8A8C056CFFFFFF          mov cl, byte ptr [ebp+eax-00000094]
:00403484 8BC1                    mov eax, ecx
:00403486 C1E104                  shl ecx, 04
:00403489 8D8C0118AA4600          lea ecx, dword ptr [ecx+eax+0046AA18]
:00403490 E8CB600000              call 00409560
:00403495 50                      push eax

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:00403496 686CDD4400              push 0044DD6C
:0040349B 6810BC4600              push 0046BC10
:004034A0 E87ED60100              call 00420B23
:004034A5 83C40C                  add esp, 0000000C
:004034A8 8A8558FFFFFF            mov al, byte ptr [ebp+FFFFFF58]
:004034AE A29CDA4400              mov byte ptr [0044DA9C], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004033D5(U), :004033E7(C), :004033FF(C)
|
:004034B3 E988FEFFFF              jmp 00403340

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00403362(C), :00403375(C), :004033A3(U)
|
:004034B8 83BD4CFFFFFF00          cmp dword ptr [ebp+FFFFFF4C], 00000000
:004034BF 0F8413000000            je 004034D8
:004034C5 33C0                    xor eax, eax
:004034C7 8A8558FFFFFF            mov al, byte ptr [ebp+FFFFFF58]
:004034CD 3DFF000000              cmp eax, 000000FF
:004034D2 0F8505000000            jne 004034DD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004034BF(C)
|
:004034D8 E958030000              jmp 00403835

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004034D2(C)
|
:004034DD 6A00                    push 00000000
:004034DF B994A64600              mov ecx, 0046A694
:004034E4 E83B5B0100              call 00419024
:004034E9 C68554FFFFFFFF          mov byte ptr [ebp+FFFFFF54], FF
:004034F0 33C0                    xor eax, eax
:004034F2 8A8564FFFFFF            mov al, byte ptr [ebp+FFFFFF64]
:004034F8 898540FFFFFF            mov dword ptr [ebp+FFFFFF40], eax
:004034FE E903030000              jmp 00403806
:00403503 33C0                    xor eax, eax
:00403505 8A8558FFFFFF            mov al, byte ptr [ebp+FFFFFF58]
:0040350B 8B84056CFFFFFF          mov eax, dword ptr [ebp+eax-00000094]
:00403512 50                      push eax
:00403513 8B8D44FFFFFF            mov ecx, dword ptr [ebp+FFFFFF44]
:00403519 E8FA030000              call 00403918
:0040351E E90D030000              jmp 00403830
:00403523 6A01                    push 00000001
:00403525 6A01                    push 00000001
:00403527 8B8544FFFFFF            mov eax, dword ptr [ebp+FFFFFF44]
:0040352D 8A4004                  mov al, byte ptr [eax+04]
:00403530 50                      push eax
:00403531 B900FB4600              mov ecx, 0046FB00
:00403536 E87A990300              call 0043CEB5
:0040353B 888554FFFFFF            mov byte ptr [ebp+FFFFFF54], al
:00403541 33C0                    xor eax, eax
:00403543 8A8554FFFFFF            mov al, byte ptr [ebp+FFFFFF54]
:00403549 3DFF000000              cmp eax, 000000FF
:0040354E 0F84BF010000            je 00403713
:00403554 8B8544FFFFFF            mov eax, dword ptr [ebp+FFFFFF44]
:0040355A 33C9                    xor ecx, ecx
:0040355C 8A4804                  mov cl, byte ptr [eax+04]
:0040355F 33C0                    xor eax, eax
:00403561 8A8554FFFFFF            mov al, byte ptr [ebp+FFFFFF54]
:00403567 3BC8                    cmp ecx, eax
:00403569 0F84A4010000            je 00403713
:0040356F 33C0                    xor eax, eax
:00403571 8A8554FFFFFF            mov al, byte ptr [ebp+FFFFFF54]
:00403577 8BC8                    mov ecx, eax
:00403579 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040357C C1E003                  shl eax, 03
:0040357F 2BC1                    sub eax, ecx
:00403581 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00403587 E8A45B0000              call 00409130
:0040358C 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040358F 03C0                    add eax, eax
:00403591 8D04C0                  lea eax, dword ptr [eax+8*eax]
:00403594 05E8564500              add eax, 004556E8
:00403599 898550FFFFFF            mov dword ptr [ebp+FFFFFF50], eax
:0040359F C78548FFFFFF00000000    mov dword ptr [ebp+FFFFFF48], 00000000
:004035A9 C7857CFFFFFF00000000    mov dword ptr [ebp+FFFFFF7C], 00000000
:004035B3 E906000000              jmp 004035BE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004035F7(U)
|
:004035B8 FF857CFFFFFF            inc dword ptr [ebp+FFFFFF7C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004035B3(U)
|
:004035BE 83BD7CFFFFFF0F          cmp dword ptr [ebp+FFFFFF7C], 0000000F
:004035C5 0F8331000000            jnb 004035FC
:004035CB 8B857CFFFFFF            mov eax, dword ptr [ebp+FFFFFF7C]
:004035D1 50                      push eax
:004035D2 8B8D50FFFFFF            mov ecx, dword ptr [ebp+FFFFFF50]
:004035D8 E8235F0000              call 00409500
:004035DD 33C9                    xor ecx, ecx
:004035DF 8AC8                    mov cl, al
:004035E1 81F9FF000000            cmp ecx, 000000FF
:004035E7 0F850A000000            jne 004035F7
:004035ED C78548FFFFFF01000000    mov dword ptr [ebp+FFFFFF48], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004035E7(C)
|
:004035F7 E9BCFFFFFF              jmp 004035B8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004035C5(C)
|
:004035FC 83BD48FFFFFF00          cmp dword ptr [ebp+FFFFFF48], 00000000
:00403603 0F84F6000000            je 004036FF
:00403609 33C0                    xor eax, eax
:0040360B 8A8554FFFFFF            mov al, byte ptr [ebp+FFFFFF54]
:00403611 8BC8                    mov ecx, eax
:00403613 8D0440                  lea eax, dword ptr [eax+2*eax]
:00403616 C1E003                  shl eax, 03
:00403619 2BC1                    sub eax, ecx
:0040361B 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00403621 E80A5B0000              call 00409130
:00403626 50                      push eax
:00403627 33C0                    xor eax, eax
:00403629 8A8558FFFFFF            mov al, byte ptr [ebp+FFFFFF58]
:0040362F 33C9                    xor ecx, ecx
:00403631 8A8C056CFFFFFF          mov cl, byte ptr [ebp+eax-00000094]
:00403638 51                      push ecx
:00403639 E82C020000              call 0040386A
:0040363E 83C408                  add esp, 00000008
:00403641 85C0                    test eax, eax
:00403643 0F84B1000000            je 004036FA
:00403649 33C0                    xor eax, eax
:0040364B 8A8558FFFFFF            mov al, byte ptr [ebp+FFFFFF58]
:00403651 8B84056CFFFFFF          mov eax, dword ptr [ebp+eax-00000094]
:00403658 50                      push eax
:00403659 8B8D50FFFFFF            mov ecx, dword ptr [ebp+FFFFFF50]
:0040365F E87C960000              call 0040CCE0
:00403664 68FF000000              push 000000FF
:00403669 33C0                    xor eax, eax
:0040366B 8A8558FFFFFF            mov al, byte ptr [ebp+FFFFFF58]
:00403671 8B84056CFFFFFF          mov eax, dword ptr [ebp+eax-00000094]
:00403678 50                      push eax
:00403679 8B8544FFFFFF            mov eax, dword ptr [ebp+FFFFFF44]
:0040367F 8B00                    mov eax, dword ptr [eax]
:00403681 8D0440                  lea eax, dword ptr [eax+2*eax]
:00403684 03C0                    add eax, eax
:00403686 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:0040368D E89A950000              call 0040CC2C
:00403692 50                      push eax
:00403693 8B8544FFFFFF            mov eax, dword ptr [ebp+FFFFFF44]
:00403699 8B00                    mov eax, dword ptr [eax]
:0040369B 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040369E 03C0                    add eax, eax
:004036A0 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:004036A7 E8845E0000              call 00409530
:004036AC 8B8D50FFFFFF            mov ecx, dword ptr [ebp+FFFFFF50]
:004036B2 E8295E0000              call 004094E0
:004036B7 50                      push eax
:004036B8 33C0                    xor eax, eax
:004036BA 8A8558FFFFFF            mov al, byte ptr [ebp+FFFFFF58]
:004036C0 33C9                    xor ecx, ecx
:004036C2 8A8C056CFFFFFF          mov cl, byte ptr [ebp+eax-00000094]
:004036C9 8BC1                    mov eax, ecx
:004036CB C1E104                  shl ecx, 04
:004036CE 8D8C0118AA4600          lea ecx, dword ptr [ecx+eax+0046AA18]
:004036D5 E8865E0000              call 00409560
:004036DA 50                      push eax

* Possible StringData Ref from Data Obj ->"%s%s"
                                  |
:004036DB 6870DD4400              push 0044DD70
:004036E0 6A00                    push 00000000
:004036E2 E84E580300              call 00438F35
:004036E7 83C410                  add esp, 00000010
:004036EA 6880000000              push 00000080
:004036EF 8B8D44FFFFFF            mov ecx, dword ptr [ebp+FFFFFF44]
:004036F5 E8CAA60200              call 0042DDC4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403643(C)
|
:004036FA E914000000              jmp 00403713

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403603(C)
|

* Possible StringData Ref from Data Obj ->"Ѿˣ޷ٽ"
                                  |
:004036FF 6880DD4400              push 0044DD80
:00403704 6A00                    push 00000000
:00403706 E82A580300              call 00438F35
:0040370B 83C408                  add esp, 00000008
:0040370E E8D43D0300              call 004374E7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040354E(C), :00403569(C), :004036FA(U)
|
:00403713 E918010000              jmp 00403830
:00403718 33C0                    xor eax, eax
:0040371A 8A8558FFFFFF            mov al, byte ptr [ebp+FFFFFF58]
:00403720 33C9                    xor ecx, ecx
:00403722 8A8C056CFFFFFF          mov cl, byte ptr [ebp+eax-00000094]
:00403729 8BC1                    mov eax, ecx
:0040372B C1E104                  shl ecx, 04
:0040372E 8D8C0118AA4600          lea ecx, dword ptr [ecx+eax+0046AA18]
:00403735 E8265E0000              call 00409560
:0040373A 50                      push eax

* Possible StringData Ref from Data Obj ->"%s𣿡"
                                  |
:0040373B 68A0DD4400              push 0044DDA0
:00403740 6A02                    push 00000002
:00403742 E8EE570300              call 00438F35
:00403747 83C40C                  add esp, 0000000C
:0040374A 85C0                    test eax, eax
:0040374C 0F848A000000            je 004037DC
:00403752 68FF000000              push 000000FF
:00403757 33C0                    xor eax, eax
:00403759 8A8558FFFFFF            mov al, byte ptr [ebp+FFFFFF58]
:0040375F 8B84056CFFFFFF          mov eax, dword ptr [ebp+eax-00000094]
:00403766 50                      push eax
:00403767 8B8544FFFFFF            mov eax, dword ptr [ebp+FFFFFF44]
:0040376D 8B00                    mov eax, dword ptr [eax]
:0040376F 8D0440                  lea eax, dword ptr [eax+2*eax]
:00403772 03C0                    add eax, eax
:00403774 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:0040377B E8AC940000              call 0040CC2C
:00403780 50                      push eax
:00403781 8B8544FFFFFF            mov eax, dword ptr [ebp+FFFFFF44]
:00403787 8B00                    mov eax, dword ptr [eax]
:00403789 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040378C 03C0                    add eax, eax
:0040378E 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:00403795 E8965D0000              call 00409530
:0040379A 33C0                    xor eax, eax
:0040379C 8A8558FFFFFF            mov al, byte ptr [ebp+FFFFFF58]
:004037A2 33C9                    xor ecx, ecx
:004037A4 8A8C056CFFFFFF          mov cl, byte ptr [ebp+eax-00000094]
:004037AB 8BC1                    mov eax, ecx
:004037AD C1E104                  shl ecx, 04
:004037B0 8D8C0118AA4600          lea ecx, dword ptr [ecx+eax+0046AA18]
:004037B7 E8A45D0000              call 00409560
:004037BC 50                      push eax

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:004037BD 68B4DD4400              push 0044DDB4
:004037C2 6A00                    push 00000000
:004037C4 E86C570300              call 00438F35
:004037C9 83C40C                  add esp, 0000000C
:004037CC 6880000000              push 00000080
:004037D1 8B8D44FFFFFF            mov ecx, dword ptr [ebp+FFFFFF44]
:004037D7 E8E8A50200              call 0042DDC4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040374C(C)
|
:004037DC E94F000000              jmp 00403830
:004037E1 33C0                    xor eax, eax
:004037E3 8A8558FFFFFF            mov al, byte ptr [ebp+FFFFFF58]
:004037E9 8B84056CFFFFFF          mov eax, dword ptr [ebp+eax-00000094]
:004037F0 50                      push eax
:004037F1 8B8D44FFFFFF            mov ecx, dword ptr [ebp+FFFFFF44]
:004037F7 E8EE000000              call 004038EA
:004037FC E92F000000              jmp 00403830
:00403801 E92A000000              jmp 00403830

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004034FE(U)
|
:00403806 83BD40FFFFFF03          cmp dword ptr [ebp+FFFFFF40], 00000003
:0040380D 0F871D000000            ja 00403830
:00403813 8B8540FFFFFF            mov eax, dword ptr [ebp+FFFFFF40]
:00403819 FF248520384000          jmp dword ptr [4*eax+00403820]

:00403820 03354000                DWORD 00403503
:00403824 23354000                DWORD 00403523
:00403828 18374000                DWORD 00403718
:0040382C E1374000                DWORD 004037E1



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040351E(U), :00403713(U), :004037DC(U), :004037FC(U), :00403801(U)
|:0040380D(C)
|
:00403830 E930FAFFFF              jmp 00403265

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00403272(C), :0040328A(C), :004034D8(U)
|
:00403835 6A18                    push 00000018
:00403837 6A27                    push 00000027
:00403839 6A00                    push 00000000
:0040383B 6A00                    push 00000000
:0040383D B900FB4600              mov ecx, 0046FB00
:00403842 E8E6720300              call 0043AB2D
:00403847 B900FB4600              mov ecx, 0046FB00
:0040384C E887B10300              call 0043E9D8
:00403851 E97AF9FFFF              jmp 004031D0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004031BF(U), :004031DD(C), :004031F5(C), :00403233(U)
|
:00403856 B998FC4600              mov ecx, 0046FC98
:0040385B E8B3030400              call 00443C13
:00403860 E900000000              jmp 00403865

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403860(U)
|
:00403865 5F                      pop edi
:00403866 5E                      pop esi
:00403867 5B                      pop ebx
:00403868 C9                      leave
:00403869 C3                      ret



* Referenced by a CALL at Address:
|:00403639   
|
:0040386A 55                      push ebp
:0040386B 8BEC                    mov ebp, esp
:0040386D 53                      push ebx
:0040386E 56                      push esi
:0040386F 57                      push edi
:00403870 8B450C                  mov eax, dword ptr [ebp+0C]
:00403873 50                      push eax
:00403874 8B4508                  mov eax, dword ptr [ebp+08]
:00403877 50                      push eax
:00403878 E8F48A0000              call 0040C371
:0040387D 83C408                  add esp, 00000008
:00403880 85C0                    test eax, eax
:00403882 0F840F000000            je 00403897
:00403888 B801000000              mov eax, 00000001
:0040388D E953000000              jmp 004038E5
:00403892 E94E000000              jmp 004038E5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403882(C)
|
:00403897 8B4508                  mov eax, dword ptr [ebp+08]
:0040389A 50                      push eax
:0040389B E86EAD0100              call 0041E60E
:004038A0 83C404                  add esp, 00000004
:004038A3 50                      push eax
:004038A4 8B450C                  mov eax, dword ptr [ebp+0C]
:004038A7 50                      push eax
:004038A8 E83B850000              call 0040BDE8
:004038AD 83C404                  add esp, 00000004
:004038B0 50                      push eax
:004038B1 8B450C                  mov eax, dword ptr [ebp+0C]
:004038B4 8D0440                  lea eax, dword ptr [eax+2*eax]
:004038B7 03C0                    add eax, eax
:004038B9 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:004038C0 E80B5A0000              call 004092D0
:004038C5 33C9                    xor ecx, ecx
:004038C7 8AC8                    mov cl, al
:004038C9 8B048DF82C4500          mov eax, dword ptr [4*ecx+00452CF8]
:004038D0 50                      push eax

* Possible StringData Ref from Data Obj ->"%s%sװ%s"
                                  |
:004038D1 68C0DD4400              push 0044DDC0
:004038D6 6A02                    push 00000002
:004038D8 E858560300              call 00438F35
:004038DD 83C414                  add esp, 00000014
:004038E0 E900000000              jmp 004038E5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040388D(U), :00403892(U), :004038E0(U)
|
:004038E5 5F                      pop edi
:004038E6 5E                      pop esi
:004038E7 5B                      pop ebx
:004038E8 C9                      leave
:004038E9 C3                      ret



* Referenced by a CALL at Address:
|:004037F7   
|
:004038EA 55                      push ebp
:004038EB 8BEC                    mov ebp, esp
:004038ED 83EC04                  sub esp, 00000004
:004038F0 53                      push ebx
:004038F1 56                      push esi
:004038F2 57                      push edi
:004038F3 894DFC                  mov dword ptr [ebp-04], ecx
:004038F6 33C0                    xor eax, eax
:004038F8 8A4508                  mov al, byte ptr [ebp+08]
:004038FB 8BC8                    mov ecx, eax
:004038FD C1E004                  shl eax, 04
:00403900 8D8C0818AA4600          lea ecx, dword ptr [eax+ecx+0046AA18]
:00403907 E83AAD0100              call 0041E646
:0040390C E900000000              jmp 00403911

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040390C(U)
|
:00403911 5F                      pop edi
:00403912 5E                      pop esi
:00403913 5B                      pop ebx
:00403914 C9                      leave
:00403915 C20400                  ret 0004



* Referenced by a CALL at Address:
|:00403519   
|
:00403918 55                      push ebp
:00403919 8BEC                    mov ebp, esp
:0040391B 83EC78                  sub esp, 00000078
:0040391E 53                      push ebx
:0040391F 56                      push esi
:00403920 57                      push edi
:00403921 894D94                  mov dword ptr [ebp-6C], ecx
:00403924 8B4594                  mov eax, dword ptr [ebp-6C]
:00403927 8B00                    mov eax, dword ptr [eax]
:00403929 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040392C 03C0                    add eax, eax
:0040392E 8D04C0                  lea eax, dword ptr [eax+8*eax]
:00403931 05E8564500              add eax, 004556E8
:00403936 8945F8                  mov dword ptr [ebp-08], eax
:00403939 C645FC01                mov [ebp-04], 01
:0040393D C70598DA440000000000    mov dword ptr [0044DA98], 00000000
:00403947 33C0                    xor eax, eax
:00403949 8A4508                  mov al, byte ptr [ebp+08]
:0040394C 8BC8                    mov ecx, eax
:0040394E C1E004                  shl eax, 04
:00403951 8D8C0818AA4600          lea ecx, dword ptr [eax+ecx+0046AA18]
:00403958 E8C35C0000              call 00409620
:0040395D 33C9                    xor ecx, ecx
:0040395F 8AC8                    mov cl, al
:00403961 83F919                  cmp ecx, 00000019
:00403964 0F8C8D030000            jl 00403CF7
:0040396A 33C0                    xor eax, eax
:0040396C 8A4508                  mov al, byte ptr [ebp+08]
:0040396F 8BC8                    mov ecx, eax
:00403971 C1E004                  shl eax, 04
:00403974 8D8C0818AA4600          lea ecx, dword ptr [eax+ecx+0046AA18]
:0040397B E8A05C0000              call 00409620
:00403980 33C9                    xor ecx, ecx
:00403982 8AC8                    mov cl, al
:00403984 83F926                  cmp ecx, 00000026
:00403987 0F8F6A030000            jg 00403CF7
:0040398D 33C0                    xor eax, eax
:0040398F 8A4508                  mov al, byte ptr [ebp+08]
:00403992 8BC8                    mov ecx, eax
:00403994 C1E004                  shl eax, 04
:00403997 8D8C0818AA4600          lea ecx, dword ptr [eax+ecx+0046AA18]
:0040399E E87D5C0000              call 00409620
:004039A3 33C9                    xor ecx, ecx
:004039A5 8AC8                    mov cl, al
:004039A7 894D90                  mov dword ptr [ebp-70], ecx
:004039AA E9F3020000              jmp 00403CA2
:004039AF 6A03                    push 00000003
:004039B1 8B4594                  mov eax, dword ptr [ebp-6C]
:004039B4 33C9                    xor ecx, ecx
:004039B6 8A4804                  mov cl, byte ptr [eax+04]
:004039B9 51                      push ecx
:004039BA 33C0                    xor eax, eax
:004039BC 8A4508                  mov al, byte ptr [ebp+08]
:004039BF 50                      push eax
:004039C0 E89B090000              call 00404360
:004039C5 83C40C                  add esp, 0000000C
:004039C8 E925030000              jmp 00403CF2
:004039CD 6A03                    push 00000003
:004039CF 8B4594                  mov eax, dword ptr [ebp-6C]
:004039D2 33C9                    xor ecx, ecx
:004039D4 8A4804                  mov cl, byte ptr [eax+04]
:004039D7 51                      push ecx
:004039D8 33C0                    xor eax, eax
:004039DA 8A4508                  mov al, byte ptr [ebp+08]
:004039DD 50                      push eax
:004039DE E814150000              call 00404EF7
:004039E3 83C40C                  add esp, 0000000C
:004039E6 E907030000              jmp 00403CF2
:004039EB 6A03                    push 00000003
:004039ED 8B4594                  mov eax, dword ptr [ebp-6C]
:004039F0 33C9                    xor ecx, ecx
:004039F2 8A4804                  mov cl, byte ptr [eax+04]
:004039F5 51                      push ecx
:004039F6 33C0                    xor eax, eax
:004039F8 8A4508                  mov al, byte ptr [ebp+08]
:004039FB 50                      push eax
:004039FC E81C1B0000              call 0040551D
:00403A01 83C40C                  add esp, 0000000C
:00403A04 E9E9020000              jmp 00403CF2
:00403A09 6A03                    push 00000003
:00403A0B 8B4594                  mov eax, dword ptr [ebp-6C]
:00403A0E 33C9                    xor ecx, ecx
:00403A10 8A4804                  mov cl, byte ptr [eax+04]
:00403A13 51                      push ecx
:00403A14 33C0                    xor eax, eax
:00403A16 8A4508                  mov al, byte ptr [ebp+08]
:00403A19 50                      push eax
:00403A1A E8DA1E0000              call 004058F9
:00403A1F 83C40C                  add esp, 0000000C
:00403A22 E9CB020000              jmp 00403CF2
:00403A27 6A03                    push 00000003
:00403A29 8B4594                  mov eax, dword ptr [ebp-6C]
:00403A2C 33C9                    xor ecx, ecx
:00403A2E 8A4804                  mov cl, byte ptr [eax+04]
:00403A31 51                      push ecx
:00403A32 33C0                    xor eax, eax
:00403A34 8A4508                  mov al, byte ptr [ebp+08]
:00403A37 50                      push eax
:00403A38 E886220000              call 00405CC3
:00403A3D 83C40C                  add esp, 0000000C
:00403A40 E9AD020000              jmp 00403CF2
:00403A45 6A03                    push 00000003
:00403A47 8B4594                  mov eax, dword ptr [ebp-6C]
:00403A4A 33C9                    xor ecx, ecx
:00403A4C 8A4804                  mov cl, byte ptr [eax+04]
:00403A4F 51                      push ecx
:00403A50 33C0                    xor eax, eax
:00403A52 8A4508                  mov al, byte ptr [ebp+08]
:00403A55 50                      push eax
:00403A56 E830260000              call 0040608B
:00403A5B 83C40C                  add esp, 0000000C
:00403A5E E98F020000              jmp 00403CF2
:00403A63 33C0                    xor eax, eax
:00403A65 8A4508                  mov al, byte ptr [ebp+08]
:00403A68 8BC8                    mov ecx, eax
:00403A6A C1E004                  shl eax, 04
:00403A6D 8D8C0818AA4600          lea ecx, dword ptr [eax+ecx+0046AA18]
:00403A74 E8875B0000              call 00409600
:00403A79 33C9                    xor ecx, ecx
:00403A7B 8AC8                    mov cl, al
:00403A7D 85C9                    test ecx, ecx
:00403A7F 0F851E000000            jne 00403AA3
:00403A85 6A03                    push 00000003
:00403A87 8B4594                  mov eax, dword ptr [ebp-6C]
:00403A8A 33C9                    xor ecx, ecx
:00403A8C 8A4804                  mov cl, byte ptr [eax+04]
:00403A8F 51                      push ecx
:00403A90 33C0                    xor eax, eax
:00403A92 8A4508                  mov al, byte ptr [ebp+08]
:00403A95 50                      push eax
:00403A96 E8C6290000              call 00406461
:00403A9B 83C40C                  add esp, 0000000C
:00403A9E E919000000              jmp 00403ABC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403A7F(C)
|
:00403AA3 6A03                    push 00000003
:00403AA5 8B4594                  mov eax, dword ptr [ebp-6C]
:00403AA8 33C9                    xor ecx, ecx
:00403AAA 8A4804                  mov cl, byte ptr [eax+04]
:00403AAD 51                      push ecx
:00403AAE 33C0                    xor eax, eax
:00403AB0 8A4508                  mov al, byte ptr [ebp+08]
:00403AB3 50                      push eax
:00403AB4 E89B2B0000              call 00406654
:00403AB9 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403A9E(U)
|
:00403ABC E931020000              jmp 00403CF2
:00403AC1 6A03                    push 00000003
:00403AC3 8B4594                  mov eax, dword ptr [ebp-6C]
:00403AC6 33C9                    xor ecx, ecx
:00403AC8 8A4804                  mov cl, byte ptr [eax+04]
:00403ACB 51                      push ecx
:00403ACC 33C0                    xor eax, eax
:00403ACE 8A4508                  mov al, byte ptr [ebp+08]
:00403AD1 50                      push eax
:00403AD2 E8702D0000              call 00406847
:00403AD7 83C40C                  add esp, 0000000C
:00403ADA E913020000              jmp 00403CF2
:00403ADF 8B4594                  mov eax, dword ptr [ebp-6C]
:00403AE2 33C9                    xor ecx, ecx
:00403AE4 8A4804                  mov cl, byte ptr [eax+04]
:00403AE7 51                      push ecx
:00403AE8 33C0                    xor eax, eax
:00403AEA 8A4508                  mov al, byte ptr [ebp+08]
:00403AED 50                      push eax
:00403AEE E8E92F0000              call 00406ADC
:00403AF3 83C408                  add esp, 00000008
:00403AF6 E9F7010000              jmp 00403CF2
:00403AFB 33C0                    xor eax, eax
:00403AFD 8A4508                  mov al, byte ptr [ebp+08]
:00403B00 8BC8                    mov ecx, eax
:00403B02 C1E004                  shl eax, 04
:00403B05 8D8C0818AA4600          lea ecx, dword ptr [eax+ecx+0046AA18]
:00403B0C E8EF5A0000              call 00409600
:00403B11 33C9                    xor ecx, ecx
:00403B13 8AC8                    mov cl, al
:00403B15 894D8C                  mov dword ptr [ebp-74], ecx
:00403B18 E975000000              jmp 00403B92
:00403B1D 8B4594                  mov eax, dword ptr [ebp-6C]
:00403B20 33C9                    xor ecx, ecx
:00403B22 8A4804                  mov cl, byte ptr [eax+04]
:00403B25 51                      push ecx
:00403B26 33C0                    xor eax, eax
:00403B28 8A4508                  mov al, byte ptr [ebp+08]
:00403B2B 50                      push eax
:00403B2C E8EC300000              call 00406C1D
:00403B31 83C408                  add esp, 00000008
:00403B34 E97D000000              jmp 00403BB6
:00403B39 8B4594                  mov eax, dword ptr [ebp-6C]
:00403B3C 33C9                    xor ecx, ecx
:00403B3E 8A4804                  mov cl, byte ptr [eax+04]
:00403B41 51                      push ecx
:00403B42 33C0                    xor eax, eax
:00403B44 8A4508                  mov al, byte ptr [ebp+08]
:00403B47 50                      push eax
:00403B48 E840320000              call 00406D8D
:00403B4D 83C408                  add esp, 00000008
:00403B50 E961000000              jmp 00403BB6
:00403B55 8B4594                  mov eax, dword ptr [ebp-6C]
:00403B58 33C9                    xor ecx, ecx
:00403B5A 8A4804                  mov cl, byte ptr [eax+04]
:00403B5D 51                      push ecx
:00403B5E 33C0                    xor eax, eax
:00403B60 8A4508                  mov al, byte ptr [ebp+08]
:00403B63 50                      push eax
:00403B64 E898330000              call 00406F01
:00403B69 83C408                  add esp, 00000008
:00403B6C E945000000              jmp 00403BB6
:00403B71 8B4594                  mov eax, dword ptr [ebp-6C]
:00403B74 33C9                    xor ecx, ecx
:00403B76 8A4804                  mov cl, byte ptr [eax+04]
:00403B79 51                      push ecx
:00403B7A 33C0                    xor eax, eax
:00403B7C 8A4508                  mov al, byte ptr [ebp+08]
:00403B7F 50                      push eax
:00403B80 E8F0340000              call 00407075
:00403B85 83C408                  add esp, 00000008
:00403B88 E929000000              jmp 00403BB6
:00403B8D E924000000              jmp 00403BB6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403B18(U)
|
:00403B92 837D8C03                cmp dword ptr [ebp-74], 00000003
:00403B96 0F871A000000            ja 00403BB6
:00403B9C 8B458C                  mov eax, dword ptr [ebp-74]
:00403B9F FF2485A63B4000          jmp dword ptr [4*eax+00403BA6]

:00403BA6 1D3B4000                DWORD 00403B1D
:00403BAA 393B4000                DWORD 00403B39
:00403BAE 553B4000                DWORD 00403B55
:00403BB2 713B4000                DWORD 00403B71



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00403B34(U), :00403B50(U), :00403B6C(U), :00403B88(U), :00403B8D(U)
|:00403B96(C)
|
:00403BB6 E937010000              jmp 00403CF2
:00403BBB 8B4594                  mov eax, dword ptr [ebp-6C]
:00403BBE 33C9                    xor ecx, ecx
:00403BC0 8A4804                  mov cl, byte ptr [eax+04]
:00403BC3 51                      push ecx
:00403BC4 33C0                    xor eax, eax
:00403BC6 8A4508                  mov al, byte ptr [ebp+08]
:00403BC9 50                      push eax
:00403BCA E81A360000              call 004071E9
:00403BCF 83C408                  add esp, 00000008
:00403BD2 E91B010000              jmp 00403CF2
:00403BD7 8B4594                  mov eax, dword ptr [ebp-6C]
:00403BDA 33C9                    xor ecx, ecx
:00403BDC 8A4804                  mov cl, byte ptr [eax+04]
:00403BDF 51                      push ecx
:00403BE0 33C0                    xor eax, eax
:00403BE2 8A4508                  mov al, byte ptr [ebp+08]
:00403BE5 50                      push eax
:00403BE6 E84E390000              call 00407539
:00403BEB 83C408                  add esp, 00000008
:00403BEE E9FF000000              jmp 00403CF2
:00403BF3 33C0                    xor eax, eax
:00403BF5 8A4508                  mov al, byte ptr [ebp+08]
:00403BF8 8BC8                    mov ecx, eax
:00403BFA C1E004                  shl eax, 04
:00403BFD 8D8C0818AA4600          lea ecx, dword ptr [eax+ecx+0046AA18]
:00403C04 E8F7590000              call 00409600
:00403C09 33C9                    xor ecx, ecx
:00403C0B 8AC8                    mov cl, al
:00403C0D 894D88                  mov dword ptr [ebp-78], ecx
:00403C10 E960000000              jmp 00403C75

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403C79(C)
|
:00403C15 8B4594                  mov eax, dword ptr [ebp-6C]
:00403C18 33C9                    xor ecx, ecx
:00403C1A 8A4804                  mov cl, byte ptr [eax+04]
:00403C1D 51                      push ecx
:00403C1E 33C0                    xor eax, eax
:00403C20 8A4508                  mov al, byte ptr [ebp+08]
:00403C23 50                      push eax
:00403C24 E8603C0000              call 00407889
:00403C29 83C408                  add esp, 00000008
:00403C2C E967000000              jmp 00403C98

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403C83(C)
|
:00403C31 8B4594                  mov eax, dword ptr [ebp-6C]
:00403C34 33C9                    xor ecx, ecx
:00403C36 8A4804                  mov cl, byte ptr [eax+04]
:00403C39 51                      push ecx
:00403C3A 33C0                    xor eax, eax
:00403C3C 8A4508                  mov al, byte ptr [ebp+08]
:00403C3F 50                      push eax
:00403C40 E8B33D0000              call 004079F8
:00403C45 83C408                  add esp, 00000008
:00403C48 E94B000000              jmp 00403C98

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403C8D(C)
|
:00403C4D 6A03                    push 00000003
:00403C4F 8B4594                  mov eax, dword ptr [ebp-6C]
:00403C52 33C9                    xor ecx, ecx
:00403C54 8A4804                  mov cl, byte ptr [eax+04]
:00403C57 51                      push ecx
:00403C58 33C0                    xor eax, eax
:00403C5A 8A4508                  mov al, byte ptr [ebp+08]
:00403C5D 50                      push eax
:00403C5E E83D3F0000              call 00407BA0
:00403C63 83C40C                  add esp, 0000000C
:00403C66 E92D000000              jmp 00403C98
:00403C6B E928000000              jmp 00403C98
:00403C70 E923000000              jmp 00403C98

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403C10(U)
|
:00403C75 837D8800                cmp dword ptr [ebp-78], 00000000
:00403C79 0F8496FFFFFF            je 00403C15
:00403C7F 837D8801                cmp dword ptr [ebp-78], 00000001
:00403C83 0F84A8FFFFFF            je 00403C31
:00403C89 837D8803                cmp dword ptr [ebp-78], 00000003
:00403C8D 0F84BAFFFFFF            je 00403C4D
:00403C93 E900000000              jmp 00403C98

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00403C2C(U), :00403C48(U), :00403C66(U), :00403C6B(U), :00403C70(U)
|:00403C93(U)
|
:00403C98 E955000000              jmp 00403CF2
:00403C9D E950000000              jmp 00403CF2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004039AA(U)
|
:00403CA2 836D9019                sub dword ptr [ebp-70], 00000019
:00403CA6 837D900D                cmp dword ptr [ebp-70], 0000000D
:00403CAA 0F8742000000            ja 00403CF2
:00403CB0 8B4590                  mov eax, dword ptr [ebp-70]
:00403CB3 FF2485BA3C4000          jmp dword ptr [4*eax+00403CBA]

:00403CBA AF394000                DWORD 004039AF
:00403CBE AF394000                DWORD 004039AF
:00403CC2 CD394000                DWORD 004039CD
:00403CC6 EB394000                DWORD 004039EB
:00403CCA 093A4000                DWORD 00403A09
:00403CCE 273A4000                DWORD 00403A27
:00403CD2 453A4000                DWORD 00403A45
:00403CD6 633A4000                DWORD 00403A63
:00403CDA C13A4000                DWORD 00403AC1
:00403CDE DF3A4000                DWORD 00403ADF
:00403CE2 FB3A4000                DWORD 00403AFB
:00403CE6 BB3B4000                DWORD 00403BBB
:00403CEA D73B4000                DWORD 00403BD7
:00403CEE F33B4000                DWORD 00403BF3



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004039C8(U), :004039E6(U), :00403A04(U), :00403A22(U), :00403A40(U)
|:00403A5E(U), :00403ABC(U), :00403ADA(U), :00403AF6(U), :00403BD2(U)
|:00403BEE(U), :00403C98(U), :00403C9D(U), :00403CAA(C)
|
:00403CF2 E91F060000              jmp 00404316

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00403964(C), :00403987(C)
|
:00403CF7 33C0                    xor eax, eax
:00403CF9 8A4508                  mov al, byte ptr [ebp+08]
:00403CFC 8BC8                    mov ecx, eax
:00403CFE C1E004                  shl eax, 04
:00403D01 8D8C0818AA4600          lea ecx, dword ptr [eax+ecx+0046AA18]
:00403D08 E813590000              call 00409620
:00403D0D 33C9                    xor ecx, ecx
:00403D0F 8AC8                    mov cl, al
:00403D11 83F927                  cmp ecx, 00000027
:00403D14 0F8516030000            jne 00404030
:00403D1A C645CC00                mov [ebp-34], 00
:00403D1E C645CD01                mov [ebp-33], 01
:00403D22 C645CE03                mov [ebp-32], 03
:00403D26 C645CF04                mov [ebp-31], 04
:00403D2A C645D006                mov [ebp-30], 06
:00403D2E C645D107                mov [ebp-2F], 07
:00403D32 C645D209                mov [ebp-2E], 09
:00403D36 C645D30A                mov [ebp-2D], 0A
:00403D3A C645D40C                mov [ebp-2C], 0C
:00403D3E C645D50D                mov [ebp-2B], 0D
:00403D42 C645D60F                mov [ebp-2A], 0F
:00403D46 C645D710                mov [ebp-29], 10
:00403D4A C645D815                mov [ebp-28], 15
:00403D4E C645D917                mov [ebp-27], 17
:00403D52 C645DA19                mov [ebp-26], 19
:00403D56 C645DB12                mov [ebp-25], 12
:00403D5A C645DC13                mov [ebp-24], 13
:00403D5E C645E00F                mov [ebp-20], 0F
:00403D62 C645E11E                mov [ebp-1F], 1E
:00403D66 C645E20F                mov [ebp-1E], 0F
:00403D6A C645E31E                mov [ebp-1D], 1E
:00403D6E C645E40F                mov [ebp-1C], 0F
:00403D72 C645E51E                mov [ebp-1B], 1E
:00403D76 C645E60F                mov [ebp-1A], 0F
:00403D7A C645E71E                mov [ebp-19], 1E
:00403D7E C645E80F                mov [ebp-18], 0F
:00403D82 C645E91E                mov [ebp-17], 1E
:00403D86 C645EA0F                mov [ebp-16], 0F
:00403D8A C645EB1E                mov [ebp-15], 1E
:00403D8E C645EC0F                mov [ebp-14], 0F
:00403D92 C645ED0F                mov [ebp-13], 0F
:00403D96 C645EE0F                mov [ebp-12], 0F
:00403D9A C645EF0F                mov [ebp-11], 0F
:00403D9E C645F01E                mov [ebp-10], 1E
:00403DA2 33C0                    xor eax, eax
:00403DA4 8A4508                  mov al, byte ptr [ebp+08]
:00403DA7 2DC0000000              sub eax, 000000C0
:00403DAC 8845F4                  mov byte ptr [ebp-0C], al
:00403DAF 33C0                    xor eax, eax
:00403DB1 8A45F4                  mov al, byte ptr [ebp-0C]
:00403DB4 33C9                    xor ecx, ecx
:00403DB6 8A4C05CC                mov cl, byte ptr [ebp+eax-34]
:00403DBA 8B048DFC2C4500          mov eax, dword ptr [4*ecx+00452CFC]
:00403DC1 50                      push eax
:00403DC2 33C0                    xor eax, eax
:00403DC4 8A45F4                  mov al, byte ptr [ebp-0C]
:00403DC7 33C9                    xor ecx, ecx
:00403DC9 8A4C05CC                mov cl, byte ptr [ebp+eax-34]
:00403DCD 8B048DF82C4500          mov eax, dword ptr [4*ecx+00452CF8]
:00403DD4 50                      push eax

* Possible StringData Ref from Data Obj ->"%sĲΪ%s"
                                  |
:00403DD5 68DCDD4400              push 0044DDDC
:00403DDA 6A00                    push 00000000
:00403DDC E854510300              call 00438F35
:00403DE1 83C410                  add esp, 00000010
:00403DE4 6A01                    push 00000001
:00403DE6 6883000000              push 00000083
:00403DEB 8B4594                  mov eax, dword ptr [ebp-6C]
:00403DEE 8A4004                  mov al, byte ptr [eax+04]
:00403DF1 50                      push eax
:00403DF2 B900FB4600              mov ecx, 0046FB00
:00403DF7 E8B9900300              call 0043CEB5
:00403DFC 8845C8                  mov byte ptr [ebp-38], al
:00403DFF 33C0                    xor eax, eax
:00403E01 8A45C8                  mov al, byte ptr [ebp-38]
:00403E04 3DFF000000              cmp eax, 000000FF
:00403E09 0F841C020000            je 0040402B
:00403E0F 33C0                    xor eax, eax
:00403E11 8A45C8                  mov al, byte ptr [ebp-38]
:00403E14 8BC8                    mov ecx, eax
:00403E16 8D0440                  lea eax, dword ptr [eax+2*eax]
:00403E19 C1E003                  shl eax, 03
:00403E1C 2BC1                    sub eax, ecx
:00403E1E 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00403E24 E877540000              call 004092A0
:00403E29 33C9                    xor ecx, ecx
:00403E2B 8AC8                    mov cl, al
:00403E2D 33C0                    xor eax, eax
:00403E2F 8A45F4                  mov al, byte ptr [ebp-0C]
:00403E32 33D2                    xor edx, edx
:00403E34 8A5405CC                mov dl, byte ptr [ebp+eax-34]
:00403E38 3BCA                    cmp ecx, edx
:00403E3A 0F85C1010000            jne 00404001
:00403E40 33C0                    xor eax, eax
:00403E42 8A45C8                  mov al, byte ptr [ebp-38]
:00403E45 8BC8                    mov ecx, eax
:00403E47 8D0440                  lea eax, dword ptr [eax+2*eax]
:00403E4A C1E003                  shl eax, 03
:00403E4D 2BC1                    sub eax, ecx
:00403E4F 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00403E55 E8D6520000              call 00409130
:00403E5A 8D0440                  lea eax, dword ptr [eax+2*eax]
:00403E5D 03C0                    add eax, eax
:00403E5F 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:00403E66 E815540000              call 00409280
:00403E6B 33C9                    xor ecx, ecx
:00403E6D 8AC8                    mov cl, al
:00403E6F 33C0                    xor eax, eax
:00403E71 8A45F4                  mov al, byte ptr [ebp-0C]
:00403E74 33D2                    xor edx, edx
:00403E76 8A5405E0                mov dl, byte ptr [ebp+eax-20]
:00403E7A 3BCA                    cmp ecx, edx
:00403E7C 0F8C4E010000            jl 00403FD0
:00403E82 33C0                    xor eax, eax
:00403E84 8A45F4                  mov al, byte ptr [ebp-0C]
:00403E87 33C9                    xor ecx, ecx
:00403E89 8A4C05CC                mov cl, byte ptr [ebp+eax-34]
:00403E8D 8B048DFC2C4500          mov eax, dword ptr [4*ecx+00452CFC]
:00403E94 50                      push eax
:00403E95 33C0                    xor eax, eax
:00403E97 8A45F4                  mov al, byte ptr [ebp-0C]
:00403E9A 33C9                    xor ecx, ecx
:00403E9C 8A4C05CC                mov cl, byte ptr [ebp+eax-34]
:00403EA0 8B048DF82C4500          mov eax, dword ptr [4*ecx+00452CF8]
:00403EA7 50                      push eax

* Possible StringData Ref from Data Obj ->"%sĲΪ%s"
                                  |
:00403EA8 68F8DD4400              push 0044DDF8
:00403EAD 6A02                    push 00000002
:00403EAF E881500300              call 00438F35
:00403EB4 83C410                  add esp, 00000010
:00403EB7 85C0                    test eax, eax
:00403EB9 0F8407010000            je 00403FC6
:00403EBF 33C0                    xor eax, eax
:00403EC1 8A45C8                  mov al, byte ptr [ebp-38]
:00403EC4 8BC8                    mov ecx, eax
:00403EC6 8D0440                  lea eax, dword ptr [eax+2*eax]
:00403EC9 C1E003                  shl eax, 03
:00403ECC 2BC1                    sub eax, ecx
:00403ECE 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00403ED4 E827530000              call 00409200
:00403ED9 668B00                  mov ax, word ptr [eax]
:00403EDC 668945C4                mov word ptr [ebp-3C], ax
:00403EE0 6A08                    push 00000008
:00403EE2 B994A64600              mov ecx, 0046A694
:00403EE7 E838510100              call 00419024
:00403EEC 6A00                    push 00000000
:00403EEE 6A07                    push 00000007
:00403EF0 33C0                    xor eax, eax
:00403EF2 8A45C5                  mov al, byte ptr [ebp-3B]
:00403EF5 8D0440                  lea eax, dword ptr [eax+2*eax]
:00403EF8 50                      push eax
:00403EF9 33C0                    xor eax, eax
:00403EFB 8A45C4                  mov al, byte ptr [ebp-3C]
:00403EFE 8D0440                  lea eax, dword ptr [eax+2*eax]
:00403F01 50                      push eax
:00403F02 B900FB4600              mov ecx, 0046FB00
:00403F07 E834AB0300              call 0043EA40
:00403F0C 33C0                    xor eax, eax
:00403F0E 8A45F4                  mov al, byte ptr [ebp-0C]
:00403F11 33C9                    xor ecx, ecx
:00403F13 8A4C05CC                mov cl, byte ptr [ebp+eax-34]
:00403F17 41                      inc ecx
:00403F18 51                      push ecx
:00403F19 33C0                    xor eax, eax
:00403F1B 8A45C8                  mov al, byte ptr [ebp-38]
:00403F1E 8BC8                    mov ecx, eax
:00403F20 8D0440                  lea eax, dword ptr [eax+2*eax]
:00403F23 C1E003                  shl eax, 03
:00403F26 2BC1                    sub eax, ecx
:00403F28 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00403F2E E8FD510000              call 00409130
:00403F33 8D0440                  lea eax, dword ptr [eax+2*eax]
:00403F36 03C0                    add eax, eax
:00403F38 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:00403F3F E86C560000              call 004095B0
:00403F44 33C0                    xor eax, eax
:00403F46 8A45C8                  mov al, byte ptr [ebp-38]
:00403F49 8BC8                    mov ecx, eax
:00403F4B 8D0440                  lea eax, dword ptr [eax+2*eax]
:00403F4E C1E003                  shl eax, 03
:00403F51 2BC1                    sub eax, ecx
:00403F53 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00403F59 E8C5740200              call 0042B423
:00403F5E 6A18                    push 00000018
:00403F60 6A27                    push 00000027
:00403F62 6A00                    push 00000000
:00403F64 6A00                    push 00000000
:00403F66 B900FB4600              mov ecx, 0046FB00
:00403F6B E8BD6B0300              call 0043AB2D
:00403F70 33C0                    xor eax, eax
:00403F72 8A45F4                  mov al, byte ptr [ebp-0C]
:00403F75 33C9                    xor ecx, ecx
:00403F77 8A4C05CC                mov cl, byte ptr [ebp+eax-34]
:00403F7B 8B048DFC2C4500          mov eax, dword ptr [4*ecx+00452CFC]
:00403F82 50                      push eax
:00403F83 33C0                    xor eax, eax
:00403F85 8A45C8                  mov al, byte ptr [ebp-38]
:00403F88 8BC8                    mov ecx, eax
:00403F8A 8D0440                  lea eax, dword ptr [eax+2*eax]
:00403F8D C1E003                  shl eax, 03
:00403F90 2BC1                    sub eax, ecx
:00403F92 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00403F98 E8E3550000              call 00409580
:00403F9D 50                      push eax

* Possible StringData Ref from Data Obj ->"%sΪ%sˡ"
                                  |
:00403F9E 6814DE4400              push 0044DE14
:00403FA3 6A00                    push 00000000
:00403FA5 E88B4F0300              call 00438F35
:00403FAA 83C410                  add esp, 00000010
:00403FAD B994A64600              mov ecx, 0046A694
:00403FB2 E8E1500100              call 00419098
:00403FB7 C70598DA440001000000    mov dword ptr [0044DA98], 00000001
:00403FC1 E905000000              jmp 00403FCB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403EB9(C)
|
:00403FC6 E98E030000              jmp 00404359

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403FC1(U)
|
:00403FCB E92C000000              jmp 00403FFC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403E7C(C)
|
:00403FD0 6A0A                    push 0000000A
:00403FD2 B994A64600              mov ecx, 0046A694
:00403FD7 E848500100              call 00419024
:00403FDC 33C0                    xor eax, eax
:00403FDE 8A45F4                  mov al, byte ptr [ebp-0C]
:00403FE1 33C9                    xor ecx, ecx
:00403FE3 8A4C05E0                mov cl, byte ptr [ebp+eax-20]
:00403FE7 51                      push ecx

* Possible StringData Ref from Data Obj ->"ȼC6%wC7ϣ޷"
                                  |
:00403FE8 6828DE4400              push 0044DE28
:00403FED 6A00                    push 00000000
:00403FEF E8414F0300              call 00438F35
:00403FF4 83C40C                  add esp, 0000000C
:00403FF7 E8EB340300              call 004374E7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403FCB(U)
|
:00403FFC E920000000              jmp 00404021

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403E3A(C)
|
:00404001 6A0A                    push 0000000A
:00404003 B994A64600              mov ecx, 0046A694
:00404008 E817500100              call 00419024

* Possible StringData Ref from Data Obj ->"Բʹô˵ߣ"
                                  |
:0040400D 6850DE4400              push 0044DE50
:00404012 6A00                    push 00000000
:00404014 E81C4F0300              call 00438F35
:00404019 83C408                  add esp, 00000008
:0040401C E8C6340300              call 004374E7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403FFC(U)
|
:00404021 B994A64600              mov ecx, 0046A694
:00404026 E86D500100              call 00419098

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403E09(C)
|
:0040402B E9E6020000              jmp 00404316

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403D14(C)
|
:00404030 33C0                    xor eax, eax
:00404032 8A4508                  mov al, byte ptr [ebp+08]
:00404035 8BC8                    mov ecx, eax
:00404037 C1E004                  shl eax, 04
:0040403A 8D8C0818AA4600          lea ecx, dword ptr [eax+ecx+0046AA18]
:00404041 E8DA550000              call 00409620
:00404046 33C9                    xor ecx, ecx
:00404048 8AC8                    mov cl, al
:0040404A 83F928                  cmp ecx, 00000028
:0040404D 0F8584010000            jne 004041D7
:00404053 C745B800000000          mov [ebp-48], 00000000
:0040405A 33C0                    xor eax, eax
:0040405C 8A4508                  mov al, byte ptr [ebp+08]
:0040405F 3DD7000000              cmp eax, 000000D7
:00404064 0F8C12000000            jl 0040407C
:0040406A 33C0                    xor eax, eax
:0040406C 8A4508                  mov al, byte ptr [ebp+08]
:0040406F 2DD7000000              sub eax, 000000D7
:00404074 8845C0                  mov byte ptr [ebp-40], al
:00404077 E90D000000              jmp 00404089

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404064(C)
|
:0040407C 33C0                    xor eax, eax
:0040407E 8A4508                  mov al, byte ptr [ebp+08]
:00404081 2DD1000000              sub eax, 000000D1
:00404086 8845C0                  mov byte ptr [ebp-40], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404077(U)
|
:00404089 33C0                    xor eax, eax
:0040408B 8A4508                  mov al, byte ptr [ebp+08]
:0040408E 8BC8                    mov ecx, eax
:00404090 C1E004                  shl eax, 04
:00404093 8D8C0818AA4600          lea ecx, dword ptr [eax+ecx+0046AA18]
:0040409A E861550000              call 00409600
:0040409F 8845BC                  mov byte ptr [ebp-44], al
:004040A2 33C0                    xor eax, eax
:004040A4 8A45C0                  mov al, byte ptr [ebp-40]
:004040A7 8B0485C0D14400          mov eax, dword ptr [4*eax+0044D1C0]
:004040AE 50                      push eax

* Possible StringData Ref from Data Obj ->"ҷ"
                                  |
:004040AF A1B8D14400              mov eax, dword ptr [0044D1B8]
:004040B4 50                      push eax

* Possible StringData Ref from Data Obj ->"ʹ%s%sߡ"
                                  |
:004040B5 686CDE4400              push 0044DE6C
:004040BA 6A00                    push 00000000
:004040BC E8744E0300              call 00438F35
:004040C1 83C410                  add esp, 00000010
:004040C4 6A01                    push 00000001
:004040C6 6883000000              push 00000083
:004040CB 8B4594                  mov eax, dword ptr [ebp-6C]
:004040CE 8A4004                  mov al, byte ptr [eax+04]
:004040D1 50                      push eax
:004040D2 B900FB4600              mov ecx, 0046FB00
:004040D7 E8D98D0300              call 0043CEB5
:004040DC 8845B4                  mov byte ptr [ebp-4C], al
:004040DF 33C0                    xor eax, eax
:004040E1 8A45B4                  mov al, byte ptr [ebp-4C]
:004040E4 3DFF000000              cmp eax, 000000FF
:004040E9 0F84E3000000            je 004041D2
:004040EF 33C0                    xor eax, eax
:004040F1 8A45B4                  mov al, byte ptr [ebp-4C]
:004040F4 8BC8                    mov ecx, eax
:004040F6 8D0440                  lea eax, dword ptr [eax+2*eax]
:004040F9 C1E003                  shl eax, 03
:004040FC 2BC1                    sub eax, ecx
:004040FE 0598C04600              add eax, 0046C098
:00404103 8945B0                  mov dword ptr [ebp-50], eax
:00404106 33C0                    xor eax, eax
:00404108 8A45C0                  mov al, byte ptr [ebp-40]
:0040410B 8A80A0DA4400            mov al, byte ptr [eax+0044DAA0]
:00404111 8845A8                  mov byte ptr [ebp-58], al
:00404114 8B45BC                  mov eax, dword ptr [ebp-44]
:00404117 50                      push eax
:00404118 8B45A8                  mov eax, dword ptr [ebp-58]
:0040411B 50                      push eax
:0040411C 8B4DB0                  mov ecx, dword ptr [ebp-50]
:0040411F E80C500000              call 00409130
:00404124 50                      push eax
:00404125 E82E3C0000              call 00407D58
:0040412A 83C40C                  add esp, 0000000C
:0040412D 8945AC                  mov dword ptr [ebp-54], eax
:00404130 837DAC00                cmp dword ptr [ebp-54], 00000000
:00404134 0F867D000000            jbe 004041B7
:0040413A 6A07                    push 00000007
:0040413C B994A64600              mov ecx, 0046A694
:00404141 E8DE4E0100              call 00419024
:00404146 8B45AC                  mov eax, dword ptr [ebp-54]
:00404149 50                      push eax
:0040414A 33C0                    xor eax, eax
:0040414C 8A45A8                  mov al, byte ptr [ebp-58]
:0040414F 50                      push eax
:00404150 8B4DB0                  mov ecx, dword ptr [ebp-50]
:00404153 E8D84F0000              call 00409130
:00404158 50                      push eax
:00404159 E86F7E0000              call 0040BFCD
:0040415E 83C40C                  add esp, 0000000C
:00404161 33C0                    xor eax, eax
:00404163 8A45A8                  mov al, byte ptr [ebp-58]
:00404166 50                      push eax
:00404167 8B4DB0                  mov ecx, dword ptr [ebp-50]
:0040416A E8C14F0000              call 00409130
:0040416F 50                      push eax
:00404170 E8AB7C0000              call 0040BE20
:00404175 83C408                  add esp, 00000008
:00404178 50                      push eax
:00404179 33C0                    xor eax, eax
:0040417B 8A45C0                  mov al, byte ptr [ebp-40]
:0040417E 8B0485C0D14400          mov eax, dword ptr [4*eax+0044D1C0]
:00404185 50                      push eax
:00404186 8B4DB0                  mov ecx, dword ptr [ebp-50]
:00404189 E8F2530000              call 00409580
:0040418E 50                      push eax

* Possible StringData Ref from Data Obj ->"%s%sΪ%wˡ"
                                  |
:0040418F 6880DE4400              push 0044DE80
:00404194 6A00                    push 00000000
:00404196 E89A4D0300              call 00438F35
:0040419B 83C414                  add esp, 00000014
:0040419E B994A64600              mov ecx, 0046A694
:004041A3 E8F04E0100              call 00419098
:004041A8 C70598DA440001000000    mov dword ptr [0044DA98], 00000001
:004041B2 E91B000000              jmp 004041D2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404134(C)
|
:004041B7 6A0A                    push 0000000A
:004041B9 B994A64600              mov ecx, 0046A694
:004041BE E8614E0100              call 00419024

* Possible StringData Ref from Data Obj ->"ִ֧ӡ"
                                  |
:004041C3 68D8D14400              push 0044D1D8
:004041C8 6A00                    push 00000000
:004041CA E8664D0300              call 00438F35
:004041CF 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004040E9(C), :004041B2(U)
|
:004041D2 E93F010000              jmp 00404316

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040404D(C)
|
:004041D7 33C0                    xor eax, eax
:004041D9 8A4508                  mov al, byte ptr [ebp+08]
:004041DC 8BC8                    mov ecx, eax
:004041DE C1E004                  shl eax, 04
:004041E1 8D8C0818AA4600          lea ecx, dword ptr [eax+ecx+0046AA18]
:004041E8 E833540000              call 00409620
:004041ED 33C9                    xor ecx, ecx
:004041EF 8AC8                    mov cl, al
:004041F1 83F929                  cmp ecx, 00000029
:004041F4 0F8508010000            jne 00404302
:004041FA 33C0                    xor eax, eax
:004041FC 8A4508                  mov al, byte ptr [ebp+08]
:004041FF 8BC8                    mov ecx, eax
:00404201 C1E004                  shl eax, 04
:00404204 8D8C0818AA4600          lea ecx, dword ptr [eax+ecx+0046AA18]
:0040420B E8F0530000              call 00409600
:00404210 8845A0                  mov byte ptr [ebp-60], al

* Possible StringData Ref from Data Obj ->"ߣ佫ľֵ"
                                  |
:00404213 6898DE4400              push 0044DE98
:00404218 6A00                    push 00000000
:0040421A E8164D0300              call 00438F35
:0040421F 83C408                  add esp, 00000008
:00404222 6A01                    push 00000001
:00404224 6883000000              push 00000083
:00404229 8B4594                  mov eax, dword ptr [ebp-6C]
:0040422C 8A4004                  mov al, byte ptr [eax+04]
:0040422F 50                      push eax
:00404230 B900FB4600              mov ecx, 0046FB00
:00404235 E87B8C0300              call 0043CEB5
:0040423A 88459C                  mov byte ptr [ebp-64], al
:0040423D 33C0                    xor eax, eax
:0040423F 8A459C                  mov al, byte ptr [ebp-64]
:00404242 3DFF000000              cmp eax, 000000FF
:00404247 0F84B0000000            je 004042FD
:0040424D 6A07                    push 00000007
:0040424F B994A64600              mov ecx, 0046A694
:00404254 E8CB4D0100              call 00419024
:00404259 33C0                    xor eax, eax
:0040425B 8A459C                  mov al, byte ptr [ebp-64]
:0040425E 8BC8                    mov ecx, eax
:00404260 8D0440                  lea eax, dword ptr [eax+2*eax]
:00404263 C1E003                  shl eax, 03
:00404266 2BC1                    sub eax, ecx
:00404268 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0040426E E8BD4E0000              call 00409130
:00404273 8D0440                  lea eax, dword ptr [eax+2*eax]
:00404276 03C0                    add eax, eax
:00404278 8D04C0                  lea eax, dword ptr [eax+8*eax]
:0040427B 05E8564500              add eax, 004556E8
:00404280 894598                  mov dword ptr [ebp-68], eax
:00404283 33C0                    xor eax, eax
:00404285 8A45A0                  mov al, byte ptr [ebp-60]
:00404288 83F801                  cmp eax, 00000001
:0040428B 0F8515000000            jne 004042A6
:00404291 6A0A                    push 0000000A
:00404293 E890300400              call 00447328
:00404298 83C404                  add esp, 00000004
:0040429B 83C014                  add eax, 00000014
:0040429E 8845A4                  mov byte ptr [ebp-5C], al
:004042A1 E910000000              jmp 004042B6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040428B(C)
|
:004042A6 6A14                    push 00000014
:004042A8 E87B300400              call 00447328
:004042AD 83C404                  add esp, 00000004
:004042B0 83C028                  add eax, 00000028
:004042B3 8845A4                  mov byte ptr [ebp-5C], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004042A1(U)
|
:004042B6 33C0                    xor eax, eax
:004042B8 8A45A4                  mov al, byte ptr [ebp-5C]
:004042BB 50                      push eax

* Possible StringData Ref from Data Obj ->"õC6%wC7㾭ֵ"
                                  |
:004042BC 68B0DE4400              push 0044DEB0
:004042C1 6A00                    push 00000000
:004042C3 E86D4C0300              call 00438F35
:004042C8 83C40C                  add esp, 0000000C
:004042CB 6A01                    push 00000001
:004042CD 8B4D98                  mov ecx, dword ptr [ebp-68]
:004042D0 E80B530000              call 004095E0
:004042D5 33C9                    xor ecx, ecx
:004042D7 8AC8                    mov cl, al
:004042D9 33C0                    xor eax, eax
:004042DB 8A45A4                  mov al, byte ptr [ebp-5C]
:004042DE 03C8                    add ecx, eax
:004042E0 51                      push ecx
:004042E1 8B4D98                  mov ecx, dword ptr [ebp-68]
:004042E4 E8E38E0000              call 0040D1CC
:004042E9 B994A64600              mov ecx, 0046A694
:004042EE E8A54D0100              call 00419098
:004042F3 C70598DA440001000000    mov dword ptr [0044DA98], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404247(C)
|
:004042FD E914000000              jmp 00404316

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004041F4(C)
|

* Possible StringData Ref from Data Obj ->"õ߲ʹã"
                                  |
:00404302 68CCDE4400              push 0044DECC
:00404307 6A00                    push 00000000
:00404309 E8274C0300              call 00438F35
:0040430E 83C408                  add esp, 00000008
:00404311 E8D1310300              call 004374E7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00403CF2(U), :0040402B(U), :004041D2(U), :004042FD(U)
|
:00404316 833D98DA440000          cmp dword ptr [0044DA98], 00000000
:0040431D 0F8431000000            je 00404354
:00404323 68FF000000              push 000000FF
:00404328 8B4508                  mov eax, dword ptr [ebp+08]
:0040432B 50                      push eax
:0040432C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040432F E8F8880000              call 0040CC2C
:00404334 50                      push eax
:00404335 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00404338 E8F3510000              call 00409530
:0040433D 6880000000              push 00000080
:00404342 8B4D94                  mov ecx, dword ptr [ebp-6C]
:00404345 E87A9A0200              call 0042DDC4
:0040434A C70598DA440000000000    mov dword ptr [0044DA98], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040431D(C)
|
:00404354 E900000000              jmp 00404359

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00403FC6(U), :00404354(U)
|
:00404359 5F                      pop edi
:0040435A 5E                      pop esi
:0040435B 5B                      pop ebx
:0040435C C9                      leave
:0040435D C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:004039C0   , :00407F08   
|
:00404360 55                      push ebp
:00404361 8BEC                    mov ebp, esp
:00404363 83EC28                  sub esp, 00000028
:00404366 53                      push ebx
:00404367 56                      push esi
:00404368 57                      push edi
:00404369 C645F0FF                mov [ebp-10], FF
:0040436D B906000000              mov ecx, 00000006
:00404372 8B4508                  mov eax, dword ptr [ebp+08]
:00404375 2BD2                    sub edx, edx
:00404377 F7F1                    div ecx
:00404379 8845F4                  mov byte ptr [ebp-0C], al
:0040437C B906000000              mov ecx, 00000006
:00404381 8B4508                  mov eax, dword ptr [ebp+08]
:00404384 2BD2                    sub edx, edx
:00404386 F7F1                    div ecx
:00404388 83FA03                  cmp edx, 00000003
:0040438B 0F8209000000            jb 0040439A
:00404391 C645F801                mov [ebp-08], 01
:00404395 E904000000              jmp 0040439E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040438B(C)
|
:0040439A C645F800                mov [ebp-08], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404395(U)
|
:0040439E 8B4508                  mov eax, dword ptr [ebp+08]
:004043A1 8A80B0D24400            mov al, byte ptr [eax+0044D2B0]
:004043A7 8845FC                  mov byte ptr [ebp-04], al
:004043AA 8B450C                  mov eax, dword ptr [ebp+0C]
:004043AD 8BC8                    mov ecx, eax
:004043AF 8D0440                  lea eax, dword ptr [eax+2*eax]
:004043B2 C1E003                  shl eax, 03
:004043B5 2BC1                    sub eax, ecx
:004043B7 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004043BD E80E500000              call 004093D0
:004043C2 33C9                    xor ecx, ecx
:004043C4 8AC8                    mov cl, al
:004043C6 83F907                  cmp ecx, 00000007
:004043C9 0F840F000000            je 004043DE
:004043CF 33C0                    xor eax, eax
:004043D1 A0A4354500              mov al, byte ptr [004535A4]
:004043D6 A804                    test al, 04
:004043D8 0F840C000000            je 004043EA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004043C9(C)
|
:004043DE C745EC01000000          mov [ebp-14], 00000001
:004043E5 E907000000              jmp 004043F1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004043D8(C)
|
:004043EA C745EC00000000          mov [ebp-14], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004043E5(U)
|
:004043F1 33C0                    xor eax, eax
:004043F3 8A45F4                  mov al, byte ptr [ebp-0C]
:004043F6 85C0                    test eax, eax
:004043F8 0F8542000000            jne 00404440
:004043FE B998FC4600              mov ecx, 0046FC98
:00404403 E80DF90300              call 00443D15
:00404408 33C9                    xor ecx, ecx
:0040440A 8AC8                    mov cl, al
:0040440C 83F902                  cmp ecx, 00000002
:0040440F 0F852B000000            jne 00404440

* Possible StringData Ref from Data Obj ->"ʱִлƣ"
                                  |
:00404415 68E0DE4400              push 0044DEE0
:0040441A 6A00                    push 00000000
:0040441C E8144B0300              call 00438F35
:00404421 83C408                  add esp, 00000008
:00404424 E8BE300300              call 004374E7
:00404429 6A18                    push 00000018
:0040442B 6A27                    push 00000027
:0040442D 6A00                    push 00000000
:0040442F 6A00                    push 00000000
:00404431 B900FB4600              mov ecx, 0046FB00
:00404436 E8F2660300              call 0043AB2D
:0040443B E901030000              jmp 00404741

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004043F8(C), :0040440F(C)
|
:00404440 837DEC00                cmp dword ptr [ebp-14], 00000000
:00404444 0F8429000000            je 00404473
:0040444A 33C0                    xor eax, eax
:0040444C 8A45F8                  mov al, byte ptr [ebp-08]
:0040444F 8B0485B0D14400          mov eax, dword ptr [4*eax+0044D1B0]
:00404456 50                      push eax
:00404457 33C0                    xor eax, eax
:00404459 8A45F4                  mov al, byte ptr [ebp-0C]
:0040445C 8B0485A8D14400          mov eax, dword ptr [4*eax+0044D1A8]
:00404463 50                      push eax

* Possible StringData Ref from Data Obj ->"%s%s"
                                  |
:00404464 68F8DE4400              push 0044DEF8
:00404469 6A00                    push 00000000
:0040446B E8C54A0300              call 00438F35
:00404470 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404444(C)
|
:00404473 6A00                    push 00000000
:00404475 B900FB4600              mov ecx, 0046FB00
:0040447A E8C1510000              call 00409640
:0040447F 33C0                    xor eax, eax
:00404481 8A45F8                  mov al, byte ptr [ebp-08]
:00404484 85C0                    test eax, eax
:00404486 0F840C000000            je 00404498
:0040448C 6A01                    push 00000001
:0040448E B900FB4600              mov ecx, 0046FB00
:00404493 E8A8510000              call 00409640

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404486(C)
|
:00404498 6A00                    push 00000000
:0040449A 33C0                    xor eax, eax
:0040449C 8A45FC                  mov al, byte ptr [ebp-04]
:0040449F 0D80000000              or eax, 00000080
:004044A4 50                      push eax
:004044A5 8B450C                  mov eax, dword ptr [ebp+0C]
:004044A8 50                      push eax
:004044A9 B900FB4600              mov ecx, 0046FB00
:004044AE E8028A0300              call 0043CEB5
:004044B3 8845F0                  mov byte ptr [ebp-10], al
:004044B6 33C0                    xor eax, eax
:004044B8 8A45F0                  mov al, byte ptr [ebp-10]
:004044BB 3DFF000000              cmp eax, 000000FF
:004044C0 0F847B020000            je 00404741
:004044C6 8B45F0                  mov eax, dword ptr [ebp-10]
:004044C9 50                      push eax
:004044CA 8B450C                  mov eax, dword ptr [ebp+0C]
:004044CD 50                      push eax
:004044CE E8D0090000              call 00404EA3
:004044D3 83C408                  add esp, 00000008
:004044D6 33C0                    xor eax, eax
:004044D8 8A45F0                  mov al, byte ptr [ebp-10]
:004044DB 8BC8                    mov ecx, eax
:004044DD 8D0440                  lea eax, dword ptr [eax+2*eax]
:004044E0 C1E003                  shl eax, 03
:004044E3 2BC1                    sub eax, ecx
:004044E5 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004044EB E8104D0000              call 00409200
:004044F0 668B00                  mov ax, word ptr [eax]
:004044F3 668945E8                mov word ptr [ebp-18], ax
:004044F7 6A00                    push 00000000
:004044F9 8D45E8                  lea eax, dword ptr [ebp-18]
:004044FC 50                      push eax
:004044FD E8D8500100              call 004195DA
:00404502 83C404                  add esp, 00000004
:00404505 50                      push eax
:00404506 8B45F4                  mov eax, dword ptr [ebp-0C]
:00404509 50                      push eax
:0040450A E8C9DBFFFF              call 004020D8
:0040450F 83C40C                  add esp, 0000000C
:00404512 85C0                    test eax, eax
:00404514 0F8427020000            je 00404741
:0040451A 837DEC00                cmp dword ptr [ebp-14], 00000000
:0040451E 0F8451000000            je 00404575
:00404524 33C0                    xor eax, eax
:00404526 8A4510                  mov al, byte ptr [ebp+10]
:00404529 83F803                  cmp eax, 00000003
:0040452C 0F8529000000            jne 0040455B
:00404532 8B4508                  mov eax, dword ptr [ebp+08]
:00404535 8BC8                    mov ecx, eax
:00404537 C1E004                  shl eax, 04
:0040453A 8D8C0818AA4600          lea ecx, dword ptr [eax+ecx+0046AA18]
:00404541 E81A500000              call 00409560
:00404546 50                      push eax

* Possible StringData Ref from Data Obj ->"ʹ%s"
                                  |
:00404547 6808DF4400              push 0044DF08
:0040454C 6A00                    push 00000000
:0040454E E8E2490300              call 00438F35
:00404553 83C40C                  add esp, 0000000C
:00404556 E91A000000              jmp 00404575

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040452C(C)
|
:0040455B 8B4508                  mov eax, dword ptr [ebp+08]
:0040455E 8B0485F0D14400          mov eax, dword ptr [4*eax+0044D1F0]
:00404565 50                      push eax

* Possible StringData Ref from Data Obj ->"%sļƲ"
                                  |
:00404566 6814DF4400              push 0044DF14
:0040456B 6A00                    push 00000000
:0040456D E8C3490300              call 00438F35
:00404572 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040451E(C), :00404556(U)
|
:00404575 33C0                    xor eax, eax
:00404577 8A45F8                  mov al, byte ptr [ebp-08]
:0040457A 85C0                    test eax, eax
:0040457C 0F8477000000            je 004045F9
:00404582 33C0                    xor eax, eax
:00404584 8A45FC                  mov al, byte ptr [ebp-04]
:00404587 83F802                  cmp eax, 00000002
:0040458A 0F8569000000            jne 004045F9
:00404590 B9D0A64600              mov ecx, 0046A6D0
:00404595 E8E64B0000              call 00409180
:0040459A A8F0                    test al, F0
:0040459C 0F8557000000            jne 004045F9
:004045A2 33C0                    xor eax, eax
:004045A4 8A45F0                  mov al, byte ptr [ebp-10]
:004045A7 8BC8                    mov ecx, eax
:004045A9 8D0440                  lea eax, dword ptr [eax+2*eax]
:004045AC C1E003                  shl eax, 03
:004045AF 2BC1                    sub eax, ecx
:004045B1 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004045B7 E8444C0000              call 00409200
:004045BC 668B00                  mov ax, word ptr [eax]
:004045BF 668945E4                mov word ptr [ebp-1C], ax
:004045C3 8B45E5                  mov eax, dword ptr [ebp-1B]
:004045C6 50                      push eax
:004045C7 8B45E4                  mov eax, dword ptr [ebp-1C]
:004045CA 50                      push eax
:004045CB B900FB4600              mov ecx, 0046FB00
:004045D0 E8136C0300              call 0043B1E8
:004045D5 8B45F0                  mov eax, dword ptr [ebp-10]
:004045D8 50                      push eax
:004045D9 8B450C                  mov eax, dword ptr [ebp+0C]
:004045DC 50                      push eax
:004045DD 33C0                    xor eax, eax
:004045DF 8A45F4                  mov al, byte ptr [ebp-0C]
:004045E2 50                      push eax
:004045E3 E863010000              call 0040474B
:004045E8 83C40C                  add esp, 0000000C
:004045EB 33C0                    xor eax, eax
:004045ED 8A45F4                  mov al, byte ptr [ebp-0C]
:004045F0 50                      push eax
:004045F1 E8DF020000              call 004048D5
:004045F6 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040457C(C), :0040458A(C), :0040459C(C)
|
:004045F9 33C0                    xor eax, eax
:004045FB 8A45F4                  mov al, byte ptr [ebp-0C]
:004045FE C1E004                  shl eax, 04
:00404601 33C9                    xor ecx, ecx
:00404603 8A4DFC                  mov cl, byte ptr [ebp-04]
:00404606 0BC1                    or eax, ecx
:00404608 50                      push eax
:00404609 8B4510                  mov eax, dword ptr [ebp+10]
:0040460C 50                      push eax
:0040460D 8B45F0                  mov eax, dword ptr [ebp-10]
:00404610 50                      push eax
:00404611 8B450C                  mov eax, dword ptr [ebp+0C]
:00404614 50                      push eax
:00404615 B9D8BC4600              mov ecx, 0046BCD8
:0040461A E8E9FD0100              call 00424408
:0040461F 33C0                    xor eax, eax
:00404621 8A45F8                  mov al, byte ptr [ebp-08]
:00404624 85C0                    test eax, eax
:00404626 0F840B010000            je 00404737
:0040462C 33C0                    xor eax, eax
:0040462E 8A45F0                  mov al, byte ptr [ebp-10]
:00404631 8BC8                    mov ecx, eax
:00404633 8D0440                  lea eax, dword ptr [eax+2*eax]
:00404636 C1E003                  shl eax, 03
:00404639 2BC1                    sub eax, ecx
:0040463B 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00404641 E8BA4B0000              call 00409200
:00404646 668B00                  mov ax, word ptr [eax]
:00404649 668945E0                mov word ptr [ebp-20], ax
:0040464D C645DC00                mov [ebp-24], 00
:00404651 E903000000              jmp 00404659

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404732(U)
|
:00404656 FE45DC                  inc [ebp-24]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404651(U)
|
:00404659 33C0                    xor eax, eax
:0040465B 8A45DC                  mov al, byte ptr [ebp-24]
:0040465E 83F804                  cmp eax, 00000004
:00404661 0F8DD0000000            jnl 00404737
:00404667 8B45DC                  mov eax, dword ptr [ebp-24]
:0040466A 50                      push eax
:0040466B 8D45E0                  lea eax, dword ptr [ebp-20]
:0040466E 50                      push eax
:0040466F E8E14F0100              call 00419655
:00404674 83C408                  add esp, 00000008
:00404677 668B00                  mov ax, word ptr [eax]
:0040467A 668945D8                mov word ptr [ebp-28], ax
:0040467E 33C0                    xor eax, eax
:00404680 8A45D8                  mov al, byte ptr [ebp-28]
:00404683 3DFF000000              cmp eax, 000000FF
:00404688 0F84A4000000            je 00404732
:0040468E 6A01                    push 00000001
:00404690 8D45D8                  lea eax, dword ptr [ebp-28]
:00404693 50                      push eax
:00404694 E8414F0100              call 004195DA
:00404699 83C404                  add esp, 00000004
:0040469C 50                      push eax
:0040469D 8B45F4                  mov eax, dword ptr [ebp-0C]
:004046A0 50                      push eax
:004046A1 E832DAFFFF              call 004020D8
:004046A6 83C40C                  add esp, 0000000C
:004046A9 85C0                    test eax, eax
:004046AB 0F8481000000            je 00404732
:004046B1 8D45D8                  lea eax, dword ptr [ebp-28]
:004046B4 50                      push eax
:004046B5 E8834E0100              call 0041953D
:004046BA 83C404                  add esp, 00000004
:004046BD 8845F0                  mov byte ptr [ebp-10], al
:004046C0 33C0                    xor eax, eax
:004046C2 8A45F0                  mov al, byte ptr [ebp-10]
:004046C5 3DFF000000              cmp eax, 000000FF
:004046CA 0F8462000000            je 00404732
:004046D0 33C0                    xor eax, eax
:004046D2 8A45F0                  mov al, byte ptr [ebp-10]
:004046D5 8BC8                    mov ecx, eax
:004046D7 8D0440                  lea eax, dword ptr [eax+2*eax]
:004046DA C1E003                  shl eax, 03
:004046DD 2BC1                    sub eax, ecx
:004046DF 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004046E5 E8364B0000              call 00409220
:004046EA 8BD8                    mov ebx, eax
:004046EC 8B450C                  mov eax, dword ptr [ebp+0C]
:004046EF 8BC8                    mov ecx, eax
:004046F1 8D0440                  lea eax, dword ptr [eax+2*eax]
:004046F4 C1E003                  shl eax, 03
:004046F7 2BC1                    sub eax, ecx
:004046F9 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004046FF E81C4B0000              call 00409220
:00404704 3BD8                    cmp ebx, eax
:00404706 0F8426000000            je 00404732
:0040470C 33C0                    xor eax, eax
:0040470E 8A45F4                  mov al, byte ptr [ebp-0C]
:00404711 C1E004                  shl eax, 04
:00404714 33C9                    xor ecx, ecx
:00404716 8A4DFC                  mov cl, byte ptr [ebp-04]
:00404719 0BC1                    or eax, ecx
:0040471B 50                      push eax
:0040471C 8B4510                  mov eax, dword ptr [ebp+10]
:0040471F 50                      push eax
:00404720 8B45F0                  mov eax, dword ptr [ebp-10]
:00404723 50                      push eax
:00404724 8B450C                  mov eax, dword ptr [ebp+0C]
:00404727 50                      push eax
:00404728 B9D8BC4600              mov ecx, 0046BCD8
:0040472D E8D6FC0100              call 00424408

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00404688(C), :004046AB(C), :004046CA(C), :00404706(C)
|
:00404732 E91FFFFFFF              jmp 00404656

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00404626(C), :00404661(C)
|
:00404737 C70598DA440001000000    mov dword ptr [0044DA98], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040443B(U), :004044C0(C), :00404514(C)
|
:00404741 E900000000              jmp 00404746

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404741(U)
|
:00404746 5F                      pop edi
:00404747 5E                      pop esi
:00404748 5B                      pop ebx
:00404749 C9                      leave
:0040474A C3                      ret



* Referenced by a CALL at Address:
|:004045E3   
|
:0040474B 55                      push ebp
:0040474C 8BEC                    mov ebp, esp
:0040474E 83EC28                  sub esp, 00000028
:00404751 53                      push ebx
:00404752 56                      push esi
:00404753 57                      push edi
:00404754 C645EC00                mov [ebp-14], 00
:00404758 8D4DF8                  lea ecx, dword ptr [ebp-08]
:0040475B E810D1FFFF              call 00401870
:00404760 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00404763 E808D1FFFF              call 00401870
:00404768 33C0                    xor eax, eax
:0040476A 8A4510                  mov al, byte ptr [ebp+10]
:0040476D 8BC8                    mov ecx, eax
:0040476F 8D0440                  lea eax, dword ptr [eax+2*eax]
:00404772 C1E003                  shl eax, 03
:00404775 2BC1                    sub eax, ecx
:00404777 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0040477D E87E4A0000              call 00409200
:00404782 50                      push eax
:00404783 8D4DF8                  lea ecx, dword ptr [ebp-08]
:00404786 E805D1FFFF              call 00401890
:0040478B 8A45EC                  mov al, byte ptr [ebp-14]
:0040478E 8845E0                  mov byte ptr [ebp-20], al
:00404791 FE45EC                  inc [ebp-14]
:00404794 8B45F8                  mov eax, dword ptr [ebp-08]
:00404797 50                      push eax
:00404798 8D45E8                  lea eax, dword ptr [ebp-18]
:0040479B 50                      push eax
:0040479C E8835F0300              call 0043A724
:004047A1 83C408                  add esp, 00000008
:004047A4 50                      push eax
:004047A5 33C0                    xor eax, eax
:004047A7 8A45E0                  mov al, byte ptr [ebp-20]
:004047AA 8D0C45A0534500          lea ecx, dword ptr [2*eax+004553A0]
:004047B1 E8DAD0FFFF              call 00401890
:004047B6 C645F000                mov [ebp-10], 00
:004047BA E903000000              jmp 004047C2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004048A4(U)
|
:004047BF FE45F0                  inc [ebp-10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004047BA(U)
|
:004047C2 33C0                    xor eax, eax
:004047C4 8A45F0                  mov al, byte ptr [ebp-10]
:004047C7 83F804                  cmp eax, 00000004
:004047CA 0F8DD9000000            jnl 004048A9
:004047D0 8B45F0                  mov eax, dword ptr [ebp-10]
:004047D3 50                      push eax
:004047D4 8D45F8                  lea eax, dword ptr [ebp-08]
:004047D7 50                      push eax
:004047D8 E8784E0100              call 00419655
:004047DD 83C408                  add esp, 00000008
:004047E0 50                      push eax
:004047E1 8D4DFC                  lea ecx, dword ptr [ebp-04]
:004047E4 E8A7D0FFFF              call 00401890
:004047E9 33C0                    xor eax, eax
:004047EB 8A45F8                  mov al, byte ptr [ebp-08]
:004047EE 3DFF000000              cmp eax, 000000FF
:004047F3 0F84AB000000            je 004048A4
:004047F9 6A01                    push 00000001
:004047FB 8D45FC                  lea eax, dword ptr [ebp-04]
:004047FE 50                      push eax
:004047FF E8D64D0100              call 004195DA
:00404804 83C404                  add esp, 00000004
:00404807 50                      push eax
:00404808 8B4508                  mov eax, dword ptr [ebp+08]
:0040480B 50                      push eax
:0040480C E8C7D8FFFF              call 004020D8
:00404811 83C40C                  add esp, 0000000C
:00404814 85C0                    test eax, eax
:00404816 0F8488000000            je 004048A4
:0040481C 8D45FC                  lea eax, dword ptr [ebp-04]
:0040481F 50                      push eax
:00404820 E8184D0100              call 0041953D
:00404825 83C404                  add esp, 00000004
:00404828 8845F4                  mov byte ptr [ebp-0C], al
:0040482B 33C0                    xor eax, eax
:0040482D 8A45F4                  mov al, byte ptr [ebp-0C]
:00404830 3DFF000000              cmp eax, 000000FF
:00404835 0F8469000000            je 004048A4
:0040483B 33C0                    xor eax, eax
:0040483D 8A45F4                  mov al, byte ptr [ebp-0C]
:00404840 8BC8                    mov ecx, eax
:00404842 8D0440                  lea eax, dword ptr [eax+2*eax]
:00404845 C1E003                  shl eax, 03
:00404848 2BC1                    sub eax, ecx
:0040484A 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00404850 E8CB490000              call 00409220
:00404855 8BD8                    mov ebx, eax
:00404857 33C0                    xor eax, eax
:00404859 8A450C                  mov al, byte ptr [ebp+0C]
:0040485C 8BC8                    mov ecx, eax
:0040485E 8D0440                  lea eax, dword ptr [eax+2*eax]
:00404861 C1E003                  shl eax, 03
:00404864 2BC1                    sub eax, ecx
:00404866 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0040486C E8AF490000              call 00409220
:00404871 3BD8                    cmp ebx, eax
:00404873 0F842B000000            je 004048A4
:00404879 8A45EC                  mov al, byte ptr [ebp-14]
:0040487C 8845DC                  mov byte ptr [ebp-24], al
:0040487F FE45EC                  inc [ebp-14]
:00404882 8B45FC                  mov eax, dword ptr [ebp-04]
:00404885 50                      push eax
:00404886 8D45E4                  lea eax, dword ptr [ebp-1C]
:00404889 50                      push eax
:0040488A E8955E0300              call 0043A724
:0040488F 83C408                  add esp, 00000008
:00404892 50                      push eax
:00404893 33C0                    xor eax, eax
:00404895 8A45DC                  mov al, byte ptr [ebp-24]
:00404898 8D0C45A0534500          lea ecx, dword ptr [2*eax+004553A0]
:0040489F E8ECCFFFFF              call 00401890

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004047F3(C), :00404816(C), :00404835(C), :00404873(C)
|
:004048A4 E916FFFFFF              jmp 004047BF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004047CA(C)
|
:004048A9 C645FCFF                mov [ebp-04], FF
:004048AD 8A45EC                  mov al, byte ptr [ebp-14]
:004048B0 8845D8                  mov byte ptr [ebp-28], al
:004048B3 FE45EC                  inc [ebp-14]
:004048B6 8D45FC                  lea eax, dword ptr [ebp-04]
:004048B9 50                      push eax
:004048BA 33C0                    xor eax, eax
:004048BC 8A45D8                  mov al, byte ptr [ebp-28]
:004048BF 8D0C45A0534500          lea ecx, dword ptr [2*eax+004553A0]
:004048C6 E8C5CFFFFF              call 00401890
:004048CB E900000000              jmp 004048D0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004048CB(U)
|
:004048D0 5F                      pop edi
:004048D1 5E                      pop esi
:004048D2 5B                      pop ebx
:004048D3 C9                      leave
:004048D4 C3                      ret



* Referenced by a CALL at Address:
|:004045F1   
|
:004048D5 55                      push ebp
:004048D6 8BEC                    mov ebp, esp
:004048D8 81EC04010000            sub esp, 00000104
:004048DE 53                      push ebx
:004048DF 56                      push esi
:004048E0 57                      push edi
:004048E1 8D8DFCFEFFFF            lea ecx, dword ptr [ebp+FFFFFEFC]
:004048E7 E8844D0000              call 00409670

* Possible StringData Ref from Data Obj ->"B:HEXEFF.E2"
                                  |
:004048EC 6848354500              push 00453548
:004048F1 8D8DFCFEFFFF            lea ecx, dword ptr [ebp+FFFFFEFC]
:004048F7 E8132C0200              call 0042750F
:004048FC 837D0800                cmp dword ptr [ebp+08], 00000000
:00404900 0F851D000000            jne 00404923
:00404906 B918E54600              mov ecx, 0046E518
:0040490B E8D0470000              call 004090E0
:00404910 50                      push eax
:00404911 6A01                    push 00000001
:00404913 8D8DFCFEFFFF            lea ecx, dword ptr [ebp+FFFFFEFC]
:00404919 E8632D0200              call 00427681
:0040491E E918000000              jmp 0040493B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404900(C)
|
:00404923 B918E54600              mov ecx, 0046E518
:00404928 E8B3470000              call 004090E0
:0040492D 50                      push eax
:0040492E 6A02                    push 00000002
:00404930 8D8DFCFEFFFF            lea ecx, dword ptr [ebp+FFFFFEFC]
:00404936 E8462D0200              call 00427681

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040491E(U)
|
:0040493B 8D8DFCFEFFFF            lea ecx, dword ptr [ebp+FFFFFEFC]
:00404941 E8DA4A0000              call 00409420
:00404946 8B4508                  mov eax, dword ptr [ebp+08]
:00404949 50                      push eax
:0040494A E80D000000              call 0040495C
:0040494F 83C404                  add esp, 00000004
:00404952 E900000000              jmp 00404957

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404952(U)
|
:00404957 5F                      pop edi
:00404958 5E                      pop esi
:00404959 5B                      pop ebx
:0040495A C9                      leave
:0040495B C3                      ret



* Referenced by a CALL at Address:
|:0040494A   
|
:0040495C 55                      push ebp
:0040495D 8BEC                    mov ebp, esp
:0040495F 83EC08                  sub esp, 00000008
:00404962 53                      push ebx
:00404963 56                      push esi
:00404964 57                      push edi
:00404965 837D0800                cmp dword ptr [ebp+08], 00000000
:00404969 0F8549000000            jne 004049B8
:0040496F 6A2D                    push 0000002D
:00404971 B994A64600              mov ecx, 0046A694
:00404976 E8A9460100              call 00419024
:0040497B C745FC10000000          mov [ebp-04], 00000010
:00404982 E904000000              jmp 0040498B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004049A4(U)
|
:00404987 8345FC10                add dword ptr [ebp-04], 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404982(U)
|
:0040498B 817DFCF0020000          cmp dword ptr [ebp-04], 000002F0
:00404992 0F8311000000            jnb 004049A9
:00404998 8B45FC                  mov eax, dword ptr [ebp-04]
:0040499B 50                      push eax
:0040499C E86D000000              call 00404A0E
:004049A1 83C404                  add esp, 00000004
:004049A4 E9DEFFFFFF              jmp 00404987

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404992(C)
|
:004049A9 B994A64600              mov ecx, 0046A694
:004049AE E8E5460100              call 00419098
:004049B3 E93A000000              jmp 004049F2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404969(C)
|
:004049B8 6A1D                    push 0000001D
:004049BA B994A64600              mov ecx, 0046A694
:004049BF E860460100              call 00419024
:004049C4 C745F810000000          mov [ebp-08], 00000010
:004049CB E904000000              jmp 004049D4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004049ED(U)
|
:004049D0 8345F810                add dword ptr [ebp-08], 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004049CB(U)
|
:004049D4 817DF8D0040000          cmp dword ptr [ebp-08], 000004D0
:004049DB 0F8311000000            jnb 004049F2
:004049E1 8B45F8                  mov eax, dword ptr [ebp-08]
:004049E4 50                      push eax
:004049E5 E861020000              call 00404C4B
:004049EA 83C404                  add esp, 00000004
:004049ED E9DEFFFFFF              jmp 004049D0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004049B3(U), :004049DB(C)
|
:004049F2 6A18                    push 00000018
:004049F4 6A27                    push 00000027
:004049F6 6A00                    push 00000000
:004049F8 6A00                    push 00000000
:004049FA B900FB4600              mov ecx, 0046FB00
:004049FF E829610300              call 0043AB2D
:00404A04 E900000000              jmp 00404A09

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404A04(U)
|
:00404A09 5F                      pop edi
:00404A0A 5E                      pop esi
:00404A0B 5B                      pop ebx
:00404A0C C9                      leave
:00404A0D C3                      ret



* Referenced by a CALL at Address:
|:0040499C   
|
:00404A0E 55                      push ebp
:00404A0F 8BEC                    mov ebp, esp
:00404A11 83EC14                  sub esp, 00000014
:00404A14 53                      push ebx
:00404A15 56                      push esi
:00404A16 57                      push edi
:00404A17 C745FC00000000          mov [ebp-04], 00000000
:00404A1E B9B0000000              mov ecx, 000000B0
:00404A23 8B4508                  mov eax, dword ptr [ebp+08]
:00404A26 2BD2                    sub edx, edx
:00404A28 F7F1                    div ecx
:00404A2A 83FA2C                  cmp edx, 0000002C
:00404A2D 0F8248000000            jb 00404A7B
:00404A33 B9B0000000              mov ecx, 000000B0
:00404A38 8B4508                  mov eax, dword ptr [ebp+08]
:00404A3B 2BD2                    sub edx, edx
:00404A3D F7F1                    div ecx
:00404A3F 83FA58                  cmp edx, 00000058
:00404A42 0F822A000000            jb 00404A72
:00404A48 B9B0000000              mov ecx, 000000B0
:00404A4D 8B4508                  mov eax, dword ptr [ebp+08]
:00404A50 2BD2                    sub edx, edx
:00404A52 F7F1                    div ecx
:00404A54 81FA84000000            cmp edx, 00000084
:00404A5A 0F8209000000            jb 00404A69
:00404A60 C645F001                mov [ebp-10], 01
:00404A64 E904000000              jmp 00404A6D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404A5A(C)
|
:00404A69 C645F002                mov [ebp-10], 02

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404A64(U)
|
:00404A6D E904000000              jmp 00404A76

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404A42(C)
|
:00404A72 C645F001                mov [ebp-10], 01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404A6D(U)
|
:00404A76 E904000000              jmp 00404A7F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404A2D(C)
|
:00404A7B C645F000                mov [ebp-10], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404A76(U)
|
:00404A7F 817D08B0000000          cmp dword ptr [ebp+08], 000000B0
:00404A86 0F832D000000            jnb 00404AB9
:00404A8C C745F430000000          mov [ebp-0C], 00000030
:00404A93 8B4508                  mov eax, dword ptr [ebp+08]
:00404A96 8945F8                  mov dword ptr [ebp-08], eax
:00404A99 B8B0000000              mov eax, 000000B0
:00404A9E 2B4508                  sub eax, dword ptr [ebp+08]
:00404AA1 8BC8                    mov ecx, eax
:00404AA3 C1E003                  shl eax, 03
:00404AA6 2BC1                    sub eax, ecx
:00404AA8 8D0481                  lea eax, dword ptr [ecx+4*eax]
:00404AAB 8D0441                  lea eax, dword ptr [ecx+2*eax]
:00404AAE C1E002                  shl eax, 02
:00404AB1 8945EC                  mov dword ptr [ebp-14], eax
:00404AB4 E963000000              jmp 00404B1C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404A86(C)
|
:00404AB9 817D0880010000          cmp dword ptr [ebp+08], 00000180
:00404AC0 0F8332000000            jnb 00404AF8
:00404AC6 8B4508                  mov eax, dword ptr [ebp+08]
:00404AC9 2D80000000              sub eax, 00000080
:00404ACE 8945F4                  mov dword ptr [ebp-0C], eax
:00404AD1 C745F8B0000000          mov [ebp-08], 000000B0
:00404AD8 C745EC00000000          mov [ebp-14], 00000000
:00404ADF 817D0818010000          cmp dword ptr [ebp+08], 00000118
:00404AE6 0F8607000000            jbe 00404AF3
:00404AEC C745FC01000000          mov [ebp-04], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404AE6(C)
|
:00404AF3 E924000000              jmp 00404B1C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404AC0(C)
|
:00404AF8 8B4508                  mov eax, dword ptr [ebp+08]
:00404AFB 2D80000000              sub eax, 00000080
:00404B00 8945F4                  mov dword ptr [ebp-0C], eax
:00404B03 B8B0010000              mov eax, 000001B0
:00404B08 2B45F4                  sub eax, dword ptr [ebp-0C]
:00404B0B 8945F8                  mov dword ptr [ebp-08], eax
:00404B0E C745EC00000000          mov [ebp-14], 00000000
:00404B15 C745FC01000000          mov [ebp-04], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00404AB4(U), :00404AF3(U)
|
:00404B1C 8B45FC                  mov eax, dword ptr [ebp-04]
:00404B1F 50                      push eax
:00404B20 8B45F0                  mov eax, dword ptr [ebp-10]
:00404B23 50                      push eax
:00404B24 8B45EC                  mov eax, dword ptr [ebp-14]
:00404B27 50                      push eax
:00404B28 8B45F8                  mov eax, dword ptr [ebp-08]
:00404B2B 50                      push eax
:00404B2C 8B45F4                  mov eax, dword ptr [ebp-0C]
:00404B2F 50                      push eax
:00404B30 E80D000000              call 00404B42
:00404B35 83C414                  add esp, 00000014
:00404B38 E900000000              jmp 00404B3D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404B38(U)
|
:00404B3D 5F                      pop edi
:00404B3E 5E                      pop esi
:00404B3F 5B                      pop ebx
:00404B40 C9                      leave
:00404B41 C3                      ret



* Referenced by a CALL at Address:
|:00404B30   
|
:00404B42 55                      push ebp
:00404B43 8BEC                    mov ebp, esp
:00404B45 83EC08                  sub esp, 00000008
:00404B48 53                      push ebx
:00404B49 56                      push esi
:00404B4A 57                      push edi
:00404B4B 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00404B4E E81DCDFFFF              call 00401870
:00404B53 E83F240200              call 00426F97
:00404B58 B900FB4600              mov ecx, 0046FB00
:00404B5D E8ED990300              call 0043E54F
:00404B62 6A18                    push 00000018
:00404B64 6A27                    push 00000027
:00404B66 6A00                    push 00000000
:00404B68 6A00                    push 00000000
:00404B6A B900FB4600              mov ecx, 0046FB00
:00404B6F E8B95F0300              call 0043AB2D
:00404B74 837D1800                cmp dword ptr [ebp+18], 00000000
:00404B78 0F847A000000            je 00404BF8
:00404B7E C645F800                mov [ebp-08], 00
:00404B82 E903000000              jmp 00404B8A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404BF3(U)
|
:00404B87 FE45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404B82(U)
|
:00404B8A 33C0                    xor eax, eax
:00404B8C 8A45F8                  mov al, byte ptr [ebp-08]
:00404B8F 8D0445A0534500          lea eax, dword ptr [2*eax+004553A0]
:00404B96 50                      push eax
:00404B97 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00404B9A E8F1CCFFFF              call 00401890
:00404B9F 33C0                    xor eax, eax
:00404BA1 8A45FC                  mov al, byte ptr [ebp-04]
:00404BA4 3DFF000000              cmp eax, 000000FF
:00404BA9 0F8505000000            jne 00404BB4
:00404BAF E944000000              jmp 00404BF8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404BA9(C)
|
:00404BB4 6A04                    push 00000004
:00404BB6 6A04                    push 00000004
:00404BB8 6A00                    push 00000000
:00404BBA 6800430300              push 00034300
:00404BBF B9E8E44600              mov ecx, 0046E4E8
:00404BC4 E8572B0400              call 00447720
:00404BC9 0500240000              add eax, 00002400
:00404BCE 50                      push eax
:00404BCF 6A30                    push 00000030
:00404BD1 6A30                    push 00000030
:00404BD3 33C0                    xor eax, eax
:00404BD5 8A45FD                  mov al, byte ptr [ebp-03]
:00404BD8 83C003                  add eax, 00000003
:00404BDB C1E004                  shl eax, 04
:00404BDE 50                      push eax
:00404BDF 33C0                    xor eax, eax
:00404BE1 8A45FC                  mov al, byte ptr [ebp-04]
:00404BE4 C1E004                  shl eax, 04
:00404BE7 83C008                  add eax, 00000008
:00404BEA 50                      push eax
:00404BEB E8C5860300              call 0043D2B5
:00404BF0 83C418                  add esp, 00000018
:00404BF3 E98FFFFFFF              jmp 00404B87

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00404B78(C), :00404BAF(U)
|
:00404BF8 6A04                    push 00000004
:00404BFA 6A04                    push 00000004
:00404BFC 6A00                    push 00000000
:00404BFE 8B4510                  mov eax, dword ptr [ebp+10]
:00404C01 50                      push eax
:00404C02 B918E54600              mov ecx, 0046E518
:00404C07 E8142B0400              call 00447720
:00404C0C 33C9                    xor ecx, ecx
:00404C0E 8A4D14                  mov cl, byte ptr [ebp+14]
:00404C11 8BD1                    mov edx, ecx
:00404C13 8D0CC9                  lea ecx, dword ptr [ecx+8*ecx]
:00404C16 8D0CC9                  lea ecx, dword ptr [ecx+8*ecx]
:00404C19 8D0CCA                  lea ecx, dword ptr [edx+8*ecx]
:00404C1C C1E106                  shl ecx, 06
:00404C1F 03C1                    add eax, ecx
:00404C21 50                      push eax
:00404C22 8B450C                  mov eax, dword ptr [ebp+0C]
:00404C25 50                      push eax
:00404C26 68EC000000              push 000000EC
:00404C2B 8B4508                  mov eax, dword ptr [ebp+08]
:00404C2E 50                      push eax
:00404C2F 68C9000000              push 000000C9
:00404C34 E87C860300              call 0043D2B5
:00404C39 83C418                  add esp, 00000018
:00404C3C E876230200              call 00426FB7
:00404C41 E900000000              jmp 00404C46

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404C41(U)
|
:00404C46 5F                      pop edi
:00404C47 5E                      pop esi
:00404C48 5B                      pop ebx
:00404C49 C9                      leave
:00404C4A C3                      ret



* Referenced by a CALL at Address:
|:004049E5   
|
:00404C4B 55                      push ebp
:00404C4C 8BEC                    mov ebp, esp
:00404C4E 83EC14                  sub esp, 00000014
:00404C51 53                      push ebx
:00404C52 56                      push esi
:00404C53 57                      push edi
:00404C54 C745FC00000000          mov [ebp-04], 00000000
:00404C5B B9C8000000              mov ecx, 000000C8
:00404C60 8B4508                  mov eax, dword ptr [ebp+08]
:00404C63 2BD2                    sub edx, edx
:00404C65 F7F1                    div ecx
:00404C67 83FA32                  cmp edx, 00000032
:00404C6A 0F8248000000            jb 00404CB8
:00404C70 B9C8000000              mov ecx, 000000C8
:00404C75 8B4508                  mov eax, dword ptr [ebp+08]
:00404C78 2BD2                    sub edx, edx
:00404C7A F7F1                    div ecx
:00404C7C 83FA64                  cmp edx, 00000064
:00404C7F 0F822A000000            jb 00404CAF
:00404C85 B9C8000000              mov ecx, 000000C8
:00404C8A 8B4508                  mov eax, dword ptr [ebp+08]
:00404C8D 2BD2                    sub edx, edx
:00404C8F F7F1                    div ecx
:00404C91 81FA96000000            cmp edx, 00000096
:00404C97 0F8209000000            jb 00404CA6
:00404C9D C645F001                mov [ebp-10], 01
:00404CA1 E904000000              jmp 00404CAA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404C97(C)
|
:00404CA6 C645F002                mov [ebp-10], 02

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404CA1(U)
|
:00404CAA E904000000              jmp 00404CB3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404C7F(C)
|
:00404CAF C645F001                mov [ebp-10], 01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404CAA(U)
|
:00404CB3 E904000000              jmp 00404CBC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404C6A(C)
|
:00404CB8 C645F000                mov [ebp-10], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404CB3(U)
|
:00404CBC 817D08C8000000          cmp dword ptr [ebp+08], 000000C8
:00404CC3 0F831D000000            jnb 00404CE6
:00404CC9 C745F408000000          mov [ebp-0C], 00000008
:00404CD0 8B4508                  mov eax, dword ptr [ebp+08]
:00404CD3 8945F8                  mov dword ptr [ebp-08], eax
:00404CD6 B8C8000000              mov eax, 000000C8
:00404CDB 2B4508                  sub eax, dword ptr [ebp+08]
:00404CDE 8945EC                  mov dword ptr [ebp-14], eax
:00404CE1 E963000000              jmp 00404D49

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404CC3(C)
|
:00404CE6 817D0870020000          cmp dword ptr [ebp+08], 00000270
:00404CED 0F8332000000            jnb 00404D25
:00404CF3 8B4508                  mov eax, dword ptr [ebp+08]
:00404CF6 2DC0000000              sub eax, 000000C0
:00404CFB 8945F4                  mov dword ptr [ebp-0C], eax
:00404CFE C745F8C8000000          mov [ebp-08], 000000C8
:00404D05 C745EC00000000          mov [ebp-14], 00000000
:00404D0C 817D089C010000          cmp dword ptr [ebp+08], 0000019C
:00404D13 0F8607000000            jbe 00404D20
:00404D19 C745FC01000000          mov [ebp-04], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404D13(C)
|
:00404D20 E924000000              jmp 00404D49

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404CED(C)
|
:00404D25 8B4508                  mov eax, dword ptr [ebp+08]
:00404D28 2DC0000000              sub eax, 000000C0
:00404D2D 8945F4                  mov dword ptr [ebp-0C], eax
:00404D30 B878020000              mov eax, 00000278
:00404D35 2B45F4                  sub eax, dword ptr [ebp-0C]
:00404D38 8945F8                  mov dword ptr [ebp-08], eax
:00404D3B C745EC00000000          mov [ebp-14], 00000000
:00404D42 C745FC01000000          mov [ebp-04], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00404CE1(U), :00404D20(U)
|
:00404D49 8B45FC                  mov eax, dword ptr [ebp-04]
:00404D4C 50                      push eax
:00404D4D 33C0                    xor eax, eax
:00404D4F 8A45F0                  mov al, byte ptr [ebp-10]
:00404D52 50                      push eax
:00404D53 8B45EC                  mov eax, dword ptr [ebp-14]
:00404D56 50                      push eax
:00404D57 8B45F8                  mov eax, dword ptr [ebp-08]
:00404D5A 50                      push eax
:00404D5B 8B45F4                  mov eax, dword ptr [ebp-0C]
:00404D5E 50                      push eax
:00404D5F E80D000000              call 00404D71
:00404D64 83C414                  add esp, 00000014
:00404D67 E900000000              jmp 00404D6C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404D67(U)
|
:00404D6C 5F                      pop edi
:00404D6D 5E                      pop esi
:00404D6E 5B                      pop ebx
:00404D6F C9                      leave
:00404D70 C3                      ret



* Referenced by a CALL at Address:
|:00404D5F   
|
:00404D71 55                      push ebp
:00404D72 8BEC                    mov ebp, esp
:00404D74 83EC0C                  sub esp, 0000000C
:00404D77 53                      push ebx
:00404D78 56                      push esi
:00404D79 57                      push edi
:00404D7A 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00404D7D E8EECAFFFF              call 00401870
:00404D82 E810220200              call 00426F97
:00404D87 B900FB4600              mov ecx, 0046FB00
:00404D8C E8BE970300              call 0043E54F
:00404D91 6A18                    push 00000018
:00404D93 6A27                    push 00000027
:00404D95 6A00                    push 00000000
:00404D97 6A00                    push 00000000
:00404D99 B900FB4600              mov ecx, 0046FB00
:00404D9E E88A5D0300              call 0043AB2D
:00404DA3 837D1800                cmp dword ptr [ebp+18], 00000000
:00404DA7 0F847A000000            je 00404E27
:00404DAD C645F400                mov [ebp-0C], 00
:00404DB1 E903000000              jmp 00404DB9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404E22(U)
|
:00404DB6 FE45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404DB1(U)
|
:00404DB9 33C0                    xor eax, eax
:00404DBB 8A45F4                  mov al, byte ptr [ebp-0C]
:00404DBE 8D0445A0534500          lea eax, dword ptr [2*eax+004553A0]
:00404DC5 50                      push eax
:00404DC6 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00404DC9 E8C2CAFFFF              call 00401890
:00404DCE 33C0                    xor eax, eax
:00404DD0 8A45FC                  mov al, byte ptr [ebp-04]
:00404DD3 3DFF000000              cmp eax, 000000FF
:00404DD8 0F8505000000            jne 00404DE3
:00404DDE E944000000              jmp 00404E27

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404DD8(C)
|
:00404DE3 6A04                    push 00000004
:00404DE5 6A04                    push 00000004
:00404DE7 6A00                    push 00000000
:00404DE9 6800790300              push 00037900
:00404DEE B9E8E44600              mov ecx, 0046E4E8
:00404DF3 E828290400              call 00447720
:00404DF8 0500CF0000              add eax, 0000CF00
:00404DFD 50                      push eax
:00404DFE 6A30                    push 00000030
:00404E00 6A30                    push 00000030
:00404E02 33C0                    xor eax, eax
:00404E04 8A45FD                  mov al, byte ptr [ebp-03]
:00404E07 83C003                  add eax, 00000003
:00404E0A C1E004                  shl eax, 04
:00404E0D 50                      push eax
:00404E0E 33C0                    xor eax, eax
:00404E10 8A45FC                  mov al, byte ptr [ebp-04]
:00404E13 C1E004                  shl eax, 04
:00404E16 83C008                  add eax, 00000008
:00404E19 50                      push eax
:00404E1A E896840300              call 0043D2B5
:00404E1F 83C418                  add esp, 00000018
:00404E22 E98FFFFFFF              jmp 00404DB6

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00404DA7(C), :00404DDE(U)
|
:00404E27 C745F800000000          mov [ebp-08], 00000000
:00404E2E E903000000              jmp 00404E36

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404E8F(U)
|
:00404E33 FF45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404E2E(U)
|
:00404E36 817DF8C8000000          cmp dword ptr [ebp-08], 000000C8
:00404E3D 0F8351000000            jnb 00404E94
:00404E43 6A04                    push 00000004
:00404E45 6A04                    push 00000004
:00404E47 6A00                    push 00000000
:00404E49 8B4514                  mov eax, dword ptr [ebp+14]
:00404E4C 8D0480                  lea eax, dword ptr [eax+4*eax]
:00404E4F 8D0480                  lea eax, dword ptr [eax+4*eax]
:00404E52 8D0480                  lea eax, dword ptr [eax+4*eax]
:00404E55 8D0480                  lea eax, dword ptr [eax+4*eax]
:00404E58 C1E006                  shl eax, 06
:00404E5B 50                      push eax
:00404E5C B918E54600              mov ecx, 0046E518
:00404E61 E8BA280400              call 00447720
:00404E66 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00404E69 8D0C89                  lea ecx, dword ptr [ecx+4*ecx]
:00404E6C 8D0C89                  lea ecx, dword ptr [ecx+4*ecx]
:00404E6F 8D04C8                  lea eax, dword ptr [eax+8*ecx]
:00404E72 034510                  add eax, dword ptr [ebp+10]
:00404E75 50                      push eax
:00404E76 6A01                    push 00000001
:00404E78 8B450C                  mov eax, dword ptr [ebp+0C]
:00404E7B 50                      push eax
:00404E7C 8B45F8                  mov eax, dword ptr [ebp-08]
:00404E7F 83C05C                  add eax, 0000005C
:00404E82 50                      push eax
:00404E83 8B4508                  mov eax, dword ptr [ebp+08]
:00404E86 50                      push eax
:00404E87 E829840300              call 0043D2B5
:00404E8C 83C418                  add esp, 00000018
:00404E8F E99FFFFFFF              jmp 00404E33

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404E3D(C)
|
:00404E94 E81E210200              call 00426FB7
:00404E99 E900000000              jmp 00404E9E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404E99(U)
|
:00404E9E 5F                      pop edi
:00404E9F 5E                      pop esi
:00404EA0 5B                      pop ebx
:00404EA1 C9                      leave
:00404EA2 C3                      ret



* Referenced by a CALL at Addresses:
|:004044CE   , :00404FBA   , :0040561C   , :004059F8   , :00405DC2   
|:0040618A   , :00406517   , :0040674E   
|
:00404EA3 55                      push ebp
:00404EA4 8BEC                    mov ebp, esp
:00404EA6 53                      push ebx
:00404EA7 56                      push esi
:00404EA8 57                      push edi
:00404EA9 8B450C                  mov eax, dword ptr [ebp+0C]
:00404EAC 50                      push eax
:00404EAD 8B4508                  mov eax, dword ptr [ebp+08]
:00404EB0 50                      push eax
:00404EB1 E827440100              call 004192DD
:00404EB6 83C408                  add esp, 00000008
:00404EB9 33C0                    xor eax, eax
:00404EBB 8A4508                  mov al, byte ptr [ebp+08]
:00404EBE 8BC8                    mov ecx, eax
:00404EC0 8D0440                  lea eax, dword ptr [eax+2*eax]
:00404EC3 C1E003                  shl eax, 03
:00404EC6 2BC1                    sub eax, ecx
:00404EC8 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00404ECE E8EC6F0200              call 0042BEBF
:00404ED3 33C0                    xor eax, eax
:00404ED5 8A450C                  mov al, byte ptr [ebp+0C]
:00404ED8 8BC8                    mov ecx, eax
:00404EDA 8D0440                  lea eax, dword ptr [eax+2*eax]
:00404EDD C1E003                  shl eax, 03
:00404EE0 2BC1                    sub eax, ecx
:00404EE2 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00404EE8 E8D26F0200              call 0042BEBF
:00404EED E900000000              jmp 00404EF2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404EED(U)
|
:00404EF2 5F                      pop edi
:00404EF3 5E                      pop esi
:00404EF4 5B                      pop ebx
:00404EF5 C9                      leave
:00404EF6 C3                      ret



* Referenced by a CALL at Addresses:
|:004039DE   , :00407F26   
|
:00404EF7 55                      push ebp
:00404EF8 8BEC                    mov ebp, esp
:00404EFA 83EC24                  sub esp, 00000024
:00404EFD 53                      push ebx
:00404EFE 56                      push esi
:00404EFF 57                      push edi
:00404F00 C645F4FF                mov [ebp-0C], FF
:00404F04 8B4508                  mov eax, dword ptr [ebp+08]
:00404F07 8A80B0D24400            mov al, byte ptr [eax+0044D2B0]
:00404F0D 8845FC                  mov byte ptr [ebp-04], al
:00404F10 8B450C                  mov eax, dword ptr [ebp+0C]
:00404F13 8BC8                    mov ecx, eax
:00404F15 8D0440                  lea eax, dword ptr [eax+2*eax]
:00404F18 C1E003                  shl eax, 03
:00404F1B 2BC1                    sub eax, ecx
:00404F1D 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00404F23 E8A8440000              call 004093D0
:00404F28 33C9                    xor ecx, ecx
:00404F2A 8AC8                    mov cl, al
:00404F2C 83F907                  cmp ecx, 00000007
:00404F2F 0F840F000000            je 00404F44
:00404F35 33C0                    xor eax, eax
:00404F37 A0A4354500              mov al, byte ptr [004535A4]
:00404F3C A804                    test al, 04
:00404F3E 0F840C000000            je 00404F50

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404F2F(C)
|
:00404F44 C745EC01000000          mov [ebp-14], 00000001
:00404F4B E907000000              jmp 00404F57

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404F3E(C)
|
:00404F50 C745EC00000000          mov [ebp-14], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404F4B(U)
|
:00404F57 C745F000000000          mov [ebp-10], 00000000
:00404F5E C745F800000000          mov [ebp-08], 00000000
:00404F65 837DEC00                cmp dword ptr [ebp-14], 00000000
:00404F69 0F8415000000            je 00404F84

* Possible StringData Ref from Data Obj ->"У"
                                  |
:00404F6F A1B0D14400              mov eax, dword ptr [0044D1B0]
:00404F74 50                      push eax

* Possible StringData Ref from Data Obj ->"%sĲֵ"
                                  |
:00404F75 6820DF4400              push 0044DF20
:00404F7A 6A00                    push 00000000
:00404F7C E8B43F0300              call 00438F35
:00404F81 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404F69(C)
|
:00404F84 6A00                    push 00000000
:00404F86 33C0                    xor eax, eax
:00404F88 8A45FC                  mov al, byte ptr [ebp-04]
:00404F8B 0D80000000              or eax, 00000080
:00404F90 50                      push eax
:00404F91 8B450C                  mov eax, dword ptr [ebp+0C]
:00404F94 50                      push eax
:00404F95 B900FB4600              mov ecx, 0046FB00
:00404F9A E8167F0300              call 0043CEB5
:00404F9F 8845F4                  mov byte ptr [ebp-0C], al
:00404FA2 33C0                    xor eax, eax
:00404FA4 8A45F4                  mov al, byte ptr [ebp-0C]
:00404FA7 3DFF000000              cmp eax, 000000FF
:00404FAC 0F8479020000            je 0040522B
:00404FB2 8B45F4                  mov eax, dword ptr [ebp-0C]
:00404FB5 50                      push eax
:00404FB6 8B450C                  mov eax, dword ptr [ebp+0C]
:00404FB9 50                      push eax
:00404FBA E8E4FEFFFF              call 00404EA3
:00404FBF 83C408                  add esp, 00000008
:00404FC2 33C0                    xor eax, eax
:00404FC4 8A45F4                  mov al, byte ptr [ebp-0C]
:00404FC7 8BC8                    mov ecx, eax
:00404FC9 8D0440                  lea eax, dword ptr [eax+2*eax]
:00404FCC C1E003                  shl eax, 03
:00404FCF 2BC1                    sub eax, ecx
:00404FD1 0598C04600              add eax, 0046C098
:00404FD6 8945E8                  mov dword ptr [ebp-18], eax
:00404FD9 33C0                    xor eax, eax
:00404FDB 8A45F4                  mov al, byte ptr [ebp-0C]
:00404FDE 8BC8                    mov ecx, eax
:00404FE0 8D0440                  lea eax, dword ptr [eax+2*eax]
:00404FE3 C1E003                  shl eax, 03
:00404FE6 2BC1                    sub eax, ecx
:00404FE8 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00404FEE E86D420000              call 00409260
:00404FF3 33C9                    xor ecx, ecx
:00404FF5 8AC8                    mov cl, al
:00404FF7 85C9                    test ecx, ecx
:00404FF9 0F8520000000            jne 0040501F
:00404FFF 6A0A                    push 0000000A
:00405001 B994A64600              mov ecx, 0046A694
:00405006 E819400100              call 00419024

* Possible StringData Ref from Data Obj ->"ִ֧ӡ"
                                  |
:0040500B 68D8D14400              push 0044D1D8
:00405010 6A00                    push 00000000
:00405012 E81E3F0300              call 00438F35
:00405017 83C408                  add esp, 00000008
:0040501A E911020000              jmp 00405230

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404FF9(C)
|
:0040501F 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00405022 E8D9410000              call 00409200
:00405027 668B00                  mov ax, word ptr [eax]
:0040502A 668945E4                mov word ptr [ebp-1C], ax
:0040502E 33C0                    xor eax, eax
:00405030 8A45F4                  mov al, byte ptr [ebp-0C]
:00405033 8BC8                    mov ecx, eax
:00405035 8D0440                  lea eax, dword ptr [eax+2*eax]
:00405038 C1E003                  shl eax, 03
:0040503B 2BC1                    sub eax, ecx
:0040503D 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00405043 E8D8410000              call 00409220
:00405048 50                      push eax
:00405049 6A02                    push 00000002
:0040504B 33C0                    xor eax, eax
:0040504D 8A45E5                  mov al, byte ptr [ebp-1B]
:00405050 8D0440                  lea eax, dword ptr [eax+2*eax]
:00405053 50                      push eax
:00405054 33C0                    xor eax, eax
:00405056 8A45E4                  mov al, byte ptr [ebp-1C]
:00405059 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040505C 50                      push eax
:0040505D B900FB4600              mov ecx, 0046FB00
:00405062 E8D9990300              call 0043EA40
:00405067 6A01                    push 00000001
:00405069 8B4510                  mov eax, dword ptr [ebp+10]
:0040506C 50                      push eax
:0040506D 6A04                    push 00000004
:0040506F 8B45F4                  mov eax, dword ptr [ebp-0C]
:00405072 50                      push eax
:00405073 8B450C                  mov eax, dword ptr [ebp+0C]
:00405076 50                      push eax
:00405077 E89FD1FFFF              call 0040221B
:0040507C 83C414                  add esp, 00000014
:0040507F 85C0                    test eax, eax
:00405081 0F8484010000            je 0040520B
:00405087 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0040508A E8F1440000              call 00409580
:0040508F 50                      push eax

* Possible StringData Ref from Data Obj ->"%sĲֵˡ"
                                  |
:00405090 6834DF4400              push 0044DF34
:00405095 6A00                    push 00000000
:00405097 E8993E0300              call 00438F35
:0040509C 83C40C                  add esp, 0000000C
:0040509F 8B4510                  mov eax, dword ptr [ebp+10]
:004050A2 50                      push eax
:004050A3 8B4508                  mov eax, dword ptr [ebp+08]
:004050A6 50                      push eax
:004050A7 8B45F4                  mov eax, dword ptr [ebp-0C]
:004050AA 50                      push eax
:004050AB E885010000              call 00405235
:004050B0 83C40C                  add esp, 0000000C
:004050B3 33C9                    xor ecx, ecx
:004050B5 8AC8                    mov cl, al
:004050B7 894DF8                  mov dword ptr [ebp-08], ecx
:004050BA B9D0A64600              mov ecx, 0046A6D0
:004050BF E8BC400000              call 00409180
:004050C4 F6C401                  test ah, 01
:004050C7 0F8536000000            jne 00405103
:004050CD C645E000                mov [ebp-20], 00
:004050D1 E903000000              jmp 004050D9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004050F9(U)
|
:004050D6 FE45E0                  inc [ebp-20]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004050D1(U)
|
:004050D9 33C0                    xor eax, eax
:004050DB 8A45E0                  mov al, byte ptr [ebp-20]
:004050DE 83F803                  cmp eax, 00000003
:004050E1 0F8D17000000            jnl 004050FE
:004050E7 6A0C                    push 0000000C
:004050E9 8B45F8                  mov eax, dword ptr [ebp-08]
:004050EC 50                      push eax
:004050ED 8B45F4                  mov eax, dword ptr [ebp-0C]
:004050F0 50                      push eax
:004050F1 E86D4A0300              call 00439B63
:004050F6 83C40C                  add esp, 0000000C
:004050F9 E9D8FFFFFF              jmp 004050D6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004050E1(C)
|
:004050FE E9C5000000              jmp 004051C8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004050C7(C)
|
:00405103 8B45F4                  mov eax, dword ptr [ebp-0C]
:00405106 50                      push eax
:00405107 8D45DC                  lea eax, dword ptr [ebp-24]
:0040510A 50                      push eax
:0040510B E8B14C0300              call 00439DC1
:00405110 83C408                  add esp, 00000008
:00405113 33C0                    xor eax, eax
:00405115 8A45F4                  mov al, byte ptr [ebp-0C]
:00405118 8BC8                    mov ecx, eax
:0040511A 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040511D C1E003                  shl eax, 03
:00405120 2BC1                    sub eax, ecx
:00405122 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00405128 E8F3400000              call 00409220
:0040512D 85C0                    test eax, eax
:0040512F 0F8409000000            je 0040513E
:00405135 C645DC0E                mov [ebp-24], 0E
:00405139 E904000000              jmp 00405142

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040512F(C)
|
:0040513E C645DC2A                mov [ebp-24], 2A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405139(U)
|
:00405142 33C0                    xor eax, eax
:00405144 A0BDFC4600              mov al, byte ptr [0046FCBD]
:00405149 03C0                    add eax, eax
:0040514B 83C006                  add eax, 00000006
:0040514E 50                      push eax
:0040514F B9B0FA4600              mov ecx, 0046FAB0
:00405154 E857400000              call 004091B0
:00405159 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040515C 50                      push eax
:0040515D 8B45DC                  mov eax, dword ptr [ebp-24]
:00405160 50                      push eax
:00405161 E8C04C0300              call 00439E26
:00405166 83C408                  add esp, 00000008
:00405169 E85A220300              call 004373C8
:0040516E 6A01                    push 00000001
:00405170 E846240300              call 004375BB
:00405175 83C404                  add esp, 00000004
:00405178 33C0                    xor eax, eax
:0040517A A0BDFC4600              mov al, byte ptr [0046FCBD]
:0040517F 03C0                    add eax, eax
:00405181 83C006                  add eax, 00000006
:00405184 50                      push eax
:00405185 B9B0FA4600              mov ecx, 0046FAB0
:0040518A E821400000              call 004091B0
:0040518F 6A01                    push 00000001
:00405191 8B45F8                  mov eax, dword ptr [ebp-08]
:00405194 50                      push eax
:00405195 8B45F4                  mov eax, dword ptr [ebp-0C]
:00405198 50                      push eax
:00405199 8B45DC                  mov eax, dword ptr [ebp-24]
:0040519C 50                      push eax
:0040519D E8CC4F0300              call 0043A16E
:004051A2 83C410                  add esp, 00000010
:004051A5 E81E220300              call 004373C8
:004051AA 6A01                    push 00000001
:004051AC E80A240300              call 004375BB
:004051B1 83C404                  add esp, 00000004
:004051B4 6A09                    push 00000009
:004051B6 6A21                    push 00000021
:004051B8 8B45DD                  mov eax, dword ptr [ebp-23]
:004051BB 50                      push eax
:004051BC 6A06                    push 00000006
:004051BE B900FB4600              mov ecx, 0046FB00
:004051C3 E865590300              call 0043AB2D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004050FE(U)
|
:004051C8 33C0                    xor eax, eax
:004051CA 8A45F4                  mov al, byte ptr [ebp-0C]
:004051CD 8BC8                    mov ecx, eax
:004051CF 8D0440                  lea eax, dword ptr [eax+2*eax]
:004051D2 C1E003                  shl eax, 03
:004051D5 2BC1                    sub eax, ecx
:004051D7 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004051DD E87E400000              call 00409260
:004051E2 33C9                    xor ecx, ecx
:004051E4 8AC8                    mov cl, al
:004051E6 2B4DF8                  sub ecx, dword ptr [ebp-08]
:004051E9 51                      push ecx
:004051EA 33C0                    xor eax, eax
:004051EC 8A45F4                  mov al, byte ptr [ebp-0C]
:004051EF 8BC8                    mov ecx, eax
:004051F1 8D0440                  lea eax, dword ptr [eax+2*eax]
:004051F4 C1E003                  shl eax, 03
:004051F7 2BC1                    sub eax, ecx
:004051F9 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004051FF E841520200              call 0042A445
:00405204 C745F001000000          mov [ebp-10], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405081(C)
|
:0040520B 8B45F0                  mov eax, dword ptr [ebp-10]
:0040520E 50                      push eax
:0040520F 33C0                    xor eax, eax
:00405211 8A45F4                  mov al, byte ptr [ebp-0C]
:00405214 50                      push eax
:00405215 8B450C                  mov eax, dword ptr [ebp+0C]
:00405218 50                      push eax
:00405219 E89A010000              call 004053B8
:0040521E 83C40C                  add esp, 0000000C
:00405221 C70598DA440001000000    mov dword ptr [0044DA98], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404FAC(C)
|
:0040522B E900000000              jmp 00405230

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040501A(U), :0040522B(U)
|
:00405230 5F                      pop edi
:00405231 5E                      pop esi
:00405232 5B                      pop ebx
:00405233 C9                      leave
:00405234 C3                      ret



* Referenced by a CALL at Address:
|:004050AB   
|
:00405235 55                      push ebp
:00405236 8BEC                    mov ebp, esp
:00405238 83EC10                  sub esp, 00000010
:0040523B 53                      push ebx
:0040523C 56                      push esi
:0040523D 57                      push edi
:0040523E C645F800                mov [ebp-08], 00
:00405242 8A45F8                  mov al, byte ptr [ebp-08]
:00405245 8845F4                  mov byte ptr [ebp-0C], al
:00405248 33C0                    xor eax, eax
:0040524A 8A450C                  mov al, byte ptr [ebp+0C]
:0040524D 8945F0                  mov dword ptr [ebp-10], eax
:00405250 E99F000000              jmp 004052F4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004052F8(C)
|
:00405255 33C0                    xor eax, eax
:00405257 8A4510                  mov al, byte ptr [ebp+10]
:0040525A 83F802                  cmp eax, 00000002
:0040525D 0F8509000000            jne 0040526C
:00405263 C645F408                mov [ebp-0C], 08
:00405267 E904000000              jmp 00405270

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040525D(C)
|
:0040526C C645F405                mov [ebp-0C], 05

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405267(U)
|
:00405270 33C0                    xor eax, eax
:00405272 8A4510                  mov al, byte ptr [ebp+10]
:00405275 83F802                  cmp eax, 00000002
:00405278 0F8509000000            jne 00405287
:0040527E C645F805                mov [ebp-08], 05
:00405282 E904000000              jmp 0040528B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405278(C)
|
:00405287 C645F804                mov [ebp-08], 04

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405282(U)
|
:0040528B E987000000              jmp 00405317

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405302(C)
|
:00405290 33C0                    xor eax, eax
:00405292 8A4510                  mov al, byte ptr [ebp+10]
:00405295 83F802                  cmp eax, 00000002
:00405298 0F8509000000            jne 004052A7
:0040529E C645F40F                mov [ebp-0C], 0F
:004052A2 E904000000              jmp 004052AB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405298(C)
|
:004052A7 C645F40A                mov [ebp-0C], 0A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004052A2(U)
|
:004052AB 33C0                    xor eax, eax
:004052AD 8A4510                  mov al, byte ptr [ebp+10]
:004052B0 83F802                  cmp eax, 00000002
:004052B3 0F8509000000            jne 004052C2
:004052B9 C645F80B                mov [ebp-08], 0B
:004052BD E904000000              jmp 004052C6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004052B3(C)
|
:004052C2 C645F806                mov [ebp-08], 06

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004052BD(U)
|
:004052C6 E94C000000              jmp 00405317

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040530C(C)
|
:004052CB 33C0                    xor eax, eax
:004052CD 8A4510                  mov al, byte ptr [ebp+10]
:004052D0 83F802                  cmp eax, 00000002
:004052D3 0F8509000000            jne 004052E2
:004052D9 C645F41E                mov [ebp-0C], 1E
:004052DD E904000000              jmp 004052E6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004052D3(C)
|
:004052E2 C645F414                mov [ebp-0C], 14

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004052DD(U)
|
:004052E6 C645F80B                mov [ebp-08], 0B
:004052EA E928000000              jmp 00405317
:004052EF E923000000              jmp 00405317

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405250(U)
|
:004052F4 837DF00C                cmp dword ptr [ebp-10], 0000000C
:004052F8 0F8457FFFFFF            je 00405255
:004052FE 837DF00D                cmp dword ptr [ebp-10], 0000000D
:00405302 0F8488FFFFFF            je 00405290
:00405308 837DF00E                cmp dword ptr [ebp-10], 0000000E
:0040530C 0F84B9FFFFFF            je 004052CB
:00405312 E900000000              jmp 00405317

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040528B(U), :004052C6(U), :004052EA(U), :004052EF(U), :00405312(U)
|
:00405317 33C0                    xor eax, eax
:00405319 8A45F8                  mov al, byte ptr [ebp-08]
:0040531C 50                      push eax
:0040531D E806200400              call 00447328
:00405322 83C404                  add esp, 00000004
:00405325 33C9                    xor ecx, ecx
:00405327 8A4DF4                  mov cl, byte ptr [ebp-0C]
:0040532A 03C1                    add eax, ecx
:0040532C 8845FC                  mov byte ptr [ebp-04], al
:0040532F 6A08                    push 00000008
:00405331 33C0                    xor eax, eax
:00405333 8A4508                  mov al, byte ptr [ebp+08]
:00405336 8BC8                    mov ecx, eax
:00405338 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040533B C1E003                  shl eax, 03
:0040533E 2BC1                    sub eax, ecx
:00405340 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00405346 E8053E0000              call 00409150
:0040534B 85C0                    test eax, eax
:0040534D 0F840B000000            je 0040535E
:00405353 33C0                    xor eax, eax
:00405355 8A45FC                  mov al, byte ptr [ebp-04]
:00405358 C1F801                  sar eax, 01
:0040535B 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040534D(C)
|
:0040535E 33C0                    xor eax, eax
:00405360 8A4508                  mov al, byte ptr [ebp+08]
:00405363 8BC8                    mov ecx, eax
:00405365 8D0440                  lea eax, dword ptr [eax+2*eax]
:00405368 C1E003                  shl eax, 03
:0040536B 2BC1                    sub eax, ecx
:0040536D 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00405373 E8E83E0000              call 00409260
:00405378 33C9                    xor ecx, ecx
:0040537A 8AC8                    mov cl, al
:0040537C 33C0                    xor eax, eax
:0040537E 8A45FC                  mov al, byte ptr [ebp-04]
:00405381 3BC8                    cmp ecx, eax
:00405383 0F8C05000000            jl 0040538E
:00405389 E91D000000              jmp 004053AB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405383(C)
|
:0040538E 33C0                    xor eax, eax
:00405390 8A4508                  mov al, byte ptr [ebp+08]
:00405393 8BC8                    mov ecx, eax
:00405395 8D0440                  lea eax, dword ptr [eax+2*eax]
:00405398 C1E003                  shl eax, 03
:0040539B 2BC1                    sub eax, ecx
:0040539D 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004053A3 E8B83E0000              call 00409260
:004053A8 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405389(U)
|
:004053AB 8A45FC                  mov al, byte ptr [ebp-04]
:004053AE E900000000              jmp 004053B3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004053AE(U)
|
:004053B3 5F                      pop edi
:004053B4 5E                      pop esi
:004053B5 5B                      pop ebx
:004053B6 C9                      leave
:004053B7 C3                      ret



* Referenced by a CALL at Addresses:
|:00405219   , :00405724   , :004058D8   , :00405AEE   , :00405CA2   
|:00405EC0   , :0040606A   , :004062B0   , :00406440   , :00406638   
|:0040682B   , :00406C01   , :00406D58   , :00406EC0   , :00407034   
|:004071A8   , :004073AE   , :00407518   , :004076FE   , :00407868   
|:004079DC   , :00407B84   , :00407D3C   , :00408528   , :00408DE1   
|
:004053B8 55                      push ebp
:004053B9 8BEC                    mov ebp, esp
:004053BB 83EC08                  sub esp, 00000008
:004053BE 53                      push ebx
:004053BF 56                      push esi
:004053C0 57                      push edi
:004053C1 8B4508                  mov eax, dword ptr [ebp+08]
:004053C4 8BC8                    mov ecx, eax
:004053C6 8D0440                  lea eax, dword ptr [eax+2*eax]
:004053C9 C1E003                  shl eax, 03
:004053CC 2BC1                    sub eax, ecx
:004053CE 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004053D4 E8573D0000              call 00409130
:004053D9 8D0440                  lea eax, dword ptr [eax+2*eax]
:004053DC 03C0                    add eax, eax
:004053DE 8D04C0                  lea eax, dword ptr [eax+8*eax]
:004053E1 05E8564500              add eax, 004556E8
:004053E6 8945F8                  mov dword ptr [ebp-08], eax
:004053E9 8B4508                  mov eax, dword ptr [ebp+08]
:004053EC 8BC8                    mov ecx, eax
:004053EE 8D0440                  lea eax, dword ptr [eax+2*eax]
:004053F1 C1E003                  shl eax, 03
:004053F4 2BC1                    sub eax, ecx
:004053F6 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004053FC E81F3E0000              call 00409220
:00405401 85C0                    test eax, eax
:00405403 0F8505000000            jne 0040540E
:00405409 E94B000000              jmp 00405459

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405403(C)
|
:0040540E 8B450C                  mov eax, dword ptr [ebp+0C]
:00405411 50                      push eax
:00405412 8B4508                  mov eax, dword ptr [ebp+08]
:00405415 50                      push eax
:00405416 E843000000              call 0040545E
:0040541B 83C408                  add esp, 00000008
:0040541E 8845FC                  mov byte ptr [ebp-04], al
:00405421 837D1000                cmp dword ptr [ebp+10], 00000000
:00405425 0F850B000000            jne 00405436
:0040542B 33C0                    xor eax, eax
:0040542D 8A45FC                  mov al, byte ptr [ebp-04]
:00405430 C1F802                  sar eax, 02
:00405433 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405425(C)
|
:00405436 6A01                    push 00000001
:00405438 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040543B E8A0410000              call 004095E0
:00405440 33C9                    xor ecx, ecx
:00405442 8AC8                    mov cl, al
:00405444 33C0                    xor eax, eax
:00405446 8A45FC                  mov al, byte ptr [ebp-04]
:00405449 03C8                    add ecx, eax
:0040544B 51                      push ecx
:0040544C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040544F E8787D0000              call 0040D1CC
:00405454 E900000000              jmp 00405459

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00405409(U), :00405454(U)
|
:00405459 5F                      pop edi
:0040545A 5E                      pop esi
:0040545B 5B                      pop ebx
:0040545C C9                      leave
:0040545D C3                      ret



* Referenced by a CALL at Address:
|:00405416   
|
:0040545E 55                      push ebp
:0040545F 8BEC                    mov ebp, esp
:00405461 83EC0C                  sub esp, 0000000C
:00405464 53                      push ebx
:00405465 56                      push esi
:00405466 57                      push edi
:00405467 33C0                    xor eax, eax
:00405469 8A4508                  mov al, byte ptr [ebp+08]
:0040546C 8BC8                    mov ecx, eax
:0040546E 8D0440                  lea eax, dword ptr [eax+2*eax]
:00405471 C1E003                  shl eax, 03
:00405474 2BC1                    sub eax, ecx
:00405476 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0040547C E8AF3C0000              call 00409130
:00405481 8D0440                  lea eax, dword ptr [eax+2*eax]
:00405484 03C0                    add eax, eax
:00405486 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:0040548D E8EE3D0000              call 00409280
:00405492 8845F4                  mov byte ptr [ebp-0C], al
:00405495 33C0                    xor eax, eax
:00405497 8A450C                  mov al, byte ptr [ebp+0C]
:0040549A 8BC8                    mov ecx, eax
:0040549C 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040549F C1E003                  shl eax, 03
:004054A2 2BC1                    sub eax, ecx
:004054A4 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004054AA E8813C0000              call 00409130
:004054AF 8D0440                  lea eax, dword ptr [eax+2*eax]
:004054B2 03C0                    add eax, eax
:004054B4 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:004054BB E8C03D0000              call 00409280
:004054C0 8845F8                  mov byte ptr [ebp-08], al
:004054C3 33C0                    xor eax, eax
:004054C5 8A45F8                  mov al, byte ptr [ebp-08]
:004054C8 83E805                  sub eax, 00000005
:004054CB 33C9                    xor ecx, ecx
:004054CD 8A4DF4                  mov cl, byte ptr [ebp-0C]
:004054D0 3BC1                    cmp eax, ecx
:004054D2 0F8C09000000            jl 004054E1
:004054D8 C645FC10                mov [ebp-04], 10
:004054DC E92F000000              jmp 00405510

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004054D2(C)
|
:004054E1 33C0                    xor eax, eax
:004054E3 8A45F4                  mov al, byte ptr [ebp-0C]
:004054E6 33C9                    xor ecx, ecx
:004054E8 8A4DF8                  mov cl, byte ptr [ebp-08]
:004054EB 3BC1                    cmp eax, ecx
:004054ED 0F8E09000000            jle 004054FC
:004054F3 C645FC04                mov [ebp-04], 04
:004054F7 E914000000              jmp 00405510

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004054ED(C)
|
:004054FC 33C0                    xor eax, eax
:004054FE 8A45F8                  mov al, byte ptr [ebp-08]
:00405501 33C9                    xor ecx, ecx
:00405503 8A4DF4                  mov cl, byte ptr [ebp-0C]
:00405506 2BC1                    sub eax, ecx
:00405508 03C0                    add eax, eax
:0040550A 83C006                  add eax, 00000006
:0040550D 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004054DC(U), :004054F7(U)
|
:00405510 8A45FC                  mov al, byte ptr [ebp-04]
:00405513 E900000000              jmp 00405518

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405513(U)
|
:00405518 5F                      pop edi
:00405519 5E                      pop esi
:0040551A 5B                      pop ebx
:0040551B C9                      leave
:0040551C C3                      ret



* Referenced by a CALL at Addresses:
|:004039FC   , :00407F44   
|
:0040551D 55                      push ebp
:0040551E 8BEC                    mov ebp, esp
:00405520 83EC24                  sub esp, 00000024
:00405523 53                      push ebx
:00405524 56                      push esi
:00405525 57                      push edi
:00405526 C645F4FF                mov [ebp-0C], FF
:0040552A 8B4508                  mov eax, dword ptr [ebp+08]
:0040552D 8A80B0D24400            mov al, byte ptr [eax+0044D2B0]
:00405533 8845FC                  mov byte ptr [ebp-04], al
:00405536 837D0810                cmp dword ptr [ebp+08], 00000010
:0040553A 0F8509000000            jne 00405549
:00405540 C645F801                mov [ebp-08], 01
:00405544 E904000000              jmp 0040554D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040553A(C)
|
:00405549 C645F800                mov [ebp-08], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405544(U)
|
:0040554D 8B450C                  mov eax, dword ptr [ebp+0C]
:00405550 8BC8                    mov ecx, eax
:00405552 8D0440                  lea eax, dword ptr [eax+2*eax]
:00405555 C1E003                  shl eax, 03
:00405558 2BC1                    sub eax, ecx
:0040555A 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00405560 E86B3E0000              call 004093D0
:00405565 33C9                    xor ecx, ecx
:00405567 8AC8                    mov cl, al
:00405569 83F907                  cmp ecx, 00000007
:0040556C 0F840F000000            je 00405581
:00405572 33C0                    xor eax, eax
:00405574 A0A4354500              mov al, byte ptr [004535A4]
:00405579 A804                    test al, 04
:0040557B 0F840C000000            je 0040558D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040556C(C)
|
:00405581 C745EC01000000          mov [ebp-14], 00000001
:00405588 E907000000              jmp 00405594

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040557B(C)
|
:0040558D C745EC00000000          mov [ebp-14], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405588(U)
|
:00405594 C745F000000000          mov [ebp-10], 00000000
:0040559B 837DEC00                cmp dword ptr [ebp-14], 00000000
:0040559F 0F841C000000            je 004055C1
:004055A5 33C0                    xor eax, eax
:004055A7 8A45F8                  mov al, byte ptr [ebp-08]
:004055AA 8B0485B0D14400          mov eax, dword ptr [4*eax+0044D1B0]
:004055B1 50                      push eax

* Possible StringData Ref from Data Obj ->"%sĹ"
                                  |
:004055B2 6848DF4400              push 0044DF48
:004055B7 6A00                    push 00000000
:004055B9 E877390300              call 00438F35
:004055BE 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040559F(C)
|
:004055C1 6A00                    push 00000000
:004055C3 B900FB4600              mov ecx, 0046FB00
:004055C8 E873400000              call 00409640
:004055CD 33C0                    xor eax, eax
:004055CF 8A45F8                  mov al, byte ptr [ebp-08]
:004055D2 85C0                    test eax, eax
:004055D4 0F840C000000            je 004055E6
:004055DA 6A01                    push 00000001
:004055DC B900FB4600              mov ecx, 0046FB00
:004055E1 E85A400000              call 00409640

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004055D4(C)
|
:004055E6 6A00                    push 00000000
:004055E8 33C0                    xor eax, eax
:004055EA 8A45FC                  mov al, byte ptr [ebp-04]
:004055ED 0D80000000              or eax, 00000080
:004055F2 50                      push eax
:004055F3 8B450C                  mov eax, dword ptr [ebp+0C]
:004055F6 50                      push eax
:004055F7 B900FB4600              mov ecx, 0046FB00
:004055FC E8B4780300              call 0043CEB5
:00405601 8845F4                  mov byte ptr [ebp-0C], al
:00405604 33C0                    xor eax, eax
:00405606 8A45F4                  mov al, byte ptr [ebp-0C]
:00405609 3DFF000000              cmp eax, 000000FF
:0040560E 0F84DB020000            je 004058EF
:00405614 8B45F4                  mov eax, dword ptr [ebp-0C]
:00405617 50                      push eax
:00405618 8B450C                  mov eax, dword ptr [ebp+0C]
:0040561B 50                      push eax
:0040561C E882F8FFFF              call 00404EA3
:00405621 83C408                  add esp, 00000008
:00405624 33C0                    xor eax, eax
:00405626 8A45F4                  mov al, byte ptr [ebp-0C]
:00405629 8BC8                    mov ecx, eax
:0040562B 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040562E C1E003                  shl eax, 03
:00405631 2BC1                    sub eax, ecx
:00405633 0598C04600              add eax, 0046C098
:00405638 8945E8                  mov dword ptr [ebp-18], eax
:0040563B 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0040563E E88D400000              call 004096D0
:00405643 33C9                    xor ecx, ecx
:00405645 8AC8                    mov cl, al
:00405647 83F904                  cmp ecx, 00000004
:0040564A 0F8514000000            jne 00405664

* Possible StringData Ref from Data Obj ->"ټٹˡ"
                                  |
:00405650 685CDF4400              push 0044DF5C
:00405655 6A00                    push 00000000
:00405657 E8D9380300              call 00438F35
:0040565C 83C408                  add esp, 00000008
:0040565F E990020000              jmp 004058F4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040564A(C)
|
:00405664 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00405667 E8943B0000              call 00409200
:0040566C 668B00                  mov ax, word ptr [eax]
:0040566F 668945E4                mov word ptr [ebp-1C], ax
:00405673 8B45E5                  mov eax, dword ptr [ebp-1B]
:00405676 50                      push eax
:00405677 8B45E4                  mov eax, dword ptr [ebp-1C]
:0040567A 50                      push eax
:0040567B B900FB4600              mov ecx, 0046FB00
:00405680 E8635B0300              call 0043B1E8
:00405685 33C0                    xor eax, eax
:00405687 8A45F4                  mov al, byte ptr [ebp-0C]
:0040568A 8BC8                    mov ecx, eax
:0040568C 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040568F C1E003                  shl eax, 03
:00405692 2BC1                    sub eax, ecx
:00405694 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0040569A E8813B0000              call 00409220
:0040569F 50                      push eax
:004056A0 6A03                    push 00000003
:004056A2 33C0                    xor eax, eax
:004056A4 8A45E5                  mov al, byte ptr [ebp-1B]
:004056A7 8D0440                  lea eax, dword ptr [eax+2*eax]
:004056AA 50                      push eax
:004056AB 33C0                    xor eax, eax
:004056AD 8A45E4                  mov al, byte ptr [ebp-1C]
:004056B0 8D0440                  lea eax, dword ptr [eax+2*eax]
:004056B3 50                      push eax
:004056B4 B900FB4600              mov ecx, 0046FB00
:004056B9 E882930300              call 0043EA40
:004056BE 6A01                    push 00000001
:004056C0 8B4510                  mov eax, dword ptr [ebp+10]
:004056C3 50                      push eax
:004056C4 6A03                    push 00000003
:004056C6 8B45F4                  mov eax, dword ptr [ebp-0C]
:004056C9 50                      push eax
:004056CA 8B450C                  mov eax, dword ptr [ebp+0C]
:004056CD 50                      push eax
:004056CE E848CBFFFF              call 0040221B
:004056D3 83C414                  add esp, 00000014
:004056D6 85C0                    test eax, eax
:004056D8 0F8438000000            je 00405716
:004056DE 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004056E1 E89A3E0000              call 00409580
:004056E6 50                      push eax

* Possible StringData Ref from Data Obj ->"%sĹˡ"
                                  |
:004056E7 6874DF4400              push 0044DF74
:004056EC 6A00                    push 00000000
:004056EE E842380300              call 00438F35
:004056F3 83C40C                  add esp, 0000000C
:004056F6 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004056F9 E8D23F0000              call 004096D0
:004056FE 33C9                    xor ecx, ecx
:00405700 8AC8                    mov cl, al
:00405702 41                      inc ecx
:00405703 83C940                  or ecx, 00000040
:00405706 51                      push ecx
:00405707 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0040570A E8913F0000              call 004096A0
:0040570F C745F001000000          mov [ebp-10], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004056D8(C)
|
:00405716 8B45F0                  mov eax, dword ptr [ebp-10]
:00405719 50                      push eax
:0040571A 33C0                    xor eax, eax
:0040571C 8A45F4                  mov al, byte ptr [ebp-0C]
:0040571F 50                      push eax
:00405720 8B450C                  mov eax, dword ptr [ebp+0C]
:00405723 50                      push eax
:00405724 E88FFCFFFF              call 004053B8
:00405729 83C40C                  add esp, 0000000C
:0040572C 33C0                    xor eax, eax
:0040572E 8A45F8                  mov al, byte ptr [ebp-08]
:00405731 85C0                    test eax, eax
:00405733 0F84AC010000            je 004058E5
:00405739 C645E000                mov [ebp-20], 00
:0040573D E903000000              jmp 00405745

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004058E0(U)
|
:00405742 FE45E0                  inc [ebp-20]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040573D(U)
|
:00405745 33C0                    xor eax, eax
:00405747 8A45E0                  mov al, byte ptr [ebp-20]
:0040574A 83F804                  cmp eax, 00000004
:0040574D 0F8D92010000            jnl 004058E5
:00405753 8B45E0                  mov eax, dword ptr [ebp-20]
:00405756 50                      push eax
:00405757 8D45E4                  lea eax, dword ptr [ebp-1C]
:0040575A 50                      push eax
:0040575B E8F53E0100              call 00419655
:00405760 83C408                  add esp, 00000008
:00405763 668B00                  mov ax, word ptr [eax]
:00405766 668945DC                mov word ptr [ebp-24], ax
:0040576A C745F000000000          mov [ebp-10], 00000000
:00405771 33C0                    xor eax, eax
:00405773 8A45DC                  mov al, byte ptr [ebp-24]
:00405776 3DFF000000              cmp eax, 000000FF
:0040577B 0F845F010000            je 004058E0
:00405781 8D45DC                  lea eax, dword ptr [ebp-24]
:00405784 50                      push eax
:00405785 E8B33D0100              call 0041953D
:0040578A 83C404                  add esp, 00000004
:0040578D 8845F4                  mov byte ptr [ebp-0C], al
:00405790 33C0                    xor eax, eax
:00405792 8A45F4                  mov al, byte ptr [ebp-0C]
:00405795 3DFF000000              cmp eax, 000000FF
:0040579A 0F8440010000            je 004058E0
:004057A0 33C0                    xor eax, eax
:004057A2 8A45F4                  mov al, byte ptr [ebp-0C]
:004057A5 8BC8                    mov ecx, eax
:004057A7 8D0440                  lea eax, dword ptr [eax+2*eax]
:004057AA C1E003                  shl eax, 03
:004057AD 2BC1                    sub eax, ecx
:004057AF 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004057B5 E8663A0000              call 00409220
:004057BA 8BD8                    mov ebx, eax
:004057BC 8B450C                  mov eax, dword ptr [ebp+0C]
:004057BF 8BC8                    mov ecx, eax
:004057C1 8D0440                  lea eax, dword ptr [eax+2*eax]
:004057C4 C1E003                  shl eax, 03
:004057C7 2BC1                    sub eax, ecx
:004057C9 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004057CF E84C3A0000              call 00409220
:004057D4 3BD8                    cmp ebx, eax
:004057D6 0F8404010000            je 004058E0
:004057DC 33C0                    xor eax, eax
:004057DE 8A45F4                  mov al, byte ptr [ebp-0C]
:004057E1 8BC8                    mov ecx, eax
:004057E3 8D0440                  lea eax, dword ptr [eax+2*eax]
:004057E6 C1E003                  shl eax, 03
:004057E9 2BC1                    sub eax, ecx
:004057EB 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004057F1 E8DA3E0000              call 004096D0
:004057F6 33C9                    xor ecx, ecx
:004057F8 8AC8                    mov cl, al
:004057FA 83F904                  cmp ecx, 00000004
:004057FD 0F84DD000000            je 004058E0
:00405803 33C0                    xor eax, eax
:00405805 8A45F4                  mov al, byte ptr [ebp-0C]
:00405808 8BC8                    mov ecx, eax
:0040580A 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040580D C1E003                  shl eax, 03
:00405810 2BC1                    sub eax, ecx
:00405812 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00405818 E8033A0000              call 00409220
:0040581D 50                      push eax
:0040581E 6A03                    push 00000003
:00405820 33C0                    xor eax, eax
:00405822 8A45DD                  mov al, byte ptr [ebp-23]
:00405825 8D0440                  lea eax, dword ptr [eax+2*eax]
:00405828 50                      push eax
:00405829 33C0                    xor eax, eax
:0040582B 8A45DC                  mov al, byte ptr [ebp-24]
:0040582E 8D0440                  lea eax, dword ptr [eax+2*eax]
:00405831 50                      push eax
:00405832 B900FB4600              mov ecx, 0046FB00
:00405837 E804920300              call 0043EA40
:0040583C 6A01                    push 00000001
:0040583E 8B4510                  mov eax, dword ptr [ebp+10]
:00405841 50                      push eax
:00405842 6A03                    push 00000003
:00405844 8B45F4                  mov eax, dword ptr [ebp-0C]
:00405847 50                      push eax
:00405848 8B450C                  mov eax, dword ptr [ebp+0C]
:0040584B 50                      push eax
:0040584C E8CAC9FFFF              call 0040221B
:00405851 83C414                  add esp, 00000014
:00405854 85C0                    test eax, eax
:00405856 0F846E000000            je 004058CA
:0040585C 33C0                    xor eax, eax
:0040585E 8A45F4                  mov al, byte ptr [ebp-0C]
:00405861 8BC8                    mov ecx, eax
:00405863 8D0440                  lea eax, dword ptr [eax+2*eax]
:00405866 C1E003                  shl eax, 03
:00405869 2BC1                    sub eax, ecx
:0040586B 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00405871 E80A3D0000              call 00409580
:00405876 50                      push eax

* Possible StringData Ref from Data Obj ->"%sĹˡ"
                                  |
:00405877 6888DF4400              push 0044DF88
:0040587C 6A00                    push 00000000
:0040587E E8B2360300              call 00438F35
:00405883 83C40C                  add esp, 0000000C
:00405886 33C0                    xor eax, eax
:00405888 8A45F4                  mov al, byte ptr [ebp-0C]
:0040588B 8BC8                    mov ecx, eax
:0040588D 8D0440                  lea eax, dword ptr [eax+2*eax]
:00405890 C1E003                  shl eax, 03
:00405893 2BC1                    sub eax, ecx
:00405895 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0040589B E8303E0000              call 004096D0
:004058A0 33C9                    xor ecx, ecx
:004058A2 8AC8                    mov cl, al
:004058A4 41                      inc ecx
:004058A5 83C940                  or ecx, 00000040
:004058A8 51                      push ecx
:004058A9 33C0                    xor eax, eax
:004058AB 8A45F4                  mov al, byte ptr [ebp-0C]
:004058AE 8BC8                    mov ecx, eax
:004058B0 8D0440                  lea eax, dword ptr [eax+2*eax]
:004058B3 C1E003                  shl eax, 03
:004058B6 2BC1                    sub eax, ecx
:004058B8 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004058BE E8DD3D0000              call 004096A0
:004058C3 C745F001000000          mov [ebp-10], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405856(C)
|
:004058CA 8B45F0                  mov eax, dword ptr [ebp-10]
:004058CD 50                      push eax
:004058CE 33C0                    xor eax, eax
:004058D0 8A45F4                  mov al, byte ptr [ebp-0C]
:004058D3 50                      push eax
:004058D4 8B450C                  mov eax, dword ptr [ebp+0C]
:004058D7 50                      push eax
:004058D8 E8DBFAFFFF              call 004053B8
:004058DD 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040577B(C), :0040579A(C), :004057D6(C), :004057FD(C)
|
:004058E0 E95DFEFFFF              jmp 00405742

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00405733(C), :0040574D(C)
|
:004058E5 C70598DA440001000000    mov dword ptr [0044DA98], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040560E(C)
|
:004058EF E900000000              jmp 004058F4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040565F(U), :004058EF(U)
|
:004058F4 5F                      pop edi
:004058F5 5E                      pop esi
:004058F6 5B                      pop ebx
:004058F7 C9                      leave
:004058F8 C3                      ret



* Referenced by a CALL at Addresses:
|:00403A1A   , :00407F62   
|
:004058F9 55                      push ebp
:004058FA 8BEC                    mov ebp, esp
:004058FC 83EC24                  sub esp, 00000024
:004058FF 53                      push ebx
:00405900 56                      push esi
:00405901 57                      push edi
:00405902 C645F4FF                mov [ebp-0C], FF
:00405906 8B4508                  mov eax, dword ptr [ebp+08]
:00405909 8A80B0D24400            mov al, byte ptr [eax+0044D2B0]
:0040590F 8845FC                  mov byte ptr [ebp-04], al
:00405912 837D0812                cmp dword ptr [ebp+08], 00000012
:00405916 0F8509000000            jne 00405925
:0040591C C645F801                mov [ebp-08], 01
:00405920 E904000000              jmp 00405929

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405916(C)
|
:00405925 C645F800                mov [ebp-08], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405920(U)
|
:00405929 8B450C                  mov eax, dword ptr [ebp+0C]
:0040592C 8BC8                    mov ecx, eax
:0040592E 8D0440                  lea eax, dword ptr [eax+2*eax]
:00405931 C1E003                  shl eax, 03
:00405934 2BC1                    sub eax, ecx
:00405936 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0040593C E88F3A0000              call 004093D0
:00405941 33C9                    xor ecx, ecx
:00405943 8AC8                    mov cl, al
:00405945 83F907                  cmp ecx, 00000007
:00405948 0F840F000000            je 0040595D
:0040594E 33C0                    xor eax, eax
:00405950 A0A4354500              mov al, byte ptr [004535A4]
:00405955 A804                    test al, 04
:00405957 0F840C000000            je 00405969

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405948(C)
|
:0040595D C745EC01000000          mov [ebp-14], 00000001
:00405964 E907000000              jmp 00405970

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405957(C)
|
:00405969 C745EC00000000          mov [ebp-14], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405964(U)
|
:00405970 C745F000000000          mov [ebp-10], 00000000
:00405977 837DEC00                cmp dword ptr [ebp-14], 00000000
:0040597B 0F841C000000            je 0040599D
:00405981 33C0                    xor eax, eax
:00405983 8A45F8                  mov al, byte ptr [ebp-08]
:00405986 8B0485B0D14400          mov eax, dword ptr [4*eax+0044D1B0]
:0040598D 50                      push eax

* Possible StringData Ref from Data Obj ->"%sķ"
                                  |
:0040598E 689CDF4400              push 0044DF9C
:00405993 6A00                    push 00000000
:00405995 E89B350300              call 00438F35
:0040599A 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040597B(C)
|
:0040599D 6A00                    push 00000000
:0040599F B900FB4600              mov ecx, 0046FB00
:004059A4 E8973C0000              call 00409640
:004059A9 33C0                    xor eax, eax
:004059AB 8A45F8                  mov al, byte ptr [ebp-08]
:004059AE 85C0                    test eax, eax
:004059B0 0F840C000000            je 004059C2
:004059B6 6A01                    push 00000001
:004059B8 B900FB4600              mov ecx, 0046FB00
:004059BD E87E3C0000              call 00409640

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004059B0(C)
|
:004059C2 6A00                    push 00000000
:004059C4 33C0                    xor eax, eax
:004059C6 8A45FC                  mov al, byte ptr [ebp-04]
:004059C9 0D80000000              or eax, 00000080
:004059CE 50                      push eax
:004059CF 8B450C                  mov eax, dword ptr [ebp+0C]
:004059D2 50                      push eax
:004059D3 B900FB4600              mov ecx, 0046FB00
:004059D8 E8D8740300              call 0043CEB5
:004059DD 8845F4                  mov byte ptr [ebp-0C], al
:004059E0 33C0                    xor eax, eax
:004059E2 8A45F4                  mov al, byte ptr [ebp-0C]
:004059E5 3DFF000000              cmp eax, 000000FF
:004059EA 0F84C9020000            je 00405CB9
:004059F0 8B45F4                  mov eax, dword ptr [ebp-0C]
:004059F3 50                      push eax
:004059F4 8B450C                  mov eax, dword ptr [ebp+0C]
:004059F7 50                      push eax
:004059F8 E8A6F4FFFF              call 00404EA3
:004059FD 83C408                  add esp, 00000008
:00405A00 33C0                    xor eax, eax
:00405A02 8A45F4                  mov al, byte ptr [ebp-0C]
:00405A05 8BC8                    mov ecx, eax
:00405A07 8D0440                  lea eax, dword ptr [eax+2*eax]
:00405A0A C1E003                  shl eax, 03
:00405A0D 2BC1                    sub eax, ecx
:00405A0F 0598C04600              add eax, 0046C098
:00405A14 8945E8                  mov dword ptr [ebp-18], eax
:00405A17 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00405A1A E8113D0000              call 00409730
:00405A1F 33C9                    xor ecx, ecx
:00405A21 8AC8                    mov cl, al
:00405A23 83F904                  cmp ecx, 00000004
:00405A26 0F8514000000            jne 00405A40

* Possible StringData Ref from Data Obj ->"ټٷˡ"
                                  |
:00405A2C 68B0DF4400              push 0044DFB0
:00405A31 6A00                    push 00000000
:00405A33 E8FD340300              call 00438F35
:00405A38 83C408                  add esp, 00000008
:00405A3B E97E020000              jmp 00405CBE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405A26(C)
|
:00405A40 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00405A43 E8B8370000              call 00409200
:00405A48 668B00                  mov ax, word ptr [eax]
:00405A4B 668945E4                mov word ptr [ebp-1C], ax
:00405A4F 8B45E5                  mov eax, dword ptr [ebp-1B]
:00405A52 50                      push eax
:00405A53 8B45E4                  mov eax, dword ptr [ebp-1C]
:00405A56 50                      push eax
:00405A57 B900FB4600              mov ecx, 0046FB00
:00405A5C E887570300              call 0043B1E8
:00405A61 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00405A64 E8B7370000              call 00409220
:00405A69 50                      push eax
:00405A6A 6A03                    push 00000003
:00405A6C 33C0                    xor eax, eax
:00405A6E 8A45E5                  mov al, byte ptr [ebp-1B]
:00405A71 8D0440                  lea eax, dword ptr [eax+2*eax]
:00405A74 50                      push eax
:00405A75 33C0                    xor eax, eax
:00405A77 8A45E4                  mov al, byte ptr [ebp-1C]
:00405A7A 8D0440                  lea eax, dword ptr [eax+2*eax]
:00405A7D 50                      push eax
:00405A7E B900FB4600              mov ecx, 0046FB00
:00405A83 E8B88F0300              call 0043EA40
:00405A88 6A01                    push 00000001
:00405A8A 8B4510                  mov eax, dword ptr [ebp+10]
:00405A8D 50                      push eax
:00405A8E 6A03                    push 00000003
:00405A90 8B45F4                  mov eax, dword ptr [ebp-0C]
:00405A93 50                      push eax
:00405A94 8B450C                  mov eax, dword ptr [ebp+0C]
:00405A97 50                      push eax
:00405A98 E87EC7FFFF              call 0040221B
:00405A9D 83C414                  add esp, 00000014
:00405AA0 85C0                    test eax, eax
:00405AA2 0F8438000000            je 00405AE0
:00405AA8 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00405AAB E8D03A0000              call 00409580
:00405AB0 50                      push eax

* Possible StringData Ref from Data Obj ->"%sķˡ"
                                  |
:00405AB1 68C8DF4400              push 0044DFC8
:00405AB6 6A00                    push 00000000
:00405AB8 E878340300              call 00438F35
:00405ABD 83C40C                  add esp, 0000000C
:00405AC0 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00405AC3 E8683C0000              call 00409730
:00405AC8 33C9                    xor ecx, ecx
:00405ACA 8AC8                    mov cl, al
:00405ACC 41                      inc ecx
:00405ACD 83C940                  or ecx, 00000040
:00405AD0 51                      push ecx
:00405AD1 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00405AD4 E8273C0000              call 00409700
:00405AD9 C745F001000000          mov [ebp-10], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405AA2(C)
|
:00405AE0 8B45F0                  mov eax, dword ptr [ebp-10]
:00405AE3 50                      push eax
:00405AE4 33C0                    xor eax, eax
:00405AE6 8A45F4                  mov al, byte ptr [ebp-0C]
:00405AE9 50                      push eax
:00405AEA 8B450C                  mov eax, dword ptr [ebp+0C]
:00405AED 50                      push eax
:00405AEE E8C5F8FFFF              call 004053B8
:00405AF3 83C40C                  add esp, 0000000C
:00405AF6 33C0                    xor eax, eax
:00405AF8 8A45F8                  mov al, byte ptr [ebp-08]
:00405AFB 85C0                    test eax, eax
:00405AFD 0F84AC010000            je 00405CAF
:00405B03 C645E000                mov [ebp-20], 00
:00405B07 E903000000              jmp 00405B0F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405CAA(U)
|
:00405B0C FE45E0                  inc [ebp-20]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405B07(U)
|
:00405B0F 33C0                    xor eax, eax
:00405B11 8A45E0                  mov al, byte ptr [ebp-20]
:00405B14 83F804                  cmp eax, 00000004
:00405B17 0F8D92010000            jnl 00405CAF
:00405B1D 8B45E0                  mov eax, dword ptr [ebp-20]
:00405B20 50                      push eax
:00405B21 8D45E4                  lea eax, dword ptr [ebp-1C]
:00405B24 50                      push eax
:00405B25 E82B3B0100              call 00419655
:00405B2A 83C408                  add esp, 00000008
:00405B2D 668B00                  mov ax, word ptr [eax]
:00405B30 668945DC                mov word ptr [ebp-24], ax
:00405B34 C745F000000000          mov [ebp-10], 00000000
:00405B3B 33C0                    xor eax, eax
:00405B3D 8A45DC                  mov al, byte ptr [ebp-24]
:00405B40 3DFF000000              cmp eax, 000000FF
:00405B45 0F845F010000            je 00405CAA
:00405B4B 8D45DC                  lea eax, dword ptr [ebp-24]
:00405B4E 50                      push eax
:00405B4F E8E9390100              call 0041953D
:00405B54 83C404                  add esp, 00000004
:00405B57 8845F4                  mov byte ptr [ebp-0C], al
:00405B5A 33C0                    xor eax, eax
:00405B5C 8A45F4                  mov al, byte ptr [ebp-0C]
:00405B5F 3DFF000000              cmp eax, 000000FF
:00405B64 0F8440010000            je 00405CAA
:00405B6A 33C0                    xor eax, eax
:00405B6C 8A45F4                  mov al, byte ptr [ebp-0C]
:00405B6F 8BC8                    mov ecx, eax
:00405B71 8D0440                  lea eax, dword ptr [eax+2*eax]
:00405B74 C1E003                  shl eax, 03
:00405B77 2BC1                    sub eax, ecx
:00405B79 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00405B7F E89C360000              call 00409220
:00405B84 8BD8                    mov ebx, eax
:00405B86 8B450C                  mov eax, dword ptr [ebp+0C]
:00405B89 8BC8                    mov ecx, eax
:00405B8B 8D0440                  lea eax, dword ptr [eax+2*eax]
:00405B8E C1E003                  shl eax, 03
:00405B91 2BC1                    sub eax, ecx
:00405B93 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00405B99 E882360000              call 00409220
:00405B9E 3BD8                    cmp ebx, eax
:00405BA0 0F8404010000            je 00405CAA
:00405BA6 33C0                    xor eax, eax
:00405BA8 8A45F4                  mov al, byte ptr [ebp-0C]
:00405BAB 8BC8                    mov ecx, eax
:00405BAD 8D0440                  lea eax, dword ptr [eax+2*eax]
:00405BB0 C1E003                  shl eax, 03
:00405BB3 2BC1                    sub eax, ecx
:00405BB5 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00405BBB E8703B0000              call 00409730
:00405BC0 33C9                    xor ecx, ecx
:00405BC2 8AC8                    mov cl, al
:00405BC4 83F904                  cmp ecx, 00000004
:00405BC7 0F84DD000000            je 00405CAA
:00405BCD 33C0                    xor eax, eax
:00405BCF 8A45F4                  mov al, byte ptr [ebp-0C]
:00405BD2 8BC8                    mov ecx, eax
:00405BD4 8D0440                  lea eax, dword ptr [eax+2*eax]
:00405BD7 C1E003                  shl eax, 03
:00405BDA 2BC1                    sub eax, ecx
:00405BDC 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00405BE2 E839360000              call 00409220
:00405BE7 50                      push eax
:00405BE8 6A03                    push 00000003
:00405BEA 33C0                    xor eax, eax
:00405BEC 8A45DD                  mov al, byte ptr [ebp-23]
:00405BEF 8D0440                  lea eax, dword ptr [eax+2*eax]
:00405BF2 50                      push eax
:00405BF3 33C0                    xor eax, eax
:00405BF5 8A45DC                  mov al, byte ptr [ebp-24]
:00405BF8 8D0440                  lea eax, dword ptr [eax+2*eax]
:00405BFB 50                      push eax
:00405BFC B900FB4600              mov ecx, 0046FB00
:00405C01 E83A8E0300              call 0043EA40
:00405C06 6A01                    push 00000001
:00405C08 8B4510                  mov eax, dword ptr [ebp+10]
:00405C0B 50                      push eax
:00405C0C 6A03                    push 00000003
:00405C0E 8B45F4                  mov eax, dword ptr [ebp-0C]
:00405C11 50                      push eax
:00405C12 8B450C                  mov eax, dword ptr [ebp+0C]
:00405C15 50                      push eax
:00405C16 E800C6FFFF              call 0040221B
:00405C1B 83C414                  add esp, 00000014
:00405C1E 85C0                    test eax, eax
:00405C20 0F846E000000            je 00405C94
:00405C26 33C0                    xor eax, eax
:00405C28 8A45F4                  mov al, byte ptr [ebp-0C]
:00405C2B 8BC8                    mov ecx, eax
:00405C2D 8D0440                  lea eax, dword ptr [eax+2*eax]
:00405C30 C1E003                  shl eax, 03
:00405C33 2BC1                    sub eax, ecx
:00405C35 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00405C3B E840390000              call 00409580
:00405C40 50                      push eax

* Possible StringData Ref from Data Obj ->"%sķˡ"
                                  |
:00405C41 68DCDF4400              push 0044DFDC
:00405C46 6A00                    push 00000000
:00405C48 E8E8320300              call 00438F35
:00405C4D 83C40C                  add esp, 0000000C
:00405C50 33C0                    xor eax, eax
:00405C52 8A45F4                  mov al, byte ptr [ebp-0C]
:00405C55 8BC8                    mov ecx, eax
:00405C57 8D0440                  lea eax, dword ptr [eax+2*eax]
:00405C5A C1E003                  shl eax, 03
:00405C5D 2BC1                    sub eax, ecx
:00405C5F 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00405C65 E8C63A0000              call 00409730
:00405C6A 33C9                    xor ecx, ecx
:00405C6C 8AC8                    mov cl, al
:00405C6E 41                      inc ecx
:00405C6F 83C940                  or ecx, 00000040
:00405C72 51                      push ecx
:00405C73 33C0                    xor eax, eax
:00405C75 8A45F4                  mov al, byte ptr [ebp-0C]
:00405C78 8BC8                    mov ecx, eax
:00405C7A 8D0440                  lea eax, dword ptr [eax+2*eax]
:00405C7D C1E003                  shl eax, 03
:00405C80 2BC1                    sub eax, ecx
:00405C82 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00405C88 E8733A0000              call 00409700
:00405C8D C745F001000000          mov [ebp-10], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405C20(C)
|
:00405C94 8B45F0                  mov eax, dword ptr [ebp-10]
:00405C97 50                      push eax
:00405C98 33C0                    xor eax, eax
:00405C9A 8A45F4                  mov al, byte ptr [ebp-0C]
:00405C9D 50                      push eax
:00405C9E 8B450C                  mov eax, dword ptr [ebp+0C]
:00405CA1 50                      push eax
:00405CA2 E811F7FFFF              call 004053B8
:00405CA7 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00405B45(C), :00405B64(C), :00405BA0(C), :00405BC7(C)
|
:00405CAA E95DFEFFFF              jmp 00405B0C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00405AFD(C), :00405B17(C)
|
:00405CAF C70598DA440001000000    mov dword ptr [0044DA98], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004059EA(C)
|
:00405CB9 E900000000              jmp 00405CBE

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00405A3B(U), :00405CB9(U)
|
:00405CBE 5F                      pop edi
:00405CBF 5E                      pop esi
:00405CC0 5B                      pop ebx
:00405CC1 C9                      leave
:00405CC2 C3                      ret



* Referenced by a CALL at Addresses:
|:00403A38   , :00407F80   
|
:00405CC3 55                      push ebp
:00405CC4 8BEC                    mov ebp, esp
:00405CC6 83EC24                  sub esp, 00000024
:00405CC9 53                      push ebx
:00405CCA 56                      push esi
:00405CCB 57                      push edi
:00405CCC C645F4FF                mov [ebp-0C], FF
:00405CD0 8B4508                  mov eax, dword ptr [ebp+08]
:00405CD3 8A80B0D24400            mov al, byte ptr [eax+0044D2B0]
:00405CD9 8845FC                  mov byte ptr [ebp-04], al
:00405CDC 837D0814                cmp dword ptr [ebp+08], 00000014
:00405CE0 0F8509000000            jne 00405CEF
:00405CE6 C645F801                mov [ebp-08], 01
:00405CEA E904000000              jmp 00405CF3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405CE0(C)
|
:00405CEF C645F800                mov [ebp-08], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405CEA(U)
|
:00405CF3 8B450C                  mov eax, dword ptr [ebp+0C]
:00405CF6 8BC8                    mov ecx, eax
:00405CF8 8D0440                  lea eax, dword ptr [eax+2*eax]
:00405CFB C1E003                  shl eax, 03
:00405CFE 2BC1                    sub eax, ecx
:00405D00 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00405D06 E8C5360000              call 004093D0
:00405D0B 33C9                    xor ecx, ecx
:00405D0D 8AC8                    mov cl, al
:00405D0F 83F907                  cmp ecx, 00000007
:00405D12 0F840F000000            je 00405D27
:00405D18 33C0                    xor eax, eax
:00405D1A A0A4354500              mov al, byte ptr [004535A4]
:00405D1F A804                    test al, 04
:00405D21 0F840C000000            je 00405D33

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405D12(C)
|
:00405D27 C745EC01000000          mov [ebp-14], 00000001
:00405D2E E907000000              jmp 00405D3A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405D21(C)
|
:00405D33 C745EC00000000          mov [ebp-14], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405D2E(U)
|
:00405D3A C745F001000000          mov [ebp-10], 00000001
:00405D41 837DEC00                cmp dword ptr [ebp-14], 00000000
:00405D45 0F841C000000            je 00405D67
:00405D4B 33C0                    xor eax, eax
:00405D4D 8A45F8                  mov al, byte ptr [ebp-08]
:00405D50 8B0485B0D14400          mov eax, dword ptr [4*eax+0044D1B0]
:00405D57 50                      push eax

* Possible StringData Ref from Data Obj ->"ʹ%sҡ"
                                  |
:00405D58 68F0DF4400              push 0044DFF0
:00405D5D 6A00                    push 00000000
:00405D5F E8D1310300              call 00438F35
:00405D64 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405D45(C)
|
:00405D67 6A00                    push 00000000
:00405D69 B900FB4600              mov ecx, 0046FB00
:00405D6E E8CD380000              call 00409640
:00405D73 33C0                    xor eax, eax
:00405D75 8A45F8                  mov al, byte ptr [ebp-08]
:00405D78 85C0                    test eax, eax
:00405D7A 0F840C000000            je 00405D8C
:00405D80 6A01                    push 00000001
:00405D82 B900FB4600              mov ecx, 0046FB00
:00405D87 E8B4380000              call 00409640

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405D7A(C)
|
:00405D8C 6A00                    push 00000000
:00405D8E 33C0                    xor eax, eax
:00405D90 8A45FC                  mov al, byte ptr [ebp-04]
:00405D93 0D80000000              or eax, 00000080
:00405D98 50                      push eax
:00405D99 8B450C                  mov eax, dword ptr [ebp+0C]
:00405D9C 50                      push eax
:00405D9D B900FB4600              mov ecx, 0046FB00
:00405DA2 E80E710300              call 0043CEB5
:00405DA7 8845F4                  mov byte ptr [ebp-0C], al
:00405DAA 33C0                    xor eax, eax
:00405DAC 8A45F4                  mov al, byte ptr [ebp-0C]
:00405DAF 3DFF000000              cmp eax, 000000FF
:00405DB4 0F84C7020000            je 00406081
:00405DBA 8B45F4                  mov eax, dword ptr [ebp-0C]
:00405DBD 50                      push eax
:00405DBE 8B450C                  mov eax, dword ptr [ebp+0C]
:00405DC1 50                      push eax
:00405DC2 E8DCF0FFFF              call 00404EA3
:00405DC7 83C408                  add esp, 00000008
:00405DCA 33C0                    xor eax, eax
:00405DCC 8A45F4                  mov al, byte ptr [ebp-0C]
:00405DCF 8BC8                    mov ecx, eax
:00405DD1 8D0440                  lea eax, dword ptr [eax+2*eax]
:00405DD4 C1E003                  shl eax, 03
:00405DD7 2BC1                    sub eax, ecx
:00405DD9 0598C04600              add eax, 0046C098
:00405DDE 8945E8                  mov dword ptr [ebp-18], eax
:00405DE1 6A10                    push 00000010
:00405DE3 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00405DE6 E865330000              call 00409150
:00405DEB 85C0                    test eax, eax
:00405DED 0F8414000000            je 00405E07

* Possible StringData Ref from Data Obj ->"Ѿˡ"
                                  |
:00405DF3 68FCDF4400              push 0044DFFC
:00405DF8 6A00                    push 00000000
:00405DFA E836310300              call 00438F35
:00405DFF 83C408                  add esp, 00000008
:00405E02 E97F020000              jmp 00406086

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405DED(C)
|
:00405E07 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00405E0A E8F1330000              call 00409200
:00405E0F 668B00                  mov ax, word ptr [eax]
:00405E12 668945E4                mov word ptr [ebp-1C], ax
:00405E16 8B45E5                  mov eax, dword ptr [ebp-1B]
:00405E19 50                      push eax
:00405E1A 8B45E4                  mov eax, dword ptr [ebp-1C]
:00405E1D 50                      push eax
:00405E1E B900FB4600              mov ecx, 0046FB00
:00405E23 E8C0530300              call 0043B1E8
:00405E28 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00405E2B E8F0330000              call 00409220
:00405E30 50                      push eax
:00405E31 6A02                    push 00000002
:00405E33 33C0                    xor eax, eax
:00405E35 8A45E5                  mov al, byte ptr [ebp-1B]
:00405E38 8D0440                  lea eax, dword ptr [eax+2*eax]
:00405E3B 50                      push eax
:00405E3C 33C0                    xor eax, eax
:00405E3E 8A45E4                  mov al, byte ptr [ebp-1C]
:00405E41 8D0440                  lea eax, dword ptr [eax+2*eax]
:00405E44 50                      push eax
:00405E45 B900FB4600              mov ecx, 0046FB00
:00405E4A E8F18B0300              call 0043EA40
:00405E4F 6A01                    push 00000001
:00405E51 8B4510                  mov eax, dword ptr [ebp+10]
:00405E54 50                      push eax
:00405E55 6A03                    push 00000003
:00405E57 8B45F4                  mov eax, dword ptr [ebp-0C]
:00405E5A 50                      push eax
:00405E5B 8B450C                  mov eax, dword ptr [ebp+0C]
:00405E5E 50                      push eax
:00405E5F E8B7C3FFFF              call 0040221B
:00405E64 83C414                  add esp, 00000014
:00405E67 85C0                    test eax, eax
:00405E69 0F8443000000            je 00405EB2
:00405E6F 33C0                    xor eax, eax
:00405E71 8A45F4                  mov al, byte ptr [ebp-0C]
:00405E74 8BC8                    mov ecx, eax
:00405E76 8D0440                  lea eax, dword ptr [eax+2*eax]
:00405E79 C1E003                  shl eax, 03
:00405E7C 2BC1                    sub eax, ecx
:00405E7E 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00405E84 E8F7360000              call 00409580
:00405E89 50                      push eax

* Possible StringData Ref from Data Obj ->"%sˡ"
                                  |
:00405E8A 680CE04400              push 0044E00C
:00405E8F 6A00                    push 00000000
:00405E91 E89F300300              call 00438F35
:00405E96 83C40C                  add esp, 0000000C
:00405E99 6A50                    push 00000050
:00405E9B 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00405E9E E8BD380000              call 00409760
:00405EA3 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00405EA6 E814600200              call 0042BEBF
:00405EAB C745F001000000          mov [ebp-10], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405E69(C)
|
:00405EB2 8B45F0                  mov eax, dword ptr [ebp-10]
:00405EB5 50                      push eax
:00405EB6 33C0                    xor eax, eax
:00405EB8 8A45F4                  mov al, byte ptr [ebp-0C]
:00405EBB 50                      push eax
:00405EBC 8B450C                  mov eax, dword ptr [ebp+0C]
:00405EBF 50                      push eax
:00405EC0 E8F3F4FFFF              call 004053B8
:00405EC5 83C40C                  add esp, 0000000C
:00405EC8 33C0                    xor eax, eax
:00405ECA 8A45F8                  mov al, byte ptr [ebp-08]
:00405ECD 85C0                    test eax, eax
:00405ECF 0F84A2010000            je 00406077
:00405ED5 C645E000                mov [ebp-20], 00
:00405ED9 E903000000              jmp 00405EE1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406072(U)
|
:00405EDE FE45E0                  inc [ebp-20]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405ED9(U)
|
:00405EE1 33C0                    xor eax, eax
:00405EE3 8A45E0                  mov al, byte ptr [ebp-20]
:00405EE6 83F804                  cmp eax, 00000004
:00405EE9 0F8D88010000            jnl 00406077
:00405EEF 8B45E0                  mov eax, dword ptr [ebp-20]
:00405EF2 50                      push eax
:00405EF3 8D45E4                  lea eax, dword ptr [ebp-1C]
:00405EF6 50                      push eax
:00405EF7 E859370100              call 00419655
:00405EFC 83C408                  add esp, 00000008
:00405EFF 668B00                  mov ax, word ptr [eax]
:00405F02 668945DC                mov word ptr [ebp-24], ax
:00405F06 C745F000000000          mov [ebp-10], 00000000
:00405F0D 33C0                    xor eax, eax
:00405F0F 8A45DC                  mov al, byte ptr [ebp-24]
:00405F12 3DFF000000              cmp eax, 000000FF
:00405F17 0F8455010000            je 00406072
:00405F1D 8D45DC                  lea eax, dword ptr [ebp-24]
:00405F20 50                      push eax
:00405F21 E817360100              call 0041953D
:00405F26 83C404                  add esp, 00000004
:00405F29 8845F4                  mov byte ptr [ebp-0C], al
:00405F2C 33C0                    xor eax, eax
:00405F2E 8A45F4                  mov al, byte ptr [ebp-0C]
:00405F31 3DFF000000              cmp eax, 000000FF
:00405F36 0F8436010000            je 00406072
:00405F3C 33C0                    xor eax, eax
:00405F3E 8A45F4                  mov al, byte ptr [ebp-0C]
:00405F41 8BC8                    mov ecx, eax
:00405F43 8D0440                  lea eax, dword ptr [eax+2*eax]
:00405F46 C1E003                  shl eax, 03
:00405F49 2BC1                    sub eax, ecx
:00405F4B 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00405F51 E8CA320000              call 00409220
:00405F56 8BD8                    mov ebx, eax
:00405F58 8B450C                  mov eax, dword ptr [ebp+0C]
:00405F5B 8BC8                    mov ecx, eax
:00405F5D 8D0440                  lea eax, dword ptr [eax+2*eax]
:00405F60 C1E003                  shl eax, 03
:00405F63 2BC1                    sub eax, ecx
:00405F65 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00405F6B E8B0320000              call 00409220
:00405F70 3BD8                    cmp ebx, eax
:00405F72 0F84FA000000            je 00406072
:00405F78 6A10                    push 00000010
:00405F7A 33C0                    xor eax, eax
:00405F7C 8A45F4                  mov al, byte ptr [ebp-0C]
:00405F7F 8BC8                    mov ecx, eax
:00405F81 8D0440                  lea eax, dword ptr [eax+2*eax]
:00405F84 C1E003                  shl eax, 03
:00405F87 2BC1                    sub eax, ecx
:00405F89 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00405F8F E8BC310000              call 00409150
:00405F94 85C0                    test eax, eax
:00405F96 0F85D6000000            jne 00406072
:00405F9C 33C0                    xor eax, eax
:00405F9E 8A45F4                  mov al, byte ptr [ebp-0C]
:00405FA1 8BC8                    mov ecx, eax
:00405FA3 8D0440                  lea eax, dword ptr [eax+2*eax]
:00405FA6 C1E003                  shl eax, 03
:00405FA9 2BC1                    sub eax, ecx
:00405FAB 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00405FB1 E86A320000              call 00409220
:00405FB6 50                      push eax
:00405FB7 6A02                    push 00000002
:00405FB9 33C0                    xor eax, eax
:00405FBB 8A45DD                  mov al, byte ptr [ebp-23]
:00405FBE 8D0440                  lea eax, dword ptr [eax+2*eax]
:00405FC1 50                      push eax
:00405FC2 33C0                    xor eax, eax
:00405FC4 8A45DC                  mov al, byte ptr [ebp-24]
:00405FC7 8D0440                  lea eax, dword ptr [eax+2*eax]
:00405FCA 50                      push eax
:00405FCB B900FB4600              mov ecx, 0046FB00
:00405FD0 E86B8A0300              call 0043EA40
:00405FD5 6A01                    push 00000001
:00405FD7 8B4510                  mov eax, dword ptr [ebp+10]
:00405FDA 50                      push eax
:00405FDB 6A03                    push 00000003
:00405FDD 8B45F4                  mov eax, dword ptr [ebp-0C]
:00405FE0 50                      push eax
:00405FE1 8B450C                  mov eax, dword ptr [ebp+0C]
:00405FE4 50                      push eax
:00405FE5 E831C2FFFF              call 0040221B
:00405FEA 83C414                  add esp, 00000014
:00405FED 85C0                    test eax, eax
:00405FEF 0F8467000000            je 0040605C
:00405FF5 33C0                    xor eax, eax
:00405FF7 8A45F4                  mov al, byte ptr [ebp-0C]
:00405FFA 8BC8                    mov ecx, eax
:00405FFC 8D0440                  lea eax, dword ptr [eax+2*eax]
:00405FFF C1E003                  shl eax, 03
:00406002 2BC1                    sub eax, ecx
:00406004 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0040600A E871350000              call 00409580
:0040600F 50                      push eax

* Possible StringData Ref from Data Obj ->"%sˡ"
                                  |
:00406010 6818E04400              push 0044E018
:00406015 6A00                    push 00000000
:00406017 E8192F0300              call 00438F35
:0040601C 83C40C                  add esp, 0000000C
:0040601F 6A50                    push 00000050
:00406021 33C0                    xor eax, eax
:00406023 8A45F4                  mov al, byte ptr [ebp-0C]
:00406026 8BC8                    mov ecx, eax
:00406028 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040602B C1E003                  shl eax, 03
:0040602E 2BC1                    sub eax, ecx
:00406030 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00406036 E825370000              call 00409760
:0040603B 33C0                    xor eax, eax
:0040603D 8A45F4                  mov al, byte ptr [ebp-0C]
:00406040 8BC8                    mov ecx, eax
:00406042 8D0440                  lea eax, dword ptr [eax+2*eax]
:00406045 C1E003                  shl eax, 03
:00406048 2BC1                    sub eax, ecx
:0040604A 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00406050 E86A5E0200              call 0042BEBF
:00406055 C745F001000000          mov [ebp-10], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405FEF(C)
|
:0040605C 8B45F0                  mov eax, dword ptr [ebp-10]
:0040605F 50                      push eax
:00406060 33C0                    xor eax, eax
:00406062 8A45F4                  mov al, byte ptr [ebp-0C]
:00406065 50                      push eax
:00406066 8B450C                  mov eax, dword ptr [ebp+0C]
:00406069 50                      push eax
:0040606A E849F3FFFF              call 004053B8
:0040606F 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00405F17(C), :00405F36(C), :00405F72(C), :00405F96(C)
|
:00406072 E967FEFFFF              jmp 00405EDE

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00405ECF(C), :00405EE9(C)
|
:00406077 C70598DA440001000000    mov dword ptr [0044DA98], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405DB4(C)
|
:00406081 E900000000              jmp 00406086

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00405E02(U), :00406081(U)
|
:00406086 5F                      pop edi
:00406087 5E                      pop esi
:00406088 5B                      pop ebx
:00406089 C9                      leave
:0040608A C3                      ret



* Referenced by a CALL at Addresses:
|:00403A56   , :00407F9E   
|
:0040608B 55                      push ebp
:0040608C 8BEC                    mov ebp, esp
:0040608E 83EC24                  sub esp, 00000024
:00406091 53                      push ebx
:00406092 56                      push esi
:00406093 57                      push edi
:00406094 C645F4FF                mov [ebp-0C], FF
:00406098 8B4508                  mov eax, dword ptr [ebp+08]
:0040609B 8A80B0D24400            mov al, byte ptr [eax+0044D2B0]
:004060A1 8845FC                  mov byte ptr [ebp-04], al
:004060A4 837D0816                cmp dword ptr [ebp+08], 00000016
:004060A8 0F8509000000            jne 004060B7
:004060AE C645F801                mov [ebp-08], 01
:004060B2 E904000000              jmp 004060BB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004060A8(C)
|
:004060B7 C645F800                mov [ebp-08], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004060B2(U)
|
:004060BB 8B450C                  mov eax, dword ptr [ebp+0C]
:004060BE 8BC8                    mov ecx, eax
:004060C0 8D0440                  lea eax, dword ptr [eax+2*eax]
:004060C3 C1E003                  shl eax, 03
:004060C6 2BC1                    sub eax, ecx
:004060C8 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004060CE E8FD320000              call 004093D0
:004060D3 33C9                    xor ecx, ecx
:004060D5 8AC8                    mov cl, al
:004060D7 83F907                  cmp ecx, 00000007
:004060DA 0F840F000000            je 004060EF
:004060E0 33C0                    xor eax, eax
:004060E2 A0A4354500              mov al, byte ptr [004535A4]
:004060E7 A804                    test al, 04
:004060E9 0F840C000000            je 004060FB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004060DA(C)
|
:004060EF C745EC01000000          mov [ebp-14], 00000001
:004060F6 E907000000              jmp 00406102

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004060E9(C)
|
:004060FB C745EC00000000          mov [ebp-14], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004060F6(U)
|
:00406102 C745F000000000          mov [ebp-10], 00000000
:00406109 837DEC00                cmp dword ptr [ebp-14], 00000000
:0040610D 0F841C000000            je 0040612F
:00406113 33C0                    xor eax, eax
:00406115 8A45F8                  mov al, byte ptr [ebp-08]
:00406118 8B0485B0D14400          mov eax, dword ptr [4*eax+0044D1B0]
:0040611F 50                      push eax

* Possible StringData Ref from Data Obj ->"ʹ%s;ÿغϼ١"
                                  |
:00406120 6824E04400              push 0044E024
:00406125 6A00                    push 00000000
:00406127 E8092E0300              call 00438F35
:0040612C 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040610D(C)
|
:0040612F 6A00                    push 00000000
:00406131 B900FB4600              mov ecx, 0046FB00
:00406136 E805350000              call 00409640
:0040613B 33C0                    xor eax, eax
:0040613D 8A45F8                  mov al, byte ptr [ebp-08]
:00406140 85C0                    test eax, eax
:00406142 0F840C000000            je 00406154
:00406148 6A01                    push 00000001
:0040614A B900FB4600              mov ecx, 0046FB00
:0040614F E8EC340000              call 00409640

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406142(C)
|
:00406154 6A00                    push 00000000
:00406156 33C0                    xor eax, eax
:00406158 8A45FC                  mov al, byte ptr [ebp-04]
:0040615B 0D80000000              or eax, 00000080
:00406160 50                      push eax
:00406161 8B450C                  mov eax, dword ptr [ebp+0C]
:00406164 50                      push eax
:00406165 B900FB4600              mov ecx, 0046FB00
:0040616A E8466D0300              call 0043CEB5
:0040616F 8845F4                  mov byte ptr [ebp-0C], al
:00406172 33C0                    xor eax, eax
:00406174 8A45F4                  mov al, byte ptr [ebp-0C]
:00406177 3DFF000000              cmp eax, 000000FF
:0040617C 0F84D5020000            je 00406457
:00406182 8B45F4                  mov eax, dword ptr [ebp-0C]
:00406185 50                      push eax
:00406186 8B450C                  mov eax, dword ptr [ebp+0C]
:00406189 50                      push eax
:0040618A E814EDFFFF              call 00404EA3
:0040618F 83C408                  add esp, 00000008
:00406192 33C0                    xor eax, eax
:00406194 8A45F4                  mov al, byte ptr [ebp-0C]
:00406197 8BC8                    mov ecx, eax
:00406199 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040619C C1E003                  shl eax, 03
:0040619F 2BC1                    sub eax, ecx
:004061A1 0598C04600              add eax, 0046C098
:004061A6 8945E8                  mov dword ptr [ebp-18], eax
:004061A9 6A20                    push 00000020
:004061AB 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004061AE E89D2F0000              call 00409150
:004061B3 85C0                    test eax, eax
:004061B5 0F8420000000            je 004061DB
:004061BB 6A0A                    push 0000000A
:004061BD B994A64600              mov ecx, 0046A694
:004061C2 E85D2E0100              call 00419024

* Possible StringData Ref from Data Obj ->"ִ֧ӡ"
                                  |
:004061C7 68D8D14400              push 0044D1D8
:004061CC 6A00                    push 00000000
:004061CE E8622D0300              call 00438F35
:004061D3 83C408                  add esp, 00000008
:004061D6 E981020000              jmp 0040645C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004061B5(C)
|
:004061DB 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004061DE E81D300000              call 00409200
:004061E3 668B00                  mov ax, word ptr [eax]
:004061E6 668945E4                mov word ptr [ebp-1C], ax
:004061EA 8B45E5                  mov eax, dword ptr [ebp-1B]
:004061ED 50                      push eax
:004061EE 8B45E4                  mov eax, dword ptr [ebp-1C]
:004061F1 50                      push eax
:004061F2 B900FB4600              mov ecx, 0046FB00
:004061F7 E8EC4F0300              call 0043B1E8
:004061FC 33C0                    xor eax, eax
:004061FE 8A45F4                  mov al, byte ptr [ebp-0C]
:00406201 8BC8                    mov ecx, eax
:00406203 8D0440                  lea eax, dword ptr [eax+2*eax]
:00406206 C1E003                  shl eax, 03
:00406209 2BC1                    sub eax, ecx
:0040620B 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00406211 E80A300000              call 00409220
:00406216 50                      push eax
:00406217 6A02                    push 00000002
:00406219 33C0                    xor eax, eax
:0040621B 8A45E5                  mov al, byte ptr [ebp-1B]
:0040621E 8D0440                  lea eax, dword ptr [eax+2*eax]
:00406221 50                      push eax
:00406222 33C0                    xor eax, eax
:00406224 8A45E4                  mov al, byte ptr [ebp-1C]
:00406227 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040622A 50                      push eax
:0040622B B900FB4600              mov ecx, 0046FB00
:00406230 E80B880300              call 0043EA40
:00406235 6A01                    push 00000001
:00406237 8B4510                  mov eax, dword ptr [ebp+10]
:0040623A 50                      push eax
:0040623B 6A03                    push 00000003
:0040623D 8B45F4                  mov eax, dword ptr [ebp-0C]
:00406240 50                      push eax
:00406241 8B450C                  mov eax, dword ptr [ebp+0C]
:00406244 50                      push eax
:00406245 E8D1BFFFFF              call 0040221B
:0040624A 83C414                  add esp, 00000014
:0040624D 85C0                    test eax, eax
:0040624F 0F844D000000            je 004062A2
:00406255 33C0                    xor eax, eax
:00406257 8A45F4                  mov al, byte ptr [ebp-0C]
:0040625A 8BC8                    mov ecx, eax
:0040625C 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040625F C1E003                  shl eax, 03
:00406262 2BC1                    sub eax, ecx
:00406264 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0040626A E811330000              call 00409580
:0040626F 50                      push eax

* Possible StringData Ref from Data Obj ->"%s;ˡ"
                                  |
:00406270 6840E04400              push 0044E040
:00406275 6A00                    push 00000000
:00406277 E8B92C0300              call 00438F35
:0040627C 83C40C                  add esp, 0000000C
:0040627F 6A60                    push 00000060
:00406281 33C0                    xor eax, eax
:00406283 8A45F4                  mov al, byte ptr [ebp-0C]
:00406286 8BC8                    mov ecx, eax
:00406288 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040628B C1E003                  shl eax, 03
:0040628E 2BC1                    sub eax, ecx
:00406290 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00406296 E8C5340000              call 00409760
:0040629B C745F001000000          mov [ebp-10], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040624F(C)
|
:004062A2 8B45F0                  mov eax, dword ptr [ebp-10]
:004062A5 50                      push eax
:004062A6 33C0                    xor eax, eax
:004062A8 8A45F4                  mov al, byte ptr [ebp-0C]
:004062AB 50                      push eax
:004062AC 8B450C                  mov eax, dword ptr [ebp+0C]
:004062AF 50                      push eax
:004062B0 E803F1FFFF              call 004053B8
:004062B5 83C40C                  add esp, 0000000C
:004062B8 33C0                    xor eax, eax
:004062BA 8A45F8                  mov al, byte ptr [ebp-08]
:004062BD 85C0                    test eax, eax
:004062BF 0F8488010000            je 0040644D
:004062C5 C645E000                mov [ebp-20], 00
:004062C9 E903000000              jmp 004062D1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406448(U)
|
:004062CE FE45E0                  inc [ebp-20]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004062C9(U)
|
:004062D1 33C0                    xor eax, eax
:004062D3 8A45E0                  mov al, byte ptr [ebp-20]
:004062D6 83F804                  cmp eax, 00000004
:004062D9 0F8D6E010000            jnl 0040644D
:004062DF 8B45E0                  mov eax, dword ptr [ebp-20]
:004062E2 50                      push eax
:004062E3 8D45E4                  lea eax, dword ptr [ebp-1C]
:004062E6 50                      push eax
:004062E7 E869330100              call 00419655
:004062EC 83C408                  add esp, 00000008
:004062EF 668B00                  mov ax, word ptr [eax]
:004062F2 668945DC                mov word ptr [ebp-24], ax
:004062F6 C745F000000000          mov [ebp-10], 00000000
:004062FD 33C0                    xor eax, eax
:004062FF 8A45DC                  mov al, byte ptr [ebp-24]
:00406302 3DFF000000              cmp eax, 000000FF
:00406307 0F843B010000            je 00406448
:0040630D 8D45DC                  lea eax, dword ptr [ebp-24]
:00406310 50                      push eax
:00406311 E827320100              call 0041953D
:00406316 83C404                  add esp, 00000004
:00406319 8845F4                  mov byte ptr [ebp-0C], al
:0040631C 33C0                    xor eax, eax
:0040631E 8A45F4                  mov al, byte ptr [ebp-0C]
:00406321 3DFF000000              cmp eax, 000000FF
:00406326 0F841C010000            je 00406448
:0040632C 33C0                    xor eax, eax
:0040632E 8A45F4                  mov al, byte ptr [ebp-0C]
:00406331 8BC8                    mov ecx, eax
:00406333 8D0440                  lea eax, dword ptr [eax+2*eax]
:00406336 C1E003                  shl eax, 03
:00406339 2BC1                    sub eax, ecx
:0040633B 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00406341 E8DA2E0000              call 00409220
:00406346 8BD8                    mov ebx, eax
:00406348 8B450C                  mov eax, dword ptr [ebp+0C]
:0040634B 8BC8                    mov ecx, eax
:0040634D 8D0440                  lea eax, dword ptr [eax+2*eax]
:00406350 C1E003                  shl eax, 03
:00406353 2BC1                    sub eax, ecx
:00406355 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0040635B E8C02E0000              call 00409220
:00406360 3BD8                    cmp ebx, eax
:00406362 0F84E0000000            je 00406448
:00406368 6A20                    push 00000020
:0040636A 33C0                    xor eax, eax
:0040636C 8A45F4                  mov al, byte ptr [ebp-0C]
:0040636F 8BC8                    mov ecx, eax
:00406371 8D0440                  lea eax, dword ptr [eax+2*eax]
:00406374 C1E003                  shl eax, 03
:00406377 2BC1                    sub eax, ecx
:00406379 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0040637F E8CC2D0000              call 00409150
:00406384 85C0                    test eax, eax
:00406386 0F85BC000000            jne 00406448
:0040638C 33C0                    xor eax, eax
:0040638E 8A45F4                  mov al, byte ptr [ebp-0C]
:00406391 8BC8                    mov ecx, eax
:00406393 8D0440                  lea eax, dword ptr [eax+2*eax]
:00406396 C1E003                  shl eax, 03
:00406399 2BC1                    sub eax, ecx
:0040639B 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004063A1 E87A2E0000              call 00409220
:004063A6 50                      push eax
:004063A7 6A02                    push 00000002
:004063A9 33C0                    xor eax, eax
:004063AB 8A45DD                  mov al, byte ptr [ebp-23]
:004063AE 8D0440                  lea eax, dword ptr [eax+2*eax]
:004063B1 50                      push eax
:004063B2 33C0                    xor eax, eax
:004063B4 8A45DC                  mov al, byte ptr [ebp-24]
:004063B7 8D0440                  lea eax, dword ptr [eax+2*eax]
:004063BA 50                      push eax
:004063BB B900FB4600              mov ecx, 0046FB00
:004063C0 E87B860300              call 0043EA40
:004063C5 6A01                    push 00000001
:004063C7 8B4510                  mov eax, dword ptr [ebp+10]
:004063CA 50                      push eax
:004063CB 6A03                    push 00000003
:004063CD 8B45F4                  mov eax, dword ptr [ebp-0C]
:004063D0 50                      push eax
:004063D1 8B450C                  mov eax, dword ptr [ebp+0C]
:004063D4 50                      push eax
:004063D5 E841BEFFFF              call 0040221B
:004063DA 83C414                  add esp, 00000014
:004063DD 85C0                    test eax, eax
:004063DF 0F844D000000            je 00406432
:004063E5 33C0                    xor eax, eax
:004063E7 8A45F4                  mov al, byte ptr [ebp-0C]
:004063EA 8BC8                    mov ecx, eax
:004063EC 8D0440                  lea eax, dword ptr [eax+2*eax]
:004063EF C1E003                  shl eax, 03
:004063F2 2BC1                    sub eax, ecx
:004063F4 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004063FA E881310000              call 00409580
:004063FF 50                      push eax

* Possible StringData Ref from Data Obj ->"%s;ˡ"
                                  |
:00406400 6858E04400              push 0044E058
:00406405 6A00                    push 00000000
:00406407 E8292B0300              call 00438F35
:0040640C 83C40C                  add esp, 0000000C
:0040640F 6A60                    push 00000060
:00406411 33C0                    xor eax, eax
:00406413 8A45F4                  mov al, byte ptr [ebp-0C]
:00406416 8BC8                    mov ecx, eax
:00406418 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040641B C1E003                  shl eax, 03
:0040641E 2BC1                    sub eax, ecx
:00406420 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00406426 E835330000              call 00409760
:0040642B C745F001000000          mov [ebp-10], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004063DF(C)
|
:00406432 8B45F0                  mov eax, dword ptr [ebp-10]
:00406435 50                      push eax
:00406436 33C0                    xor eax, eax
:00406438 8A45F4                  mov al, byte ptr [ebp-0C]
:0040643B 50                      push eax
:0040643C 8B450C                  mov eax, dword ptr [ebp+0C]
:0040643F 50                      push eax
:00406440 E873EFFFFF              call 004053B8
:00406445 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00406307(C), :00406326(C), :00406362(C), :00406386(C)
|
:00406448 E981FEFFFF              jmp 004062CE

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004062BF(C), :004062D9(C)
|
:0040644D C70598DA440001000000    mov dword ptr [0044DA98], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040617C(C)
|
:00406457 E900000000              jmp 0040645C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004061D6(U), :00406457(U)
|
:0040645C 5F                      pop edi
:0040645D 5E                      pop esi
:0040645E 5B                      pop ebx
:0040645F C9                      leave
:00406460 C3                      ret



* Referenced by a CALL at Addresses:
|:00403A96   , :00407FBC   
|
:00406461 55                      push ebp
:00406462 8BEC                    mov ebp, esp
:00406464 83EC14                  sub esp, 00000014
:00406467 53                      push ebx
:00406468 56                      push esi
:00406469 57                      push edi
:0040646A C645F8FF                mov [ebp-08], FF
:0040646E 8B4508                  mov eax, dword ptr [ebp+08]
:00406471 8A80B0D24400            mov al, byte ptr [eax+0044D2B0]
:00406477 8845FC                  mov byte ptr [ebp-04], al
:0040647A 8B450C                  mov eax, dword ptr [ebp+0C]
:0040647D 8BC8                    mov ecx, eax
:0040647F 8D0440                  lea eax, dword ptr [eax+2*eax]
:00406482 C1E003                  shl eax, 03
:00406485 2BC1                    sub eax, ecx
:00406487 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0040648D E83E2F0000              call 004093D0
:00406492 33C9                    xor ecx, ecx
:00406494 8AC8                    mov cl, al
:00406496 83F907                  cmp ecx, 00000007
:00406499 0F840F000000            je 004064AE
:0040649F 33C0                    xor eax, eax
:004064A1 A0A4354500              mov al, byte ptr [004535A4]
:004064A6 A804                    test al, 04
:004064A8 0F840C000000            je 004064BA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406499(C)
|
:004064AE C745F001000000          mov [ebp-10], 00000001
:004064B5 E907000000              jmp 004064C1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004064A8(C)
|
:004064BA C745F000000000          mov [ebp-10], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004064B5(U)
|
:004064C1 C745F400000000          mov [ebp-0C], 00000000
:004064C8 837DF000                cmp dword ptr [ebp-10], 00000000
:004064CC 0F840F000000            je 004064E1

* Possible StringData Ref from Data Obj ->"ʹо֧ӵĹٶȼ롣"
                                  |
:004064D2 6870E04400              push 0044E070
:004064D7 6A00                    push 00000000
:004064D9 E8572A0300              call 00438F35
:004064DE 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004064CC(C)
|
:004064E1 6A00                    push 00000000
:004064E3 33C0                    xor eax, eax
:004064E5 8A45FC                  mov al, byte ptr [ebp-04]
:004064E8 0D80000000              or eax, 00000080
:004064ED 50                      push eax
:004064EE 8B450C                  mov eax, dword ptr [ebp+0C]
:004064F1 50                      push eax
:004064F2 B900FB4600              mov ecx, 0046FB00
:004064F7 E8B9690300              call 0043CEB5
:004064FC 8845F8                  mov byte ptr [ebp-08], al
:004064FF 33C0                    xor eax, eax
:00406501 8A45F8                  mov al, byte ptr [ebp-08]
:00406504 3DFF000000              cmp eax, 000000FF
:00406509 0F843B010000            je 0040664A
:0040650F 8B45F8                  mov eax, dword ptr [ebp-08]
:00406512 50                      push eax
:00406513 8B450C                  mov eax, dword ptr [ebp+0C]
:00406516 50                      push eax
:00406517 E887E9FFFF              call 00404EA3
:0040651C 83C408                  add esp, 00000008
:0040651F 6A02                    push 00000002
:00406521 33C0                    xor eax, eax
:00406523 8A45F8                  mov al, byte ptr [ebp-08]
:00406526 8BC8                    mov ecx, eax
:00406528 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040652B C1E003                  shl eax, 03
:0040652E 2BC1                    sub eax, ecx
:00406530 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00406536 E8152C0000              call 00409150
:0040653B 85C0                    test eax, eax
:0040653D 0F8420000000            je 00406563
:00406543 6A0A                    push 0000000A
:00406545 B994A64600              mov ecx, 0046A694
:0040654A E8D52A0100              call 00419024

* Possible StringData Ref from Data Obj ->"ִ֧ӡ"
                                  |
:0040654F 68D8D14400              push 0044D1D8
:00406554 6A00                    push 00000000
:00406556 E8DA290300              call 00438F35
:0040655B 83C408                  add esp, 00000008
:0040655E E9EC000000              jmp 0040664F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040653D(C)
|
:00406563 33C0                    xor eax, eax
:00406565 8A45F8                  mov al, byte ptr [ebp-08]
:00406568 8BC8                    mov ecx, eax
:0040656A 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040656D C1E003                  shl eax, 03
:00406570 2BC1                    sub eax, ecx
:00406572 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00406578 E8832C0000              call 00409200
:0040657D 668B00                  mov ax, word ptr [eax]
:00406580 668945EC                mov word ptr [ebp-14], ax
:00406584 33C0                    xor eax, eax
:00406586 8A45F8                  mov al, byte ptr [ebp-08]
:00406589 8BC8                    mov ecx, eax
:0040658B 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040658E C1E003                  shl eax, 03
:00406591 2BC1                    sub eax, ecx
:00406593 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00406599 E8822C0000              call 00409220
:0040659E 50                      push eax
:0040659F 6A03                    push 00000003
:004065A1 33C0                    xor eax, eax
:004065A3 8A45ED                  mov al, byte ptr [ebp-13]
:004065A6 8D0440                  lea eax, dword ptr [eax+2*eax]
:004065A9 50                      push eax
:004065AA 33C0                    xor eax, eax
:004065AC 8A45EC                  mov al, byte ptr [ebp-14]
:004065AF 8D0440                  lea eax, dword ptr [eax+2*eax]
:004065B2 50                      push eax
:004065B3 B900FB4600              mov ecx, 0046FB00
:004065B8 E883840300              call 0043EA40
:004065BD 6A01                    push 00000001
:004065BF 8B4510                  mov eax, dword ptr [ebp+10]
:004065C2 50                      push eax
:004065C3 6A05                    push 00000005
:004065C5 8B45F8                  mov eax, dword ptr [ebp-08]
:004065C8 50                      push eax
:004065C9 8B450C                  mov eax, dword ptr [ebp+0C]
:004065CC 50                      push eax
:004065CD E849BCFFFF              call 0040221B
:004065D2 83C414                  add esp, 00000014
:004065D5 85C0                    test eax, eax
:004065D7 0F844D000000            je 0040662A
:004065DD 33C0                    xor eax, eax
:004065DF 8A45F8                  mov al, byte ptr [ebp-08]
:004065E2 8BC8                    mov ecx, eax
:004065E4 8D0440                  lea eax, dword ptr [eax+2*eax]
:004065E7 C1E003                  shl eax, 03
:004065EA 2BC1                    sub eax, ecx
:004065EC 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004065F2 E8892F0000              call 00409580
:004065F7 50                      push eax

* Possible StringData Ref from Data Obj ->"%sĹٶȼˡ"
                                  |
:004065F8 6890E04400              push 0044E090
:004065FD 6A00                    push 00000000
:004065FF E831290300              call 00438F35
:00406604 83C40C                  add esp, 0000000C
:00406607 6A42                    push 00000042
:00406609 33C0                    xor eax, eax
:0040660B 8A45F8                  mov al, byte ptr [ebp-08]
:0040660E 8BC8                    mov ecx, eax
:00406610 8D0440                  lea eax, dword ptr [eax+2*eax]
:00406613 C1E003                  shl eax, 03
:00406616 2BC1                    sub eax, ecx
:00406618 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0040661E E83D310000              call 00409760
:00406623 C745F401000000          mov [ebp-0C], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004065D7(C)
|
:0040662A 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040662D 50                      push eax
:0040662E 33C0                    xor eax, eax
:00406630 8A45F8                  mov al, byte ptr [ebp-08]
:00406633 50                      push eax
:00406634 8B450C                  mov eax, dword ptr [ebp+0C]
:00406637 50                      push eax
:00406638 E87BEDFFFF              call 004053B8
:0040663D 83C40C                  add esp, 0000000C
:00406640 C70598DA440001000000    mov dword ptr [0044DA98], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406509(C)
|
:0040664A E900000000              jmp 0040664F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040655E(U), :0040664A(U)
|
:0040664F 5F                      pop edi
:00406650 5E                      pop esi
:00406651 5B                      pop ebx
:00406652 C9                      leave
:00406653 C3                      ret



* Referenced by a CALL at Addresses:
|:00403AB4   , :00407FDA   
|
:00406654 55                      push ebp
:00406655 8BEC                    mov ebp, esp
:00406657 83EC14                  sub esp, 00000014
:0040665A 53                      push ebx
:0040665B 56                      push esi
:0040665C 57                      push edi
:0040665D C645F8FF                mov [ebp-08], FF
:00406661 8B4508                  mov eax, dword ptr [ebp+08]
:00406664 8A80B0D24400            mov al, byte ptr [eax+0044D2B0]
:0040666A 8845FC                  mov byte ptr [ebp-04], al
:0040666D 8B450C                  mov eax, dword ptr [ebp+0C]
:00406670 8BC8                    mov ecx, eax
:00406672 8D0440                  lea eax, dword ptr [eax+2*eax]
:00406675 C1E003                  shl eax, 03
:00406678 2BC1                    sub eax, ecx
:0040667A 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00406680 E84B2D0000              call 004093D0
:00406685 33C9                    xor ecx, ecx
:00406687 8AC8                    mov cl, al
:00406689 83F907                  cmp ecx, 00000007
:0040668C 0F840F000000            je 004066A1
:00406692 33C0                    xor eax, eax
:00406694 A0A4354500              mov al, byte ptr [004535A4]
:00406699 A804                    test al, 04
:0040669B 0F840C000000            je 004066AD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040668C(C)
|
:004066A1 C745F001000000          mov [ebp-10], 00000001
:004066A8 E907000000              jmp 004066B4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040669B(C)
|
:004066AD C745F000000000          mov [ebp-10], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004066A8(U)
|
:004066B4 C745F400000000          mov [ebp-0C], 00000000
:004066BB 837DF000                cmp dword ptr [ebp-10], 00000000
:004066BF 0F840F000000            je 004066D4

* Possible StringData Ref from Data Obj ->"ʹо֧ӵƶ롣"
                                  |
:004066C5 68A8E04400              push 0044E0A8
:004066CA 6A00                    push 00000000
:004066CC E864280300              call 00438F35
:004066D1 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004066BF(C)
|
:004066D4 6A00                    push 00000000
:004066D6 33C0                    xor eax, eax
:004066D8 8A45FC                  mov al, byte ptr [ebp-04]
:004066DB 0D80000000              or eax, 00000080
:004066E0 50                      push eax
:004066E1 8B450C                  mov eax, dword ptr [ebp+0C]
:004066E4 50                      push eax
:004066E5 B900FB4600              mov ecx, 0046FB00
:004066EA E8C6670300              call 0043CEB5
:004066EF 8845F8                  mov byte ptr [ebp-08], al
:004066F2 33C0                    xor eax, eax
:004066F4 8A45F8                  mov al, byte ptr [ebp-08]
:004066F7 3DFF000000              cmp eax, 000000FF
:004066FC 0F843B010000            je 0040683D
:00406702 6A01                    push 00000001
:00406704 33C0                    xor eax, eax
:00406706 8A45F8                  mov al, byte ptr [ebp-08]
:00406709 8BC8                    mov ecx, eax
:0040670B 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040670E C1E003                  shl eax, 03
:00406711 2BC1                    sub eax, ecx
:00406713 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00406719 E8322A0000              call 00409150
:0040671E 85C0                    test eax, eax
:00406720 0F8420000000            je 00406746
:00406726 6A0A                    push 0000000A
:00406728 B994A64600              mov ecx, 0046A694
:0040672D E8F2280100              call 00419024

* Possible StringData Ref from Data Obj ->"ִ֧ӡ"
                                  |
:00406732 68D8D14400              push 0044D1D8
:00406737 6A00                    push 00000000
:00406739 E8F7270300              call 00438F35
:0040673E 83C408                  add esp, 00000008
:00406741 E9FC000000              jmp 00406842

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406720(C)
|
:00406746 8B45F8                  mov eax, dword ptr [ebp-08]
:00406749 50                      push eax
:0040674A 8B450C                  mov eax, dword ptr [ebp+0C]
:0040674D 50                      push eax
:0040674E E850E7FFFF              call 00404EA3
:00406753 83C408                  add esp, 00000008
:00406756 33C0                    xor eax, eax
:00406758 8A45F8                  mov al, byte ptr [ebp-08]
:0040675B 8BC8                    mov ecx, eax
:0040675D 8D0440                  lea eax, dword ptr [eax+2*eax]
:00406760 C1E003                  shl eax, 03
:00406763 2BC1                    sub eax, ecx
:00406765 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0040676B E8902A0000              call 00409200
:00406770 668B00                  mov ax, word ptr [eax]
:00406773 668945EC                mov word ptr [ebp-14], ax
:00406777 33C0                    xor eax, eax
:00406779 8A45F8                  mov al, byte ptr [ebp-08]
:0040677C 8BC8                    mov ecx, eax
:0040677E 8D0440                  lea eax, dword ptr [eax+2*eax]
:00406781 C1E003                  shl eax, 03
:00406784 2BC1                    sub eax, ecx
:00406786 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0040678C E88F2A0000              call 00409220
:00406791 50                      push eax
:00406792 6A03                    push 00000003
:00406794 33C0                    xor eax, eax
:00406796 8A45ED                  mov al, byte ptr [ebp-13]
:00406799 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040679C 50                      push eax
:0040679D 33C0                    xor eax, eax
:0040679F 8A45EC                  mov al, byte ptr [ebp-14]
:004067A2 8D0440                  lea eax, dword ptr [eax+2*eax]
:004067A5 50                      push eax
:004067A6 B900FB4600              mov ecx, 0046FB00
:004067AB E890820300              call 0043EA40
:004067B0 6A01                    push 00000001
:004067B2 8B4510                  mov eax, dword ptr [ebp+10]
:004067B5 50                      push eax
:004067B6 6A05                    push 00000005
:004067B8 8B45F8                  mov eax, dword ptr [ebp-08]
:004067BB 50                      push eax
:004067BC 8B450C                  mov eax, dword ptr [ebp+0C]
:004067BF 50                      push eax
:004067C0 E856BAFFFF              call 0040221B
:004067C5 83C414                  add esp, 00000014
:004067C8 85C0                    test eax, eax
:004067CA 0F844D000000            je 0040681D
:004067D0 33C0                    xor eax, eax
:004067D2 8A45F8                  mov al, byte ptr [ebp-08]
:004067D5 8BC8                    mov ecx, eax
:004067D7 8D0440                  lea eax, dword ptr [eax+2*eax]
:004067DA C1E003                  shl eax, 03
:004067DD 2BC1                    sub eax, ecx
:004067DF 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004067E5 E8962D0000              call 00409580
:004067EA 50                      push eax

* Possible StringData Ref from Data Obj ->"%sƶˡ"
                                  |
:004067EB 68C8E04400              push 0044E0C8
:004067F0 6A00                    push 00000000
:004067F2 E83E270300              call 00438F35
:004067F7 83C40C                  add esp, 0000000C
:004067FA 6A41                    push 00000041
:004067FC 33C0                    xor eax, eax
:004067FE 8A45F8                  mov al, byte ptr [ebp-08]
:00406801 8BC8                    mov ecx, eax
:00406803 8D0440                  lea eax, dword ptr [eax+2*eax]
:00406806 C1E003                  shl eax, 03
:00406809 2BC1                    sub eax, ecx
:0040680B 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00406811 E84A2F0000              call 00409760
:00406816 C745F401000000          mov [ebp-0C], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004067CA(C)
|
:0040681D 8B45F4                  mov eax, dword ptr [ebp-0C]
:00406820 50                      push eax
:00406821 33C0                    xor eax, eax
:00406823 8A45F8                  mov al, byte ptr [ebp-08]
:00406826 50                      push eax
:00406827 8B450C                  mov eax, dword ptr [ebp+0C]
:0040682A 50                      push eax
:0040682B E888EBFFFF              call 004053B8
:00406830 83C40C                  add esp, 0000000C
:00406833 C70598DA440001000000    mov dword ptr [0044DA98], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004066FC(C)
|
:0040683D E900000000              jmp 00406842

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00406741(U), :0040683D(U)
|
:00406842 5F                      pop edi
:00406843 5E                      pop esi
:00406844 5B                      pop ebx
:00406845 C9                      leave
:00406846 C3                      ret



* Referenced by a CALL at Addresses:
|:00403AD2   , :00407FF8   
|
:00406847 55                      push ebp
:00406848 8BEC                    mov ebp, esp
:0040684A 83EC18                  sub esp, 00000018
:0040684D 53                      push ebx
:0040684E 56                      push esi
:0040684F 57                      push edi
:00406850 C645F0FF                mov [ebp-10], FF
:00406854 8B4508                  mov eax, dword ptr [ebp+08]
:00406857 8A80B0D24400            mov al, byte ptr [eax+0044D2B0]
:0040685D 8845FC                  mov byte ptr [ebp-04], al
:00406860 837D081C                cmp dword ptr [ebp+08], 0000001C
:00406864 0F8609000000            jbe 00406873
:0040686A C645F801                mov [ebp-08], 01
:0040686E E904000000              jmp 00406877

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406864(C)
|
:00406873 C645F800                mov [ebp-08], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040686E(U)
|
:00406877 8B450C                  mov eax, dword ptr [ebp+0C]
:0040687A 8BC8                    mov ecx, eax
:0040687C 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040687F C1E003                  shl eax, 03
:00406882 2BC1                    sub eax, ecx
:00406884 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0040688A E8412B0000              call 004093D0
:0040688F 33C9                    xor ecx, ecx
:00406891 8AC8                    mov cl, al
:00406893 83F907                  cmp ecx, 00000007
:00406896 0F840F000000            je 004068AB
:0040689C 33C0                    xor eax, eax
:0040689E A0A4354500              mov al, byte ptr [004535A4]
:004068A3 A804                    test al, 04
:004068A5 0F840C000000            je 004068B7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406896(C)
|
:004068AB C745EC01000000          mov [ebp-14], 00000001
:004068B2 E907000000              jmp 004068BE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004068A5(C)
|
:004068B7 C745EC00000000          mov [ebp-14], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004068B2(U)
|
:004068BE 8B4508                  mov eax, dword ptr [ebp+08]
:004068C1 33C9                    xor ecx, ecx
:004068C3 8A4DF8                  mov cl, byte ptr [ebp-08]
:004068C6 83F901                  cmp ecx, 00000001
:004068C9 1BC9                    sbb ecx, ecx
:004068CB 83E1FC                  and ecx, FFFFFFFC
:004068CE 83C11D                  add ecx, 0000001D
:004068D1 2BC1                    sub eax, ecx
:004068D3 8845F4                  mov byte ptr [ebp-0C], al
:004068D6 33C0                    xor eax, eax
:004068D8 8A45F8                  mov al, byte ptr [ebp-08]
:004068DB 85C0                    test eax, eax
:004068DD 0F85D2000000            jne 004069B5
:004068E3 837DEC00                cmp dword ptr [ebp-14], 00000000
:004068E7 0F841C000000            je 00406909
:004068ED 33C0                    xor eax, eax
:004068EF 8A45F8                  mov al, byte ptr [ebp-08]
:004068F2 8B0485B8D14400          mov eax, dword ptr [4*eax+0044D1B8]
:004068F9 50                      push eax

* Possible StringData Ref from Data Obj ->"ʹ%s;ָ"
                                  |
:004068FA 68DCE04400              push 0044E0DC
:004068FF 6A00                    push 00000000
:00406901 E82F260300              call 00438F35
:00406906 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004068E7(C)
|
:00406909 6A01                    push 00000001
:0040690B 33C0                    xor eax, eax
:0040690D 8A45FC                  mov al, byte ptr [ebp-04]
:00406910 0D80000000              or eax, 00000080
:00406915 50                      push eax
:00406916 8B450C                  mov eax, dword ptr [ebp+0C]
:00406919 50                      push eax
:0040691A B900FB4600              mov ecx, 0046FB00
:0040691F E891650300              call 0043CEB5
:00406924 8845F0                  mov byte ptr [ebp-10], al
:00406927 33C0                    xor eax, eax
:00406929 8A45F0                  mov al, byte ptr [ebp-10]
:0040692C 3DFF000000              cmp eax, 000000FF
:00406931 0F8479000000            je 004069B0
:00406937 6A00                    push 00000000
:00406939 8B45F0                  mov eax, dword ptr [ebp-10]
:0040693C 50                      push eax
:0040693D E8A2000000              call 004069E4
:00406942 83C408                  add esp, 00000008
:00406945 85C0                    test eax, eax
:00406947 0F8463000000            je 004069B0
:0040694D 33C0                    xor eax, eax
:0040694F 8A45F0                  mov al, byte ptr [ebp-10]
:00406952 8BC8                    mov ecx, eax
:00406954 8D0440                  lea eax, dword ptr [eax+2*eax]
:00406957 C1E003                  shl eax, 03
:0040695A 2BC1                    sub eax, ecx
:0040695C 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00406962 E899280000              call 00409200
:00406967 668B00                  mov ax, word ptr [eax]
:0040696A 668945E8                mov word ptr [ebp-18], ax
:0040696E 8B45E9                  mov eax, dword ptr [ebp-17]
:00406971 50                      push eax
:00406972 8B45E8                  mov eax, dword ptr [ebp-18]
:00406975 50                      push eax
:00406976 B900FB4600              mov ecx, 0046FB00
:0040697B E868480300              call 0043B1E8
:00406980 8B4510                  mov eax, dword ptr [ebp+10]
:00406983 50                      push eax
:00406984 8B450C                  mov eax, dword ptr [ebp+0C]
:00406987 50                      push eax
:00406988 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040698B 50                      push eax
:0040698C 33C0                    xor eax, eax
:0040698E 8A45F0                  mov al, byte ptr [ebp-10]
:00406991 8BC8                    mov ecx, eax
:00406993 8D0440                  lea eax, dword ptr [eax+2*eax]
:00406996 C1E003                  shl eax, 03
:00406999 2BC1                    sub eax, ecx
:0040699B 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004069A1 E84C200000              call 004089F2
:004069A6 C70598DA440001000000    mov dword ptr [0044DA98], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00406931(C), :00406947(C)
|
:004069B0 E925000000              jmp 004069DA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004068DD(C)
|
:004069B5 8B4510                  mov eax, dword ptr [ebp+10]
:004069B8 50                      push eax
:004069B9 8B45F4                  mov eax, dword ptr [ebp-0C]
:004069BC 50                      push eax
:004069BD 8B450C                  mov eax, dword ptr [ebp+0C]
:004069C0 8BC8                    mov ecx, eax
:004069C2 8D0440                  lea eax, dword ptr [eax+2*eax]
:004069C5 C1E003                  shl eax, 03
:004069C8 2BC1                    sub eax, ecx
:004069CA 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004069D0 E820240000              call 00408DF5
:004069D5 A398DA4400              mov dword ptr [0044DA98], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004069B0(U)
|
:004069DA E900000000              jmp 004069DF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004069DA(U)
|
:004069DF 5F                      pop edi
:004069E0 5E                      pop esi
:004069E1 5B                      pop ebx
:004069E2 C9                      leave
:004069E3 C3                      ret



* Referenced by a CALL at Addresses:
|:0040693D   , :00406BCA   
|
:004069E4 55                      push ebp
:004069E5 8BEC                    mov ebp, esp
:004069E7 83EC08                  sub esp, 00000008
:004069EA 53                      push ebx
:004069EB 56                      push esi
:004069EC 57                      push edi
:004069ED 33C0                    xor eax, eax
:004069EF 8A4508                  mov al, byte ptr [ebp+08]
:004069F2 8BC8                    mov ecx, eax
:004069F4 8D0440                  lea eax, dword ptr [eax+2*eax]
:004069F7 C1E003                  shl eax, 03
:004069FA 2BC1                    sub eax, ecx
:004069FC 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00406A02 E829270000              call 00409130
:00406A07 8D0440                  lea eax, dword ptr [eax+2*eax]
:00406A0A 03C0                    add eax, eax
:00406A0C 8D04C0                  lea eax, dword ptr [eax+8*eax]
:00406A0F 05E8564500              add eax, 004556E8
:00406A14 8945FC                  mov dword ptr [ebp-04], eax
:00406A17 C745F801000000          mov [ebp-08], 00000001
:00406A1E 33C0                    xor eax, eax
:00406A20 8A4508                  mov al, byte ptr [ebp+08]
:00406A23 8BC8                    mov ecx, eax
:00406A25 8D0440                  lea eax, dword ptr [eax+2*eax]
:00406A28 C1E003                  shl eax, 03
:00406A2B 2BC1                    sub eax, ecx
:00406A2D 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00406A33 E8782D0000              call 004097B0
:00406A38 8BD8                    mov ebx, eax
:00406A3A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00406A3D E84E2D0000              call 00409790
:00406A42 3BD8                    cmp ebx, eax
:00406A44 0F8514000000            jne 00406A5E
:00406A4A 33C0                    xor eax, eax
:00406A4C 8A450C                  mov al, byte ptr [ebp+0C]
:00406A4F 85C0                    test eax, eax
:00406A51 0F8507000000            jne 00406A5E
:00406A57 C745F800000000          mov [ebp-08], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00406A44(C), :00406A51(C)
|
:00406A5E 33C0                    xor eax, eax
:00406A60 8A4508                  mov al, byte ptr [ebp+08]
:00406A63 8BC8                    mov ecx, eax
:00406A65 8D0440                  lea eax, dword ptr [eax+2*eax]
:00406A68 C1E003                  shl eax, 03
:00406A6B 2BC1                    sub eax, ecx
:00406A6D 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00406A73 E8E8270000              call 00409260
:00406A78 33DB                    xor ebx, ebx
:00406A7A 8AD8                    mov bl, al
:00406A7C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00406A7F E85C270000              call 004091E0
:00406A84 33C9                    xor ecx, ecx
:00406A86 8AC8                    mov cl, al
:00406A88 3BD9                    cmp ebx, ecx
:00406A8A 0F8515000000            jne 00406AA5
:00406A90 33C0                    xor eax, eax
:00406A92 8A450C                  mov al, byte ptr [ebp+0C]
:00406A95 83F801                  cmp eax, 00000001
:00406A98 0F8507000000            jne 00406AA5
:00406A9E C745F800000000          mov [ebp-08], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00406A8A(C), :00406A98(C)
|
:00406AA5 837DF800                cmp dword ptr [ebp-08], 00000000
:00406AA9 0F8520000000            jne 00406ACF
:00406AAF 6A0A                    push 0000000A
:00406AB1 B994A64600              mov ecx, 0046A694
:00406AB6 E869250100              call 00419024

* Possible StringData Ref from Data Obj ->"ٻָˡ"
                                  |
:00406ABB 68F0E04400              push 0044E0F0
:00406AC0 6A00                    push 00000000
:00406AC2 E86E240300              call 00438F35
:00406AC7 83C408                  add esp, 00000008
:00406ACA E8180A0300              call 004374E7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406AA9(C)
|
:00406ACF 8B45F8                  mov eax, dword ptr [ebp-08]
:00406AD2 E900000000              jmp 00406AD7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406AD2(U)
|
:00406AD7 5F                      pop edi
:00406AD8 5E                      pop esi
:00406AD9 5B                      pop ebx
:00406ADA C9                      leave
:00406ADB C3                      ret



* Referenced by a CALL at Addresses:
|:00403AEE   , :00408014   
|
:00406ADC 55                      push ebp
:00406ADD 8BEC                    mov ebp, esp
:00406ADF 83EC0C                  sub esp, 0000000C
:00406AE2 53                      push ebx
:00406AE3 56                      push esi
:00406AE4 57                      push edi
:00406AE5 C645F8FF                mov [ebp-08], FF
:00406AE9 8B4508                  mov eax, dword ptr [ebp+08]
:00406AEC 8A80B0D24400            mov al, byte ptr [eax+0044D2B0]
:00406AF2 8845FC                  mov byte ptr [ebp-04], al
:00406AF5 8B450C                  mov eax, dword ptr [ebp+0C]
:00406AF8 8BC8                    mov ecx, eax
:00406AFA 8D0440                  lea eax, dword ptr [eax+2*eax]
:00406AFD C1E003                  shl eax, 03
:00406B00 2BC1                    sub eax, ecx
:00406B02 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00406B08 E8C3280000              call 004093D0
:00406B0D 33C9                    xor ecx, ecx
:00406B0F 8AC8                    mov cl, al
:00406B11 83F907                  cmp ecx, 00000007
:00406B14 0F840F000000            je 00406B29
:00406B1A 33C0                    xor eax, eax
:00406B1C A0A4354500              mov al, byte ptr [004535A4]
:00406B21 A804                    test al, 04
:00406B23 0F840C000000            je 00406B35

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406B14(C)
|
:00406B29 C745F401000000          mov [ebp-0C], 00000001
:00406B30 E907000000              jmp 00406B3C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406B23(C)
|
:00406B35 C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406B30(U)
|
:00406B3C 837DF400                cmp dword ptr [ebp-0C], 00000000
:00406B40 0F8415000000            je 00406B5B

* Possible StringData Ref from Data Obj ->"ҷ"
                                  |
:00406B46 A1B8D14400              mov eax, dword ptr [0044D1B8]
:00406B4B 50                      push eax

* Possible StringData Ref from Data Obj ->"ʹ%sĲֵָ"
                                  |
:00406B4C 6800E14400              push 0044E100
:00406B51 6A00                    push 00000000
:00406B53 E8DD230300              call 00438F35
:00406B58 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406B40(C)
|
:00406B5B 6A01                    push 00000001
:00406B5D 33C0                    xor eax, eax
:00406B5F 8A45FC                  mov al, byte ptr [ebp-04]
:00406B62 0D80000000              or eax, 00000080
:00406B67 50                      push eax
:00406B68 8B450C                  mov eax, dword ptr [ebp+0C]
:00406B6B 50                      push eax
:00406B6C B900FB4600              mov ecx, 0046FB00
:00406B71 E83F630300              call 0043CEB5
:00406B76 8845F8                  mov byte ptr [ebp-08], al
:00406B79 33C0                    xor eax, eax
:00406B7B 8A45F8                  mov al, byte ptr [ebp-08]
:00406B7E 3DFF000000              cmp eax, 000000FF
:00406B83 0F848A000000            je 00406C13
:00406B89 33C0                    xor eax, eax
:00406B8B 8A45F8                  mov al, byte ptr [ebp-08]
:00406B8E 8BC8                    mov ecx, eax
:00406B90 8D0440                  lea eax, dword ptr [eax+2*eax]
:00406B93 C1E003                  shl eax, 03
:00406B96 2BC1                    sub eax, ecx
:00406B98 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00406B9E E8FD260000              call 004092A0
:00406BA3 33C9                    xor ecx, ecx
:00406BA5 8AC8                    mov cl, al
:00406BA7 83F91C                  cmp ecx, 0000001C
:00406BAA 0F8514000000            jne 00406BC4

* Possible StringData Ref from Data Obj ->"ʶӲִС"
                                  |
:00406BB0 6814E14400              push 0044E114
:00406BB5 6A00                    push 00000000
:00406BB7 E879230300              call 00438F35
:00406BBC 83C408                  add esp, 00000008
:00406BBF E954000000              jmp 00406C18

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406BAA(C)
|
:00406BC4 6A01                    push 00000001
:00406BC6 8B45F8                  mov eax, dword ptr [ebp-08]
:00406BC9 50                      push eax
:00406BCA E815FEFFFF              call 004069E4
:00406BCF 83C408                  add esp, 00000008
:00406BD2 85C0                    test eax, eax
:00406BD4 0F8439000000            je 00406C13
:00406BDA 6A01                    push 00000001
:00406BDC B921000000              mov ecx, 00000021
:00406BE1 8B4508                  mov eax, dword ptr [ebp+08]
:00406BE4 2BD2                    sub edx, edx
:00406BE6 F7F1                    div ecx
:00406BE8 52                      push edx
:00406BE9 8B45F8                  mov eax, dword ptr [ebp-08]
:00406BEC 50                      push eax
:00406BED E85FB7FFFF              call 00402351
:00406BF2 83C40C                  add esp, 0000000C
:00406BF5 6A01                    push 00000001
:00406BF7 33C0                    xor eax, eax
:00406BF9 8A45F8                  mov al, byte ptr [ebp-08]
:00406BFC 50                      push eax
:00406BFD 8B450C                  mov eax, dword ptr [ebp+0C]
:00406C00 50                      push eax
:00406C01 E8B2E7FFFF              call 004053B8
:00406C06 83C40C                  add esp, 0000000C
:00406C09 C70598DA440001000000    mov dword ptr [0044DA98], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00406B83(C), :00406BD4(C)
|
:00406C13 E900000000              jmp 00406C18

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00406BBF(U), :00406C13(U)
|
:00406C18 5F                      pop edi
:00406C19 5E                      pop esi
:00406C1A 5B                      pop ebx
:00406C1B C9                      leave
:00406C1C C3                      ret



* Referenced by a CALL at Addresses:
|:00403B2C   , :00408030   
|
:00406C1D 55                      push ebp
:00406C1E 8BEC                    mov ebp, esp
:00406C20 83EC14                  sub esp, 00000014
:00406C23 53                      push ebx
:00406C24 56                      push esi
:00406C25 57                      push edi
:00406C26 C645F4FF                mov [ebp-0C], FF
:00406C2A 8B4508                  mov eax, dword ptr [ebp+08]
:00406C2D 8A80B0D24400            mov al, byte ptr [eax+0044D2B0]
:00406C33 8845FC                  mov byte ptr [ebp-04], al
:00406C36 8B450C                  mov eax, dword ptr [ebp+0C]
:00406C39 8BC8                    mov ecx, eax
:00406C3B 8D0440                  lea eax, dword ptr [eax+2*eax]
:00406C3E C1E003                  shl eax, 03
:00406C41 2BC1                    sub eax, ecx
:00406C43 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00406C49 E882270000              call 004093D0
:00406C4E 33C9                    xor ecx, ecx
:00406C50 8AC8                    mov cl, al
:00406C52 83F907                  cmp ecx, 00000007
:00406C55 0F840F000000            je 00406C6A
:00406C5B 33C0                    xor eax, eax
:00406C5D A0A4354500              mov al, byte ptr [004535A4]
:00406C62 A804                    test al, 04
:00406C64 0F840C000000            je 00406C76

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406C55(C)
|
:00406C6A C745F001000000          mov [ebp-10], 00000001
:00406C71 E907000000              jmp 00406C7D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406C64(C)
|
:00406C76 C745F000000000          mov [ebp-10], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406C71(U)
|
:00406C7D 837DF000                cmp dword ptr [ebp-10], 00000000
:00406C81 0F8415000000            je 00406C9C

* Possible StringData Ref from Data Obj ->"ҷ"
                                  |
:00406C87 A1B8D14400              mov eax, dword ptr [0044D1B8]
:00406C8C 50                      push eax

* Possible StringData Ref from Data Obj ->"ʹ%sĻ״ָ̬"
                                  |
:00406C8D 6828E14400              push 0044E128
:00406C92 6A00                    push 00000000
:00406C94 E89C220300              call 00438F35
:00406C99 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406C81(C)
|
:00406C9C 6A01                    push 00000001
:00406C9E 33C0                    xor eax, eax
:00406CA0 8A45FC                  mov al, byte ptr [ebp-04]
:00406CA3 0D80000000              or eax, 00000080
:00406CA8 50                      push eax
:00406CA9 8B450C                  mov eax, dword ptr [ebp+0C]
:00406CAC 50                      push eax
:00406CAD B900FB4600              mov ecx, 0046FB00
:00406CB2 E8FE610300              call 0043CEB5
:00406CB7 8845F4                  mov byte ptr [ebp-0C], al
:00406CBA 33C0                    xor eax, eax
:00406CBC 8A45F4                  mov al, byte ptr [ebp-0C]
:00406CBF 3DFF000000              cmp eax, 000000FF
:00406CC4 0F84B9000000            je 00406D83
:00406CCA 33C0                    xor eax, eax
:00406CCC 8A45F4                  mov al, byte ptr [ebp-0C]
:00406CCF 8BC8                    mov ecx, eax
:00406CD1 8D0440                  lea eax, dword ptr [eax+2*eax]
:00406CD4 C1E003                  shl eax, 03
:00406CD7 2BC1                    sub eax, ecx
:00406CD9 0598C04600              add eax, 0046C098
:00406CDE 8945F8                  mov dword ptr [ebp-08], eax
:00406CE1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00406CE4 E817250000              call 00409200
:00406CE9 668B00                  mov ax, word ptr [eax]
:00406CEC 668945EC                mov word ptr [ebp-14], ax
:00406CF0 6A10                    push 00000010
:00406CF2 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00406CF5 E856240000              call 00409150
:00406CFA 85C0                    test eax, eax
:00406CFC 0F846D000000            je 00406D6F
:00406D02 6A00                    push 00000000
:00406D04 6A05                    push 00000005
:00406D06 33C0                    xor eax, eax
:00406D08 8A45ED                  mov al, byte ptr [ebp-13]
:00406D0B 8D0440                  lea eax, dword ptr [eax+2*eax]
:00406D0E 50                      push eax
:00406D0F 33C0                    xor eax, eax
:00406D11 8A45EC                  mov al, byte ptr [ebp-14]
:00406D14 8D0440                  lea eax, dword ptr [eax+2*eax]
:00406D17 50                      push eax
:00406D18 B900FB4600              mov ecx, 0046FB00
:00406D1D E81E7D0300              call 0043EA40
:00406D22 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00406D25 E856280000              call 00409580
:00406D2A 50                      push eax

* Possible StringData Ref from Data Obj ->"%sӻлָˡ"
                                  |
:00406D2B 6840E14400              push 0044E140
:00406D30 6A00                    push 00000000
:00406D32 E8FE210300              call 00438F35
:00406D37 83C40C                  add esp, 0000000C
:00406D3A 6A10                    push 00000010
:00406D3C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00406D3F E88C2A0000              call 004097D0
:00406D44 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00406D47 E873510200              call 0042BEBF
:00406D4C 6A01                    push 00000001
:00406D4E 33C0                    xor eax, eax
:00406D50 8A45F4                  mov al, byte ptr [ebp-0C]
:00406D53 50                      push eax
:00406D54 8B450C                  mov eax, dword ptr [ebp+0C]
:00406D57 50                      push eax
:00406D58 E85BE6FFFF              call 004053B8
:00406D5D 83C40C                  add esp, 0000000C
:00406D60 C70598DA440001000000    mov dword ptr [0044DA98], 00000001
:00406D6A E914000000              jmp 00406D83

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406CFC(C)
|

* Possible StringData Ref from Data Obj ->"֧ûлҡ"
                                  |
:00406D6F 6854E14400              push 0044E154
:00406D74 6A00                    push 00000000
:00406D76 E8BA210300              call 00438F35
:00406D7B 83C408                  add esp, 00000008
:00406D7E E905000000              jmp 00406D88

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00406CC4(C), :00406D6A(U)
|
:00406D83 E900000000              jmp 00406D88

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00406D7E(U), :00406D83(U)
|
:00406D88 5F                      pop edi
:00406D89 5E                      pop esi
:00406D8A 5B                      pop ebx
:00406D8B C9                      leave
:00406D8C C3                      ret



* Referenced by a CALL at Addresses:
|:00403B48   , :0040804C   
|
:00406D8D 55                      push ebp
:00406D8E 8BEC                    mov ebp, esp
:00406D90 83EC14                  sub esp, 00000014
:00406D93 53                      push ebx
:00406D94 56                      push esi
:00406D95 57                      push edi
:00406D96 C645F4FF                mov [ebp-0C], FF
:00406D9A 8B4508                  mov eax, dword ptr [ebp+08]
:00406D9D 8A80B0D24400            mov al, byte ptr [eax+0044D2B0]
:00406DA3 8845FC                  mov byte ptr [ebp-04], al
:00406DA6 8B450C                  mov eax, dword ptr [ebp+0C]
:00406DA9 8BC8                    mov ecx, eax
:00406DAB 8D0440                  lea eax, dword ptr [eax+2*eax]
:00406DAE C1E003                  shl eax, 03
:00406DB1 2BC1                    sub eax, ecx
:00406DB3 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00406DB9 E812260000              call 004093D0
:00406DBE 33C9                    xor ecx, ecx
:00406DC0 8AC8                    mov cl, al
:00406DC2 83F907                  cmp ecx, 00000007
:00406DC5 0F840F000000            je 00406DDA
:00406DCB 33C0                    xor eax, eax
:00406DCD A0A4354500              mov al, byte ptr [004535A4]
:00406DD2 A804                    test al, 04
:00406DD4 0F840C000000            je 00406DE6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406DC5(C)
|
:00406DDA C745F001000000          mov [ebp-10], 00000001
:00406DE1 E907000000              jmp 00406DED

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406DD4(C)
|
:00406DE6 C745F000000000          mov [ebp-10], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406DE1(U)
|
:00406DED 837DF000                cmp dword ptr [ebp-10], 00000000
:00406DF1 0F8415000000            je 00406E0C

* Possible StringData Ref from Data Obj ->"ҷ"
                                  |
:00406DF7 A1B8D14400              mov eax, dword ptr [0044D1B8]
:00406DFC 50                      push eax

* Possible StringData Ref from Data Obj ->"ʹ%s;״̬лָ"
                                  |
:00406DFD 6868E14400              push 0044E168
:00406E02 6A00                    push 00000000
:00406E04 E82C210300              call 00438F35
:00406E09 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406DF1(C)
|
:00406E0C 6A01                    push 00000001
:00406E0E 33C0                    xor eax, eax
:00406E10 8A45FC                  mov al, byte ptr [ebp-04]
:00406E13 0D80000000              or eax, 00000080
:00406E18 50                      push eax
:00406E19 8B450C                  mov eax, dword ptr [ebp+0C]
:00406E1C 50                      push eax
:00406E1D B900FB4600              mov ecx, 0046FB00
:00406E22 E88E600300              call 0043CEB5
:00406E27 8845F4                  mov byte ptr [ebp-0C], al
:00406E2A 33C0                    xor eax, eax
:00406E2C 8A45F4                  mov al, byte ptr [ebp-0C]
:00406E2F 3DFF000000              cmp eax, 000000FF
:00406E34 0F84BD000000            je 00406EF7
:00406E3A 33C0                    xor eax, eax
:00406E3C 8A45F4                  mov al, byte ptr [ebp-0C]
:00406E3F 8BC8                    mov ecx, eax
:00406E41 8D0440                  lea eax, dword ptr [eax+2*eax]
:00406E44 C1E003                  shl eax, 03
:00406E47 2BC1                    sub eax, ecx
:00406E49 0598C04600              add eax, 0046C098
:00406E4E 8945F8                  mov dword ptr [ebp-08], eax
:00406E51 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00406E54 E8A7230000              call 00409200
:00406E59 668B00                  mov ax, word ptr [eax]
:00406E5C 668945EC                mov word ptr [ebp-14], ax
:00406E60 6A20                    push 00000020
:00406E62 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00406E65 E8E6220000              call 00409150
:00406E6A 85C0                    test eax, eax
:00406E6C 0F8465000000            je 00406ED7
:00406E72 6A00                    push 00000000
:00406E74 6A05                    push 00000005
:00406E76 33C0                    xor eax, eax
:00406E78 8A45ED                  mov al, byte ptr [ebp-13]
:00406E7B 8D0440                  lea eax, dword ptr [eax+2*eax]
:00406E7E 50                      push eax
:00406E7F 33C0                    xor eax, eax
:00406E81 8A45EC                  mov al, byte ptr [ebp-14]
:00406E84 8D0440                  lea eax, dword ptr [eax+2*eax]
:00406E87 50                      push eax
:00406E88 B900FB4600              mov ecx, 0046FB00
:00406E8D E8AE7B0300              call 0043EA40
:00406E92 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00406E95 E8E6260000              call 00409580
:00406E9A 50                      push eax

* Possible StringData Ref from Data Obj ->"%s;״̬лָˡ"
                                  |
:00406E9B 6888E14400              push 0044E188
:00406EA0 6A00                    push 00000000
:00406EA2 E88E200300              call 00438F35
:00406EA7 83C40C                  add esp, 0000000C
:00406EAA 6A20                    push 00000020
:00406EAC 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00406EAF E81C290000              call 004097D0
:00406EB4 6A01                    push 00000001
:00406EB6 33C0                    xor eax, eax
:00406EB8 8A45F4                  mov al, byte ptr [ebp-0C]
:00406EBB 50                      push eax
:00406EBC 8B450C                  mov eax, dword ptr [ebp+0C]
:00406EBF 50                      push eax
:00406EC0 E8F3E4FFFF              call 004053B8
:00406EC5 83C40C                  add esp, 0000000C
:00406EC8 C70598DA440001000000    mov dword ptr [0044DA98], 00000001
:00406ED2 E920000000              jmp 00406EF7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406E6C(C)
|
:00406ED7 6A0A                    push 0000000A
:00406ED9 B994A64600              mov ecx, 0046A694
:00406EDE E841210100              call 00419024

* Possible StringData Ref from Data Obj ->"ִ֧ӡ"
                                  |
:00406EE3 68D8D14400              push 0044D1D8
:00406EE8 6A00                    push 00000000
:00406EEA E846200300              call 00438F35
:00406EEF 83C408                  add esp, 00000008
:00406EF2 E905000000              jmp 00406EFC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00406E34(C), :00406ED2(U)
|
:00406EF7 E900000000              jmp 00406EFC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00406EF2(U), :00406EF7(U)
|
:00406EFC 5F                      pop edi
:00406EFD 5E                      pop esi
:00406EFE 5B                      pop ebx
:00406EFF C9                      leave
:00406F00 C3                      ret



* Referenced by a CALL at Addresses:
|:00403B64   , :00408068   
|
:00406F01 55                      push ebp
:00406F02 8BEC                    mov ebp, esp
:00406F04 83EC14                  sub esp, 00000014
:00406F07 53                      push ebx
:00406F08 56                      push esi
:00406F09 57                      push edi
:00406F0A C645F4FF                mov [ebp-0C], FF
:00406F0E 8B4508                  mov eax, dword ptr [ebp+08]
:00406F11 8A80B0D24400            mov al, byte ptr [eax+0044D2B0]
:00406F17 8845FC                  mov byte ptr [ebp-04], al
:00406F1A 8B450C                  mov eax, dword ptr [ebp+0C]
:00406F1D 8BC8                    mov ecx, eax
:00406F1F 8D0440                  lea eax, dword ptr [eax+2*eax]
:00406F22 C1E003                  shl eax, 03
:00406F25 2BC1                    sub eax, ecx
:00406F27 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00406F2D E89E240000              call 004093D0
:00406F32 33C9                    xor ecx, ecx
:00406F34 8AC8                    mov cl, al
:00406F36 83F907                  cmp ecx, 00000007
:00406F39 0F840F000000            je 00406F4E
:00406F3F 33C0                    xor eax, eax
:00406F41 A0A4354500              mov al, byte ptr [004535A4]
:00406F46 A804                    test al, 04
:00406F48 0F840C000000            je 00406F5A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406F39(C)
|
:00406F4E C745F001000000          mov [ebp-10], 00000001
:00406F55 E907000000              jmp 00406F61

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406F48(C)
|
:00406F5A C745F000000000          mov [ebp-10], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406F55(U)
|
:00406F61 837DF000                cmp dword ptr [ebp-10], 00000000
:00406F65 0F8415000000            je 00406F80

* Possible StringData Ref from Data Obj ->"ҷ"
                                  |
:00406F6B A1B8D14400              mov eax, dword ptr [0044D1B8]
:00406F70 50                      push eax

* Possible StringData Ref from Data Obj ->"ʹ%sӹٶȼ״̬лָ"
                                  |
:00406F71 68A8E14400              push 0044E1A8
:00406F76 6A00                    push 00000000
:00406F78 E8B81F0300              call 00438F35
:00406F7D 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406F65(C)
|
:00406F80 6A01                    push 00000001
:00406F82 33C0                    xor eax, eax
:00406F84 8A45FC                  mov al, byte ptr [ebp-04]
:00406F87 0D80000000              or eax, 00000080
:00406F8C 50                      push eax
:00406F8D 8B450C                  mov eax, dword ptr [ebp+0C]
:00406F90 50                      push eax
:00406F91 B900FB4600              mov ecx, 0046FB00
:00406F96 E81A5F0300              call 0043CEB5
:00406F9B 8845F4                  mov byte ptr [ebp-0C], al
:00406F9E 33C0                    xor eax, eax
:00406FA0 8A45F4                  mov al, byte ptr [ebp-0C]
:00406FA3 3DFF000000              cmp eax, 000000FF
:00406FA8 0F84BD000000            je 0040706B
:00406FAE 33C0                    xor eax, eax
:00406FB0 8A45F4                  mov al, byte ptr [ebp-0C]
:00406FB3 8BC8                    mov ecx, eax
:00406FB5 8D0440                  lea eax, dword ptr [eax+2*eax]
:00406FB8 C1E003                  shl eax, 03
:00406FBB 2BC1                    sub eax, ecx
:00406FBD 0598C04600              add eax, 0046C098
:00406FC2 8945F8                  mov dword ptr [ebp-08], eax
:00406FC5 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00406FC8 E833220000              call 00409200
:00406FCD 668B00                  mov ax, word ptr [eax]
:00406FD0 668945EC                mov word ptr [ebp-14], ax
:00406FD4 6A02                    push 00000002
:00406FD6 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00406FD9 E872210000              call 00409150
:00406FDE 85C0                    test eax, eax
:00406FE0 0F8465000000            je 0040704B
:00406FE6 6A00                    push 00000000
:00406FE8 6A05                    push 00000005
:00406FEA 33C0                    xor eax, eax
:00406FEC 8A45ED                  mov al, byte ptr [ebp-13]
:00406FEF 8D0440                  lea eax, dword ptr [eax+2*eax]
:00406FF2 50                      push eax
:00406FF3 33C0                    xor eax, eax
:00406FF5 8A45EC                  mov al, byte ptr [ebp-14]
:00406FF8 8D0440                  lea eax, dword ptr [eax+2*eax]
:00406FFB 50                      push eax
:00406FFC B900FB4600              mov ecx, 0046FB00
:00407001 E83A7A0300              call 0043EA40
:00407006 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00407009 E872250000              call 00409580
:0040700E 50                      push eax

* Possible StringData Ref from Data Obj ->"%sĹٶȻָˡ"
                                  |
:0040700F 68C8E14400              push 0044E1C8
:00407014 6A00                    push 00000000
:00407016 E81A1F0300              call 00438F35
:0040701B 83C40C                  add esp, 0000000C
:0040701E 6A02                    push 00000002
:00407020 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00407023 E8A8270000              call 004097D0
:00407028 6A01                    push 00000001
:0040702A 33C0                    xor eax, eax
:0040702C 8A45F4                  mov al, byte ptr [ebp-0C]
:0040702F 50                      push eax
:00407030 8B450C                  mov eax, dword ptr [ebp+0C]
:00407033 50                      push eax
:00407034 E87FE3FFFF              call 004053B8
:00407039 83C40C                  add esp, 0000000C
:0040703C C70598DA440001000000    mov dword ptr [0044DA98], 00000001
:00407046 E920000000              jmp 0040706B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406FE0(C)
|
:0040704B 6A0A                    push 0000000A
:0040704D B994A64600              mov ecx, 0046A694
:00407052 E8CD1F0100              call 00419024

* Possible StringData Ref from Data Obj ->"ִ֧ӡ"
                                  |
:00407057 68D8D14400              push 0044D1D8
:0040705C 6A00                    push 00000000
:0040705E E8D21E0300              call 00438F35
:00407063 83C408                  add esp, 00000008
:00407066 E905000000              jmp 00407070

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00406FA8(C), :00407046(U)
|
:0040706B E900000000              jmp 00407070

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00407066(U), :0040706B(U)
|
:00407070 5F                      pop edi
:00407071 5E                      pop esi
:00407072 5B                      pop ebx
:00407073 C9                      leave
:00407074 C3                      ret



* Referenced by a CALL at Addresses:
|:00403B80   , :00408084   
|
:00407075 55                      push ebp
:00407076 8BEC                    mov ebp, esp
:00407078 83EC14                  sub esp, 00000014
:0040707B 53                      push ebx
:0040707C 56                      push esi
:0040707D 57                      push edi
:0040707E C645F4FF                mov [ebp-0C], FF
:00407082 8B4508                  mov eax, dword ptr [ebp+08]
:00407085 8A80B0D24400            mov al, byte ptr [eax+0044D2B0]
:0040708B 8845FC                  mov byte ptr [ebp-04], al
:0040708E 8B450C                  mov eax, dword ptr [ebp+0C]
:00407091 8BC8                    mov ecx, eax
:00407093 8D0440                  lea eax, dword ptr [eax+2*eax]
:00407096 C1E003                  shl eax, 03
:00407099 2BC1                    sub eax, ecx
:0040709B 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004070A1 E82A230000              call 004093D0
:004070A6 33C9                    xor ecx, ecx
:004070A8 8AC8                    mov cl, al
:004070AA 83F907                  cmp ecx, 00000007
:004070AD 0F840F000000            je 004070C2
:004070B3 33C0                    xor eax, eax
:004070B5 A0A4354500              mov al, byte ptr [004535A4]
:004070BA A804                    test al, 04
:004070BC 0F840C000000            je 004070CE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004070AD(C)
|
:004070C2 C745F001000000          mov [ebp-10], 00000001
:004070C9 E907000000              jmp 004070D5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004070BC(C)
|
:004070CE C745F000000000          mov [ebp-10], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004070C9(U)
|
:004070D5 837DF000                cmp dword ptr [ebp-10], 00000000
:004070D9 0F8415000000            je 004070F4

* Possible StringData Ref from Data Obj ->"ҷ"
                                  |
:004070DF A1B8D14400              mov eax, dword ptr [0044D1B8]
:004070E4 50                      push eax

* Possible StringData Ref from Data Obj ->"ʹ%sƶ״̬лָ"
                                  |
:004070E5 68E0E14400              push 0044E1E0
:004070EA 6A00                    push 00000000
:004070EC E8441E0300              call 00438F35
:004070F1 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004070D9(C)
|
:004070F4 6A01                    push 00000001
:004070F6 33C0                    xor eax, eax
:004070F8 8A45FC                  mov al, byte ptr [ebp-04]
:004070FB 0D80000000              or eax, 00000080
:00407100 50                      push eax
:00407101 8B450C                  mov eax, dword ptr [ebp+0C]
:00407104 50                      push eax
:00407105 B900FB4600              mov ecx, 0046FB00
:0040710A E8A65D0300              call 0043CEB5
:0040710F 8845F4                  mov byte ptr [ebp-0C], al
:00407112 33C0                    xor eax, eax
:00407114 8A45F4                  mov al, byte ptr [ebp-0C]
:00407117 3DFF000000              cmp eax, 000000FF
:0040711C 0F84BD000000            je 004071DF
:00407122 33C0                    xor eax, eax
:00407124 8A45F4                  mov al, byte ptr [ebp-0C]
:00407127 8BC8                    mov ecx, eax
:00407129 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040712C C1E003                  shl eax, 03
:0040712F 2BC1                    sub eax, ecx
:00407131 0598C04600              add eax, 0046C098
:00407136 8945F8                  mov dword ptr [ebp-08], eax
:00407139 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040713C E8BF200000              call 00409200
:00407141 668B00                  mov ax, word ptr [eax]
:00407144 668945EC                mov word ptr [ebp-14], ax
:00407148 6A01                    push 00000001
:0040714A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040714D E8FE1F0000              call 00409150
:00407152 85C0                    test eax, eax
:00407154 0F8465000000            je 004071BF
:0040715A 6A00                    push 00000000
:0040715C 6A05                    push 00000005
:0040715E 33C0                    xor eax, eax
:00407160 8A45ED                  mov al, byte ptr [ebp-13]
:00407163 8D0440                  lea eax, dword ptr [eax+2*eax]
:00407166 50                      push eax
:00407167 33C0                    xor eax, eax
:00407169 8A45EC                  mov al, byte ptr [ebp-14]
:0040716C 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040716F 50                      push eax
:00407170 B900FB4600              mov ecx, 0046FB00
:00407175 E8C6780300              call 0043EA40
:0040717A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040717D E8FE230000              call 00409580
:00407182 50                      push eax

* Possible StringData Ref from Data Obj ->"%sƶָˡ"
                                  |
:00407183 6800E24400              push 0044E200
:00407188 6A00                    push 00000000
:0040718A E8A61D0300              call 00438F35
:0040718F 83C40C                  add esp, 0000000C
:00407192 6A01                    push 00000001
:00407194 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00407197 E834260000              call 004097D0
:0040719C 6A01                    push 00000001
:0040719E 33C0                    xor eax, eax
:004071A0 8A45F4                  mov al, byte ptr [ebp-0C]
:004071A3 50                      push eax
:004071A4 8B450C                  mov eax, dword ptr [ebp+0C]
:004071A7 50                      push eax
:004071A8 E80BE2FFFF              call 004053B8
:004071AD 83C40C                  add esp, 0000000C
:004071B0 C70598DA440001000000    mov dword ptr [0044DA98], 00000001
:004071BA E920000000              jmp 004071DF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407154(C)
|
:004071BF 6A0A                    push 0000000A
:004071C1 B994A64600              mov ecx, 0046A694
:004071C6 E8591E0100              call 00419024

* Possible StringData Ref from Data Obj ->"ִ֧ӡ"
                                  |
:004071CB 68D8D14400              push 0044D1D8
:004071D0 6A00                    push 00000000
:004071D2 E85E1D0300              call 00438F35
:004071D7 83C408                  add esp, 00000008
:004071DA E905000000              jmp 004071E4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040711C(C), :004071BA(U)
|
:004071DF E900000000              jmp 004071E4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004071DA(U), :004071DF(U)
|
:004071E4 5F                      pop edi
:004071E5 5E                      pop esi
:004071E6 5B                      pop ebx
:004071E7 C9                      leave
:004071E8 C3                      ret



* Referenced by a CALL at Addresses:
|:00403BCA   , :004080A0   
|
:004071E9 55                      push ebp
:004071EA 8BEC                    mov ebp, esp
:004071EC 83EC20                  sub esp, 00000020
:004071EF 53                      push ebx
:004071F0 56                      push esi
:004071F1 57                      push edi
:004071F2 C645F0FF                mov [ebp-10], FF
:004071F6 8B4508                  mov eax, dword ptr [ebp+08]
:004071F9 8A80B0D24400            mov al, byte ptr [eax+0044D2B0]
:004071FF 8845FC                  mov byte ptr [ebp-04], al
:00407202 837D0829                cmp dword ptr [ebp+08], 00000029
:00407206 0F8509000000            jne 00407215
:0040720C C645F801                mov [ebp-08], 01
:00407210 E904000000              jmp 00407219

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407206(C)
|
:00407215 C645F800                mov [ebp-08], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407210(U)
|
:00407219 8B450C                  mov eax, dword ptr [ebp+0C]
:0040721C 8BC8                    mov ecx, eax
:0040721E 8D0440                  lea eax, dword ptr [eax+2*eax]
:00407221 C1E003                  shl eax, 03
:00407224 2BC1                    sub eax, ecx
:00407226 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0040722C E89F210000              call 004093D0
:00407231 33C9                    xor ecx, ecx
:00407233 8AC8                    mov cl, al
:00407235 83F907                  cmp ecx, 00000007
:00407238 0F840F000000            je 0040724D
:0040723E 33C0                    xor eax, eax
:00407240 A0A4354500              mov al, byte ptr [004535A4]
:00407245 A804                    test al, 04
:00407247 0F840C000000            je 00407259

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407238(C)
|
:0040724D C745EC01000000          mov [ebp-14], 00000001
:00407254 E907000000              jmp 00407260

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407247(C)
|
:00407259 C745EC00000000          mov [ebp-14], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407254(U)
|
:00407260 837DEC00                cmp dword ptr [ebp-14], 00000000
:00407264 0F841C000000            je 00407286
:0040726A 33C0                    xor eax, eax
:0040726C 8A45F8                  mov al, byte ptr [ebp-08]
:0040726F 8B0485B8D14400          mov eax, dword ptr [4*eax+0044D1B8]
:00407276 50                      push eax

* Possible StringData Ref from Data Obj ->"%sĹ"
                                  |
:00407277 6814E24400              push 0044E214
:0040727C 6A00                    push 00000000
:0040727E E8B21C0300              call 00438F35
:00407283 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407264(C)
|
:00407286 6A00                    push 00000000
:00407288 B900FB4600              mov ecx, 0046FB00
:0040728D E8AE230000              call 00409640
:00407292 33C0                    xor eax, eax
:00407294 8A45F8                  mov al, byte ptr [ebp-08]
:00407297 85C0                    test eax, eax
:00407299 0F8418000000            je 004072B7
:0040729F 6A01                    push 00000001
:004072A1 B900FB4600              mov ecx, 0046FB00
:004072A6 E855250000              call 00409800
:004072AB 6A01                    push 00000001
:004072AD B900FB4600              mov ecx, 0046FB00
:004072B2 E889230000              call 00409640

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407299(C)
|
:004072B7 6A01                    push 00000001
:004072B9 33C0                    xor eax, eax
:004072BB 8A45FC                  mov al, byte ptr [ebp-04]
:004072BE 0D80000000              or eax, 00000080
:004072C3 50                      push eax
:004072C4 8B450C                  mov eax, dword ptr [ebp+0C]
:004072C7 50                      push eax
:004072C8 B900FB4600              mov ecx, 0046FB00
:004072CD E8E35B0300              call 0043CEB5
:004072D2 8845F0                  mov byte ptr [ebp-10], al
:004072D5 6A00                    push 00000000
:004072D7 B900FB4600              mov ecx, 0046FB00
:004072DC E81F250000              call 00409800
:004072E1 33C0                    xor eax, eax
:004072E3 8A45F0                  mov al, byte ptr [ebp-10]
:004072E6 3DFF000000              cmp eax, 000000FF
:004072EB 0F843E020000            je 0040752F
:004072F1 33C0                    xor eax, eax
:004072F3 8A45F0                  mov al, byte ptr [ebp-10]
:004072F6 8BC8                    mov ecx, eax
:004072F8 8D0440                  lea eax, dword ptr [eax+2*eax]
:004072FB C1E003                  shl eax, 03
:004072FE 2BC1                    sub eax, ecx
:00407300 0598C04600              add eax, 0046C098
:00407305 8945F4                  mov dword ptr [ebp-0C], eax
:00407308 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040730B E8F01E0000              call 00409200
:00407310 668B00                  mov ax, word ptr [eax]
:00407313 668945E8                mov word ptr [ebp-18], ax
:00407317 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040731A E8B1230000              call 004096D0
:0040731F 33C9                    xor ecx, ecx
:00407321 8AC8                    mov cl, al
:00407323 85C9                    test ecx, ecx
:00407325 0F8514000000            jne 0040733F

* Possible StringData Ref from Data Obj ->"֧ӵĹˡ"
                                  |
:0040732B 6828E24400              push 0044E228
:00407330 6A00                    push 00000000
:00407332 E8FE1B0300              call 00438F35
:00407337 83C408                  add esp, 00000008
:0040733A E9F5010000              jmp 00407534

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407325(C)
|
:0040733F 8B45E9                  mov eax, dword ptr [ebp-17]
:00407342 50                      push eax
:00407343 8B45E8                  mov eax, dword ptr [ebp-18]
:00407346 50                      push eax
:00407347 B900FB4600              mov ecx, 0046FB00
:0040734C E8973E0300              call 0043B1E8
:00407351 6A00                    push 00000000
:00407353 6A04                    push 00000004
:00407355 33C0                    xor eax, eax
:00407357 8A45E9                  mov al, byte ptr [ebp-17]
:0040735A 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040735D 50                      push eax
:0040735E 33C0                    xor eax, eax
:00407360 8A45E8                  mov al, byte ptr [ebp-18]
:00407363 8D0440                  lea eax, dword ptr [eax+2*eax]
:00407366 50                      push eax
:00407367 B900FB4600              mov ecx, 0046FB00
:0040736C E8CF760300              call 0043EA40
:00407371 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00407374 E807220000              call 00409580
:00407379 50                      push eax

* Possible StringData Ref from Data Obj ->"%sĹˡ"
                                  |
:0040737A 6848E24400              push 0044E248
:0040737F 6A00                    push 00000000
:00407381 E8AF1B0300              call 00438F35
:00407386 83C40C                  add esp, 0000000C
:00407389 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040738C E83F230000              call 004096D0
:00407391 33C9                    xor ecx, ecx
:00407393 8AC8                    mov cl, al
:00407395 49                      dec ecx
:00407396 83C940                  or ecx, 00000040
:00407399 51                      push ecx
:0040739A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040739D E8FE220000              call 004096A0
:004073A2 6A01                    push 00000001
:004073A4 33C0                    xor eax, eax
:004073A6 8A45F0                  mov al, byte ptr [ebp-10]
:004073A9 50                      push eax
:004073AA 8B450C                  mov eax, dword ptr [ebp+0C]
:004073AD 50                      push eax
:004073AE E805E0FFFF              call 004053B8
:004073B3 83C40C                  add esp, 0000000C
:004073B6 33C0                    xor eax, eax
:004073B8 8A45F8                  mov al, byte ptr [ebp-08]
:004073BB 85C0                    test eax, eax
:004073BD 0F8462010000            je 00407525
:004073C3 C645E400                mov [ebp-1C], 00
:004073C7 E903000000              jmp 004073CF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407520(U)
|
:004073CC FE45E4                  inc [ebp-1C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004073C7(U)
|
:004073CF 33C0                    xor eax, eax
:004073D1 8A45E4                  mov al, byte ptr [ebp-1C]
:004073D4 83F804                  cmp eax, 00000004
:004073D7 0F8D48010000            jnl 00407525
:004073DD 8B45E4                  mov eax, dword ptr [ebp-1C]
:004073E0 50                      push eax
:004073E1 8D45E8                  lea eax, dword ptr [ebp-18]
:004073E4 50                      push eax
:004073E5 E86B220100              call 00419655
:004073EA 83C408                  add esp, 00000008
:004073ED 668B00                  mov ax, word ptr [eax]
:004073F0 668945E0                mov word ptr [ebp-20], ax
:004073F4 33C0                    xor eax, eax
:004073F6 8A45E0                  mov al, byte ptr [ebp-20]
:004073F9 3DFF000000              cmp eax, 000000FF
:004073FE 0F841C010000            je 00407520
:00407404 8D45E0                  lea eax, dword ptr [ebp-20]
:00407407 50                      push eax
:00407408 E830210100              call 0041953D
:0040740D 83C404                  add esp, 00000004
:00407410 8845F0                  mov byte ptr [ebp-10], al
:00407413 33C0                    xor eax, eax
:00407415 8A45F0                  mov al, byte ptr [ebp-10]
:00407418 3DFF000000              cmp eax, 000000FF
:0040741D 0F84FD000000            je 00407520
:00407423 33C0                    xor eax, eax
:00407425 8A45F0                  mov al, byte ptr [ebp-10]
:00407428 8BC8                    mov ecx, eax
:0040742A 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040742D C1E003                  shl eax, 03
:00407430 2BC1                    sub eax, ecx
:00407432 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00407438 E8E31D0000              call 00409220
:0040743D 8BD8                    mov ebx, eax
:0040743F 8B450C                  mov eax, dword ptr [ebp+0C]
:00407442 8BC8                    mov ecx, eax
:00407444 8D0440                  lea eax, dword ptr [eax+2*eax]
:00407447 C1E003                  shl eax, 03
:0040744A 2BC1                    sub eax, ecx
:0040744C 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00407452 E8C91D0000              call 00409220
:00407457 3BD8                    cmp ebx, eax
:00407459 0F85C1000000            jne 00407520
:0040745F 33C0                    xor eax, eax
:00407461 8A45F0                  mov al, byte ptr [ebp-10]
:00407464 8BC8                    mov ecx, eax
:00407466 8D0440                  lea eax, dword ptr [eax+2*eax]
:00407469 C1E003                  shl eax, 03
:0040746C 2BC1                    sub eax, ecx
:0040746E 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00407474 E857220000              call 004096D0
:00407479 33C9                    xor ecx, ecx
:0040747B 8AC8                    mov cl, al
:0040747D 85C9                    test ecx, ecx
:0040747F 0F849B000000            je 00407520
:00407485 6A00                    push 00000000
:00407487 6A04                    push 00000004
:00407489 33C0                    xor eax, eax
:0040748B 8A45E1                  mov al, byte ptr [ebp-1F]
:0040748E 8D0440                  lea eax, dword ptr [eax+2*eax]
:00407491 50                      push eax
:00407492 33C0                    xor eax, eax
:00407494 8A45E0                  mov al, byte ptr [ebp-20]
:00407497 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040749A 50                      push eax
:0040749B B900FB4600              mov ecx, 0046FB00
:004074A0 E89B750300              call 0043EA40
:004074A5 33C0                    xor eax, eax
:004074A7 8A45F0                  mov al, byte ptr [ebp-10]
:004074AA 8BC8                    mov ecx, eax
:004074AC 8D0440                  lea eax, dword ptr [eax+2*eax]
:004074AF C1E003                  shl eax, 03
:004074B2 2BC1                    sub eax, ecx
:004074B4 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004074BA E8C1200000              call 00409580
:004074BF 50                      push eax

* Possible StringData Ref from Data Obj ->"%sĹˡ"
                                  |
:004074C0 685CE24400              push 0044E25C
:004074C5 6A00                    push 00000000
:004074C7 E8691A0300              call 00438F35
:004074CC 83C40C                  add esp, 0000000C
:004074CF 33C0                    xor eax, eax
:004074D1 8A45F0                  mov al, byte ptr [ebp-10]
:004074D4 8BC8                    mov ecx, eax
:004074D6 8D0440                  lea eax, dword ptr [eax+2*eax]
:004074D9 C1E003                  shl eax, 03
:004074DC 2BC1                    sub eax, ecx
:004074DE 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004074E4 E8E7210000              call 004096D0
:004074E9 33C9                    xor ecx, ecx
:004074EB 8AC8                    mov cl, al
:004074ED 49                      dec ecx
:004074EE 83C940                  or ecx, 00000040
:004074F1 51                      push ecx
:004074F2 33C0                    xor eax, eax
:004074F4 8A45F0                  mov al, byte ptr [ebp-10]
:004074F7 8BC8                    mov ecx, eax
:004074F9 8D0440                  lea eax, dword ptr [eax+2*eax]
:004074FC C1E003                  shl eax, 03
:004074FF 2BC1                    sub eax, ecx
:00407501 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00407507 E894210000              call 004096A0
:0040750C 6A01                    push 00000001
:0040750E 33C0                    xor eax, eax
:00407510 8A45F0                  mov al, byte ptr [ebp-10]
:00407513 50                      push eax
:00407514 8B450C                  mov eax, dword ptr [ebp+0C]
:00407517 50                      push eax
:00407518 E89BDEFFFF              call 004053B8
:0040751D 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004073FE(C), :0040741D(C), :00407459(C), :0040747F(C)
|
:00407520 E9A7FEFFFF              jmp 004073CC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004073BD(C), :004073D7(C)
|
:00407525 C70598DA440001000000    mov dword ptr [0044DA98], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004072EB(C)
|
:0040752F E900000000              jmp 00407534

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040733A(U), :0040752F(U)
|
:00407534 5F                      pop edi
:00407535 5E                      pop esi
:00407536 5B                      pop ebx
:00407537 C9                      leave
:00407538 C3                      ret



* Referenced by a CALL at Addresses:
|:00403BE6   , :004080BC   
|
:00407539 55                      push ebp
:0040753A 8BEC                    mov ebp, esp
:0040753C 83EC20                  sub esp, 00000020
:0040753F 53                      push ebx
:00407540 56                      push esi
:00407541 57                      push edi
:00407542 C645F0FF                mov [ebp-10], FF
:00407546 8B4508                  mov eax, dword ptr [ebp+08]
:00407549 8A80B0D24400            mov al, byte ptr [eax+0044D2B0]
:0040754F 8845FC                  mov byte ptr [ebp-04], al
:00407552 837D082B                cmp dword ptr [ebp+08], 0000002B
:00407556 0F8509000000            jne 00407565
:0040755C C645F801                mov [ebp-08], 01
:00407560 E904000000              jmp 00407569

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407556(C)
|
:00407565 C645F800                mov [ebp-08], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407560(U)
|
:00407569 8B450C                  mov eax, dword ptr [ebp+0C]
:0040756C 8BC8                    mov ecx, eax
:0040756E 8D0440                  lea eax, dword ptr [eax+2*eax]
:00407571 C1E003                  shl eax, 03
:00407574 2BC1                    sub eax, ecx
:00407576 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0040757C E84F1E0000              call 004093D0
:00407581 33C9                    xor ecx, ecx
:00407583 8AC8                    mov cl, al
:00407585 83F907                  cmp ecx, 00000007
:00407588 0F840F000000            je 0040759D
:0040758E 33C0                    xor eax, eax
:00407590 A0A4354500              mov al, byte ptr [004535A4]
:00407595 A804                    test al, 04
:00407597 0F840C000000            je 004075A9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407588(C)
|
:0040759D C745EC01000000          mov [ebp-14], 00000001
:004075A4 E907000000              jmp 004075B0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407597(C)
|
:004075A9 C745EC00000000          mov [ebp-14], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004075A4(U)
|
:004075B0 837DEC00                cmp dword ptr [ebp-14], 00000000
:004075B4 0F841C000000            je 004075D6
:004075BA 33C0                    xor eax, eax
:004075BC 8A45F8                  mov al, byte ptr [ebp-08]
:004075BF 8B0485B8D14400          mov eax, dword ptr [4*eax+0044D1B8]
:004075C6 50                      push eax

* Possible StringData Ref from Data Obj ->"ʹ%sķߡ"
                                  |
:004075C7 6870E24400              push 0044E270
:004075CC 6A00                    push 00000000
:004075CE E862190300              call 00438F35
:004075D3 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004075B4(C)
|
:004075D6 6A00                    push 00000000
:004075D8 B900FB4600              mov ecx, 0046FB00
:004075DD E85E200000              call 00409640
:004075E2 33C0                    xor eax, eax
:004075E4 8A45F8                  mov al, byte ptr [ebp-08]
:004075E7 85C0                    test eax, eax
:004075E9 0F8418000000            je 00407607
:004075EF 6A01                    push 00000001
:004075F1 B900FB4600              mov ecx, 0046FB00
:004075F6 E805220000              call 00409800
:004075FB 6A01                    push 00000001
:004075FD B900FB4600              mov ecx, 0046FB00
:00407602 E839200000              call 00409640

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004075E9(C)
|
:00407607 6A01                    push 00000001
:00407609 33C0                    xor eax, eax
:0040760B 8A45FC                  mov al, byte ptr [ebp-04]
:0040760E 0D80000000              or eax, 00000080
:00407613 50                      push eax
:00407614 8B450C                  mov eax, dword ptr [ebp+0C]
:00407617 50                      push eax
:00407618 B900FB4600              mov ecx, 0046FB00
:0040761D E893580300              call 0043CEB5
:00407622 8845F0                  mov byte ptr [ebp-10], al
:00407625 6A00                    push 00000000
:00407627 B900FB4600              mov ecx, 0046FB00
:0040762C E8CF210000              call 00409800
:00407631 33C0                    xor eax, eax
:00407633 8A45F0                  mov al, byte ptr [ebp-10]
:00407636 3DFF000000              cmp eax, 000000FF
:0040763B 0F843E020000            je 0040787F
:00407641 33C0                    xor eax, eax
:00407643 8A45F0                  mov al, byte ptr [ebp-10]
:00407646 8BC8                    mov ecx, eax
:00407648 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040764B C1E003                  shl eax, 03
:0040764E 2BC1                    sub eax, ecx
:00407650 0598C04600              add eax, 0046C098
:00407655 8945F4                  mov dword ptr [ebp-0C], eax
:00407658 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040765B E8D0200000              call 00409730
:00407660 33C9                    xor ecx, ecx
:00407662 8AC8                    mov cl, al
:00407664 85C9                    test ecx, ecx
:00407666 0F8514000000            jne 00407680

* Possible StringData Ref from Data Obj ->"֧ӵķˡ"
                                  |
:0040766C 6884E24400              push 0044E284
:00407671 6A00                    push 00000000
:00407673 E8BD180300              call 00438F35
:00407678 83C408                  add esp, 00000008
:0040767B E904020000              jmp 00407884

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407666(C)
|
:00407680 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00407683 E8781B0000              call 00409200
:00407688 668B00                  mov ax, word ptr [eax]
:0040768B 668945E8                mov word ptr [ebp-18], ax
:0040768F 8B45E9                  mov eax, dword ptr [ebp-17]
:00407692 50                      push eax
:00407693 8B45E8                  mov eax, dword ptr [ebp-18]
:00407696 50                      push eax
:00407697 B900FB4600              mov ecx, 0046FB00
:0040769C E8473B0300              call 0043B1E8
:004076A1 6A00                    push 00000000
:004076A3 6A04                    push 00000004
:004076A5 33C0                    xor eax, eax
:004076A7 8A45E9                  mov al, byte ptr [ebp-17]
:004076AA 8D0440                  lea eax, dword ptr [eax+2*eax]
:004076AD 50                      push eax
:004076AE 33C0                    xor eax, eax
:004076B0 8A45E8                  mov al, byte ptr [ebp-18]
:004076B3 8D0440                  lea eax, dword ptr [eax+2*eax]
:004076B6 50                      push eax
:004076B7 B900FB4600              mov ecx, 0046FB00
:004076BC E87F730300              call 0043EA40
:004076C1 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004076C4 E8B71E0000              call 00409580
:004076C9 50                      push eax

* Possible StringData Ref from Data Obj ->"%sķˡ"
                                  |
:004076CA 68A4E24400              push 0044E2A4
:004076CF 6A00                    push 00000000
:004076D1 E85F180300              call 00438F35
:004076D6 83C40C                  add esp, 0000000C
:004076D9 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004076DC E84F200000              call 00409730
:004076E1 33C9                    xor ecx, ecx
:004076E3 8AC8                    mov cl, al
:004076E5 49                      dec ecx
:004076E6 83C940                  or ecx, 00000040
:004076E9 51                      push ecx
:004076EA 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004076ED E80E200000              call 00409700
:004076F2 6A01                    push 00000001
:004076F4 33C0                    xor eax, eax
:004076F6 8A45F0                  mov al, byte ptr [ebp-10]
:004076F9 50                      push eax
:004076FA 8B450C                  mov eax, dword ptr [ebp+0C]
:004076FD 50                      push eax
:004076FE E8B5DCFFFF              call 004053B8
:00407703 83C40C                  add esp, 0000000C
:00407706 33C0                    xor eax, eax
:00407708 8A45F8                  mov al, byte ptr [ebp-08]
:0040770B 85C0                    test eax, eax
:0040770D 0F8462010000            je 00407875
:00407713 C645E400                mov [ebp-1C], 00
:00407717 E903000000              jmp 0040771F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407870(U)
|
:0040771C FE45E4                  inc [ebp-1C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407717(U)
|
:0040771F 33C0                    xor eax, eax
:00407721 8A45E4                  mov al, byte ptr [ebp-1C]
:00407724 83F804                  cmp eax, 00000004
:00407727 0F8D48010000            jnl 00407875
:0040772D 8B45E4                  mov eax, dword ptr [ebp-1C]
:00407730 50                      push eax
:00407731 8D45E8                  lea eax, dword ptr [ebp-18]
:00407734 50                      push eax
:00407735 E81B1F0100              call 00419655
:0040773A 83C408                  add esp, 00000008
:0040773D 668B00                  mov ax, word ptr [eax]
:00407740 668945E0                mov word ptr [ebp-20], ax
:00407744 33C0                    xor eax, eax
:00407746 8A45E0                  mov al, byte ptr [ebp-20]
:00407749 3DFF000000              cmp eax, 000000FF
:0040774E 0F841C010000            je 00407870
:00407754 8D45E0                  lea eax, dword ptr [ebp-20]
:00407757 50                      push eax
:00407758 E8E01D0100              call 0041953D
:0040775D 83C404                  add esp, 00000004
:00407760 8845F0                  mov byte ptr [ebp-10], al
:00407763 33C0                    xor eax, eax
:00407765 8A45F0                  mov al, byte ptr [ebp-10]
:00407768 3DFF000000              cmp eax, 000000FF
:0040776D 0F84FD000000            je 00407870
:00407773 33C0                    xor eax, eax
:00407775 8A45F0                  mov al, byte ptr [ebp-10]
:00407778 8BC8                    mov ecx, eax
:0040777A 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040777D C1E003                  shl eax, 03
:00407780 2BC1                    sub eax, ecx
:00407782 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00407788 E8931A0000              call 00409220
:0040778D 8BD8                    mov ebx, eax
:0040778F 8B450C                  mov eax, dword ptr [ebp+0C]
:00407792 8BC8                    mov ecx, eax
:00407794 8D0440                  lea eax, dword ptr [eax+2*eax]
:00407797 C1E003                  shl eax, 03
:0040779A 2BC1                    sub eax, ecx
:0040779C 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004077A2 E8791A0000              call 00409220
:004077A7 3BD8                    cmp ebx, eax
:004077A9 0F85C1000000            jne 00407870
:004077AF 33C0                    xor eax, eax
:004077B1 8A45F0                  mov al, byte ptr [ebp-10]
:004077B4 8BC8                    mov ecx, eax
:004077B6 8D0440                  lea eax, dword ptr [eax+2*eax]
:004077B9 C1E003                  shl eax, 03
:004077BC 2BC1                    sub eax, ecx
:004077BE 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004077C4 E8671F0000              call 00409730
:004077C9 33C9                    xor ecx, ecx
:004077CB 8AC8                    mov cl, al
:004077CD 85C9                    test ecx, ecx
:004077CF 0F849B000000            je 00407870
:004077D5 6A00                    push 00000000
:004077D7 6A04                    push 00000004
:004077D9 33C0                    xor eax, eax
:004077DB 8A45E1                  mov al, byte ptr [ebp-1F]
:004077DE 8D0440                  lea eax, dword ptr [eax+2*eax]
:004077E1 50                      push eax
:004077E2 33C0                    xor eax, eax
:004077E4 8A45E0                  mov al, byte ptr [ebp-20]
:004077E7 8D0440                  lea eax, dword ptr [eax+2*eax]
:004077EA 50                      push eax
:004077EB B900FB4600              mov ecx, 0046FB00
:004077F0 E84B720300              call 0043EA40
:004077F5 33C0                    xor eax, eax
:004077F7 8A45F0                  mov al, byte ptr [ebp-10]
:004077FA 8BC8                    mov ecx, eax
:004077FC 8D0440                  lea eax, dword ptr [eax+2*eax]
:004077FF C1E003                  shl eax, 03
:00407802 2BC1                    sub eax, ecx
:00407804 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0040780A E8711D0000              call 00409580
:0040780F 50                      push eax

* Possible StringData Ref from Data Obj ->"%sķˡ"
                                  |
:00407810 68B8E24400              push 0044E2B8
:00407815 6A00                    push 00000000
:00407817 E819170300              call 00438F35
:0040781C 83C40C                  add esp, 0000000C
:0040781F 33C0                    xor eax, eax
:00407821 8A45F0                  mov al, byte ptr [ebp-10]
:00407824 8BC8                    mov ecx, eax
:00407826 8D0440                  lea eax, dword ptr [eax+2*eax]
:00407829 C1E003                  shl eax, 03
:0040782C 2BC1                    sub eax, ecx
:0040782E 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00407834 E8F71E0000              call 00409730
:00407839 33C9                    xor ecx, ecx
:0040783B 8AC8                    mov cl, al
:0040783D 49                      dec ecx
:0040783E 83C940                  or ecx, 00000040
:00407841 51                      push ecx
:00407842 33C0                    xor eax, eax
:00407844 8A45F0                  mov al, byte ptr [ebp-10]
:00407847 8BC8                    mov ecx, eax
:00407849 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040784C C1E003                  shl eax, 03
:0040784F 2BC1                    sub eax, ecx
:00407851 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00407857 E8A41E0000              call 00409700
:0040785C 6A01                    push 00000001
:0040785E 33C0                    xor eax, eax
:00407860 8A45F0                  mov al, byte ptr [ebp-10]
:00407863 50                      push eax
:00407864 8B450C                  mov eax, dword ptr [ebp+0C]
:00407867 50                      push eax
:00407868 E84BDBFFFF              call 004053B8
:0040786D 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040774E(C), :0040776D(C), :004077A9(C), :004077CF(C)
|
:00407870 E9A7FEFFFF              jmp 0040771C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040770D(C), :00407727(C)
|
:00407875 C70598DA440001000000    mov dword ptr [0044DA98], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040763B(C)
|
:0040787F E900000000              jmp 00407884

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040767B(U), :0040787F(U)
|
:00407884 5F                      pop edi
:00407885 5E                      pop esi
:00407886 5B                      pop ebx
:00407887 C9                      leave
:00407888 C3                      ret



* Referenced by a CALL at Addresses:
|:00403C24   , :004080D8   
|
:00407889 55                      push ebp
:0040788A 8BEC                    mov ebp, esp
:0040788C 83EC14                  sub esp, 00000014
:0040788F 53                      push ebx
:00407890 56                      push esi
:00407891 57                      push edi
:00407892 C645F4FF                mov [ebp-0C], FF
:00407896 8B4508                  mov eax, dword ptr [ebp+08]
:00407899 8A80B0D24400            mov al, byte ptr [eax+0044D2B0]
:0040789F 8845FC                  mov byte ptr [ebp-04], al
:004078A2 8B450C                  mov eax, dword ptr [ebp+0C]
:004078A5 8BC8                    mov ecx, eax
:004078A7 8D0440                  lea eax, dword ptr [eax+2*eax]
:004078AA C1E003                  shl eax, 03
:004078AD 2BC1                    sub eax, ecx
:004078AF 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004078B5 E8161B0000              call 004093D0
:004078BA 33C9                    xor ecx, ecx
:004078BC 8AC8                    mov cl, al
:004078BE 83F907                  cmp ecx, 00000007
:004078C1 0F840F000000            je 004078D6
:004078C7 33C0                    xor eax, eax
:004078C9 A0A4354500              mov al, byte ptr [004535A4]
:004078CE A804                    test al, 04
:004078D0 0F840C000000            je 004078E2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004078C1(C)
|
:004078D6 C745F001000000          mov [ebp-10], 00000001
:004078DD E907000000              jmp 004078E9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004078D0(C)
|
:004078E2 C745F000000000          mov [ebp-10], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004078DD(U)
|
:004078E9 837DF000                cmp dword ptr [ebp-10], 00000000
:004078ED 0F8415000000            je 00407908

* Possible StringData Ref from Data Obj ->"ҷ"
                                  |
:004078F3 A1B8D14400              mov eax, dword ptr [0044D1B8]
:004078F8 50                      push eax

* Possible StringData Ref from Data Obj ->"%sܲԹ˺̶ȡ"
                                  |
:004078F9 68CCE24400              push 0044E2CC
:004078FE 6A00                    push 00000000
:00407900 E830160300              call 00438F35
:00407905 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004078ED(C)
|
:00407908 6A01                    push 00000001
:0040790A 33C0                    xor eax, eax
:0040790C 8A45FC                  mov al, byte ptr [ebp-04]
:0040790F 0D80000000              or eax, 00000080
:00407914 50                      push eax
:00407915 8B450C                  mov eax, dword ptr [ebp+0C]
:00407918 50                      push eax
:00407919 B900FB4600              mov ecx, 0046FB00
:0040791E E892550300              call 0043CEB5
:00407923 8845F4                  mov byte ptr [ebp-0C], al
:00407926 33C0                    xor eax, eax
:00407928 8A45F4                  mov al, byte ptr [ebp-0C]
:0040792B 3DFF000000              cmp eax, 000000FF
:00407930 0F84B8000000            je 004079EE
:00407936 33C0                    xor eax, eax
:00407938 8A45F4                  mov al, byte ptr [ebp-0C]
:0040793B 8BC8                    mov ecx, eax
:0040793D 8D0440                  lea eax, dword ptr [eax+2*eax]
:00407940 C1E003                  shl eax, 03
:00407943 2BC1                    sub eax, ecx
:00407945 0598C04600              add eax, 0046C098
:0040794A 8945F8                  mov dword ptr [ebp-08], eax
:0040794D 6A08                    push 00000008
:0040794F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00407952 E8F9170000              call 00409150
:00407957 85C0                    test eax, eax
:00407959 0F8420000000            je 0040797F
:0040795F 6A0A                    push 0000000A
:00407961 B994A64600              mov ecx, 0046A694
:00407966 E8B9160100              call 00419024

* Possible StringData Ref from Data Obj ->"ִ֧ӡ"
                                  |
:0040796B 68D8D14400              push 0044D1D8
:00407970 6A00                    push 00000000
:00407972 E8BE150300              call 00438F35
:00407977 83C408                  add esp, 00000008
:0040797A E974000000              jmp 004079F3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407959(C)
|
:0040797F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00407982 E879180000              call 00409200
:00407987 668B00                  mov ax, word ptr [eax]
:0040798A 668945EC                mov word ptr [ebp-14], ax
:0040798E 6A00                    push 00000000
:00407990 6A05                    push 00000005
:00407992 33C0                    xor eax, eax
:00407994 8A45ED                  mov al, byte ptr [ebp-13]
:00407997 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040799A 50                      push eax
:0040799B 33C0                    xor eax, eax
:0040799D 8A45EC                  mov al, byte ptr [ebp-14]
:004079A0 8D0440                  lea eax, dword ptr [eax+2*eax]
:004079A3 50                      push eax
:004079A4 B900FB4600              mov ecx, 0046FB00
:004079A9 E892700300              call 0043EA40
:004079AE 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004079B1 E8CA1B0000              call 00409580
:004079B6 50                      push eax

* Possible StringData Ref from Data Obj ->"%sܲԹ˺ˡ"
                                  |
:004079B7 68ECE24400              push 0044E2EC
:004079BC 6A00                    push 00000000
:004079BE E872150300              call 00438F35
:004079C3 83C40C                  add esp, 0000000C
:004079C6 6A48                    push 00000048
:004079C8 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004079CB E8901D0000              call 00409760
:004079D0 6A01                    push 00000001
:004079D2 33C0                    xor eax, eax
:004079D4 8A45F4                  mov al, byte ptr [ebp-0C]
:004079D7 50                      push eax
:004079D8 8B450C                  mov eax, dword ptr [ebp+0C]
:004079DB 50                      push eax
:004079DC E8D7D9FFFF              call 004053B8
:004079E1 83C40C                  add esp, 0000000C
:004079E4 C70598DA440001000000    mov dword ptr [0044DA98], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407930(C)
|
:004079EE E900000000              jmp 004079F3

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040797A(U), :004079EE(U)
|
:004079F3 5F                      pop edi
:004079F4 5E                      pop esi
:004079F5 5B                      pop ebx
:004079F6 C9                      leave
:004079F7 C3                      ret



* Referenced by a CALL at Addresses:
|:00403C40   , :004080F4   
|
:004079F8 55                      push ebp
:004079F9 8BEC                    mov ebp, esp
:004079FB 83EC14                  sub esp, 00000014
:004079FE 53                      push ebx
:004079FF 56                      push esi
:00407A00 57                      push edi
:00407A01 C645F4FF                mov [ebp-0C], FF
:00407A05 8B4508                  mov eax, dword ptr [ebp+08]
:00407A08 8A80B0D24400            mov al, byte ptr [eax+0044D2B0]
:00407A0E 8845FC                  mov byte ptr [ebp-04], al
:00407A11 8B450C                  mov eax, dword ptr [ebp+0C]
:00407A14 8BC8                    mov ecx, eax
:00407A16 8D0440                  lea eax, dword ptr [eax+2*eax]
:00407A19 C1E003                  shl eax, 03
:00407A1C 2BC1                    sub eax, ecx
:00407A1E 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00407A24 E8A7190000              call 004093D0
:00407A29 33C9                    xor ecx, ecx
:00407A2B 8AC8                    mov cl, al
:00407A2D 83F907                  cmp ecx, 00000007
:00407A30 0F840F000000            je 00407A45
:00407A36 33C0                    xor eax, eax
:00407A38 A0A4354500              mov al, byte ptr [004535A4]
:00407A3D A804                    test al, 04
:00407A3F 0F840C000000            je 00407A51

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407A30(C)
|
:00407A45 C745F001000000          mov [ebp-10], 00000001
:00407A4C E907000000              jmp 00407A58

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407A3F(C)
|
:00407A51 C745F000000000          mov [ebp-10], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407A4C(U)
|
:00407A58 837DF000                cmp dword ptr [ebp-10], 00000000
:00407A5C 0F840F000000            je 00407A71

* Possible StringData Ref from Data Obj ->"ʹжϵĲӿж"
                                  |
:00407A62 680CE34400              push 0044E30C
:00407A67 6A00                    push 00000000
:00407A69 E8C7140300              call 00438F35
:00407A6E 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407A5C(C)
|
:00407A71 6A01                    push 00000001
:00407A73 33C0                    xor eax, eax
:00407A75 8A45FC                  mov al, byte ptr [ebp-04]
:00407A78 0D80000000              or eax, 00000080
:00407A7D 50                      push eax
:00407A7E 8B450C                  mov eax, dword ptr [ebp+0C]
:00407A81 50                      push eax
:00407A82 B900FB4600              mov ecx, 0046FB00
:00407A87 E829540300              call 0043CEB5
:00407A8C 8845F4                  mov byte ptr [ebp-0C], al
:00407A8F 33C0                    xor eax, eax
:00407A91 8A45F4                  mov al, byte ptr [ebp-0C]
:00407A94 3DFF000000              cmp eax, 000000FF
:00407A99 0F84F7000000            je 00407B96
:00407A9F 33C0                    xor eax, eax
:00407AA1 8A45F4                  mov al, byte ptr [ebp-0C]
:00407AA4 8BC8                    mov ecx, eax
:00407AA6 8D0440                  lea eax, dword ptr [eax+2*eax]
:00407AA9 C1E003                  shl eax, 03
:00407AAC 2BC1                    sub eax, ecx
:00407AAE 0598C04600              add eax, 0046C098
:00407AB3 8945F8                  mov dword ptr [ebp-08], eax
:00407AB6 33C0                    xor eax, eax
:00407AB8 8A45F4                  mov al, byte ptr [ebp-0C]
:00407ABB 3B450C                  cmp eax, dword ptr [ebp+0C]
:00407ABE 0F8514000000            jne 00407AD8

* Possible StringData Ref from Data Obj ->"ҾӲִС"
                                  |
:00407AC4 682CE34400              push 0044E32C
:00407AC9 6A00                    push 00000000
:00407ACB E865140300              call 00438F35
:00407AD0 83C408                  add esp, 00000008
:00407AD3 E9C3000000              jmp 00407B9B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407ABE(C)
|
:00407AD8 6A40                    push 00000040
:00407ADA 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00407ADD E87E180000              call 00409360
:00407AE2 85C0                    test eax, eax
:00407AE4 0F8515000000            jne 00407AFF
:00407AEA 6880000000              push 00000080
:00407AEF 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00407AF2 E869180000              call 00409360
:00407AF7 85C0                    test eax, eax
:00407AF9 0F8459000000            je 00407B58

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407AE4(C)
|
:00407AFF 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00407B02 E8F9160000              call 00409200
:00407B07 668B00                  mov ax, word ptr [eax]
:00407B0A 668945EC                mov word ptr [ebp-14], ax
:00407B0E 6A00                    push 00000000
:00407B10 6A05                    push 00000005
:00407B12 33C0                    xor eax, eax
:00407B14 8A45ED                  mov al, byte ptr [ebp-13]
:00407B17 8D0440                  lea eax, dword ptr [eax+2*eax]
:00407B1A 50                      push eax
:00407B1B 33C0                    xor eax, eax
:00407B1D 8A45EC                  mov al, byte ptr [ebp-14]
:00407B20 8D0440                  lea eax, dword ptr [eax+2*eax]
:00407B23 50                      push eax
:00407B24 B900FB4600              mov ecx, 0046FB00
:00407B29 E8126F0300              call 0043EA40
:00407B2E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00407B31 E84A1A0000              call 00409580
:00407B36 50                      push eax

* Possible StringData Ref from Data Obj ->"%sٴжˡ"
                                  |
:00407B37 6840E34400              push 0044E340
:00407B3C 6A00                    push 00000000
:00407B3E E8F2130300              call 00438F35
:00407B43 83C40C                  add esp, 0000000C
:00407B46 68C0000000              push 000000C0
:00407B4B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00407B4E E8DD170000              call 00409330
:00407B53 E920000000              jmp 00407B78

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407AF9(C)
|
:00407B58 6A0A                    push 0000000A
:00407B5A B994A64600              mov ecx, 0046A694
:00407B5F E8C0140100              call 00419024

* Possible StringData Ref from Data Obj ->"ִ֧ӡ"
                                  |
:00407B64 68D8D14400              push 0044D1D8
:00407B69 6A00                    push 00000000
:00407B6B E8C5130300              call 00438F35
:00407B70 83C408                  add esp, 00000008
:00407B73 E923000000              jmp 00407B9B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407B53(U)
|
:00407B78 6A01                    push 00000001
:00407B7A 33C0                    xor eax, eax
:00407B7C 8A45F4                  mov al, byte ptr [ebp-0C]
:00407B7F 50                      push eax
:00407B80 8B450C                  mov eax, dword ptr [ebp+0C]
:00407B83 50                      push eax
:00407B84 E82FD8FFFF              call 004053B8
:00407B89 83C40C                  add esp, 0000000C
:00407B8C C70598DA440001000000    mov dword ptr [0044DA98], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407A99(C)
|
:00407B96 E900000000              jmp 00407B9B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00407AD3(U), :00407B73(U), :00407B96(U)
|
:00407B9B 5F                      pop edi
:00407B9C 5E                      pop esi
:00407B9D 5B                      pop ebx
:00407B9E C9                      leave
:00407B9F C3                      ret



* Referenced by a CALL at Addresses:
|:00403C5E   , :0040812E   
|
:00407BA0 55                      push ebp
:00407BA1 8BEC                    mov ebp, esp
:00407BA3 83EC18                  sub esp, 00000018
:00407BA6 53                      push ebx
:00407BA7 56                      push esi
:00407BA8 57                      push edi
:00407BA9 C645F4FF                mov [ebp-0C], FF
:00407BAD 8B4508                  mov eax, dword ptr [ebp+08]
:00407BB0 8A80B0D24400            mov al, byte ptr [eax+0044D2B0]
:00407BB6 8845FC                  mov byte ptr [ebp-04], al
:00407BB9 8B450C                  mov eax, dword ptr [ebp+0C]
:00407BBC 8BC8                    mov ecx, eax
:00407BBE 8D0440                  lea eax, dword ptr [eax+2*eax]
:00407BC1 C1E003                  shl eax, 03
:00407BC4 2BC1                    sub eax, ecx
:00407BC6 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00407BCC E8FF170000              call 004093D0
:00407BD1 33C9                    xor ecx, ecx
:00407BD3 8AC8                    mov cl, al
:00407BD5 83F907                  cmp ecx, 00000007
:00407BD8 0F840F000000            je 00407BED
:00407BDE 33C0                    xor eax, eax
:00407BE0 A0A4354500              mov al, byte ptr [004535A4]
:00407BE5 A804                    test al, 04
:00407BE7 0F840C000000            je 00407BF9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407BD8(C)
|
:00407BED C745EC01000000          mov [ebp-14], 00000001
:00407BF4 E907000000              jmp 00407C00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407BE7(C)
|
:00407BF9 C745EC00000000          mov [ebp-14], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407BF4(U)
|
:00407C00 C745F000000000          mov [ebp-10], 00000000
:00407C07 837DEC00                cmp dword ptr [ebp-14], 00000000
:00407C0B 0F8415000000            je 00407C26

* Possible StringData Ref from Data Obj ->"У"
                                  |
:00407C11 A1B0D14400              mov eax, dword ptr [0044D1B0]
:00407C16 50                      push eax

* Possible StringData Ref from Data Obj ->"ס%sĲԡ"
                                  |
:00407C17 6854E34400              push 0044E354
:00407C1C 6A00                    push 00000000
:00407C1E E812130300              call 00438F35
:00407C23 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407C0B(C)
|
:00407C26 6A00                    push 00000000
:00407C28 33C0                    xor eax, eax
:00407C2A 8A45FC                  mov al, byte ptr [ebp-04]
:00407C2D 0D80000000              or eax, 00000080
:00407C32 50                      push eax
:00407C33 8B450C                  mov eax, dword ptr [ebp+0C]
:00407C36 50                      push eax
:00407C37 B900FB4600              mov ecx, 0046FB00
:00407C3C E874520300              call 0043CEB5
:00407C41 8845F4                  mov byte ptr [ebp-0C], al
:00407C44 33C0                    xor eax, eax
:00407C46 8A45F4                  mov al, byte ptr [ebp-0C]
:00407C49 3DFF000000              cmp eax, 000000FF
:00407C4E 0F84FA000000            je 00407D4E
:00407C54 33C0                    xor eax, eax
:00407C56 8A45F4                  mov al, byte ptr [ebp-0C]
:00407C59 8BC8                    mov ecx, eax
:00407C5B 8D0440                  lea eax, dword ptr [eax+2*eax]
:00407C5E C1E003                  shl eax, 03
:00407C61 2BC1                    sub eax, ecx
:00407C63 0598C04600              add eax, 0046C098
:00407C68 8945F8                  mov dword ptr [ebp-08], eax
:00407C6B 6A04                    push 00000004
:00407C6D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00407C70 E8DB140000              call 00409150
:00407C75 85C0                    test eax, eax
:00407C77 0F8420000000            je 00407C9D
:00407C7D 6A0A                    push 0000000A
:00407C7F B994A64600              mov ecx, 0046A694
:00407C84 E89B130100              call 00419024

* Possible StringData Ref from Data Obj ->"ִ֧ӡ"
                                  |
:00407C89 68D8D14400              push 0044D1D8
:00407C8E 6A00                    push 00000000
:00407C90 E8A0120300              call 00438F35
:00407C95 83C408                  add esp, 00000008
:00407C98 E9B6000000              jmp 00407D53

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407C77(C)
|
:00407C9D 6A01                    push 00000001
:00407C9F 8B4510                  mov eax, dword ptr [ebp+10]
:00407CA2 50                      push eax
:00407CA3 6A03                    push 00000003
:00407CA5 8B45F4                  mov eax, dword ptr [ebp-0C]
:00407CA8 50                      push eax
:00407CA9 8B450C                  mov eax, dword ptr [ebp+0C]
:00407CAC 50                      push eax
:00407CAD E869A5FFFF              call 0040221B
:00407CB2 83C414                  add esp, 00000014
:00407CB5 85C0                    test eax, eax
:00407CB7 0F8471000000            je 00407D2E
:00407CBD 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00407CC0 E83B150000              call 00409200
:00407CC5 668B00                  mov ax, word ptr [eax]
:00407CC8 668945E8                mov word ptr [ebp-18], ax
:00407CCC 33C0                    xor eax, eax
:00407CCE 8A45F4                  mov al, byte ptr [ebp-0C]
:00407CD1 8BC8                    mov ecx, eax
:00407CD3 8D0440                  lea eax, dword ptr [eax+2*eax]
:00407CD6 C1E003                  shl eax, 03
:00407CD9 2BC1                    sub eax, ecx
:00407CDB 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00407CE1 E83A150000              call 00409220
:00407CE6 50                      push eax
:00407CE7 6A02                    push 00000002
:00407CE9 33C0                    xor eax, eax
:00407CEB 8A45E9                  mov al, byte ptr [ebp-17]
:00407CEE 8D0440                  lea eax, dword ptr [eax+2*eax]
:00407CF1 50                      push eax
:00407CF2 33C0                    xor eax, eax
:00407CF4 8A45E8                  mov al, byte ptr [ebp-18]
:00407CF7 8D0440                  lea eax, dword ptr [eax+2*eax]
:00407CFA 50                      push eax
:00407CFB B900FB4600              mov ecx, 0046FB00
:00407D00 E83B6D0300              call 0043EA40
:00407D05 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00407D08 E873180000              call 00409580
:00407D0D 50                      push eax

* Possible StringData Ref from Data Obj ->"%sĲԱסˡ"
                                  |
:00407D0E 6864E34400              push 0044E364
:00407D13 6A00                    push 00000000
:00407D15 E81B120300              call 00438F35
:00407D1A 83C40C                  add esp, 0000000C
:00407D1D 6A44                    push 00000044
:00407D1F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00407D22 E8391A0000              call 00409760
:00407D27 C745F001000000          mov [ebp-10], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407CB7(C)
|
:00407D2E 8B45F0                  mov eax, dword ptr [ebp-10]
:00407D31 50                      push eax
:00407D32 33C0                    xor eax, eax
:00407D34 8A45F4                  mov al, byte ptr [ebp-0C]
:00407D37 50                      push eax
:00407D38 8B450C                  mov eax, dword ptr [ebp+0C]
:00407D3B 50                      push eax
:00407D3C E877D6FFFF              call 004053B8
:00407D41 83C40C                  add esp, 0000000C
:00407D44 C70598DA440001000000    mov dword ptr [0044DA98], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407C4E(C)
|
:00407D4E E900000000              jmp 00407D53

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00407C98(U), :00407D4E(U)
|
:00407D53 5F                      pop edi
:00407D54 5E                      pop esi
:00407D55 5B                      pop ebx
:00407D56 C9                      leave
:00407D57 C3                      ret



* Referenced by a CALL at Address:
|:00404125   
|
:00407D58 55                      push ebp
:00407D59 8BEC                    mov ebp, esp
:00407D5B 83EC08                  sub esp, 00000008
:00407D5E 53                      push ebx
:00407D5F 56                      push esi
:00407D60 57                      push edi
:00407D61 C745FC00000000          mov [ebp-04], 00000000
:00407D68 33C0                    xor eax, eax
:00407D6A 8A450C                  mov al, byte ptr [ebp+0C]
:00407D6D 50                      push eax
:00407D6E 8B4508                  mov eax, dword ptr [ebp+08]
:00407D71 50                      push eax
:00407D72 E8A9400000              call 0040BE20
:00407D77 83C408                  add esp, 00000008
:00407D7A 8945F8                  mov dword ptr [ebp-08], eax
:00407D7D 33C0                    xor eax, eax
:00407D7F 8A450C                  mov al, byte ptr [ebp+0C]
:00407D82 83F803                  cmp eax, 00000003
:00407D85 0F8445000000            je 00407DD0
:00407D8B 817DF8FF000000          cmp dword ptr [ebp-08], 000000FF
:00407D92 0F8338000000            jnb 00407DD0
:00407D98 33C0                    xor eax, eax
:00407D9A 8A4510                  mov al, byte ptr [ebp+10]
:00407D9D 83F801                  cmp eax, 00000001
:00407DA0 0F8515000000            jne 00407DBB
:00407DA6 6A04                    push 00000004
:00407DA8 E87BF50300              call 00447328
:00407DAD 83C404                  add esp, 00000004
:00407DB0 83C002                  add eax, 00000002
:00407DB3 8945FC                  mov dword ptr [ebp-04], eax
:00407DB6 E910000000              jmp 00407DCB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407DA0(C)
|
:00407DBB 6A06                    push 00000006
:00407DBD E866F50300              call 00447328
:00407DC2 83C404                  add esp, 00000004
:00407DC5 83C005                  add eax, 00000005
:00407DC8 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407DB6(U)
|
:00407DCB E94E000000              jmp 00407E1E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00407D85(C), :00407D92(C)
|
:00407DD0 33C0                    xor eax, eax
:00407DD2 8A450C                  mov al, byte ptr [ebp+0C]
:00407DD5 83F803                  cmp eax, 00000003
:00407DD8 0F8540000000            jne 00407E1E
:00407DDE 817DF8E8030000          cmp dword ptr [ebp-08], 000003E8
:00407DE5 0F8333000000            jnb 00407E1E
:00407DEB 33C0                    xor eax, eax
:00407DED 8A4510                  mov al, byte ptr [ebp+10]
:00407DF0 83F801                  cmp eax, 00000001
:00407DF3 0F8515000000            jne 00407E0E
:00407DF9 6A0B                    push 0000000B
:00407DFB E828F50300              call 00447328
:00407E00 83C404                  add esp, 00000004
:00407E03 83C00F                  add eax, 0000000F
:00407E06 8945FC                  mov dword ptr [ebp-04], eax
:00407E09 E910000000              jmp 00407E1E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407DF3(C)
|
:00407E0E 6A15                    push 00000015
:00407E10 E813F50300              call 00447328
:00407E15 83C404                  add esp, 00000004
:00407E18 83C01E                  add eax, 0000001E
:00407E1B 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00407DCB(U), :00407DD8(C), :00407DE5(C), :00407E09(U)
|
:00407E1E 8B45FC                  mov eax, dword ptr [ebp-04]
:00407E21 E900000000              jmp 00407E26

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407E21(U)
|
:00407E26 5F                      pop edi
:00407E27 5E                      pop esi
:00407E28 5B                      pop ebx
:00407E29 C9                      leave
:00407E2A C3                      ret



* Referenced by a CALL at Addresses:
|:00402C71   , :0041BDBF   
|
:00407E2B 55                      push ebp
:00407E2C 8BEC                    mov ebp, esp
:00407E2E 83EC0C                  sub esp, 0000000C
:00407E31 53                      push ebx
:00407E32 56                      push esi
:00407E33 57                      push edi
:00407E34 894DF8                  mov dword ptr [ebp-08], ecx
:00407E37 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00407E3A E891150000              call 004093D0
:00407E3F 33C9                    xor ecx, ecx
:00407E41 8AC8                    mov cl, al
:00407E43 83F907                  cmp ecx, 00000007
:00407E46 0F840F000000            je 00407E5B
:00407E4C 33C0                    xor eax, eax
:00407E4E A0A4354500              mov al, byte ptr [004535A4]
:00407E53 A804                    test al, 04
:00407E55 0F840C000000            je 00407E67

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407E46(C)
|
:00407E5B C745FC01000000          mov [ebp-04], 00000001
:00407E62 E907000000              jmp 00407E6E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407E55(C)
|
:00407E67 C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407E62(U)
|
:00407E6E 33C0                    xor eax, eax
:00407E70 8A4508                  mov al, byte ptr [ebp+08]
:00407E73 33C9                    xor ecx, ecx
:00407E75 8A88E0D24400            mov cl, byte ptr [eax+0044D2E0]
:00407E7B 8B45F8                  mov eax, dword ptr [ebp-08]
:00407E7E 33D2                    xor edx, edx
:00407E80 8A5013                  mov dl, byte ptr [eax+13]
:00407E83 3BCA                    cmp ecx, edx
:00407E85 0F8E26000000            jle 00407EB1

* Possible StringData Ref from Data Obj ->"ֵ㣡"
                                  |
:00407E8B 6878E34400              push 0044E378
:00407E90 6A00                    push 00000000
:00407E92 E89E100300              call 00438F35
:00407E97 83C408                  add esp, 00000008
:00407E9A 6A18                    push 00000018
:00407E9C 6A27                    push 00000027
:00407E9E 6A00                    push 00000000
:00407EA0 6A00                    push 00000000
:00407EA2 B900FB4600              mov ecx, 0046FB00
:00407EA7 E8812C0300              call 0043AB2D
:00407EAC E981030000              jmp 00408232

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407E85(C)
|
:00407EB1 33C0                    xor eax, eax
:00407EB3 8A4508                  mov al, byte ptr [ebp+08]
:00407EB6 247F                    and al, 7F
:00407EB8 884508                  mov byte ptr [ebp+08], al
:00407EBB 837DFC00                cmp dword ptr [ebp-04], 00000000
:00407EBF 0F8525000000            jne 00407EEA
:00407EC5 33C0                    xor eax, eax
:00407EC7 8A4508                  mov al, byte ptr [ebp+08]
:00407ECA 8B0485F0D14400          mov eax, dword ptr [4*eax+0044D1F0]
:00407ED1 50                      push eax
:00407ED2 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00407ED5 E8A6160000              call 00409580
:00407EDA 50                      push eax

* Possible StringData Ref from Data Obj ->"%sʹ%sƣ"
                                  |
:00407EDB 6888E34400              push 0044E388
:00407EE0 6A00                    push 00000000
:00407EE2 E84E100300              call 00438F35
:00407EE7 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407EBF(C)
|
:00407EEA 33C0                    xor eax, eax
:00407EEC 8A4508                  mov al, byte ptr [ebp+08]
:00407EEF 8945F4                  mov dword ptr [ebp-0C], eax
:00407EF2 E949020000              jmp 00408140
:00407EF7 6A02                    push 00000002
:00407EF9 8B45F8                  mov eax, dword ptr [ebp-08]
:00407EFC 33C9                    xor ecx, ecx
:00407EFE 8A4804                  mov cl, byte ptr [eax+04]
:00407F01 51                      push ecx
:00407F02 33C0                    xor eax, eax
:00407F04 8A4508                  mov al, byte ptr [ebp+08]
:00407F07 50                      push eax
:00407F08 E853C4FFFF              call 00404360
:00407F0D 83C40C                  add esp, 0000000C
:00407F10 E9CB020000              jmp 004081E0
:00407F15 6A02                    push 00000002
:00407F17 8B45F8                  mov eax, dword ptr [ebp-08]
:00407F1A 33C9                    xor ecx, ecx
:00407F1C 8A4804                  mov cl, byte ptr [eax+04]
:00407F1F 51                      push ecx
:00407F20 33C0                    xor eax, eax
:00407F22 8A4508                  mov al, byte ptr [ebp+08]
:00407F25 50                      push eax
:00407F26 E8CCCFFFFF              call 00404EF7
:00407F2B 83C40C                  add esp, 0000000C
:00407F2E E9AD020000              jmp 004081E0
:00407F33 6A02                    push 00000002
:00407F35 8B45F8                  mov eax, dword ptr [ebp-08]
:00407F38 33C9                    xor ecx, ecx
:00407F3A 8A4804                  mov cl, byte ptr [eax+04]
:00407F3D 51                      push ecx
:00407F3E 33C0                    xor eax, eax
:00407F40 8A4508                  mov al, byte ptr [ebp+08]
:00407F43 50                      push eax
:00407F44 E8D4D5FFFF              call 0040551D
:00407F49 83C40C                  add esp, 0000000C
:00407F4C E98F020000              jmp 004081E0
:00407F51 6A02                    push 00000002
:00407F53 8B45F8                  mov eax, dword ptr [ebp-08]
:00407F56 33C9                    xor ecx, ecx
:00407F58 8A4804                  mov cl, byte ptr [eax+04]
:00407F5B 51                      push ecx
:00407F5C 33C0                    xor eax, eax
:00407F5E 8A4508                  mov al, byte ptr [ebp+08]
:00407F61 50                      push eax
:00407F62 E892D9FFFF              call 004058F9
:00407F67 83C40C                  add esp, 0000000C
:00407F6A E971020000              jmp 004081E0
:00407F6F 6A02                    push 00000002
:00407F71 8B45F8                  mov eax, dword ptr [ebp-08]
:00407F74 33C9                    xor ecx, ecx
:00407F76 8A4804                  mov cl, byte ptr [eax+04]
:00407F79 51                      push ecx
:00407F7A 33C0                    xor eax, eax
:00407F7C 8A4508                  mov al, byte ptr [ebp+08]
:00407F7F 50                      push eax
:00407F80 E83EDDFFFF              call 00405CC3
:00407F85 83C40C                  add esp, 0000000C
:00407F88 E953020000              jmp 004081E0
:00407F8D 6A02                    push 00000002
:00407F8F 8B45F8                  mov eax, dword ptr [ebp-08]
:00407F92 33C9                    xor ecx, ecx
:00407F94 8A4804                  mov cl, byte ptr [eax+04]
:00407F97 51                      push ecx
:00407F98 33C0                    xor eax, eax
:00407F9A 8A4508                  mov al, byte ptr [ebp+08]
:00407F9D 50                      push eax
:00407F9E E8E8E0FFFF              call 0040608B
:00407FA3 83C40C                  add esp, 0000000C
:00407FA6 E935020000              jmp 004081E0
:00407FAB 6A02                    push 00000002
:00407FAD 8B45F8                  mov eax, dword ptr [ebp-08]
:00407FB0 33C9                    xor ecx, ecx
:00407FB2 8A4804                  mov cl, byte ptr [eax+04]
:00407FB5 51                      push ecx
:00407FB6 33C0                    xor eax, eax
:00407FB8 8A4508                  mov al, byte ptr [ebp+08]
:00407FBB 50                      push eax
:00407FBC E8A0E4FFFF              call 00406461
:00407FC1 83C40C                  add esp, 0000000C
:00407FC4 E917020000              jmp 004081E0
:00407FC9 6A02                    push 00000002
:00407FCB 8B45F8                  mov eax, dword ptr [ebp-08]
:00407FCE 33C9                    xor ecx, ecx
:00407FD0 8A4804                  mov cl, byte ptr [eax+04]
:00407FD3 51                      push ecx
:00407FD4 33C0                    xor eax, eax
:00407FD6 8A4508                  mov al, byte ptr [ebp+08]
:00407FD9 50                      push eax
:00407FDA E875E6FFFF              call 00406654
:00407FDF 83C40C                  add esp, 0000000C
:00407FE2 E9F9010000              jmp 004081E0
:00407FE7 6A02                    push 00000002
:00407FE9 8B45F8                  mov eax, dword ptr [ebp-08]
:00407FEC 33C9                    xor ecx, ecx
:00407FEE 8A4804                  mov cl, byte ptr [eax+04]
:00407FF1 51                      push ecx
:00407FF2 33C0                    xor eax, eax
:00407FF4 8A4508                  mov al, byte ptr [ebp+08]
:00407FF7 50                      push eax
:00407FF8 E84AE8FFFF              call 00406847
:00407FFD 83C40C                  add esp, 0000000C
:00408000 E9DB010000              jmp 004081E0
:00408005 8B45F8                  mov eax, dword ptr [ebp-08]
:00408008 33C9                    xor ecx, ecx
:0040800A 8A4804                  mov cl, byte ptr [eax+04]
:0040800D 51                      push ecx
:0040800E 33C0                    xor eax, eax
:00408010 8A4508                  mov al, byte ptr [ebp+08]
:00408013 50                      push eax
:00408014 E8C3EAFFFF              call 00406ADC
:00408019 83C408                  add esp, 00000008
:0040801C E9BF010000              jmp 004081E0
:00408021 8B45F8                  mov eax, dword ptr [ebp-08]
:00408024 33C9                    xor ecx, ecx
:00408026 8A4804                  mov cl, byte ptr [eax+04]
:00408029 51                      push ecx
:0040802A 33C0                    xor eax, eax
:0040802C 8A4508                  mov al, byte ptr [ebp+08]
:0040802F 50                      push eax
:00408030 E8E8EBFFFF              call 00406C1D
:00408035 83C408                  add esp, 00000008
:00408038 E9A3010000              jmp 004081E0
:0040803D 8B45F8                  mov eax, dword ptr [ebp-08]
:00408040 33C9                    xor ecx, ecx
:00408042 8A4804                  mov cl, byte ptr [eax+04]
:00408045 51                      push ecx
:00408046 33C0                    xor eax, eax
:00408048 8A4508                  mov al, byte ptr [ebp+08]
:0040804B 50                      push eax
:0040804C E83CEDFFFF              call 00406D8D
:00408051 83C408                  add esp, 00000008
:00408054 E987010000              jmp 004081E0
:00408059 8B45F8                  mov eax, dword ptr [ebp-08]
:0040805C 33C9                    xor ecx, ecx
:0040805E 8A4804                  mov cl, byte ptr [eax+04]
:00408061 51                      push ecx
:00408062 33C0                    xor eax, eax
:00408064 8A4508                  mov al, byte ptr [ebp+08]
:00408067 50                      push eax
:00408068 E894EEFFFF              call 00406F01
:0040806D 83C408                  add esp, 00000008
:00408070 E96B010000              jmp 004081E0
:00408075 8B45F8                  mov eax, dword ptr [ebp-08]
:00408078 33C9                    xor ecx, ecx
:0040807A 8A4804                  mov cl, byte ptr [eax+04]
:0040807D 51                      push ecx
:0040807E 33C0                    xor eax, eax
:00408080 8A4508                  mov al, byte ptr [ebp+08]
:00408083 50                      push eax
:00408084 E8ECEFFFFF              call 00407075
:00408089 83C408                  add esp, 00000008
:0040808C E94F010000              jmp 004081E0
:00408091 8B45F8                  mov eax, dword ptr [ebp-08]
:00408094 33C9                    xor ecx, ecx
:00408096 8A4804                  mov cl, byte ptr [eax+04]
:00408099 51                      push ecx
:0040809A 33C0                    xor eax, eax
:0040809C 8A4508                  mov al, byte ptr [ebp+08]
:0040809F 50                      push eax
:004080A0 E844F1FFFF              call 004071E9
:004080A5 83C408                  add esp, 00000008
:004080A8 E933010000              jmp 004081E0
:004080AD 8B45F8                  mov eax, dword ptr [ebp-08]
:004080B0 33C9                    xor ecx, ecx
:004080B2 8A4804                  mov cl, byte ptr [eax+04]
:004080B5 51                      push ecx
:004080B6 33C0                    xor eax, eax
:004080B8 8A4508                  mov al, byte ptr [ebp+08]
:004080BB 50                      push eax
:004080BC E878F4FFFF              call 00407539
:004080C1 83C408                  add esp, 00000008
:004080C4 E917010000              jmp 004081E0
:004080C9 8B45F8                  mov eax, dword ptr [ebp-08]
:004080CC 33C9                    xor ecx, ecx
:004080CE 8A4804                  mov cl, byte ptr [eax+04]
:004080D1 51                      push ecx
:004080D2 33C0                    xor eax, eax
:004080D4 8A4508                  mov al, byte ptr [ebp+08]
:004080D7 50                      push eax
:004080D8 E8ACF7FFFF              call 00407889
:004080DD 83C408                  add esp, 00000008
:004080E0 E9FB000000              jmp 004081E0
:004080E5 8B45F8                  mov eax, dword ptr [ebp-08]
:004080E8 33C9                    xor ecx, ecx
:004080EA 8A4804                  mov cl, byte ptr [eax+04]
:004080ED 51                      push ecx
:004080EE 33C0                    xor eax, eax
:004080F0 8A4508                  mov al, byte ptr [ebp+08]
:004080F3 50                      push eax
:004080F4 E8FFF8FFFF              call 004079F8
:004080F9 83C408                  add esp, 00000008
:004080FC E9DF000000              jmp 004081E0
:00408101 8B45F8                  mov eax, dword ptr [ebp-08]
:00408104 33C9                    xor ecx, ecx
:00408106 8A4804                  mov cl, byte ptr [eax+04]
:00408109 51                      push ecx
:0040810A 33C0                    xor eax, eax
:0040810C 8A4508                  mov al, byte ptr [ebp+08]
:0040810F 50                      push eax
:00408110 E824010000              call 00408239
:00408115 83C408                  add esp, 00000008
:00408118 E9C3000000              jmp 004081E0
:0040811D 6A02                    push 00000002
:0040811F 8B45F8                  mov eax, dword ptr [ebp-08]
:00408122 33C9                    xor ecx, ecx
:00408124 8A4804                  mov cl, byte ptr [eax+04]
:00408127 51                      push ecx
:00408128 33C0                    xor eax, eax
:0040812A 8A4508                  mov al, byte ptr [ebp+08]
:0040812D 50                      push eax
:0040812E E86DFAFFFF              call 00407BA0
:00408133 83C40C                  add esp, 0000000C
:00408136 E9A5000000              jmp 004081E0
:0040813B E9A0000000              jmp 004081E0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407EF2(U)
|
:00408140 837DF42F                cmp dword ptr [ebp-0C], 0000002F
:00408144 0F8796000000            ja 004081E0
:0040814A 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040814D 33C9                    xor ecx, ecx
:0040814F 8A88B0814000            mov cl, byte ptr [eax+004081B0]
:00408155 FF248D5C814000          jmp dword ptr [4*ecx+0040815C]

:0040815C F77E4000                DWORD 00407EF7
:00408160 157F4000                DWORD 00407F15
:00408164 337F4000                DWORD 00407F33
:00408168 517F4000                DWORD 00407F51
:0040816C 6F7F4000                DWORD 00407F6F
:00408170 8D7F4000                DWORD 00407F8D
:00408174 AB7F4000                DWORD 00407FAB
:00408178 C97F4000                DWORD 00407FC9
:0040817C E77F4000                DWORD 00407FE7
:00408180 05804000                DWORD 00408005
:00408184 21804000                DWORD 00408021
:00408188 3D804000                DWORD 0040803D
:0040818C 59804000                DWORD 00408059
:00408190 75804000                DWORD 00408075
:00408194 91804000                DWORD 00408091
:00408198 AD804000                DWORD 004080AD
:0040819C C9804000                DWORD 004080C9
:004081A0 E5804000                DWORD 004080E5
:004081A4 01814000                DWORD 00408101
:004081A8 1D814000                DWORD 0040811D
:004081AC E0814000                DWORD 004081E0


:004081B0 00000000000000000000    BYTE 10 DUP(0)
:004081BA 0000                    BYTE 2 DUP(0)


:004081BC 0101                    add dword ptr [ecx], eax
:004081BE 0102                    add dword ptr [edx], eax
:004081C0 0203                    add al, byte ptr [ebx]
:004081C2 030404                  add eax, dword ptr [esp+eax]
:004081C5 0505060708              add eax, 08070605
:004081CA 0808                    or byte ptr [eax], cl
:004081CC 0808                    or byte ptr [eax], cl
:004081CE 0808                    or byte ptr [eax], cl
:004081D0 0809                    or byte ptr [ecx], cl
:004081D2 0909                    or dword ptr [ecx], ecx
:004081D4 0A0B                    or cl, byte ptr [ebx]
:004081D6 0C0D                    or al, 0D
:004081D8 0E                      push cs
:004081D9 0E                      push cs
:004081DA 0F                      BYTE 0fh
:004081DB 0F                      BYTE 0fh
:004081DC 1011                    adc byte ptr [ecx], dl
:004081DE 1213                    adc dl, byte ptr [ebx]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00407F10(U), :00407F2E(U), :00407F4C(U), :00407F6A(U), :00407F88(U)
|:00407FA6(U), :00407FC4(U), :00407FE2(U), :00408000(U), :0040801C(U)
|:00408038(U), :00408054(U), :00408070(U), :0040808C(U), :004080A8(U)
|:004080C4(U), :004080E0(U), :004080FC(U), :00408118(U), :00408136(U)
|:0040813B(U), :00408144(C)
|
:004081E0 833D98DA440000          cmp dword ptr [0044DA98], 00000000
:004081E7 0F8440000000            je 0040822D
:004081ED 8B45F8                  mov eax, dword ptr [ebp-08]
:004081F0 33C9                    xor ecx, ecx
:004081F2 8A4813                  mov cl, byte ptr [eax+13]
:004081F5 33C0                    xor eax, eax
:004081F7 8A4508                  mov al, byte ptr [ebp+08]
:004081FA 33D2                    xor edx, edx
:004081FC 8A90E0D24400            mov dl, byte ptr [eax+0044D2E0]
:00408202 2BCA                    sub ecx, edx
:00408204 8B45F8                  mov eax, dword ptr [ebp-08]
:00408207 884813                  mov byte ptr [eax+13], cl
:0040820A 6880000000              push 00000080
:0040820F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00408212 E8AD5B0200              call 0042DDC4
:00408217 C70598DA440000000000    mov dword ptr [0044DA98], 00000000
:00408221 6A00                    push 00000000
:00408223 B900FB4600              mov ecx, 0046FB00
:00408228 E813140000              call 00409640

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004081E7(C)
|
:0040822D E900000000              jmp 00408232

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00407EAC(U), :0040822D(U)
|
:00408232 5F                      pop edi
:00408233 5E                      pop esi
:00408234 5B                      pop ebx
:00408235 C9                      leave
:00408236 C20400                  ret 0004



* Referenced by a CALL at Address:
|:00408110   
|
:00408239 55                      push ebp
:0040823A 8BEC                    mov ebp, esp
:0040823C 83EC48                  sub esp, 00000048
:0040823F 53                      push ebx
:00408240 56                      push esi
:00408241 57                      push edi
:00408242 C645E0FF                mov [ebp-20], FF
:00408246 8B4508                  mov eax, dword ptr [ebp+08]
:00408249 8A80B0D24400            mov al, byte ptr [eax+0044D2B0]
:0040824F 8845FC                  mov byte ptr [ebp-04], al
:00408252 8B450C                  mov eax, dword ptr [ebp+0C]
:00408255 8BC8                    mov ecx, eax
:00408257 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040825A C1E003                  shl eax, 03
:0040825D 2BC1                    sub eax, ecx
:0040825F 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00408265 E866110000              call 004093D0
:0040826A 33C9                    xor ecx, ecx
:0040826C 8AC8                    mov cl, al
:0040826E 83F907                  cmp ecx, 00000007
:00408271 0F840F000000            je 00408286
:00408277 33C0                    xor eax, eax
:00408279 A0A4354500              mov al, byte ptr [004535A4]
:0040827E A804                    test al, 04
:00408280 0F840C000000            je 00408292

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408271(C)
|
:00408286 C745C801000000          mov [ebp-38], 00000001
:0040828D E907000000              jmp 00408299

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408280(C)
|
:00408292 C745C800000000          mov [ebp-38], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040828D(U)
|
:00408299 C645CC00                mov [ebp-34], 00
:0040829D C645CD01                mov [ebp-33], 01
:004082A1 C645CE03                mov [ebp-32], 03
:004082A5 C645CF04                mov [ebp-31], 04
:004082A9 C645D006                mov [ebp-30], 06
:004082AD C645D107                mov [ebp-2F], 07
:004082B1 C645D209                mov [ebp-2E], 09
:004082B5 C645D30A                mov [ebp-2D], 0A
:004082B9 C645D40C                mov [ebp-2C], 0C
:004082BD C645D50D                mov [ebp-2B], 0D
:004082C1 C645D60F                mov [ebp-2A], 0F
:004082C5 C645D710                mov [ebp-29], 10
:004082C9 C645D812                mov [ebp-28], 12
:004082CD C645D913                mov [ebp-27], 13
:004082D1 C645DA15                mov [ebp-26], 15
:004082D5 C645DB17                mov [ebp-25], 17
:004082D9 C645DC19                mov [ebp-24], 19
:004082DD C645E80F                mov [ebp-18], 0F
:004082E1 C645E91E                mov [ebp-17], 1E
:004082E5 C645EA0F                mov [ebp-16], 0F
:004082E9 C645EB1E                mov [ebp-15], 1E
:004082ED C645EC0F                mov [ebp-14], 0F
:004082F1 C645ED1E                mov [ebp-13], 1E
:004082F5 C645EE0F                mov [ebp-12], 0F
:004082F9 C645EF1E                mov [ebp-11], 1E
:004082FD C645F00F                mov [ebp-10], 0F
:00408301 C645F11E                mov [ebp-0F], 1E
:00408305 C645F20F                mov [ebp-0E], 0F
:00408309 C645F31E                mov [ebp-0D], 1E
:0040830D C645F40F                mov [ebp-0C], 0F
:00408311 C645F51E                mov [ebp-0B], 1E
:00408315 C645F60F                mov [ebp-0A], 0F
:00408319 C645F70F                mov [ebp-09], 0F
:0040831D C645F80F                mov [ebp-08], 0F
:00408321 837DC800                cmp dword ptr [ebp-38], 00000000
:00408325 0F840F000000            je 0040833A

* Possible StringData Ref from Data Obj ->"ʹ"
                                  |
:0040832B 6898E34400              push 0044E398
:00408330 6A00                    push 00000000
:00408332 E8FE0B0300              call 00438F35
:00408337 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408325(C)
|
:0040833A 6A01                    push 00000001
:0040833C 33C0                    xor eax, eax
:0040833E 8A45FC                  mov al, byte ptr [ebp-04]
:00408341 0D80000000              or eax, 00000080
:00408346 50                      push eax
:00408347 8B450C                  mov eax, dword ptr [ebp+0C]
:0040834A 50                      push eax
:0040834B B900FB4600              mov ecx, 0046FB00
:00408350 E8604B0300              call 0043CEB5
:00408355 8845E0                  mov byte ptr [ebp-20], al
:00408358 33C0                    xor eax, eax
:0040835A 8A45E0                  mov al, byte ptr [ebp-20]
:0040835D 3DFF000000              cmp eax, 000000FF
:00408362 0F84D2010000            je 0040853A
:00408368 33C0                    xor eax, eax
:0040836A 8A45E0                  mov al, byte ptr [ebp-20]
:0040836D 8BC8                    mov ecx, eax
:0040836F 8D0440                  lea eax, dword ptr [eax+2*eax]
:00408372 C1E003                  shl eax, 03
:00408375 2BC1                    sub eax, ecx
:00408377 0598C04600              add eax, 0046C098
:0040837C 8945E4                  mov dword ptr [ebp-1C], eax
:0040837F C645B801                mov [ebp-48], 01
:00408383 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00408386 E8150F0000              call 004092A0
:0040838B 8845C0                  mov byte ptr [ebp-40], al
:0040838E 33C0                    xor eax, eax
:00408390 8A45C0                  mov al, byte ptr [ebp-40]
:00408393 83F820                  cmp eax, 00000020
:00408396 0F8C2E000000            jl 004083CA
:0040839C 33C0                    xor eax, eax
:0040839E 8A45C0                  mov al, byte ptr [ebp-40]
:004083A1 83F827                  cmp eax, 00000027
:004083A4 0F8F20000000            jg 004083CA
:004083AA 6A0A                    push 0000000A
:004083AC B994A64600              mov ecx, 0046A694
:004083B1 E86E0C0100              call 00419024

* Possible StringData Ref from Data Obj ->"ִ֧ӡ"
                                  |
:004083B6 68D8D14400              push 0044D1D8
:004083BB 6A00                    push 00000000
:004083BD E8730B0300              call 00438F35
:004083C2 83C408                  add esp, 00000008
:004083C5 E975010000              jmp 0040853F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00408396(C), :004083A4(C)
|
:004083CA C745BC00000000          mov [ebp-44], 00000000
:004083D1 E903000000              jmp 004083D9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408402(U)
|
:004083D6 FF45BC                  inc [ebp-44]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004083D1(U)
|
:004083D9 837DBC11                cmp dword ptr [ebp-44], 00000011
:004083DD 0F8324000000            jnb 00408407
:004083E3 8B45BC                  mov eax, dword ptr [ebp-44]
:004083E6 33C9                    xor ecx, ecx
:004083E8 8A4C05CC                mov cl, byte ptr [ebp+eax-34]
:004083EC 33C0                    xor eax, eax
:004083EE 8A45C0                  mov al, byte ptr [ebp-40]
:004083F1 3BC8                    cmp ecx, eax
:004083F3 0F8509000000            jne 00408402
:004083F9 C645B800                mov [ebp-48], 00
:004083FD E905000000              jmp 00408407

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004083F3(C)
|
:00408402 E9CFFFFFFF              jmp 004083D6

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004083DD(C), :004083FD(U)
|
:00408407 33C0                    xor eax, eax
:00408409 8A45B8                  mov al, byte ptr [ebp-48]
:0040840C 85C0                    test eax, eax
:0040840E 0F8420000000            je 00408434
:00408414 6A0A                    push 0000000A
:00408416 B994A64600              mov ecx, 0046A694
:0040841B E8040C0100              call 00419024

* Possible StringData Ref from Data Obj ->"֧ӵԲˡ"
                                  |
:00408420 68ACE34400              push 0044E3AC
:00408425 6A00                    push 00000000
:00408427 E8090B0300              call 00438F35
:0040842C 83C408                  add esp, 00000008
:0040842F E90B010000              jmp 0040853F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040840E(C)
|
:00408434 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00408437 E8F40C0000              call 00409130
:0040843C 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040843F 03C0                    add eax, eax
:00408441 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:00408448 E8330E0000              call 00409280
:0040844D 33C9                    xor ecx, ecx
:0040844F 8AC8                    mov cl, al
:00408451 8B45BC                  mov eax, dword ptr [ebp-44]
:00408454 33D2                    xor edx, edx
:00408456 8A5405E8                mov dl, byte ptr [ebp+eax-18]
:0040845A 3BCA                    cmp ecx, edx
:0040845C 0F8D20000000            jnl 00408482
:00408462 6A0A                    push 0000000A
:00408464 B994A64600              mov ecx, 0046A694
:00408469 E8B60B0100              call 00419024

* Possible StringData Ref from Data Obj ->"ڵȼ̫ͣԡ"
                                  |
:0040846E 68CCE34400              push 0044E3CC
:00408473 6A00                    push 00000000
:00408475 E8BB0A0300              call 00438F35
:0040847A 83C408                  add esp, 00000008
:0040847D E9BD000000              jmp 0040853F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040845C(C)
|
:00408482 FE45C0                  inc [ebp-40]
:00408485 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00408488 E8730D0000              call 00409200
:0040848D 668B00                  mov ax, word ptr [eax]
:00408490 668945C4                mov word ptr [ebp-3C], ax
:00408494 6A08                    push 00000008
:00408496 B994A64600              mov ecx, 0046A694
:0040849B E8840B0100              call 00419024
:004084A0 6A00                    push 00000000
:004084A2 6A07                    push 00000007
:004084A4 33C0                    xor eax, eax
:004084A6 8A45C5                  mov al, byte ptr [ebp-3B]
:004084A9 8D0440                  lea eax, dword ptr [eax+2*eax]
:004084AC 50                      push eax
:004084AD 33C0                    xor eax, eax
:004084AF 8A45C4                  mov al, byte ptr [ebp-3C]
:004084B2 8D0440                  lea eax, dword ptr [eax+2*eax]
:004084B5 50                      push eax
:004084B6 B900FB4600              mov ecx, 0046FB00
:004084BB E880650300              call 0043EA40
:004084C0 33C0                    xor eax, eax
:004084C2 8A45C0                  mov al, byte ptr [ebp-40]
:004084C5 8B0485F82C4500          mov eax, dword ptr [4*eax+00452CF8]
:004084CC 50                      push eax
:004084CD 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004084D0 E8AB100000              call 00409580
:004084D5 50                      push eax

* Possible StringData Ref from Data Obj ->"%sΪ%sˡ"
                                  |
:004084D6 68ECE34400              push 0044E3EC
:004084DB 6A00                    push 00000000
:004084DD E8530A0300              call 00438F35
:004084E2 83C410                  add esp, 00000010
:004084E5 8B45C0                  mov eax, dword ptr [ebp-40]
:004084E8 50                      push eax
:004084E9 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004084EC E83F0C0000              call 00409130
:004084F1 8D0440                  lea eax, dword ptr [eax+2*eax]
:004084F4 03C0                    add eax, eax
:004084F6 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:004084FD E8AE100000              call 004095B0
:00408502 33C0                    xor eax, eax
:00408504 8A45E0                  mov al, byte ptr [ebp-20]
:00408507 8BC8                    mov ecx, eax
:00408509 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040850C C1E003                  shl eax, 03
:0040850F 2BC1                    sub eax, ecx
:00408511 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00408517 E8072F0200              call 0042B423
:0040851C 6A01                    push 00000001
:0040851E 33C0                    xor eax, eax
:00408520 8A45E0                  mov al, byte ptr [ebp-20]
:00408523 50                      push eax
:00408524 8B450C                  mov eax, dword ptr [ebp+0C]
:00408527 50                      push eax
:00408528 E88BCEFFFF              call 004053B8
:0040852D 83C40C                  add esp, 0000000C
:00408530 C70598DA440001000000    mov dword ptr [0044DA98], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408362(C)
|
:0040853A E900000000              jmp 0040853F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004083C5(U), :0040842F(U), :0040847D(U), :0040853A(U)
|
:0040853F 5F                      pop edi
:00408540 5E                      pop esi
:00408541 5B                      pop ebx
:00408542 C9                      leave
:00408543 C3                      ret



* Referenced by a CALL at Addresses:
|:00408870   , :0041C22D   
|
:00408544 55                      push ebp
:00408545 8BEC                    mov ebp, esp
:00408547 83EC14                  sub esp, 00000014
:0040854A 53                      push ebx
:0040854B 56                      push esi
:0040854C 57                      push edi
:0040854D C745FC00000000          mov [ebp-04], 00000000
:00408554 33C0                    xor eax, eax
:00408556 8A450C                  mov al, byte ptr [ebp+0C]
:00408559 85C0                    test eax, eax
:0040855B 0F840C000000            je 0040856D
:00408561 C745F84B000000          mov [ebp-08], 0000004B
:00408568 E907000000              jmp 00408574

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040855B(C)
|
:0040856D C745F832000000          mov [ebp-08], 00000032

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408568(U)
|
:00408574 33C0                    xor eax, eax
:00408576 8A450C                  mov al, byte ptr [ebp+0C]
:00408579 85C0                    test eax, eax
:0040857B 0F840C000000            je 0040858D
:00408581 C745F47D000000          mov [ebp-0C], 0000007D
:00408588 E907000000              jmp 00408594

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040857B(C)
|
:0040858D C745F464000000          mov [ebp-0C], 00000064

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408588(U)
|
:00408594 33C0                    xor eax, eax
:00408596 8A450C                  mov al, byte ptr [ebp+0C]
:00408599 85C0                    test eax, eax
:0040859B 0F840C000000            je 004085AD
:004085A1 C745F0FA000000          mov [ebp-10], 000000FA
:004085A8 E907000000              jmp 004085B4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040859B(C)
|
:004085AD C745F0C8000000          mov [ebp-10], 000000C8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004085A8(U)
|
:004085B4 33C0                    xor eax, eax
:004085B6 8A4510                  mov al, byte ptr [ebp+10]
:004085B9 8945EC                  mov dword ptr [ebp-14], eax
:004085BC E964000000              jmp 00408625

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408629(C)
|
:004085C1 33C0                    xor eax, eax
:004085C3 8A4508                  mov al, byte ptr [ebp+08]
:004085C6 03C0                    add eax, eax
:004085C8 B905000000              mov ecx, 00000005
:004085CD 99                      cdq
:004085CE F7F9                    idiv ecx
:004085D0 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004085D3 C1E901                  shr ecx, 01
:004085D6 03C1                    add eax, ecx
:004085D8 8945FC                  mov dword ptr [ebp-04], eax
:004085DB E968000000              jmp 00408648

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408633(C)
|
:004085E0 33C0                    xor eax, eax
:004085E2 8A4508                  mov al, byte ptr [ebp+08]
:004085E5 8D0440                  lea eax, dword ptr [eax+2*eax]
:004085E8 B907000000              mov ecx, 00000007
:004085ED 99                      cdq
:004085EE F7F9                    idiv ecx
:004085F0 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004085F3 C1E901                  shr ecx, 01
:004085F6 03C1                    add eax, ecx
:004085F8 8945FC                  mov dword ptr [ebp-04], eax
:004085FB E948000000              jmp 00408648

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040863D(C)
|
:00408600 33C0                    xor eax, eax
:00408602 8A4508                  mov al, byte ptr [ebp+08]
:00408605 C1E002                  shl eax, 02
:00408608 B905000000              mov ecx, 00000005
:0040860D 99                      cdq
:0040860E F7F9                    idiv ecx
:00408610 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00408613 C1E901                  shr ecx, 01
:00408616 03C1                    add eax, ecx
:00408618 8945FC                  mov dword ptr [ebp-04], eax
:0040861B E928000000              jmp 00408648
:00408620 E923000000              jmp 00408648

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004085BC(U)
|
:00408625 837DEC00                cmp dword ptr [ebp-14], 00000000
:00408629 0F8492FFFFFF            je 004085C1
:0040862F 837DEC01                cmp dword ptr [ebp-14], 00000001
:00408633 0F84A7FFFFFF            je 004085E0
:00408639 837DEC02                cmp dword ptr [ebp-14], 00000002
:0040863D 0F84BDFFFFFF            je 00408600
:00408643 E900000000              jmp 00408648

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004085DB(U), :004085FB(U), :0040861B(U), :00408620(U), :00408643(U)
|
:00408648 8B45FC                  mov eax, dword ptr [ebp-04]
:0040864B E900000000              jmp 00408650

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040864B(U)
|
:00408650 5F                      pop edi
:00408651 5E                      pop esi
:00408652 5B                      pop ebx
:00408653 C9                      leave
:00408654 C3                      ret



* Referenced by a CALL at Addresses:
|:00408887   , :00408945   , :0041C244   
|
:00408655 55                      push ebp
:00408656 8BEC                    mov ebp, esp
:00408658 83EC14                  sub esp, 00000014
:0040865B 53                      push ebx
:0040865C 56                      push esi
:0040865D 57                      push edi
:0040865E 8B4508                  mov eax, dword ptr [ebp+08]
:00408661 50                      push eax
:00408662 E8A5680100              call 0041EF0C
:00408667 83C404                  add esp, 00000004
:0040866A 50                      push eax
:0040866B E8F1090200              call 00429061
:00408670 83C404                  add esp, 00000004
:00408673 8845F8                  mov byte ptr [ebp-08], al
:00408676 33C0                    xor eax, eax
:00408678 8A45F8                  mov al, byte ptr [ebp-08]
:0040867B 3DFF000000              cmp eax, 000000FF
:00408680 0F8508000000            jne 0040868E
:00408686 8B4510                  mov eax, dword ptr [ebp+10]
:00408689 E94E010000              jmp 004087DC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408680(C)
|
:0040868E 33C0                    xor eax, eax
:00408690 8A45F8                  mov al, byte ptr [ebp-08]
:00408693 8BC8                    mov ecx, eax
:00408695 8D0440                  lea eax, dword ptr [eax+2*eax]
:00408698 C1E003                  shl eax, 03
:0040869B 2BC1                    sub eax, ecx
:0040869D 0598C04600              add eax, 0046C098
:004086A2 8945F0                  mov dword ptr [ebp-10], eax
:004086A5 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004086A8 E8F30B0000              call 004092A0
:004086AD 8845F4                  mov byte ptr [ebp-0C], al
:004086B0 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004086B3 E8691C0200              call 0042A321
:004086B8 8845FC                  mov byte ptr [ebp-04], al
:004086BB 6A08                    push 00000008
:004086BD 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004086C0 E88B0A0000              call 00409150
:004086C5 85C0                    test eax, eax
:004086C7 0F8404000000            je 004086D1
:004086CD C16D1001                shr dword ptr [ebp+10], 01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004086C7(C)
|
:004086D1 33C0                    xor eax, eax
:004086D3 8A45FC                  mov al, byte ptr [ebp-04]
:004086D6 83F80A                  cmp eax, 0000000A
:004086D9 0F8D21000000            jnl 00408700
:004086DF B80A000000              mov eax, 0000000A
:004086E4 33C9                    xor ecx, ecx
:004086E6 8A4DFC                  mov cl, byte ptr [ebp-04]
:004086E9 2BC1                    sub eax, ecx
:004086EB 0FAF4510                imul eax, dword ptr [ebp+10]
:004086EF B90A000000              mov ecx, 0000000A
:004086F4 2BD2                    sub edx, edx
:004086F6 F7F1                    div ecx
:004086F8 014510                  add dword ptr [ebp+10], eax
:004086FB E92C000000              jmp 0040872C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004086D9(C)
|
:00408700 33C0                    xor eax, eax
:00408702 8A45FC                  mov al, byte ptr [ebp-04]
:00408705 83F80A                  cmp eax, 0000000A
:00408708 0F8E1E000000            jle 0040872C
:0040870E 33C9                    xor ecx, ecx
:00408710 33C0                    xor eax, eax
:00408712 8A45FC                  mov al, byte ptr [ebp-04]
:00408715 83E80A                  sub eax, 0000000A
:00408718 0FAF4510                imul eax, dword ptr [ebp+10]
:0040871C BB0A000000              mov ebx, 0000000A
:00408721 2BD2                    sub edx, edx
:00408723 F7F3                    div ebx
:00408725 2BC8                    sub ecx, eax
:00408727 F7D9                    neg ecx
:00408729 294D10                  sub dword ptr [ebp+10], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004086FB(U), :00408708(C)
|
:0040872C 33C0                    xor eax, eax
:0040872E 8A45F4                  mov al, byte ptr [ebp-0C]
:00408731 83F822                  cmp eax, 00000022
:00408734 0F8532000000            jne 0040876C
:0040873A 33C0                    xor eax, eax
:0040873C 8A450C                  mov al, byte ptr [ebp+0C]
:0040873F 83F806                  cmp eax, 00000006
:00408742 0F8D24000000            jnl 0040876C
:00408748 33C0                    xor eax, eax
:0040874A 8A450C                  mov al, byte ptr [ebp+0C]
:0040874D B903000000              mov ecx, 00000003
:00408752 99                      cdq
:00408753 F7F9                    idiv ecx
:00408755 8845EC                  mov byte ptr [ebp-14], al
:00408758 33C0                    xor eax, eax
:0040875A 8A45EC                  mov al, byte ptr [ebp-14]
:0040875D 83C002                  add eax, 00000002
:00408760 0FAF4510                imul eax, dword ptr [ebp+10]
:00408764 894510                  mov dword ptr [ebp+10], eax
:00408767 E968000000              jmp 004087D4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00408734(C), :00408742(C)
|
:0040876C 33C0                    xor eax, eax
:0040876E 8A45F4                  mov al, byte ptr [ebp-0C]
:00408771 83F81E                  cmp eax, 0000001E
:00408774 0F8C1F000000            jl 00408799
:0040877A 33C0                    xor eax, eax
:0040877C 8A45F4                  mov al, byte ptr [ebp-0C]
:0040877F 83F81F                  cmp eax, 0000001F
:00408782 0F8F11000000            jg 00408799
:00408788 8B4510                  mov eax, dword ptr [ebp+10]
:0040878B 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040878E C1E801                  shr eax, 01
:00408791 894510                  mov dword ptr [ebp+10], eax
:00408794 E93B000000              jmp 004087D4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00408774(C), :00408782(C)
|
:00408799 33C0                    xor eax, eax
:0040879B 8A45F4                  mov al, byte ptr [ebp-0C]
:0040879E 83F812                  cmp eax, 00000012
:004087A1 0F8C0E000000            jl 004087B5
:004087A7 33C0                    xor eax, eax
:004087A9 8A45F4                  mov al, byte ptr [ebp-0C]
:004087AC 83F814                  cmp eax, 00000014
:004087AF 0F8E0E000000            jle 004087C3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004087A1(C)
|
:004087B5 33C0                    xor eax, eax
:004087B7 8A45F4                  mov al, byte ptr [ebp-0C]
:004087BA 83F826                  cmp eax, 00000026
:004087BD 0F8511000000            jne 004087D4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004087AF(C)
|
:004087C3 8B4510                  mov eax, dword ptr [ebp+10]
:004087C6 03C0                    add eax, eax
:004087C8 B903000000              mov ecx, 00000003
:004087CD 2BD2                    sub edx, edx
:004087CF F7F1                    div ecx
:004087D1 894510                  mov dword ptr [ebp+10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00408767(U), :00408794(U), :004087BD(C)
|
:004087D4 8B4510                  mov eax, dword ptr [ebp+10]
:004087D7 E900000000              jmp 004087DC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00408689(U), :004087D7(U)
|
:004087DC 5F                      pop edi
:004087DD 5E                      pop esi
:004087DE 5B                      pop ebx
:004087DF C9                      leave
:004087E0 C3                      ret



* Referenced by a CALL at Address:
|:004239E3   
|
:004087E1 55                      push ebp
:004087E2 8BEC                    mov ebp, esp
:004087E4 83EC1C                  sub esp, 0000001C
:004087E7 53                      push ebx
:004087E8 56                      push esi
:004087E9 57                      push edi
:004087EA 894DE4                  mov dword ptr [ebp-1C], ecx
:004087ED 8B4D08                  mov ecx, dword ptr [ebp+08]
:004087F0 E81B090000              call 00409110
:004087F5 8845F4                  mov byte ptr [ebp-0C], al
:004087F8 8B45E4                  mov eax, dword ptr [ebp-1C]
:004087FB 8B00                    mov eax, dword ptr [eax]
:004087FD 8D0440                  lea eax, dword ptr [eax+2*eax]
:00408800 03C0                    add eax, eax
:00408802 8D04C0                  lea eax, dword ptr [eax+8*eax]
:00408805 05E8564500              add eax, 004556E8
:0040880A 8945EC                  mov dword ptr [ebp-14], eax
:0040880D 33C0                    xor eax, eax
:0040880F 8A450C                  mov al, byte ptr [ebp+0C]
:00408812 C1E804                  shr eax, 04
:00408815 2401                    and al, 01
:00408817 8845F0                  mov byte ptr [ebp-10], al
:0040881A 33C0                    xor eax, eax
:0040881C 8A450C                  mov al, byte ptr [ebp+0C]
:0040881F 240F                    and al, 0F
:00408821 8845E8                  mov byte ptr [ebp-18], al
:00408824 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00408827 E8E4080000              call 00409110
:0040882C 33C9                    xor ecx, ecx
:0040882E 8AC8                    mov cl, al
:00408830 51                      push ecx
:00408831 E8F2EA0300              call 00447328
:00408836 83C404                  add esp, 00000004
:00408839 8BC8                    mov ecx, eax
:0040883B 33C0                    xor eax, eax
:0040883D 8A45F4                  mov al, byte ptr [ebp-0C]
:00408840 BB05000000              mov ebx, 00000005
:00408845 99                      cdq
:00408846 F7FB                    idiv ebx
:00408848 3BC8                    cmp ecx, eax
:0040884A 0F830F000000            jnb 0040885F
:00408850 C745FC00000000          mov [ebp-04], 00000000
:00408857 8B45FC                  mov eax, dword ptr [ebp-04]
:0040885A E9A1000000              jmp 00408900

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040884A(C)
|
:0040885F 8B45E8                  mov eax, dword ptr [ebp-18]
:00408862 50                      push eax
:00408863 8B45F0                  mov eax, dword ptr [ebp-10]
:00408866 50                      push eax
:00408867 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040886A E8A1080000              call 00409110
:0040886F 50                      push eax
:00408870 E8CFFCFFFF              call 00408544
:00408875 83C40C                  add esp, 0000000C
:00408878 8945FC                  mov dword ptr [ebp-04], eax
:0040887B 8B45FC                  mov eax, dword ptr [ebp-04]
:0040887E 50                      push eax
:0040887F 8B450C                  mov eax, dword ptr [ebp+0C]
:00408882 50                      push eax
:00408883 8B4508                  mov eax, dword ptr [ebp+08]
:00408886 50                      push eax
:00408887 E8C9FDFFFF              call 00408655
:0040888C 83C40C                  add esp, 0000000C
:0040888F 8945FC                  mov dword ptr [ebp-04], eax
:00408892 33C0                    xor eax, eax
:00408894 8A45F4                  mov al, byte ptr [ebp-0C]
:00408897 C1F801                  sar eax, 01
:0040889A 50                      push eax
:0040889B 8B45FC                  mov eax, dword ptr [ebp-04]
:0040889E 50                      push eax
:0040889F E827EA0300              call 004472CB
:004088A4 83C408                  add esp, 00000008
:004088A7 8945FC                  mov dword ptr [ebp-04], eax
:004088AA 8B45E4                  mov eax, dword ptr [ebp-1C]
:004088AD 8B00                    mov eax, dword ptr [eax]
:004088AF 50                      push eax
:004088B0 E8073A0000              call 0040C2BC
:004088B5 83C404                  add esp, 00000004
:004088B8 8845F8                  mov byte ptr [ebp-08], al
:004088BB 33C0                    xor eax, eax
:004088BD 8A45F8                  mov al, byte ptr [ebp-08]
:004088C0 83F806                  cmp eax, 00000006
:004088C3 0F841C000000            je 004088E5
:004088C9 33C0                    xor eax, eax
:004088CB 8A45F8                  mov al, byte ptr [ebp-08]
:004088CE 83F80A                  cmp eax, 0000000A
:004088D1 0F840E000000            je 004088E5
:004088D7 33C0                    xor eax, eax
:004088D9 8A45F8                  mov al, byte ptr [ebp-08]
:004088DC 83F80B                  cmp eax, 0000000B
:004088DF 0F8513000000            jne 004088F8

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004088C3(C), :004088D1(C)
|
:004088E5 6A00                    push 00000000
:004088E7 6A00                    push 00000000
:004088E9 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004088EC E86D410000              call 0040CA5E
:004088F1 33C9                    xor ecx, ecx
:004088F3 8AC8                    mov cl, al
:004088F5 014DFC                  add dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004088DF(C)
|
:004088F8 8B45FC                  mov eax, dword ptr [ebp-04]
:004088FB E900000000              jmp 00408900

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040885A(U), :004088FB(U)
|
:00408900 5F                      pop edi
:00408901 5E                      pop esi
:00408902 5B                      pop ebx
:00408903 C9                      leave
:00408904 C20800                  ret 0008



* Referenced by a CALL at Address:
|:00423A1A   
|
:00408907 55                      push ebp
:00408908 8BEC                    mov ebp, esp
:0040890A 83EC10                  sub esp, 00000010
:0040890D 53                      push ebx
:0040890E 56                      push esi
:0040890F 57                      push edi
:00408910 894DF0                  mov dword ptr [ebp-10], ecx
:00408913 33C0                    xor eax, eax
:00408915 8A450C                  mov al, byte ptr [ebp+0C]
:00408918 C1E804                  shr eax, 04
:0040891B 2401                    and al, 01
:0040891D 8845F8                  mov byte ptr [ebp-08], al
:00408920 33C0                    xor eax, eax
:00408922 8A450C                  mov al, byte ptr [ebp+0C]
:00408925 240F                    and al, 0F
:00408927 8845F4                  mov byte ptr [ebp-0C], al
:0040892A 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040892D 50                      push eax
:0040892E E82C000000              call 0040895F
:00408933 83C404                  add esp, 00000004
:00408936 8945FC                  mov dword ptr [ebp-04], eax
:00408939 8B45FC                  mov eax, dword ptr [ebp-04]
:0040893C 50                      push eax
:0040893D 8B450C                  mov eax, dword ptr [ebp+0C]
:00408940 50                      push eax
:00408941 8B4508                  mov eax, dword ptr [ebp+08]
:00408944 50                      push eax
:00408945 E80BFDFFFF              call 00408655
:0040894A 83C40C                  add esp, 0000000C
:0040894D 8945FC                  mov dword ptr [ebp-04], eax
:00408950 8B45FC                  mov eax, dword ptr [ebp-04]
:00408953 E900000000              jmp 00408958

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408953(U)
|
:00408958 5F                      pop edi
:00408959 5E                      pop esi
:0040895A 5B                      pop ebx
:0040895B C9                      leave
:0040895C C20800                  ret 0008



* Referenced by a CALL at Address:
|:0040892E   
|
:0040895F 55                      push ebp
:00408960 8BEC                    mov ebp, esp
:00408962 83EC08                  sub esp, 00000008
:00408965 53                      push ebx
:00408966 56                      push esi
:00408967 57                      push edi
:00408968 C745FC00000000          mov [ebp-04], 00000000
:0040896F 33C0                    xor eax, eax
:00408971 8A4508                  mov al, byte ptr [ebp+08]
:00408974 8945F8                  mov dword ptr [ebp-08], eax
:00408977 E946000000              jmp 004089C2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004089C6(C)
|
:0040897C 6A10                    push 00000010
:0040897E E8A5E90300              call 00447328
:00408983 83C404                  add esp, 00000004
:00408986 83C032                  add eax, 00000032
:00408989 8945FC                  mov dword ptr [ebp-04], eax
:0040898C E954000000              jmp 004089E5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004089D0(C)
|
:00408991 6A1A                    push 0000001A
:00408993 E890E90300              call 00447328
:00408998 83C404                  add esp, 00000004
:0040899B 83C04B                  add eax, 0000004B
:0040899E 8945FC                  mov dword ptr [ebp-04], eax
:004089A1 E93F000000              jmp 004089E5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004089DA(C)
|
:004089A6 6A33                    push 00000033
:004089A8 E87BE90300              call 00447328
:004089AD 83C404                  add esp, 00000004
:004089B0 0596000000              add eax, 00000096
:004089B5 8945FC                  mov dword ptr [ebp-04], eax
:004089B8 E928000000              jmp 004089E5
:004089BD E923000000              jmp 004089E5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408977(U)
|
:004089C2 837DF800                cmp dword ptr [ebp-08], 00000000
:004089C6 0F84B0FFFFFF            je 0040897C
:004089CC 837DF801                cmp dword ptr [ebp-08], 00000001
:004089D0 0F84BBFFFFFF            je 00408991
:004089D6 837DF802                cmp dword ptr [ebp-08], 00000002
:004089DA 0F84C6FFFFFF            je 004089A6
:004089E0 E900000000              jmp 004089E5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040898C(U), :004089A1(U), :004089B8(U), :004089BD(U), :004089E0(U)
|
:004089E5 8B45FC                  mov eax, dword ptr [ebp-04]
:004089E8 E900000000              jmp 004089ED

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004089E8(U)
|
:004089ED 5F                      pop edi
:004089EE 5E                      pop esi
:004089EF 5B                      pop ebx
:004089F0 C9                      leave
:004089F1 C3                      ret



* Referenced by a CALL at Addresses:
|:004069A1   , :00408FA7   
|
:004089F2 55                      push ebp
:004089F3 8BEC                    mov ebp, esp
:004089F5 83EC24                  sub esp, 00000024
:004089F8 53                      push ebx
:004089F9 56                      push esi
:004089FA 57                      push edi
:004089FB 894DE4                  mov dword ptr [ebp-1C], ecx
:004089FE 8B45E4                  mov eax, dword ptr [ebp-1C]
:00408A01 8B00                    mov eax, dword ptr [eax]
:00408A03 8D0440                  lea eax, dword ptr [eax+2*eax]
:00408A06 03C0                    add eax, eax
:00408A08 8D04C0                  lea eax, dword ptr [eax+8*eax]
:00408A0B 05E8564500              add eax, 004556E8
:00408A10 8945F0                  mov dword ptr [ebp-10], eax
:00408A13 C745F400000000          mov [ebp-0C], 00000000
:00408A1A 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00408A1D E80E0E0000              call 00409830
:00408A22 33C9                    xor ecx, ecx
:00408A24 8AC8                    mov cl, al
:00408A26 83F902                  cmp ecx, 00000002
:00408A29 0F8514000000            jne 00408A43
:00408A2F 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00408A32 E8590D0000              call 00409790
:00408A37 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00408A3A 3B410F                  cmp eax, dword ptr [ecx+0F]
:00408A3D 0F8505000000            jne 00408A48

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408A29(C)
|
:00408A43 E9A6030000              jmp 00408DEE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408A3D(C)
|
:00408A48 33C0                    xor eax, eax
:00408A4A 8A450C                  mov al, byte ptr [ebp+0C]
:00408A4D 3DFF000000              cmp eax, 000000FF
:00408A52 0F842A000000            je 00408A82
:00408A58 33C0                    xor eax, eax
:00408A5A 8A450C                  mov al, byte ptr [ebp+0C]
:00408A5D 8BC8                    mov ecx, eax
:00408A5F 8D0440                  lea eax, dword ptr [eax+2*eax]
:00408A62 C1E003                  shl eax, 03
:00408A65 2BC1                    sub eax, ecx
:00408A67 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00408A6D E8BE060000              call 00409130
:00408A72 8D0440                  lea eax, dword ptr [eax+2*eax]
:00408A75 03C0                    add eax, eax
:00408A77 8D04C0                  lea eax, dword ptr [eax+8*eax]
:00408A7A 05E8564500              add eax, 004556E8
:00408A7F 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408A52(C)
|
:00408A82 33C0                    xor eax, eax
:00408A84 8A4510                  mov al, byte ptr [ebp+10]
:00408A87 83F803                  cmp eax, 00000003
:00408A8A 0F8415010000            je 00408BA5
:00408A90 33C0                    xor eax, eax
:00408A92 8A450C                  mov al, byte ptr [ebp+0C]
:00408A95 8BC8                    mov ecx, eax
:00408A97 8D0440                  lea eax, dword ptr [eax+2*eax]
:00408A9A C1E003                  shl eax, 03
:00408A9D 2BC1                    sub eax, ecx
:00408A9F 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00408AA5 E886060000              call 00409130
:00408AAA 50                      push eax
:00408AAB E80C380000              call 0040C2BC
:00408AB0 83C404                  add esp, 00000004
:00408AB3 8845F8                  mov byte ptr [ebp-08], al
:00408AB6 33C0                    xor eax, eax
:00408AB8 8A45F8                  mov al, byte ptr [ebp-08]
:00408ABB 83F806                  cmp eax, 00000006
:00408ABE 0F841C000000            je 00408AE0
:00408AC4 33C0                    xor eax, eax
:00408AC6 8A45F8                  mov al, byte ptr [ebp-08]
:00408AC9 83F80A                  cmp eax, 0000000A
:00408ACC 0F840E000000            je 00408AE0
:00408AD2 33C0                    xor eax, eax
:00408AD4 8A45F8                  mov al, byte ptr [ebp-08]
:00408AD7 83F80B                  cmp eax, 0000000B
:00408ADA 0F8513000000            jne 00408AF3

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00408ABE(C), :00408ACC(C)
|
:00408AE0 6A00                    push 00000000
:00408AE2 6A00                    push 00000000
:00408AE4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00408AE7 E8723F0000              call 0040CA5E
:00408AEC 33C9                    xor ecx, ecx
:00408AEE 8AC8                    mov cl, al
:00408AF0 894DF4                  mov dword ptr [ebp-0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408ADA(C)
|
:00408AF3 33C0                    xor eax, eax
:00408AF5 8A4508                  mov al, byte ptr [ebp+08]
:00408AF8 8945E0                  mov dword ptr [ebp-20], eax
:00408AFB E97C000000              jmp 00408B7C
:00408B00 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00408B03 E808060000              call 00409110
:00408B08 33C9                    xor ecx, ecx
:00408B0A 8AC8                    mov cl, al
:00408B0C C1F901                  sar ecx, 01
:00408B0F 83C114                  add ecx, 00000014
:00408B12 894DF4                  mov dword ptr [ebp-0C], ecx
:00408B15 E986000000              jmp 00408BA0
:00408B1A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00408B1D E8EE050000              call 00409110
:00408B22 33C9                    xor ecx, ecx
:00408B24 8AC8                    mov cl, al
:00408B26 8D048D00000000          lea eax, dword ptr [4*ecx+00000000]
:00408B2D B905000000              mov ecx, 00000005
:00408B32 99                      cdq
:00408B33 F7F9                    idiv ecx
:00408B35 83C028                  add eax, 00000028
:00408B38 8945F4                  mov dword ptr [ebp-0C], eax
:00408B3B E960000000              jmp 00408BA0
:00408B40 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00408B43 E8C8050000              call 00409110
:00408B48 33C9                    xor ecx, ecx
:00408B4A 8AC8                    mov cl, al
:00408B4C 8BC1                    mov eax, ecx
:00408B4E 8D0C89                  lea ecx, dword ptr [ecx+4*ecx]
:00408B51 8D0448                  lea eax, dword ptr [eax+2*ecx]
:00408B54 B90A000000              mov ecx, 0000000A
:00408B59 99                      cdq
:00408B5A F7F9                    idiv ecx
:00408B5C 83C03C                  add eax, 0000003C
:00408B5F 8945F4                  mov dword ptr [ebp-0C], eax
:00408B62 E939000000              jmp 00408BA0
:00408B67 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00408B6A E8210C0000              call 00409790
:00408B6F 8945F4                  mov dword ptr [ebp-0C], eax
:00408B72 E929000000              jmp 00408BA0
:00408B77 E924000000              jmp 00408BA0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408AFB(U)
|
:00408B7C 837DE003                cmp dword ptr [ebp-20], 00000003
:00408B80 0F871A000000            ja 00408BA0
:00408B86 8B45E0                  mov eax, dword ptr [ebp-20]
:00408B89 FF2485908B4000          jmp dword ptr [4*eax+00408B90]

:00408B90 008B4000                DWORD 00408B00
:00408B94 1A8B4000                DWORD 00408B1A
:00408B98 408B4000                DWORD 00408B40
:00408B9C 678B4000                DWORD 00408B67



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00408B15(U), :00408B3B(U), :00408B62(U), :00408B72(U), :00408B77(U)
|:00408B80(C)
|
:00408BA0 E9B2000000              jmp 00408C57

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408A8A(C)
|
:00408BA5 33C0                    xor eax, eax
:00408BA7 8A4508                  mov al, byte ptr [ebp+08]
:00408BAA 8945DC                  mov dword ptr [ebp-24], eax
:00408BAD E981000000              jmp 00408C33
:00408BB2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00408BB5 E856050000              call 00409110
:00408BBA 33C9                    xor ecx, ecx
:00408BBC 8AC8                    mov cl, al
:00408BBE BB0A000000              mov ebx, 0000000A
:00408BC3 8BC1                    mov eax, ecx
:00408BC5 99                      cdq
:00408BC6 F7FB                    idiv ebx
:00408BC8 83C064                  add eax, 00000064
:00408BCB 8945F4                  mov dword ptr [ebp-0C], eax
:00408BCE E984000000              jmp 00408C57
:00408BD3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00408BD6 E835050000              call 00409110
:00408BDB 33C9                    xor ecx, ecx
:00408BDD 8AC8                    mov cl, al
:00408BDF BB05000000              mov ebx, 00000005
:00408BE4 8BC1                    mov eax, ecx
:00408BE6 99                      cdq
:00408BE7 F7FB                    idiv ebx
:00408BE9 052C010000              add eax, 0000012C
:00408BEE 8945F4                  mov dword ptr [ebp-0C], eax
:00408BF1 E961000000              jmp 00408C57
:00408BF6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00408BF9 E812050000              call 00409110
:00408BFE 33C9                    xor ecx, ecx
:00408C00 8AC8                    mov cl, al
:00408C02 8D044D00000000          lea eax, dword ptr [2*ecx+00000000]
:00408C09 B905000000              mov ecx, 00000005
:00408C0E 99                      cdq
:00408C0F F7F9                    idiv ecx
:00408C11 05F4010000              add eax, 000001F4
:00408C16 8945F4                  mov dword ptr [ebp-0C], eax
:00408C19 E939000000              jmp 00408C57
:00408C1E 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00408C21 E86A0B0000              call 00409790
:00408C26 8945F4                  mov dword ptr [ebp-0C], eax
:00408C29 E929000000              jmp 00408C57
:00408C2E E924000000              jmp 00408C57

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408BAD(U)
|
:00408C33 837DDC03                cmp dword ptr [ebp-24], 00000003
:00408C37 0F871A000000            ja 00408C57
:00408C3D 8B45DC                  mov eax, dword ptr [ebp-24]
:00408C40 FF2485478C4000          jmp dword ptr [4*eax+00408C47]

:00408C47 B28B4000                DWORD 00408BB2
:00408C4B D38B4000                DWORD 00408BD3
:00408C4F F68B4000                DWORD 00408BF6
:00408C53 1E8C4000                DWORD 00408C1E



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00408BCE(U), :00408BF1(U), :00408C19(U), :00408C29(U), :00408C2E(U)
|:00408C37(C)
|
:00408C57 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00408C5A E8310B0000              call 00409790
:00408C5F 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00408C62 8B490F                  mov ecx, dword ptr [ecx+0F]
:00408C65 034DF4                  add ecx, dword ptr [ebp-0C]
:00408C68 3BC1                    cmp eax, ecx
:00408C6A 0F8311000000            jnb 00408C81
:00408C70 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00408C73 E8180B0000              call 00409790
:00408C78 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00408C7B 2B410F                  sub eax, dword ptr [ecx+0F]
:00408C7E 8945F4                  mov dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408C6A(C)
|
:00408C81 6A00                    push 00000000
:00408C83 6A06                    push 00000006
:00408C85 8B45E4                  mov eax, dword ptr [ebp-1C]
:00408C88 33C9                    xor ecx, ecx
:00408C8A 8A4806                  mov cl, byte ptr [eax+06]
:00408C8D 8D0449                  lea eax, dword ptr [ecx+2*ecx]
:00408C90 50                      push eax
:00408C91 8B45E4                  mov eax, dword ptr [ebp-1C]
:00408C94 33C9                    xor ecx, ecx
:00408C96 8A4805                  mov cl, byte ptr [eax+05]
:00408C99 8D0449                  lea eax, dword ptr [ecx+2*ecx]
:00408C9C 50                      push eax
:00408C9D B900FB4600              mov ecx, 0046FB00
:00408CA2 E8995D0300              call 0043EA40
:00408CA7 B9D0A64600              mov ecx, 0046A6D0
:00408CAC E8CF040000              call 00409180
:00408CB1 F6C401                  test ah, 01
:00408CB4 0F8539000000            jne 00408CF3
:00408CBA C645EC00                mov [ebp-14], 00
:00408CBE E903000000              jmp 00408CC6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408CE9(U)
|
:00408CC3 FE45EC                  inc [ebp-14]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408CBE(U)
|
:00408CC6 33C0                    xor eax, eax
:00408CC8 8A45EC                  mov al, byte ptr [ebp-14]
:00408CCB 83F803                  cmp eax, 00000003
:00408CCE 0F8D1A000000            jnl 00408CEE
:00408CD4 6A0D                    push 0000000D
:00408CD6 8B45F4                  mov eax, dword ptr [ebp-0C]
:00408CD9 50                      push eax
:00408CDA 8B45E4                  mov eax, dword ptr [ebp-1C]
:00408CDD 8A4004                  mov al, byte ptr [eax+04]
:00408CE0 50                      push eax
:00408CE1 E87D0E0300              call 00439B63
:00408CE6 83C40C                  add esp, 0000000C
:00408CE9 E9D5FFFFFF              jmp 00408CC3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408CCE(C)
|
:00408CEE E9D4000000              jmp 00408DC7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408CB4(C)
|
:00408CF3 8B45E4                  mov eax, dword ptr [ebp-1C]
:00408CF6 8A4004                  mov al, byte ptr [eax+04]
:00408CF9 50                      push eax
:00408CFA 8D45E8                  lea eax, dword ptr [ebp-18]
:00408CFD 50                      push eax
:00408CFE E8BE100300              call 00439DC1
:00408D03 83C408                  add esp, 00000008
:00408D06 8B45E4                  mov eax, dword ptr [ebp-1C]
:00408D09 33C9                    xor ecx, ecx
:00408D0B 8A4804                  mov cl, byte ptr [eax+04]
:00408D0E 8BC1                    mov eax, ecx
:00408D10 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:00408D13 C1E103                  shl ecx, 03
:00408D16 2BC8                    sub ecx, eax
:00408D18 8D8998C04600            lea ecx, dword ptr [ecx+0046C098]
:00408D1E E8FD040000              call 00409220
:00408D23 85C0                    test eax, eax
:00408D25 0F8409000000            je 00408D34
:00408D2B C645E80E                mov [ebp-18], 0E
:00408D2F E904000000              jmp 00408D38

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408D25(C)
|
:00408D34 C645E82A                mov [ebp-18], 2A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408D2F(U)
|
:00408D38 33C0                    xor eax, eax
:00408D3A A0BDFC4600              mov al, byte ptr [0046FCBD]
:00408D3F 03C0                    add eax, eax
:00408D41 83C006                  add eax, 00000006
:00408D44 50                      push eax
:00408D45 B9B0FA4600              mov ecx, 0046FAB0
:00408D4A E861040000              call 004091B0
:00408D4F 8B45E4                  mov eax, dword ptr [ebp-1C]
:00408D52 8A4004                  mov al, byte ptr [eax+04]
:00408D55 50                      push eax
:00408D56 8B45E8                  mov eax, dword ptr [ebp-18]
:00408D59 50                      push eax
:00408D5A E8C7100300              call 00439E26
:00408D5F 83C408                  add esp, 00000008
:00408D62 E861E60200              call 004373C8
:00408D67 6A01                    push 00000001
:00408D69 E84DE80200              call 004375BB
:00408D6E 83C404                  add esp, 00000004
:00408D71 33C0                    xor eax, eax
:00408D73 A0BDFC4600              mov al, byte ptr [0046FCBD]
:00408D78 03C0                    add eax, eax
:00408D7A 83C006                  add eax, 00000006
:00408D7D 50                      push eax
:00408D7E B9B0FA4600              mov ecx, 0046FAB0
:00408D83 E828040000              call 004091B0
:00408D88 6880000000              push 00000080
:00408D8D 8B45F4                  mov eax, dword ptr [ebp-0C]
:00408D90 50                      push eax
:00408D91 8B45E4                  mov eax, dword ptr [ebp-1C]
:00408D94 8A4004                  mov al, byte ptr [eax+04]
:00408D97 50                      push eax
:00408D98 8B45E8                  mov eax, dword ptr [ebp-18]
:00408D9B 50                      push eax
:00408D9C E8CD130300              call 0043A16E
:00408DA1 83C410                  add esp, 00000010
:00408DA4 E81FE60200              call 004373C8
:00408DA9 6A01                    push 00000001
:00408DAB E80BE80200              call 004375BB
:00408DB0 83C404                  add esp, 00000004
:00408DB3 6A09                    push 00000009
:00408DB5 6A21                    push 00000021
:00408DB7 8B45E9                  mov eax, dword ptr [ebp-17]
:00408DBA 50                      push eax
:00408DBB 6A06                    push 00000006
:00408DBD B900FB4600              mov ecx, 0046FB00
:00408DC2 E8661D0300              call 0043AB2D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408CEE(U)
|
:00408DC7 8B45F4                  mov eax, dword ptr [ebp-0C]
:00408DCA 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00408DCD 01410F                  add dword ptr [ecx+0F], eax
:00408DD0 6A01                    push 00000001
:00408DD2 8B45E4                  mov eax, dword ptr [ebp-1C]
:00408DD5 33C9                    xor ecx, ecx
:00408DD7 8A4804                  mov cl, byte ptr [eax+04]
:00408DDA 51                      push ecx
:00408DDB 33C0                    xor eax, eax
:00408DDD 8A450C                  mov al, byte ptr [ebp+0C]
:00408DE0 50                      push eax
:00408DE1 E8D2C5FFFF              call 004053B8
:00408DE6 83C40C                  add esp, 0000000C
:00408DE9 E900000000              jmp 00408DEE

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00408A43(U), :00408DE9(U)
|
:00408DEE 5F                      pop edi
:00408DEF 5E                      pop esi
:00408DF0 5B                      pop ebx
:00408DF1 C9                      leave
:00408DF2 C20C00                  ret 000C



* Referenced by a CALL at Address:
|:004069D0   
|
:00408DF5 55                      push ebp
:00408DF6 8BEC                    mov ebp, esp
:00408DF8 83EC20                  sub esp, 00000020
:00408DFB 53                      push ebx
:00408DFC 56                      push esi
:00408DFD 57                      push edi
:00408DFE 894DE0                  mov dword ptr [ebp-20], ecx
:00408E01 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00408E04 E8C7050000              call 004093D0
:00408E09 33C9                    xor ecx, ecx
:00408E0B 8AC8                    mov cl, al
:00408E0D 83F907                  cmp ecx, 00000007
:00408E10 0F840F000000            je 00408E25
:00408E16 33C0                    xor eax, eax
:00408E18 A0A4354500              mov al, byte ptr [004535A4]
:00408E1D A804                    test al, 04
:00408E1F 0F840C000000            je 00408E31

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408E10(C)
|
:00408E25 C745F801000000          mov [ebp-08], 00000001
:00408E2C E907000000              jmp 00408E38

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408E1F(C)
|
:00408E31 C745F800000000          mov [ebp-08], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408E2C(U)
|
:00408E38 C745F400000000          mov [ebp-0C], 00000000
:00408E3F 68FF000000              push 000000FF
:00408E44 68C0030000              push 000003C0
:00408E49 6A04                    push 00000004
:00408E4B 6A00                    push 00000000
:00408E4D 68E82C0000              push 00002CE8
:00408E52 B950F94600              mov ecx, 0046F950
:00408E57 E8C4E80300              call 00447720
:00408E5C 50                      push eax
:00408E5D E801E60300              call 00447463
:00408E62 83C40C                  add esp, 0000000C
:00408E65 6A00                    push 00000000
:00408E67 6A01                    push 00000001
:00408E69 6880000000              push 00000080
:00408E6E 8B45E0                  mov eax, dword ptr [ebp-20]
:00408E71 83C005                  add eax, 00000005
:00408E74 50                      push eax
:00408E75 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00408E78 E854090100              call 004197D1
:00408E7D 8845FC                  mov byte ptr [ebp-04], al
:00408E80 837DF800                cmp dword ptr [ebp-08], 00000000
:00408E84 0F8420000000            je 00408EAA
:00408E8A 6A01                    push 00000001
:00408E8C B900FB4600              mov ecx, 0046FB00
:00408E91 E8BA090000              call 00409850
:00408E96 B900FB4600              mov ecx, 0046FB00
:00408E9B E8000A0000              call 004098A0
:00408EA0 6A02                    push 00000002
:00408EA2 E8A7E70200              call 0043764E
:00408EA7 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408E84(C)
|
:00408EAA 33C0                    xor eax, eax
:00408EAC 8A45FC                  mov al, byte ptr [ebp-04]
:00408EAF 3DFF000000              cmp eax, 000000FF
:00408EB4 0F848A010000            je 00409044
:00408EBA 837DF800                cmp dword ptr [ebp-08], 00000000
:00408EBE 0F8417000000            je 00408EDB

* Possible StringData Ref from Data Obj ->"ָΧڲӵ;"
                                  |
:00408EC4 6804E44400              push 0044E404
:00408EC9 6A02                    push 00000002
:00408ECB E865000300              call 00438F35
:00408ED0 83C408                  add esp, 00000008
:00408ED3 8945F0                  mov dword ptr [ebp-10], eax
:00408ED6 E907000000              jmp 00408EE2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408EBE(C)
|
:00408EDB C745F001000000          mov [ebp-10], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408ED6(U)
|
:00408EE2 837DF000                cmp dword ptr [ebp-10], 00000000
:00408EE6 0F8453010000            je 0040903F
:00408EEC C745EC00000000          mov [ebp-14], 00000000
:00408EF3 6A18                    push 00000018
:00408EF5 6A27                    push 00000027
:00408EF7 6A00                    push 00000000
:00408EF9 6A00                    push 00000000
:00408EFB B900FB4600              mov ecx, 0046FB00
:00408F00 E8281C0300              call 0043AB2D
:00408F05 C745E808494500          mov [ebp-18], 00454908
:00408F0C E903000000              jmp 00408F14

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408FAC(U)
|
:00408F11 FF45E8                  inc [ebp-18]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408F0C(U)
|
:00408F14 8B45E8                  mov eax, dword ptr [ebp-18]
:00408F17 33C9                    xor ecx, ecx
:00408F19 8A08                    mov cl, byte ptr [eax]
:00408F1B 81F9FF000000            cmp ecx, 000000FF
:00408F21 0F848A000000            je 00408FB1
:00408F27 8B45E8                  mov eax, dword ptr [ebp-18]
:00408F2A 33C9                    xor ecx, ecx
:00408F2C 8A08                    mov cl, byte ptr [eax]
:00408F2E 8BC1                    mov eax, ecx
:00408F30 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:00408F33 C1E103                  shl ecx, 03
:00408F36 2BC8                    sub ecx, eax
:00408F38 8D8998C04600            lea ecx, dword ptr [ecx+0046C098]
:00408F3E E8ED010000              call 00409130
:00408F43 8D0440                  lea eax, dword ptr [eax+2*eax]
:00408F46 03C0                    add eax, eax
:00408F48 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:00408F4F E83C080000              call 00409790
:00408F54 8BD8                    mov ebx, eax
:00408F56 8B45E8                  mov eax, dword ptr [ebp-18]
:00408F59 33C9                    xor ecx, ecx
:00408F5B 8A08                    mov cl, byte ptr [eax]
:00408F5D 8BC1                    mov eax, ecx
:00408F5F 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:00408F62 C1E103                  shl ecx, 03
:00408F65 2BC8                    sub ecx, eax
:00408F67 8D8998C04600            lea ecx, dword ptr [ecx+0046C098]
:00408F6D E83E080000              call 004097B0
:00408F72 3BD8                    cmp ebx, eax
:00408F74 0F8632000000            jbe 00408FAC
:00408F7A C745EC01000000          mov [ebp-14], 00000001
:00408F81 8B450C                  mov eax, dword ptr [ebp+0C]
:00408F84 50                      push eax
:00408F85 8B45E0                  mov eax, dword ptr [ebp-20]
:00408F88 8A4004                  mov al, byte ptr [eax+04]
:00408F8B 50                      push eax
:00408F8C 8B4508                  mov eax, dword ptr [ebp+08]
:00408F8F 50                      push eax
:00408F90 8B45E8                  mov eax, dword ptr [ebp-18]
:00408F93 33C9                    xor ecx, ecx
:00408F95 8A08                    mov cl, byte ptr [eax]
:00408F97 8BC1                    mov eax, ecx
:00408F99 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:00408F9C C1E103                  shl ecx, 03
:00408F9F 2BC8                    sub ecx, eax
:00408FA1 8D8998C04600            lea ecx, dword ptr [ecx+0046C098]
:00408FA7 E846FAFFFF              call 004089F2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408F74(C)
|
:00408FAC E960FFFFFF              jmp 00408F11

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408F21(C)
|
:00408FB1 837DEC00                cmp dword ptr [ebp-14], 00000000
:00408FB5 0F843B000000            je 00408FF6
:00408FBB 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00408FBE E85D020000              call 00409220
:00408FC3 85C0                    test eax, eax
:00408FC5 0F840C000000            je 00408FD7

* Possible StringData Ref from Data Obj ->"Ҿ"
                                  |
:00408FCB C745E420E44400          mov [ebp-1C], 0044E420
:00408FD2 E907000000              jmp 00408FDE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408FC5(C)
|

* Possible StringData Ref from Data Obj ->"о"
                                  |
:00408FD7 C745E428E44400          mov [ebp-1C], 0044E428

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408FD2(U)
|
:00408FDE 8B45E4                  mov eax, dword ptr [ebp-1C]
:00408FE1 50                      push eax

* Possible StringData Ref from Data Obj ->"%s;ָˡ"
                                  |
:00408FE2 6830E44400              push 0044E430
:00408FE7 6A00                    push 00000000
:00408FE9 E847FF0200              call 00438F35
:00408FEE 83C40C                  add esp, 0000000C
:00408FF1 E938000000              jmp 0040902E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408FB5(C)
|
:00408FF6 6A0A                    push 0000000A
:00408FF8 B994A64600              mov ecx, 0046A694
:00408FFD E822000100              call 00419024

* Possible StringData Ref from Data Obj ->"ûҪָĲӡ"
                                  |
:00409002 6844E44400              push 0044E444
:00409007 6A00                    push 00000000
:00409009 E827FF0200              call 00438F35
:0040900E 83C408                  add esp, 00000008
:00409011 6A00                    push 00000000
:00409013 B900FB4600              mov ecx, 0046FB00
:00409018 E833080000              call 00409850
:0040901D B900FB4600              mov ecx, 0046FB00
:00409022 E879080000              call 004098A0
:00409027 33C0                    xor eax, eax
:00409029 E96F000000              jmp 0040909D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408FF1(U)
|
:0040902E B994A64600              mov ecx, 0046A694
:00409033 E860000100              call 00419098
:00409038 C745F401000000          mov [ebp-0C], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408EE6(C)
|
:0040903F E931000000              jmp 00409075

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408EB4(C)
|
:00409044 6A0A                    push 0000000A
:00409046 B994A64600              mov ecx, 0046A694
:0040904B E8D4FF0000              call 00419024

* Possible StringData Ref from Data Obj ->"ΧûҾӡ"
                                  |
:00409050 685CE44400              push 0044E45C
:00409055 6A00                    push 00000000
:00409057 E8D9FE0200              call 00438F35
:0040905C 83C408                  add esp, 00000008
:0040905F 6A00                    push 00000000
:00409061 B900FB4600              mov ecx, 0046FB00
:00409066 E8E5070000              call 00409850
:0040906B B900FB4600              mov ecx, 0046FB00
:00409070 E82B080000              call 004098A0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040903F(U)
|
:00409075 837DF800                cmp dword ptr [ebp-08], 00000000
:00409079 0F8416000000            je 00409095
:0040907F 6A00                    push 00000000
:00409081 B900FB4600              mov ecx, 0046FB00
:00409086 E8C5070000              call 00409850
:0040908B B900FB4600              mov ecx, 0046FB00
:00409090 E80B080000              call 004098A0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409079(C)
|
:00409095 8B45F4                  mov eax, dword ptr [ebp-0C]
:00409098 E900000000              jmp 0040909D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00409029(U), :00409098(U)
|
:0040909D 5F                      pop edi
:0040909E 5E                      pop esi
:0040909F 5B                      pop ebx
:004090A0 C9                      leave
:004090A1 C20800                  ret 0008


:004090A4 CC                      int 03
:004090A5 CC                      int 03
:004090A6 CC                      int 03
:004090A7 CC                      int 03
:004090A8 CC                      int 03
:004090A9 CC                      int 03
:004090AA CC                      int 03
:004090AB CC                      int 03
:004090AC CC                      int 03
:004090AD CC                      int 03
:004090AE CC                      int 03
:004090AF CC                      int 03

* Referenced by a CALL at Addresses:
|:004020C9   , :00432A6A   , :00432A81   
|
:004090B0 55                      push ebp
:004090B1 8BEC                    mov ebp, esp
:004090B3 53                      push ebx
:004090B4 56                      push esi
:004090B5 57                      push edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004090CB(U)
|
:004090B6 FF4D10                  dec [ebp+10]
:004090B9 0F8811000000            js 004090D0
:004090BF 8B4D08                  mov ecx, dword ptr [ebp+08]
:004090C2 FF5514                  call [ebp+14]
:004090C5 8B450C                  mov eax, dword ptr [ebp+0C]
:004090C8 014508                  add dword ptr [ebp+08], eax
:004090CB E9E6FFFFFF              jmp 004090B6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004090B9(C)
|
:004090D0 E900000000              jmp 004090D5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004090D0(U)
|
:004090D5 5F                      pop edi
:004090D6 5E                      pop esi
:004090D7 5B                      pop ebx
:004090D8 C9                      leave
:004090D9 C21000                  ret 0010


:004090DC CC                      int 03
:004090DD CC                      int 03
:004090DE CC                      int 03
:004090DF CC                      int 03

* Referenced by a CALL at Addresses:
|:004020E6   , :004021FF   , :0040490B   , :00404928   , :00409FF8   
|:0040A204   , :0040A280   , :0040A2A3   , :0040AD57   , :0040AF22   
|:0040AF4B   , :0040AF6E   , :0040B44C   , :00411ED8   , :00414B28   
|:00415611   , :00419F80   , :00420C9D   , :00421991   , :00421A89   
|:00421AE7   , :00421B15   , :00424BDE   , :00424F4B   , :00424FA4   
|:00425018   , :004250FF   , :00425168   , :004253E9   , :00425418   
|:00425477   , :004254A6   , :00425749   , :00428275   , :004282B2   
|:0042951E   , :004295F4   , :00429817   , :0042983A   , :0042A9EA   
|:0042AB16   , :0042B4EA   , :0042B592   , :0042C0ED   , :00431CD3   
|:004329B6   , :00432C1F   , :00432CAF   , :00438639   , :00438696   
|:00439D1D   , :00439D89   , :0043BC9C   , :0043BFAF   , :0043BFF5   
|:0043C501   , :0043C805   , :0043C83A   , :0043C8E9   , :0043D915   
|:0043E1AB   , :0043E27B   , :0043EAEB   , :0043ECBB   , :0043ED26   
|:0044036D   , :0044041F   , :0044044B   , :004404BB   , :0044054C   
|:00443AB9   , :00443B0A   
|
:004090E0 55                      push ebp
:004090E1 8BEC                    mov ebp, esp
:004090E3 83EC04                  sub esp, 00000004
:004090E6 53                      push ebx
:004090E7 56                      push esi
:004090E8 57                      push edi
:004090E9 894DFC                  mov dword ptr [ebp-04], ecx
:004090EC 6A04                    push 00000004
:004090EE 6A00                    push 00000000
:004090F0 6A00                    push 00000000
:004090F2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004090F5 E826E60300              call 00447720
:004090FA E900000000              jmp 004090FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004090FA(U)
|
:004090FF 5F                      pop edi
:00409100 5E                      pop esi
:00409101 5B                      pop ebx
:00409102 C9                      leave
:00409103 C3                      ret


:00409104 CC                      int 03
:00409105 CC                      int 03
:00409106 CC                      int 03
:00409107 CC                      int 03
:00409108 CC                      int 03
:00409109 CC                      int 03
:0040910A CC                      int 03
:0040910B CC                      int 03
:0040910C CC                      int 03
:0040910D CC                      int 03
:0040910E CC                      int 03
:0040910F CC                      int 03

* Referenced by a CALL at Addresses:
|:004022E4   , :004022FE   , :004087F0   , :00408827   , :0040886A   
|:00408B03   , :00408B1D   , :00408B43   , :00408BB5   , :00408BD6   
|:00408BF9   , :0040BE62   , :0040C032   , :0041C1F5   , :0041C202   
|:0041C227   , :0041C2E5   , :0041C2F2   , :0041C375   , :0041C382   
|:0041C422   , :0041C42F   , :0041C503   , :0041C510   , :0041C56E   
|:0041C57B   , :0042A8DF   , :0042AE40   , :0042AEC3   
|
:00409110 55                      push ebp
:00409111 8BEC                    mov ebp, esp
:00409113 83EC04                  sub esp, 00000004
:00409116 53                      push ebx
:00409117 56                      push esi
:00409118 57                      push edi
:00409119 894DFC                  mov dword ptr [ebp-04], ecx
:0040911C 8B45FC                  mov eax, dword ptr [ebp-04]
:0040911F 8A401D                  mov al, byte ptr [eax+1D]
:00409122 E900000000              jmp 00409127

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409122(U)
|
:00409127 5F                      pop edi
:00409128 5E                      pop esi
:00409129 5B                      pop ebx
:0040912A C9                      leave
:0040912B C3                      ret


:0040912C CC                      int 03
:0040912D CC                      int 03
:0040912E CC                      int 03
:0040912F CC                      int 03

* Referenced by a CALL at Addresses:
|:00402239   , :00402263   , :00402374   , :00403587   , :00403621   
|:00403E55   , :00403F2E   , :0040411F   , :00404153   , :0040416A   
|:0040426E   , :004053D4   , :0040547C   , :004054AA   , :00406A02   
|:00408437   , :004084EC   , :00408A6D   , :00408AA5   , :00408F3E   
|:0041A406   , :0041A83D   , :0041A958   , :0041BFC5   , :0041CCA8   
|:0041CE4F   , :00423808   , :00423895   , :004238C9   , :004238EC   
|:004240FC   , :004278AD   , :00427D1C   , :0042880C   , :004289E7   
|:00428D82   , :00429096   , :00429244   , :004292ED   , :0042AC6C   
|:0042C711   , :0042C75A   , :0042CAB5   , :0042CAFC   , :00439E44   
|:0043A046   , :0043A18C   , :0043C975   , :0043CE4D   , :0044095E   
|:00440983   , :00440B91   , :00440D27   , :004414E3   , :00441573   
|:004416FD   , :00441749   , :004417AB   , :004417F7   , :00441B1D   
|:0044331D   , :00443371   , :004435B9   , :004437E4   , :004438AA   
|
:00409130 55                      push ebp
:00409131 8BEC                    mov ebp, esp
:00409133 83EC04                  sub esp, 00000004
:00409136 53                      push ebx
:00409137 56                      push esi
:00409138 57                      push edi
:00409139 894DFC                  mov dword ptr [ebp-04], ecx
:0040913C 8B45FC                  mov eax, dword ptr [ebp-04]
:0040913F 8B00                    mov eax, dword ptr [eax]
:00409141 E900000000              jmp 00409146

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409141(U)
|
:00409146 5F                      pop edi
:00409147 5E                      pop esi
:00409148 5B                      pop ebx
:00409149 C9                      leave
:0040914A C3                      ret


:0040914B CC                      int 03
:0040914C CC                      int 03
:0040914D CC                      int 03
:0040914E CC                      int 03
:0040914F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040229A   , :00405346   , :00405DE6   , :00405F8F   , :004061AE   
|:0040637F   , :00406536   , :00406719   , :00406CF5   , :00406E65   
|:00406FD9   , :0040714D   , :00407952   , :00407C70   , :004086C0   
|:0041A5F8   , :0041C6BA   , :0041CBB1   , :0041CBFB   , :0041D25B   
|:004223F4   , :004230E7   , :004237B1   , :0042383E   , :00423D5E   
|:00429BFC   , :00429C55   , :00429CB6   , :00429D0F   , :00429D70   
|:00429DC9   , :00429E2A   , :00429E83   , :00429EE4   , :00429F3D   
|:00429F9E   , :00429FF7   , :0042A3BC   , :0042A59A   , :0042B09D   
|:0042B0C0   , :0042B0E3   , :0042B106   , :0042B129   , :0042B154   
|:0042CCA9   , :0042D156   , :0042D327   , :0043DB49   , :0043F244   
|:0043F2E4   , :004431C4   , :004432DD   
|
:00409150 55                      push ebp
:00409151 8BEC                    mov ebp, esp
:00409153 83EC04                  sub esp, 00000004
:00409156 53                      push ebx
:00409157 56                      push esi
:00409158 57                      push edi
:00409159 894DFC                  mov dword ptr [ebp-04], ecx
:0040915C 8B45FC                  mov eax, dword ptr [ebp-04]
:0040915F 33C9                    xor ecx, ecx
:00409161 8A4816                  mov cl, byte ptr [eax+16]
:00409164 33C0                    xor eax, eax
:00409166 8A4508                  mov al, byte ptr [ebp+08]
:00409169 23C8                    and ecx, eax
:0040916B 8BC1                    mov eax, ecx
:0040916D E900000000              jmp 00409172

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040916D(U)
|
:00409172 5F                      pop edi
:00409173 5E                      pop esi
:00409174 5B                      pop ebx
:00409175 C9                      leave
:00409176 C20400                  ret 0004


:00409179 CC                      int 03
:0040917A CC                      int 03
:0040917B CC                      int 03
:0040917C CC                      int 03
:0040917D CC                      int 03
:0040917E CC                      int 03
:0040917F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040243F   , :004025B4   , :00404595   , :004050BF   , :00408CAC   
|:00409AAC   , :00409AC7   , :00409AE1   , :00409AFB   , :00423DF0   
|:00424249   , :004245B4   , :00424766   , :0042C8A3   , :0042D3B7   
|:0043EB5F   , :0043EBA9   , :0043EBDB   , :0043FE61   , :0043FEE6   
|:0043FF31   , :0043FFC3   , :00440779   , :00441CB2   , :00441D54   
|:00441E48   , :00441FA5   
|
:00409180 55                      push ebp
:00409181 8BEC                    mov ebp, esp
:00409183 83EC04                  sub esp, 00000004
:00409186 53                      push ebx
:00409187 56                      push esi
:00409188 57                      push edi
:00409189 894DFC                  mov dword ptr [ebp-04], ecx
:0040918C 8B45FC                  mov eax, dword ptr [ebp-04]
:0040918F 33C9                    xor ecx, ecx
:00409191 668B4808                mov cx, word ptr [eax+08]
:00409195 8BC1                    mov eax, ecx
:00409197 E900000000              jmp 0040919C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409197(U)
|
:0040919C 5F                      pop edi
:0040919D 5E                      pop esi
:0040919E 5B                      pop ebx
:0040919F C9                      leave
:004091A0 C3                      ret


:004091A1 CC                      int 03
:004091A2 CC                      int 03
:004091A3 CC                      int 03
:004091A4 CC                      int 03
:004091A5 CC                      int 03
:004091A6 CC                      int 03
:004091A7 CC                      int 03
:004091A8 CC                      int 03
:004091A9 CC                      int 03
:004091AA CC                      int 03
:004091AB CC                      int 03
:004091AC CC                      int 03
:004091AD CC                      int 03
:004091AE CC                      int 03
:004091AF CC                      int 03

* Referenced by a CALL at Addresses:
|:004024D6   , :0040250C   , :00405154   , :0040518A   , :00408D4A   
|:00408D83   , :00416D9B   , :004226EC   , :00422CDA   , :00422E5B   
|:00423447   , :00423E58   , :00423EBC   , :00424559   , :0042D580   
|:0042D79F   , :0042DA92   , :00437446   , :0043746E   , :0043757E   
|:004375F2   , :00439D01   , :00439D65   , :0043B8D0   
|
:004091B0 55                      push ebp
:004091B1 8BEC                    mov ebp, esp
:004091B3 83EC04                  sub esp, 00000004
:004091B6 53                      push ebx
:004091B7 56                      push esi
:004091B8 57                      push edi
:004091B9 894DFC                  mov dword ptr [ebp-04], ecx
:004091BC 8B4508                  mov eax, dword ptr [ebp+08]
:004091BF 50                      push eax
:004091C0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004091C3 E82DE10200              call 004372F5
:004091C8 E900000000              jmp 004091CD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004091C8(U)
|
:004091CD 5F                      pop edi
:004091CE 5E                      pop esi
:004091CF 5B                      pop ebx
:004091D0 C9                      leave
:004091D1 C20400                  ret 0004


:004091D4 CC                      int 03
:004091D5 CC                      int 03
:004091D6 CC                      int 03
:004091D7 CC                      int 03
:004091D8 CC                      int 03
:004091D9 CC                      int 03
:004091DA CC                      int 03
:004091DB CC                      int 03
:004091DC CC                      int 03
:004091DD CC                      int 03
:004091DE CC                      int 03
:004091DF CC                      int 03

* Referenced by a CALL at Addresses:
|:004023DF   , :004023F3   , :00406A7F   , :0040BEB9   , :0040C0C4   
|:0041070D   , :00410991   , :0041C72C   , :0041CFCD   , :0041CFF0   
|:0041D027   , :0042A469   , :0042B233   , :0042B3AB   , :0042C21C   
|:0042DE3B   , :0043A38A   , :0043A39E   , :00440FB5   
|
:004091E0 55                      push ebp
:004091E1 8BEC                    mov ebp, esp
:004091E3 83EC04                  sub esp, 00000004
:004091E6 53                      push ebx
:004091E7 56                      push esi
:004091E8 57                      push edi
:004091E9 894DFC                  mov dword ptr [ebp-04], ecx
:004091EC 8B45FC                  mov eax, dword ptr [ebp-04]
:004091EF 8A4022                  mov al, byte ptr [eax+22]
:004091F2 E900000000              jmp 004091F7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004091F2(U)
|
:004091F7 5F                      pop edi
:004091F8 5E                      pop esi
:004091F9 5B                      pop ebx
:004091FA C9                      leave
:004091FB C3                      ret


:004091FC CC                      int 03
:004091FD CC                      int 03
:004091FE CC                      int 03
:004091FF CC                      int 03

* Referenced by a CALL at Addresses:
|:0040238C   , :00402EA9   , :00403ED4   , :004044EB   , :004045B7   
|:00404641   , :0040477D   , :00405022   , :00405667   , :00405A43   
|:00405E0A   , :004061DE   , :00406578   , :0040676B   , :00406962   
|:00406CE4   , :00406E54   , :00406FC8   , :0040713C   , :0040730B   
|:00407683   , :00407982   , :00407B02   , :00407CC0   , :00408488   
|:00419339   , :0041935A   , :0041A010   , :0041A713   , :0041AE43   
|:0041B673   , :0041B835   , :0041B98A   , :0041BFEF   , :0041D55F   
|:0041E128   , :00422268   , :004225EB   , :004229B7   , :004229D8   
|:00422F30   , :00423082   , :00423258   , :00423365   , :00424516   
|:004245E3   , :00424664   , :004248F1   , :00427D7C   , :0042A34B   
|:00439B81   , :00439DDF   , :0043BA74   , :0043CF25   , :0043E4F9   
|:0043E704   , :004409E0   , :00442688   , :00442C3B   
|
:00409200 55                      push ebp
:00409201 8BEC                    mov ebp, esp
:00409203 83EC04                  sub esp, 00000004
:00409206 53                      push ebx
:00409207 56                      push esi
:00409208 57                      push edi
:00409209 894DFC                  mov dword ptr [ebp-04], ecx
:0040920C 8B45FC                  mov eax, dword ptr [ebp-04]
:0040920F 83C005                  add eax, 00000005
:00409212 E900000000              jmp 00409217

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409212(U)
|
:00409217 5F                      pop edi
:00409218 5E                      pop esi
:00409219 5B                      pop ebx
:0040921A C9                      leave
:0040921B C3                      ret


:0040921C CC                      int 03
:0040921D CC                      int 03
:0040921E CC                      int 03
:0040921F CC                      int 03

* Referenced by a CALL at Addresses:
|:004024AA   , :004046E5   , :004046FF   , :00404850   , :0040486C   
|:00405043   , :00405128   , :004053FC   , :0040569A   , :004057B5   
|:004057CF   , :00405818   , :00405A64   , :00405B7F   , :00405B99   
|:00405BE2   , :00405E2B   , :00405F51   , :00405F6B   , :00405FB1   
|:00406211   , :00406341   , :0040635B   , :004063A1   , :00406599   
|:0040678C   , :00407438   , :00407452   , :00407788   , :004077A2   
|:00407CE1   , :00408D1E   , :00408FBE   , :004192B4   , :00419DEE   
|:00419E0B   , :00419FBD   , :00419FC7   , :0041A448   , :0041A452   
|:0041AA76   , :0041AF90   , :0041B3CE   , :0041B818   , :0041C905   
|:0041C90F   , :0041D444   , :0041D454   , :0041D4F7   , :0041D5D0   
|:0041D5DA   , :0041D666   , :0041D670   , :0041D71F   , :0041D729   
|:0041D7CC   , :0041D7D6   , :0041D864   , :0041D86E   , :0041D8FC   
|:0041D906   , :0041DB3D   , :0042244B   , :0042316E   , :00423ACC   
|:00423BD9   , :00424046   , :004242CA   , :004242FF   , :004248BE   
|:004284F8   , :004289B2   , :00428D4D   , :00428E6C   , :00429289   
|:0042A8C5   , :0042A8CF   , :0042BD7C   , :0042C622   , :0042C68B   
|:0042C738   , :0042CA43   , :0042CA98   , :0042CADF   , :0042CC08   
|:0042D178   , :0042D349   , :00439E84   , :00439F12   , :0043A20A   
|:0043B714   , :0043BAAF   , :0043C146   , :0043D0C0   , :0043D0DC   
|:0043D174   , :0043D190   , :0043DC37   , :0043F5B1   , :00442E34   
|
:00409220 55                      push ebp
:00409221 8BEC                    mov ebp, esp
:00409223 83EC04                  sub esp, 00000004
:00409226 53                      push ebx
:00409227 56                      push esi
:00409228 57                      push edi
:00409229 894DFC                  mov dword ptr [ebp-04], ecx
:0040922C 8B45FC                  mov eax, dword ptr [ebp-04]
:0040922F 33C9                    xor ecx, ecx
:00409231 8A4804                  mov cl, byte ptr [eax+04]
:00409234 83F90F                  cmp ecx, 0000000F
:00409237 0F8C07000000            jl 00409244
:0040923D 33C0                    xor eax, eax
:0040923F E905000000              jmp 00409249

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409237(C)
|
:00409244 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040923F(U)
|
:00409249 E900000000              jmp 0040924E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409249(U)
|
:0040924E 5F                      pop edi
:0040924F 5E                      pop esi
:00409250 5B                      pop ebx
:00409251 C9                      leave
:00409252 C3                      ret


:00409253 CC                      int 03
:00409254 CC                      int 03
:00409255 CC                      int 03
:00409256 CC                      int 03
:00409257 CC                      int 03
:00409258 CC                      int 03
:00409259 CC                      int 03
:0040925A CC                      int 03
:0040925B CC                      int 03
:0040925C CC                      int 03
:0040925D CC                      int 03
:0040925E CC                      int 03
:0040925F CC                      int 03

* Referenced by a CALL at Addresses:
|:004023CC   , :004023FF   , :00402552   , :00404FEE   , :004051DD   
|:00405373   , :004053A3   , :00406A73   , :0041C2CF   , :0043A0CD   
|:0043A1D3   , :0043A37B   , :0043A3C4   , :0043A3ED   , :0043A416   
|:0043F7D9   , :00440AF3   
|
:00409260 55                      push ebp
:00409261 8BEC                    mov ebp, esp
:00409263 83EC04                  sub esp, 00000004
:00409266 53                      push ebx
:00409267 56                      push esi
:00409268 57                      push edi
:00409269 894DFC                  mov dword ptr [ebp-04], ecx
:0040926C 8B45FC                  mov eax, dword ptr [ebp-04]
:0040926F 8A4013                  mov al, byte ptr [eax+13]
:00409272 E900000000              jmp 00409277

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409272(U)
|
:00409277 5F                      pop edi
:00409278 5E                      pop esi
:00409279 5B                      pop ebx
:0040927A C9                      leave
:0040927B C3                      ret


:0040927C CC                      int 03
:0040927D CC                      int 03
:0040927E CC                      int 03
:0040927F CC                      int 03

* Referenced by a CALL at Addresses:
|:004026DC   , :00402AE3   , :00403E66   , :0040548D   , :004054BB   
|:00408448   , :0040B471   , :0040BF67   , :0040D215   , :0040D2BE   
|:0041B0E2   , :0041CEE5   , :00423A2F   , :00423A46   , :00423A6D   
|:00423A93   , :00423BA4   , :00423BBF   , :0042881D   , :0042C17D   
|:00434413   , :0043A057   , :0043F6B8   
|
:00409280 55                      push ebp
:00409281 8BEC                    mov ebp, esp
:00409283 83EC04                  sub esp, 00000004
:00409286 53                      push ebx
:00409287 56                      push esi
:00409288 57                      push edi
:00409289 894DFC                  mov dword ptr [ebp-04], ecx
:0040928C 8B45FC                  mov eax, dword ptr [ebp-04]
:0040928F 8A4025                  mov al, byte ptr [eax+25]
:00409292 E900000000              jmp 00409297

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409292(U)
|
:00409297 5F                      pop edi
:00409298 5E                      pop esi
:00409299 5B                      pop ebx
:0040929A C9                      leave
:0040929B C3                      ret


:0040929C CC                      int 03
:0040929D CC                      int 03
:0040929E CC                      int 03
:0040929F CC                      int 03

* Referenced by a CALL at Addresses:
|:00402626   , :00403E24   , :00406B9E   , :00408386   , :004086A8   
|:0041937B   , :0041A57F   , :0041A594   , :0041A5A9   , :0041A690   
|:0041A975   , :0041AA04   , :0041AE85   , :0041AEAC   , :0041B5D1   
|:0041C866   , :0041D981   , :00424351   , :00429268   , :0042927D   
|:004292A3   , :004292C5   , :00429342   , :0042A2C0   , :0042A2E8   
|:0042A330   , :0042A37D   , :0042A3A5   , :0042A5E0   , :0042A815   
|:0042A89E   , :0042AC89   , :0042B446   , :0042BF4B   , :0042C25F   
|:0042C93E   , :0042CFBA   , :0042DE9C   , :00439FF6   , :004416D6   
|:0044172B   , :00441785   , :004417D9   , :00441A76   
|
:004092A0 55                      push ebp
:004092A1 8BEC                    mov ebp, esp
:004092A3 83EC04                  sub esp, 00000004
:004092A6 53                      push ebx
:004092A7 56                      push esi
:004092A8 57                      push edi
:004092A9 894DFC                  mov dword ptr [ebp-04], ecx
:004092AC 8B45FC                  mov eax, dword ptr [ebp-04]
:004092AF 8B00                    mov eax, dword ptr [eax]
:004092B1 8D0440                  lea eax, dword ptr [eax+2*eax]
:004092B4 03C0                    add eax, eax
:004092B6 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:004092BD E80E000000              call 004092D0
:004092C2 E900000000              jmp 004092C7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004092C2(U)
|
:004092C7 5F                      pop edi
:004092C8 5E                      pop esi
:004092C9 5B                      pop ebx
:004092CA C9                      leave
:004092CB C3                      ret


:004092CC CC                      int 03
:004092CD CC                      int 03
:004092CE CC                      int 03
:004092CF CC                      int 03

* Referenced by a CALL at Addresses:
|:004038C0   , :004092BD   , :0040BF48   , :0040C2D4   , :0040C3C7   
|:0041B0A0   , :0041B0C5   , :0041C09A   , :0041C0AE   , :0041C0C3   
|:0041CE85   , :0042413A   , :0043422A   , :00435F4C   , :0043F390   
|:0043F3E2   
|
:004092D0 55                      push ebp
:004092D1 8BEC                    mov ebp, esp
:004092D3 83EC04                  sub esp, 00000004
:004092D6 53                      push ebx
:004092D7 56                      push esi
:004092D8 57                      push edi
:004092D9 894DFC                  mov dword ptr [ebp-04], ecx
:004092DC 8B45FC                  mov eax, dword ptr [ebp-04]
:004092DF 8A4024                  mov al, byte ptr [eax+24]
:004092E2 E900000000              jmp 004092E7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004092E2(U)
|
:004092E7 5F                      pop edi
:004092E8 5E                      pop esi
:004092E9 5B                      pop ebx
:004092EA C9                      leave
:004092EB C3                      ret


:004092EC CC                      int 03
:004092ED CC                      int 03
:004092EE CC                      int 03
:004092EF CC                      int 03

* Referenced by a CALL at Addresses:
|:00402DFE   , :0041DD41   
|
:004092F0 55                      push ebp
:004092F1 8BEC                    mov ebp, esp
:004092F3 83EC04                  sub esp, 00000004
:004092F6 53                      push ebx
:004092F7 56                      push esi
:004092F8 57                      push edi
:004092F9 894DFC                  mov dword ptr [ebp-04], ecx
:004092FC 8B450C                  mov eax, dword ptr [ebp+0C]
:004092FF 50                      push eax
:00409300 8B4508                  mov eax, dword ptr [ebp+08]
:00409303 8A4001                  mov al, byte ptr [eax+01]
:00409306 50                      push eax
:00409307 8B4508                  mov eax, dword ptr [ebp+08]
:0040930A 8A00                    mov al, byte ptr [eax]
:0040930C 50                      push eax
:0040930D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00409310 E858260200              call 0042B96D
:00409315 E900000000              jmp 0040931A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409315(U)
|
:0040931A 5F                      pop edi
:0040931B 5E                      pop esi
:0040931C 5B                      pop ebx
:0040931D C9                      leave
:0040931E C20800                  ret 0008


:00409321 CC                      int 03
:00409322 CC                      int 03
:00409323 CC                      int 03
:00409324 CC                      int 03
:00409325 CC                      int 03
:00409326 CC                      int 03
:00409327 CC                      int 03
:00409328 CC                      int 03
:00409329 CC                      int 03
:0040932A CC                      int 03
:0040932B CC                      int 03
:0040932C CC                      int 03
:0040932D CC                      int 03
:0040932E CC                      int 03
:0040932F CC                      int 03

* Referenced by a CALL at Addresses:
|:00402DEA   , :00407B4E   , :00427BAC   , :00427EBB   , :00428677   
|:004286F9   , :004288E1   , :0042B5C8   , :0042B816   , :0042C852   
|:00440948   , :00440B24   , :00443470   
|
:00409330 55                      push ebp
:00409331 8BEC                    mov ebp, esp
:00409333 83EC04                  sub esp, 00000004
:00409336 53                      push ebx
:00409337 56                      push esi
:00409338 57                      push edi
:00409339 894DFC                  mov dword ptr [ebp-04], ecx
:0040933C 8B45FC                  mov eax, dword ptr [ebp-04]
:0040933F 33C9                    xor ecx, ecx
:00409341 8A480C                  mov cl, byte ptr [eax+0C]
:00409344 33C0                    xor eax, eax
:00409346 8A4508                  mov al, byte ptr [ebp+08]
:00409349 F7D0                    not eax
:0040934B 23C8                    and ecx, eax
:0040934D 8B45FC                  mov eax, dword ptr [ebp-04]
:00409350 88480C                  mov byte ptr [eax+0C], cl
:00409353 E900000000              jmp 00409358

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409353(U)
|
:00409358 5F                      pop edi
:00409359 5E                      pop esi
:0040935A 5B                      pop ebx
:0040935B C9                      leave
:0040935C C20400                  ret 0004


:0040935F CC                      int 03

* Referenced by a CALL at Addresses:
|:004025E6   , :0040283E   , :00402BF4   , :00402D96   , :00402E21   
|:004031EE   , :00403283   , :00407ADD   , :00407AF2   , :004192FD   
|:0041931C   , :0041A2D9   , :0041AA6B   , :0041AFB0   , :0041B4C7   
|:0041B5FD   , :0041B63C   , :0041B702   , :0041B7B8   , :0041B7F7   
|:0041BA30   , :0041BD6B   , :0041BDE6   , :0041BDF8   , :0041CC4E   
|:0041CC75   , :0041D1CE   , :0041DB67   , :0041DBC3   , :0041DBD9   
|:00429694   , :0042B5B8   , :0042B6C2   , :0042BB76   , :0042C4F2   
|:0042C891   , :0042CC32   , :0042CD88   , :0042D09A   , :0042D0BE   
|:0042D26B   , :0042D28F   , :0043DB6D   , :0043DB94   , :0044249B   
|:004424AD   , :00442A97   , :00442ABE   , :00442BC9   , :00442E58   
|:004431A2   
|
:00409360 55                      push ebp
:00409361 8BEC                    mov ebp, esp
:00409363 83EC04                  sub esp, 00000004
:00409366 53                      push ebx
:00409367 56                      push esi
:00409368 57                      push edi
:00409369 894DFC                  mov dword ptr [ebp-04], ecx
:0040936C 8B45FC                  mov eax, dword ptr [ebp-04]
:0040936F 33C9                    xor ecx, ecx
:00409371 8A480C                  mov cl, byte ptr [eax+0C]
:00409374 33C0                    xor eax, eax
:00409376 8A4508                  mov al, byte ptr [ebp+08]
:00409379 23C8                    and ecx, eax
:0040937B 33C0                    xor eax, eax
:0040937D 8A4508                  mov al, byte ptr [ebp+08]
:00409380 3BC8                    cmp ecx, eax
:00409382 0F850A000000            jne 00409392
:00409388 B801000000              mov eax, 00000001
:0040938D E902000000              jmp 00409394

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409382(C)
|
:00409392 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040938D(U)
|
:00409394 E900000000              jmp 00409399

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409394(U)
|
:00409399 5F                      pop edi
:0040939A 5E                      pop esi
:0040939B 5B                      pop ebx
:0040939C C9                      leave
:0040939D C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0040261B   , :0041B747   
|
:004093A0 55                      push ebp
:004093A1 8BEC                    mov ebp, esp
:004093A3 83EC04                  sub esp, 00000004
:004093A6 53                      push ebx
:004093A7 56                      push esi
:004093A8 57                      push edi
:004093A9 894DFC                  mov dword ptr [ebp-04], ecx
:004093AC 8B4508                  mov eax, dword ptr [ebp+08]
:004093AF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004093B2 894109                  mov dword ptr [ecx+09], eax
:004093B5 E900000000              jmp 004093BA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004093B5(U)
|
:004093BA 5F                      pop edi
:004093BB 5E                      pop esi
:004093BC 5B                      pop ebx
:004093BD C9                      leave
:004093BE C20400                  ret 0004


:004093C1 CC                      int 03
:004093C2 CC                      int 03
:004093C3 CC                      int 03
:004093C4 CC                      int 03
:004093C5 CC                      int 03
:004093C6 CC                      int 03
:004093C7 CC                      int 03
:004093C8 CC                      int 03
:004093C9 CC                      int 03
:004093CA CC                      int 03
:004093CB CC                      int 03
:004093CC CC                      int 03
:004093CD CC                      int 03
:004093CE CC                      int 03
:004093CF CC                      int 03

* Referenced by a CALL at Addresses:
|:00402E62   , :004043BD   , :00404F23   , :00405560   , :0040593C   
|:00405D06   , :004060CE   , :0040648D   , :00406680   , :0040688A   
|:00406B08   , :00406C49   , :00406DB9   , :00406F2D   , :004070A1   
|:0040722C   , :0040757C   , :004078B5   , :00407A24   , :00407BCC   
|:00407E3A   , :00408265   , :00408E04   , :0041A08D   , :0041A56A   
|:0041B60D   , :0041B64C   , :0041B94D   , :0041B9B0   , :0041B9D9   
|:0041BD7B   , :0041D1DE   , :0041DB77   , :00427B03   , :00429507   
|:00429538   , :004295AF   , :00429612   , :0042964A   , :00429662   
|:0042A917   , :0042BB20   , :0042C470   , :0042C484   , :0042CC18   
|:00439F34   , :0043CED6   , :0043F5D6   , :00441393   , :004424F2   
|:00442A6E   , :00442BE9   , :00443209   
|
:004093D0 55                      push ebp
:004093D1 8BEC                    mov ebp, esp
:004093D3 83EC04                  sub esp, 00000004
:004093D6 53                      push ebx
:004093D7 56                      push esi
:004093D8 57                      push edi
:004093D9 894DFC                  mov dword ptr [ebp-04], ecx
:004093DC 8B45FC                  mov eax, dword ptr [ebp-04]
:004093DF 8A400D                  mov al, byte ptr [eax+0D]
:004093E2 E900000000              jmp 004093E7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004093E2(U)
|
:004093E7 5F                      pop edi
:004093E8 5E                      pop esi
:004093E9 5B                      pop ebx
:004093EA C9                      leave
:004093EB C3                      ret


:004093EC CC                      int 03
:004093ED CC                      int 03
:004093EE CC                      int 03
:004093EF CC                      int 03

* Referenced by a CALL at Addresses:
|:00402F10   , :0040967F   , :00409910   , :00409F46   , :0040A1CA   
|:0040AD4D   , :0040AE73   , :0040B0BC   , :0040B3C4   , :00424BBC   
|:00424F41   , :004250DD   , :004253BA   , :00426D24   , :00426DCB   
|:0042E1A0   , :0042E28D   , :004340D4   , :004403C2   , :00440D61   
|
:004093F0 55                      push ebp
:004093F1 8BEC                    mov ebp, esp
:004093F3 83EC04                  sub esp, 00000004
:004093F6 53                      push ebx
:004093F7 56                      push esi
:004093F8 57                      push edi
:004093F9 894DFC                  mov dword ptr [ebp-04], ecx
:004093FC 8B45FC                  mov eax, dword ptr [ebp-04]
:004093FF C700FFFFFFFF            mov dword ptr [eax], FFFFFFFF
:00409405 E900000000              jmp 0040940A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409405(U)
|
:0040940A 8B45FC                  mov eax, dword ptr [ebp-04]
:0040940D 5F                      pop edi
:0040940E 5E                      pop esi
:0040940F 5B                      pop ebx
:00409410 C9                      leave
:00409411 C3                      ret


:00409412 CC                      int 03
:00409413 CC                      int 03
:00409414 CC                      int 03
:00409415 CC                      int 03
:00409416 CC                      int 03
:00409417 CC                      int 03
:00409418 CC                      int 03
:00409419 CC                      int 03
:0040941A CC                      int 03
:0040941B CC                      int 03
:0040941C CC                      int 03
:0040941D CC                      int 03
:0040941E CC                      int 03
:0040941F CC                      int 03

* Referenced by a CALL at Addresses:
|:00402F51   , :00404941   , :0040A18E   , :0040A238   , :0040A2D4   
|:0040A2FB   , :0040A364   , :0040AD89   , :0040AE27   , :0040AF9F   
|:0040AFCA   , :0040B033   , :0040B18B   , :0040B5ED   , :00411E89   
|:00411F21   , :00414B48   , :00415631   , :00422542   , :0042354A   
|:00423718   , :00424BF1   , :00424FC2   , :0042509C   , :004250A6   
|:00425115   , :004253FF   , :0042548D   , :00426D67   , :00426E0E   
|:00428292   , :004284AB   , :00429830   , :0042B4C5   , :0042B540   
|:0042B663   , :0042E1FF   , :0042E26F   , :0042E2DF   , :00434115   
|:004341DC   , :0043F45B   , :00440361   , :00440405   , :00440441   
|:00440590   , :00440710   , :00440DA2   , :00443B23   
|
:00409420 55                      push ebp
:00409421 8BEC                    mov ebp, esp
:00409423 83EC04                  sub esp, 00000004
:00409426 53                      push ebx
:00409427 56                      push esi
:00409428 57                      push edi
:00409429 894DFC                  mov dword ptr [ebp-04], ecx
:0040942C 8B45FC                  mov eax, dword ptr [ebp-04]
:0040942F 8B00                    mov eax, dword ptr [eax]
:00409431 50                      push eax
:00409432 E813E40300              call 0044784A
:00409437 83C404                  add esp, 00000004
:0040943A E900000000              jmp 0040943F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040943A(U)
|
:0040943F 5F                      pop edi
:00409440 5E                      pop esi
:00409441 5B                      pop ebx
:00409442 C9                      leave
:00409443 C3                      ret


:00409444 CC                      int 03
:00409445 CC                      int 03
:00409446 CC                      int 03
:00409447 CC                      int 03
:00409448 CC                      int 03
:00409449 CC                      int 03
:0040944A CC                      int 03
:0040944B CC                      int 03
:0040944C CC                      int 03
:0040944D CC                      int 03
:0040944E CC                      int 03
:0040944F CC                      int 03

* Referenced by a CALL at Addresses:
|:00402F49   , :00409E61   , :00409E8B   , :00409EB5   , :00409EE4   
|:0040A230   , :0040A28E   , :0040AD81   , :0040AF59   , :0040B180   
|:00424BE9   , :00424FBA   , :0042510D   , :004253F7   , :00425485   
|:0042755C   , :004275BF   , :0042E242   , :0042E2D7   , :0043410D   
|:00440D9A   
|
:00409450 55                      push ebp
:00409451 8BEC                    mov ebp, esp
:00409453 83EC04                  sub esp, 00000004
:00409456 53                      push ebx
:00409457 56                      push esi
:00409458 57                      push edi
:00409459 894DFC                  mov dword ptr [ebp-04], ecx
:0040945C 6A00                    push 00000000
:0040945E 8B4508                  mov eax, dword ptr [ebp+08]
:00409461 50                      push eax
:00409462 8B45FC                  mov eax, dword ptr [ebp-04]
:00409465 8B00                    mov eax, dword ptr [eax]
:00409467 50                      push eax
:00409468 E830E40300              call 0044789D
:0040946D 83C40C                  add esp, 0000000C
:00409470 8B4510                  mov eax, dword ptr [ebp+10]
:00409473 50                      push eax
:00409474 8B450C                  mov eax, dword ptr [ebp+0C]
:00409477 50                      push eax
:00409478 8B45FC                  mov eax, dword ptr [ebp-04]
:0040947B 8B00                    mov eax, dword ptr [eax]
:0040947D 50                      push eax
:0040947E E8D6E30300              call 00447859
:00409483 83C40C                  add esp, 0000000C
:00409486 E900000000              jmp 0040948B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409486(U)
|
:0040948B 5F                      pop edi
:0040948C 5E                      pop esi
:0040948D 5B                      pop ebx
:0040948E C9                      leave
:0040948F C20C00                  ret 000C


:00409492 CC                      int 03
:00409493 CC                      int 03
:00409494 CC                      int 03
:00409495 CC                      int 03
:00409496 CC                      int 03
:00409497 CC                      int 03
:00409498 CC                      int 03
:00409499 CC                      int 03
:0040949A CC                      int 03
:0040949B CC                      int 03
:0040949C CC                      int 03
:0040949D CC                      int 03
:0040949E CC                      int 03
:0040949F CC                      int 03

* Referenced by a CALL at Addresses:
|:00403055   , :00413927   , :004167ED   , :004210F0   , :00421284   
|:004218D5   , :00421B81   , :00435BA5   , :00435BF0   , :00435D16   
|:00438019   , :004384EA   , :00438794   , :0043A6FF   , :0043CDAB   
|:00440062   , :004401DE   
|
:004094A0 55                      push ebp
:004094A1 8BEC                    mov ebp, esp
:004094A3 83EC04                  sub esp, 00000004
:004094A6 53                      push ebx
:004094A7 56                      push esi
:004094A8 57                      push edi
:004094A9 894DFC                  mov dword ptr [ebp-04], ecx
:004094AC 8B45FC                  mov eax, dword ptr [ebp-04]
:004094AF 8B4004                  mov eax, dword ptr [eax+04]
:004094B2 E900000000              jmp 004094B7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004094B2(U)
|
:004094B7 5F                      pop edi
:004094B8 5E                      pop esi
:004094B9 5B                      pop ebx
:004094BA C9                      leave
:004094BB C3                      ret


:004094BC CC                      int 03
:004094BD CC                      int 03
:004094BE CC                      int 03
:004094BF CC                      int 03

* Referenced by a CALL at Addresses:
|:00403062   , :00413935   , :004167FB   , :004210FD   , :00421291   
|:004218E2   , :00421B8E   , :00435BB2   , :00435BFD   , :00438029   
|:004384FA   , :004387A4   , :00439185   , :0043A70F   , :0043CDBB   
|:0044006F   , :004401EB   
|
:004094C0 55                      push ebp
:004094C1 8BEC                    mov ebp, esp
:004094C3 83EC04                  sub esp, 00000004
:004094C6 53                      push ebx
:004094C7 56                      push esi
:004094C8 57                      push edi
:004094C9 894DFC                  mov dword ptr [ebp-04], ecx
:004094CC 8B45FC                  mov eax, dword ptr [ebp-04]
:004094CF 8B4008                  mov eax, dword ptr [eax+08]
:004094D2 E900000000              jmp 004094D7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004094D2(U)
|
:004094D7 5F                      pop edi
:004094D8 5E                      pop esi
:004094D9 5B                      pop ebx
:004094DA C9                      leave
:004094DB C3                      ret


:004094DC CC                      int 03
:004094DD CC                      int 03
:004094DE CC                      int 03
:004094DF CC                      int 03

* Referenced by a CALL at Addresses:
|:004036B2   , :0040959D   , :0040BE11   , :0040CF14   , :0040CF38   
|:00410AFC   , :00411193   , :004165AD   , :00423F45   , :00437B11   
|:0043F352   
|
:004094E0 55                      push ebp
:004094E1 8BEC                    mov ebp, esp
:004094E3 83EC04                  sub esp, 00000004
:004094E6 53                      push ebx
:004094E7 56                      push esi
:004094E8 57                      push edi
:004094E9 894DFC                  mov dword ptr [ebp-04], ecx
:004094EC 8B45FC                  mov eax, dword ptr [ebp-04]
:004094EF 83C006                  add eax, 00000006
:004094F2 E900000000              jmp 004094F7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004094F2(U)
|
:004094F7 5F                      pop edi
:004094F8 5E                      pop esi
:004094F9 5B                      pop ebx
:004094FA C9                      leave
:004094FB C3                      ret


:004094FC CC                      int 03
:004094FD CC                      int 03
:004094FE CC                      int 03
:004094FF CC                      int 03

* Referenced by a CALL at Addresses:
|:0040313C   , :004035D8   , :0040CD86   , :0042A76B   , :00434B0C   
|:0043FC46   
|
:00409500 55                      push ebp
:00409501 8BEC                    mov ebp, esp
:00409503 83EC04                  sub esp, 00000004
:00409506 53                      push ebx
:00409507 56                      push esi
:00409508 57                      push edi
:00409509 894DFC                  mov dword ptr [ebp-04], ecx
:0040950C 33C0                    xor eax, eax
:0040950E 8A4508                  mov al, byte ptr [ebp+08]
:00409511 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00409514 8A440827                mov al, byte ptr [eax+ecx+27]
:00409518 E900000000              jmp 0040951D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409518(U)
|
:0040951D 5F                      pop edi
:0040951E 5E                      pop esi
:0040951F 5B                      pop ebx
:00409520 C9                      leave
:00409521 C20400                  ret 0004


:00409524 CC                      int 03
:00409525 CC                      int 03
:00409526 CC                      int 03
:00409527 CC                      int 03
:00409528 CC                      int 03
:00409529 CC                      int 03
:0040952A CC                      int 03
:0040952B CC                      int 03
:0040952C CC                      int 03
:0040952D CC                      int 03
:0040952E CC                      int 03
:0040952F CC                      int 03

* Referenced by a CALL at Addresses:
|:004036A7   , :00403795   , :00404338   , :0040D15E   , :004161FE   
|:004162F8   , :00416399   , :00434B38   
|
:00409530 55                      push ebp
:00409531 8BEC                    mov ebp, esp
:00409533 83EC04                  sub esp, 00000004
:00409536 53                      push ebx
:00409537 56                      push esi
:00409538 57                      push edi
:00409539 894DFC                  mov dword ptr [ebp-04], ecx
:0040953C 8A450C                  mov al, byte ptr [ebp+0C]
:0040953F 33C9                    xor ecx, ecx
:00409541 8A4D08                  mov cl, byte ptr [ebp+08]
:00409544 8B55FC                  mov edx, dword ptr [ebp-04]
:00409547 88441127                mov byte ptr [ecx+edx+27], al
:0040954B E900000000              jmp 00409550

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040954B(U)
|
:00409550 5F                      pop edi
:00409551 5E                      pop esi
:00409552 5B                      pop ebx
:00409553 C9                      leave
:00409554 C20800                  ret 0008


:00409557 CC                      int 03
:00409558 CC                      int 03
:00409559 CC                      int 03
:0040955A CC                      int 03
:0040955B CC                      int 03
:0040955C CC                      int 03
:0040955D CC                      int 03
:0040955E CC                      int 03
:0040955F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040316E   , :00403452   , :00403490   , :004036D5   , :00403735   
|:004037B7   , :00404541   , :0040CE84   , :0040D178   , :004161D3   
|:004162CD   , :0041E637   
|
:00409560 55                      push ebp
:00409561 8BEC                    mov ebp, esp
:00409563 83EC04                  sub esp, 00000004
:00409566 53                      push ebx
:00409567 56                      push esi
:00409568 57                      push edi
:00409569 894DFC                  mov dword ptr [ebp-04], ecx
:0040956C 8B45FC                  mov eax, dword ptr [ebp-04]
:0040956F E900000000              jmp 00409574

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040956F(U)
|
:00409574 5F                      pop edi
:00409575 5E                      pop esi
:00409576 5B                      pop ebx
:00409577 C9                      leave
:00409578 C3                      ret


:00409579 CC                      int 03
:0040957A CC                      int 03
:0040957B CC                      int 03
:0040957C CC                      int 03
:0040957D CC                      int 03
:0040957E CC                      int 03
:0040957F CC                      int 03

* Referenced by a CALL at Addresses:
|:004032E0   , :00403307   , :00403F98   , :00404189   , :0040508A   
|:004056E1   , :00405871   , :00405AAB   , :00405C3B   , :00405E84   
|:0040600A   , :0040626A   , :004063FA   , :004065F2   , :004067E5   
|:00406D25   , :00406E95   , :00407009   , :0040717D   , :00407374   
|:004074BA   , :004076C4   , :0040780A   , :004079B1   , :00407B31   
|:00407D08   , :00407ED5   , :004084D0   , :00423B46   , :00423DD1   
|:00429580   , :00429984   , :0042AAB0   , :0042BE79   , :0042BE96   
|:0042C92E   , :0042CCC5   , :00439FA5   , :0043AEBF   , :0043AF07   
|:0043CC61   , :0043CCF1   , :00441B01   
|
:00409580 55                      push ebp
:00409581 8BEC                    mov ebp, esp
:00409583 83EC04                  sub esp, 00000004
:00409586 53                      push ebx
:00409587 56                      push esi
:00409588 57                      push edi
:00409589 894DFC                  mov dword ptr [ebp-04], ecx
:0040958C 8B45FC                  mov eax, dword ptr [ebp-04]
:0040958F 8B00                    mov eax, dword ptr [eax]
:00409591 8D0440                  lea eax, dword ptr [eax+2*eax]
:00409594 03C0                    add eax, eax
:00409596 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:0040959D E83EFFFFFF              call 004094E0
:004095A2 E900000000              jmp 004095A7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004095A2(U)
|
:004095A7 5F                      pop edi
:004095A8 5E                      pop esi
:004095A9 5B                      pop ebx
:004095AA C9                      leave
:004095AB C3                      ret


:004095AC CC                      int 03
:004095AD CC                      int 03
:004095AE CC                      int 03
:004095AF CC                      int 03

* Referenced by a CALL at Addresses:
|:00403F3F   , :004084FD   , :0042B1A4   , :00431E5E   , :0044170E   
|:0044175A   , :004417BC   , :00441808   , :00441B2E   
|
:004095B0 55                      push ebp
:004095B1 8BEC                    mov ebp, esp
:004095B3 83EC04                  sub esp, 00000004
:004095B6 53                      push ebx
:004095B7 56                      push esi
:004095B8 57                      push edi
:004095B9 894DFC                  mov dword ptr [ebp-04], ecx
:004095BC 8A4508                  mov al, byte ptr [ebp+08]
:004095BF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004095C2 884124                  mov byte ptr [ecx+24], al
:004095C5 E900000000              jmp 004095CA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004095C5(U)
|
:004095CA 5F                      pop edi
:004095CB 5E                      pop esi
:004095CC 5B                      pop ebx
:004095CD C9                      leave
:004095CE C20400                  ret 0004


:004095D1 CC                      int 03
:004095D2 CC                      int 03
:004095D3 CC                      int 03
:004095D4 CC                      int 03
:004095D5 CC                      int 03
:004095D6 CC                      int 03
:004095D7 CC                      int 03
:004095D8 CC                      int 03
:004095D9 CC                      int 03
:004095DA CC                      int 03
:004095DB CC                      int 03
:004095DC CC                      int 03
:004095DD CC                      int 03
:004095DE CC                      int 03
:004095DF CC                      int 03

* Referenced by a CALL at Addresses:
|:004042D0   , :0040543B   , :0040BED8   , :00423FAA   , :0044381C   
|
:004095E0 55                      push ebp
:004095E1 8BEC                    mov ebp, esp
:004095E3 83EC04                  sub esp, 00000004
:004095E6 53                      push ebx
:004095E7 56                      push esi
:004095E8 57                      push edi
:004095E9 894DFC                  mov dword ptr [ebp-04], ecx
:004095EC 8B45FC                  mov eax, dword ptr [ebp-04]
:004095EF 8A4026                  mov al, byte ptr [eax+26]
:004095F2 E900000000              jmp 004095F7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004095F2(U)
|
:004095F7 5F                      pop edi
:004095F8 5E                      pop esi
:004095F9 5B                      pop ebx
:004095FA C9                      leave
:004095FB C3                      ret


:004095FC CC                      int 03
:004095FD CC                      int 03
:004095FE CC                      int 03
:004095FF CC                      int 03

* Referenced by a CALL at Addresses:
|:00403A74   , :00403B0C   , :00403C04   , :0040409A   , :0040420B   
|:0040CB16   , :0042A7AB   , :0043606B   
|
:00409600 55                      push ebp
:00409601 8BEC                    mov ebp, esp
:00409603 83EC04                  sub esp, 00000004
:00409606 53                      push ebx
:00409607 56                      push esi
:00409608 57                      push edi
:00409609 894DFC                  mov dword ptr [ebp-04], ecx
:0040960C 8B45FC                  mov eax, dword ptr [ebp-04]
:0040960F 8A400F                  mov al, byte ptr [eax+0F]
:00409612 E900000000              jmp 00409617

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409612(U)
|
:00409617 5F                      pop edi
:00409618 5E                      pop esi
:00409619 5B                      pop ebx
:0040961A C9                      leave
:0040961B C3                      ret


:0040961C CC                      int 03
:0040961D CC                      int 03
:0040961E CC                      int 03
:0040961F CC                      int 03

* Referenced by a CALL at Addresses:
|:00403958   , :0040397B   , :0040399E   , :00403D08   , :00404041   
|:004041E8   , :0040C152   , :0040C269   , :0040C389   , :004161B9   
|:0042A784   
|
:00409620 55                      push ebp
:00409621 8BEC                    mov ebp, esp
:00409623 83EC04                  sub esp, 00000004
:00409626 53                      push ebx
:00409627 56                      push esi
:00409628 57                      push edi
:00409629 894DFC                  mov dword ptr [ebp-04], ecx
:0040962C 8B45FC                  mov eax, dword ptr [ebp-04]
:0040962F 8A400D                  mov al, byte ptr [eax+0D]
:00409632 E900000000              jmp 00409637

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409632(U)
|
:00409637 5F                      pop edi
:00409638 5E                      pop esi
:00409639 5B                      pop ebx
:0040963A C9                      leave
:0040963B C3                      ret


:0040963C CC                      int 03
:0040963D CC                      int 03
:0040963E CC                      int 03
:0040963F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040447A   , :00404493   , :004055C8   , :004055E1   , :004059A4   
|:004059BD   , :00405D6E   , :00405D87   , :00406136   , :0040614F   
|:0040728D   , :004072B2   , :004075DD   , :00407602   , :00408228   
|:0041D99E   , :0041D9BD   , :0041D9DC   , :0041D9FB   
|
:00409640 55                      push ebp
:00409641 8BEC                    mov ebp, esp
:00409643 83EC04                  sub esp, 00000004
:00409646 53                      push ebx
:00409647 56                      push esi
:00409648 57                      push edi
:00409649 894DFC                  mov dword ptr [ebp-04], ecx
:0040964C 8A4508                  mov al, byte ptr [ebp+08]
:0040964F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00409652 884149                  mov byte ptr [ecx+49], al
:00409655 E900000000              jmp 0040965A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409655(U)
|
:0040965A 5F                      pop edi
:0040965B 5E                      pop esi
:0040965C 5B                      pop ebx
:0040965D C9                      leave
:0040965E C20400                  ret 0004


:00409661 CC                      int 03
:00409662 CC                      int 03
:00409663 CC                      int 03
:00409664 CC                      int 03
:00409665 CC                      int 03
:00409666 CC                      int 03
:00409667 CC                      int 03
:00409668 CC                      int 03
:00409669 CC                      int 03
:0040966A CC                      int 03
:0040966B CC                      int 03
:0040966C CC                      int 03
:0040966D CC                      int 03
:0040966E CC                      int 03
:0040966F CC                      int 03

* Referenced by a CALL at Addresses:
|:004048E7   , :00411D56   , :00411EBE   , :00414A7E   , :004155DD   
|:004224FE   , :0042350D   , :0042369B   , :0042823A   , :00428386   
|:004297FD   , :0042B43B   , :0042B5FE   , :0042E1AB   , :00434120   
|:00437283   , :004372B2   , :0043F40D   , :0044031F   , :004403BA   
|:00443AC7   
|
:00409670 55                      push ebp
:00409671 8BEC                    mov ebp, esp
:00409673 83EC04                  sub esp, 00000004
:00409676 53                      push ebx
:00409677 56                      push esi
:00409678 57                      push edi
:00409679 894DFC                  mov dword ptr [ebp-04], ecx
:0040967C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040967F E86CFDFFFF              call 004093F0
:00409684 E900000000              jmp 00409689

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409684(U)
|
:00409689 8B45FC                  mov eax, dword ptr [ebp-04]
:0040968C 5F                      pop edi
:0040968D 5E                      pop esi
:0040968E 5B                      pop ebx
:0040968F C9                      leave
:00409690 C3                      ret


:00409691 CC                      int 03
:00409692 CC                      int 03
:00409693 CC                      int 03
:00409694 CC                      int 03
:00409695 CC                      int 03
:00409696 CC                      int 03
:00409697 CC                      int 03
:00409698 CC                      int 03
:00409699 CC                      int 03
:0040969A CC                      int 03
:0040969B CC                      int 03
:0040969C CC                      int 03
:0040969D CC                      int 03
:0040969E CC                      int 03
:0040969F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040570A   , :004058BE   , :0040739D   , :00407507   , :00428ACD   
|:0042AF7E   
|
:004096A0 55                      push ebp
:004096A1 8BEC                    mov ebp, esp
:004096A3 83EC04                  sub esp, 00000004
:004096A6 53                      push ebx
:004096A7 56                      push esi
:004096A8 57                      push edi
:004096A9 894DFC                  mov dword ptr [ebp-04], ecx
:004096AC 8A4508                  mov al, byte ptr [ebp+08]
:004096AF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004096B2 884114                  mov byte ptr [ecx+14], al
:004096B5 E900000000              jmp 004096BA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004096B5(U)
|
:004096BA 5F                      pop edi
:004096BB 5E                      pop esi
:004096BC 5B                      pop ebx
:004096BD C9                      leave
:004096BE C20400                  ret 0004


:004096C1 CC                      int 03
:004096C2 CC                      int 03
:004096C3 CC                      int 03
:004096C4 CC                      int 03
:004096C5 CC                      int 03
:004096C6 CC                      int 03
:004096C7 CC                      int 03
:004096C8 CC                      int 03
:004096C9 CC                      int 03
:004096CA CC                      int 03
:004096CB CC                      int 03
:004096CC CC                      int 03
:004096CD CC                      int 03
:004096CE CC                      int 03
:004096CF CC                      int 03

* Referenced by a CALL at Addresses:
|:0040563E   , :004056F9   , :004057F1   , :0040589B   , :0040731A   
|:0040738C   , :00407474   , :004074E4   , :0041A899   , :0041C353   
|:0041C96E   , :004299D2   , :0042AF6E   , :0043F15A   
|
:004096D0 55                      push ebp
:004096D1 8BEC                    mov ebp, esp
:004096D3 83EC04                  sub esp, 00000004
:004096D6 53                      push ebx
:004096D7 56                      push esi
:004096D8 57                      push edi
:004096D9 894DFC                  mov dword ptr [ebp-04], ecx
:004096DC 8B45FC                  mov eax, dword ptr [ebp-04]
:004096DF 33C9                    xor ecx, ecx
:004096E1 8A4814                  mov cl, byte ptr [eax+14]
:004096E4 80E1BF                  and cl, BF
:004096E7 8AC1                    mov al, cl
:004096E9 E900000000              jmp 004096EE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004096E9(U)
|
:004096EE 5F                      pop edi
:004096EF 5E                      pop esi
:004096F0 5B                      pop ebx
:004096F1 C9                      leave
:004096F2 C3                      ret


:004096F3 CC                      int 03
:004096F4 CC                      int 03
:004096F5 CC                      int 03
:004096F6 CC                      int 03
:004096F7 CC                      int 03
:004096F8 CC                      int 03
:004096F9 CC                      int 03
:004096FA CC                      int 03
:004096FB CC                      int 03
:004096FC CC                      int 03
:004096FD CC                      int 03
:004096FE CC                      int 03
:004096FF CC                      int 03

* Referenced by a CALL at Addresses:
|:00405AD4   , :00405C88   , :004076ED   , :00407857   , :00428AF5   
|:0042B00D   
|
:00409700 55                      push ebp
:00409701 8BEC                    mov ebp, esp
:00409703 83EC04                  sub esp, 00000004
:00409706 53                      push ebx
:00409707 56                      push esi
:00409708 57                      push edi
:00409709 894DFC                  mov dword ptr [ebp-04], ecx
:0040970C 8A4508                  mov al, byte ptr [ebp+08]
:0040970F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00409712 884115                  mov byte ptr [ecx+15], al
:00409715 E900000000              jmp 0040971A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409715(U)
|
:0040971A 5F                      pop edi
:0040971B 5E                      pop esi
:0040971C 5B                      pop ebx
:0040971D C9                      leave
:0040971E C20400                  ret 0004


:00409721 CC                      int 03
:00409722 CC                      int 03
:00409723 CC                      int 03
:00409724 CC                      int 03
:00409725 CC                      int 03
:00409726 CC                      int 03
:00409727 CC                      int 03
:00409728 CC                      int 03
:00409729 CC                      int 03
:0040972A CC                      int 03
:0040972B CC                      int 03
:0040972C CC                      int 03
:0040972D CC                      int 03
:0040972E CC                      int 03
:0040972F CC                      int 03

* Referenced by a CALL at Addresses:
|:00405A1A   , :00405AC3   , :00405BBB   , :00405C65   , :0040765B   
|:004076DC   , :004077C4   , :00407834   , :0041A8CA   , :0041C400   
|:0041C94C   , :00429A0D   , :0042AFFD   , :0043F1CE   
|
:00409730 55                      push ebp
:00409731 8BEC                    mov ebp, esp
:00409733 83EC04                  sub esp, 00000004
:00409736 53                      push ebx
:00409737 56                      push esi
:00409738 57                      push edi
:00409739 894DFC                  mov dword ptr [ebp-04], ecx
:0040973C 8B45FC                  mov eax, dword ptr [ebp-04]
:0040973F 33C9                    xor ecx, ecx
:00409741 8A4815                  mov cl, byte ptr [eax+15]
:00409744 80E1BF                  and cl, BF
:00409747 8AC1                    mov al, cl
:00409749 E900000000              jmp 0040974E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409749(U)
|
:0040974E 5F                      pop edi
:0040974F 5E                      pop esi
:00409750 5B                      pop ebx
:00409751 C9                      leave
:00409752 C3                      ret


:00409753 CC                      int 03
:00409754 CC                      int 03
:00409755 CC                      int 03
:00409756 CC                      int 03
:00409757 CC                      int 03
:00409758 CC                      int 03
:00409759 CC                      int 03
:0040975A CC                      int 03
:0040975B CC                      int 03
:0040975C CC                      int 03
:0040975D CC                      int 03
:0040975E CC                      int 03
:0040975F CC                      int 03

* Referenced by a CALL at Addresses:
|:00405E9E   , :00406036   , :00406296   , :00406426   , :0040661E   
|:00406811   , :004079CB   , :00407D22   , :00428880   , :00428C13   
|
:00409760 55                      push ebp
:00409761 8BEC                    mov ebp, esp
:00409763 83EC04                  sub esp, 00000004
:00409766 53                      push ebx
:00409767 56                      push esi
:00409768 57                      push edi
:00409769 894DFC                  mov dword ptr [ebp-04], ecx
:0040976C 8B45FC                  mov eax, dword ptr [ebp-04]
:0040976F 33C9                    xor ecx, ecx
:00409771 8A4816                  mov cl, byte ptr [eax+16]
:00409774 0A4D08                  or cl, byte ptr [ebp+08]
:00409777 8B45FC                  mov eax, dword ptr [ebp-04]
:0040977A 884816                  mov byte ptr [eax+16], cl
:0040977D E900000000              jmp 00409782

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040977D(U)
|
:00409782 5F                      pop edi
:00409783 5E                      pop esi
:00409784 5B                      pop ebx
:00409785 C9                      leave
:00409786 C20400                  ret 0004


:00409789 CC                      int 03
:0040978A CC                      int 03
:0040978B CC                      int 03
:0040978C CC                      int 03
:0040978D CC                      int 03
:0040978E CC                      int 03
:0040978F CC                      int 03

* Referenced by a CALL at Addresses:
|:00406A3D   , :00408A32   , :00408B6A   , :00408C21   , :00408C5A   
|:00408C73   , :00408F4F   , :0040BEA0   , :0040C096   , :004106F7   
|:00410955   , :004109D1   , :00419EF4   , :00419F0D   , :0041A4D5   
|:0041A545   , :0041A84E   , :0041C4D0   , :0041C709   , :0041CED5   
|:0041CF08   , :0041CF1F   , :0041CF35   , :0041CF52   , :0041CF80   
|:0042A405   , :0042A727   , :0042A7B7   , :0042A7F3   , :0042A807   
|:0042B219   , :0042B39D   , :0042C1E5   , :00433ED6   , :0043A2B3   
|:0043A2C3   , :00440FE8   , :0044332E   , :00443382   
|
:00409790 55                      push ebp
:00409791 8BEC                    mov ebp, esp
:00409793 83EC04                  sub esp, 00000004
:00409796 53                      push ebx
:00409797 56                      push esi
:00409798 57                      push edi
:00409799 894DFC                  mov dword ptr [ebp-04], ecx
:0040979C 8B45FC                  mov eax, dword ptr [ebp-04]
:0040979F 8B401E                  mov eax, dword ptr [eax+1E]
:004097A2 E900000000              jmp 004097A7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004097A2(U)
|
:004097A7 5F                      pop edi
:004097A8 5E                      pop esi
:004097A9 5B                      pop ebx
:004097AA C9                      leave
:004097AB C3                      ret


:004097AC CC                      int 03
:004097AD CC                      int 03
:004097AE CC                      int 03
:004097AF CC                      int 03

* Referenced by a CALL at Addresses:
|:00406A33   , :00408F6D   , :0041A498   , :0041A524   , :0041A86C   
|:0041C264   , :0041C4BB   , :00424121   , :004249E7   , :004287B9   
|:00428B14   , :00428B48   , :00428B65   , :00428B8B   , :0043A08D   
|:0043A1B6   , :0043A2A6   , :0043A2E5   , :0043A30C   , :0043A331   
|:0043CA27   , :0043F76B   , :00440ACE   , :00443351   , :004433AB   
|:004433C6   
|
:004097B0 55                      push ebp
:004097B1 8BEC                    mov ebp, esp
:004097B3 83EC04                  sub esp, 00000004
:004097B6 53                      push ebx
:004097B7 56                      push esi
:004097B8 57                      push edi
:004097B9 894DFC                  mov dword ptr [ebp-04], ecx
:004097BC 8B45FC                  mov eax, dword ptr [ebp-04]
:004097BF 8B400F                  mov eax, dword ptr [eax+0F]
:004097C2 E900000000              jmp 004097C7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004097C2(U)
|
:004097C7 5F                      pop edi
:004097C8 5E                      pop esi
:004097C9 5B                      pop ebx
:004097CA C9                      leave
:004097CB C3                      ret


:004097CC CC                      int 03
:004097CD CC                      int 03
:004097CE CC                      int 03
:004097CF CC                      int 03

* Referenced by a CALL at Addresses:
|:00406D3F   , :00406EAF   , :00407023   , :00407197   , :00428BEB   
|:0042B08E   , :00440B41   
|
:004097D0 55                      push ebp
:004097D1 8BEC                    mov ebp, esp
:004097D3 83EC04                  sub esp, 00000004
:004097D6 53                      push ebx
:004097D7 56                      push esi
:004097D8 57                      push edi
:004097D9 894DFC                  mov dword ptr [ebp-04], ecx
:004097DC 8B45FC                  mov eax, dword ptr [ebp-04]
:004097DF 33C9                    xor ecx, ecx
:004097E1 8A4816                  mov cl, byte ptr [eax+16]
:004097E4 33C0                    xor eax, eax
:004097E6 8A4508                  mov al, byte ptr [ebp+08]
:004097E9 F7D0                    not eax
:004097EB 23C8                    and ecx, eax
:004097ED 8B45FC                  mov eax, dword ptr [ebp-04]
:004097F0 884816                  mov byte ptr [eax+16], cl
:004097F3 E900000000              jmp 004097F8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004097F3(U)
|
:004097F8 5F                      pop edi
:004097F9 5E                      pop esi
:004097FA 5B                      pop ebx
:004097FB C9                      leave
:004097FC C20400                  ret 0004


:004097FF CC                      int 03

* Referenced by a CALL at Addresses:
|:004072A6   , :004072DC   , :004075F6   , :0040762C   
|
:00409800 55                      push ebp
:00409801 8BEC                    mov ebp, esp
:00409803 83EC04                  sub esp, 00000004
:00409806 53                      push ebx
:00409807 56                      push esi
:00409808 57                      push edi
:00409809 894DFC                  mov dword ptr [ebp-04], ecx
:0040980C 8B4508                  mov eax, dword ptr [ebp+08]
:0040980F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00409812 89414A                  mov dword ptr [ecx+4A], eax
:00409815 E900000000              jmp 0040981A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409815(U)
|
:0040981A 5F                      pop edi
:0040981B 5E                      pop esi
:0040981C 5B                      pop ebx
:0040981D C9                      leave
:0040981E C20400                  ret 0004


:00409821 CC                      int 03
:00409822 CC                      int 03
:00409823 CC                      int 03
:00409824 CC                      int 03
:00409825 CC                      int 03
:00409826 CC                      int 03
:00409827 CC                      int 03
:00409828 CC                      int 03
:00409829 CC                      int 03
:0040982A CC                      int 03
:0040982B CC                      int 03
:0040982C CC                      int 03
:0040982D CC                      int 03
:0040982E CC                      int 03
:0040982F CC                      int 03

* Referenced by a CALL at Addresses:
|:00408A1D   , :00419775   , :00419FE9   , :0041A1A8   , :0041B778   
|:0041B79E   , :0041CE97   , :00427952   , :00427A9A   , :00427D67   
|:0042854D   , :004285A4   , :004285DF   , :00428787   , :0042898B   
|:00428A6B   , :00428D04   , :0042A6D6   , :0042AF3F   , :0042B97C   
|:0042B9EE   , :0042BA73   , :0042BECE   , :0042C502   , :0042CC81   
|:0043BA4A   , :0043C121   , :0043C1A2   , :0043C215   , :0043C359   
|:0043C98D   , :0043CC2B   , :0043DAFE   , :0043E4D2   , :00440A99   
|:004414BE   , :0044154E   , :00441617   , :004416A4   , :004424CD   
|:00442C0E   , :00442E0D   , :004431E4   , :004435FB   , :004437BD   
|:004439A0   
|
:00409830 55                      push ebp
:00409831 8BEC                    mov ebp, esp
:00409833 83EC04                  sub esp, 00000004
:00409836 53                      push ebx
:00409837 56                      push esi
:00409838 57                      push edi
:00409839 894DFC                  mov dword ptr [ebp-04], ecx
:0040983C 8B45FC                  mov eax, dword ptr [ebp-04]
:0040983F 8A400B                  mov al, byte ptr [eax+0B]
:00409842 E900000000              jmp 00409847

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409842(U)
|
:00409847 5F                      pop edi
:00409848 5E                      pop esi
:00409849 5B                      pop ebx
:0040984A C9                      leave
:0040984B C3                      ret


:0040984C CC                      int 03
:0040984D CC                      int 03
:0040984E CC                      int 03
:0040984F CC                      int 03

* Referenced by a CALL at Addresses:
|:00408E91   , :00409018   , :00409066   , :00409086   , :0041DC27   
|:0041DF42   , :0043CF8B   , :0043D25A   
|
:00409850 55                      push ebp
:00409851 8BEC                    mov ebp, esp
:00409853 83EC04                  sub esp, 00000004
:00409856 53                      push ebx
:00409857 56                      push esi
:00409858 57                      push edi
:00409859 894DFC                  mov dword ptr [ebp-04], ecx
:0040985C 8B4508                  mov eax, dword ptr [ebp+08]
:0040985F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00409862 894128                  mov dword ptr [ecx+28], eax
:00409865 8B45FC                  mov eax, dword ptr [ebp-04]
:00409868 8B400C                  mov eax, dword ptr [eax+0C]
:0040986B 99                      cdq
:0040986C 83E20F                  and edx, 0000000F
:0040986F 03C2                    add eax, edx
:00409871 C1F804                  sar eax, 04
:00409874 50                      push eax
:00409875 8B45FC                  mov eax, dword ptr [ebp-04]
:00409878 8B4008                  mov eax, dword ptr [eax+08]
:0040987B 99                      cdq
:0040987C 83E20F                  and edx, 0000000F
:0040987F 03C2                    add eax, edx
:00409881 C1F804                  sar eax, 04
:00409884 50                      push eax
:00409885 6A00                    push 00000000
:00409887 6A00                    push 00000000
:00409889 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040988C E8B4110300              call 0043AA45
:00409891 E900000000              jmp 00409896

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409891(U)
|
:00409896 5F                      pop edi
:00409897 5E                      pop esi
:00409898 5B                      pop ebx
:00409899 C9                      leave
:0040989A C20400                  ret 0004


:0040989D CC                      int 03
:0040989E CC                      int 03
:0040989F CC                      int 03

* Referenced by a CALL at Addresses:
|:00408E9B   , :00409022   , :00409070   , :00409090   , :0041B6DE   
|:0041DA84   , :0041DC31   , :0041DF4C   , :0043ACF7   , :0043ADE1   
|:0043B097   , :0043CF93   , :0043D26A   , :0043E47F   , :00440A35   
|:00442D8F   
|
:004098A0 55                      push ebp
:004098A1 8BEC                    mov ebp, esp
:004098A3 83EC04                  sub esp, 00000004
:004098A6 53                      push ebx
:004098A7 56                      push esi
:004098A8 57                      push edi
:004098A9 894DFC                  mov dword ptr [ebp-04], ecx
:004098AC 8B45FC                  mov eax, dword ptr [ebp-04]
:004098AF 8B400C                  mov eax, dword ptr [eax+0C]
:004098B2 99                      cdq
:004098B3 83E20F                  and edx, 0000000F
:004098B6 03C2                    add eax, edx
:004098B8 C1F804                  sar eax, 04
:004098BB 50                      push eax
:004098BC 8B45FC                  mov eax, dword ptr [ebp-04]
:004098BF 8B4008                  mov eax, dword ptr [eax+08]
:004098C2 99                      cdq
:004098C3 83E20F                  and edx, 0000000F
:004098C6 03C2                    add eax, edx
:004098C8 C1F804                  sar eax, 04
:004098CB 50                      push eax
:004098CC 6A00                    push 00000000
:004098CE 6A00                    push 00000000
:004098D0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004098D3 E8363B0300              call 0043D40E
:004098D8 E900000000              jmp 004098DD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004098D8(U)
|
:004098DD 5F                      pop edi
:004098DE 5E                      pop esi
:004098DF 5B                      pop ebx
:004098E0 C9                      leave
:004098E1 C3                      ret


:004098E2 CC                      int 03
:004098E3 CC                      int 03
:004098E4 CC                      int 03
:004098E5 CC                      int 03
:004098E6 CC                      int 03
:004098E7 CC                      int 03
:004098E8 CC                      int 03
:004098E9 CC                      int 03
:004098EA CC                      int 03
:004098EB CC                      int 03
:004098EC CC                      int 03
:004098ED CC                      int 03
:004098EE CC                      int 03
:004098EF CC                      int 03
:004098F0 55                      push ebp
:004098F1 8BEC                    mov ebp, esp
:004098F3 53                      push ebx
:004098F4 56                      push esi
:004098F5 57                      push edi
:004098F6 E80A000000              call 00409905
:004098FB E900000000              jmp 00409900

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004098FB(U)
|
:00409900 5F                      pop edi
:00409901 5E                      pop esi
:00409902 5B                      pop ebx
:00409903 C9                      leave
:00409904 C3                      ret



* Referenced by a CALL at Address:
|:004098F6   
|
:00409905 55                      push ebp
:00409906 8BEC                    mov ebp, esp
:00409908 53                      push ebx
:00409909 56                      push esi
:0040990A 57                      push edi
:0040990B B9D8564500              mov ecx, 004556D8
:00409910 E8DBFAFFFF              call 004093F0
:00409915 E900000000              jmp 0040991A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409915(U)
|
:0040991A 5F                      pop edi
:0040991B 5E                      pop esi
:0040991C 5B                      pop ebx
:0040991D C9                      leave
:0040991E C3                      ret



* Referenced by a CALL at Addresses:
|:0040AF15   , :0040B124   , :0040B415   
|
:0040991F 55                      push ebp
:00409920 8BEC                    mov ebp, esp
:00409922 81EC00010000            sub esp, 00000100
:00409928 53                      push ebx
:00409929 56                      push esi
:0040992A 57                      push edi

* Possible StringData Ref from Data Obj ->"C:SAVE00.E2S"
                                  |
:0040992B B8D4E94400              mov eax, 0044E9D4
:00409930 8D8D00FFFFFF            lea ecx, dword ptr [ebp+FFFFFF00]
:00409936 8B10                    mov edx, dword ptr [eax]
:00409938 8911                    mov dword ptr [ecx], edx
:0040993A 8B5004                  mov edx, dword ptr [eax+04]
:0040993D 895104                  mov dword ptr [ecx+04], edx
:00409940 8B5008                  mov edx, dword ptr [eax+08]
:00409943 895108                  mov dword ptr [ecx+08], edx
:00409946 8A400C                  mov al, byte ptr [eax+0C]
:00409949 88410C                  mov byte ptr [ecx+0C], al
:0040994C 8DBD0DFFFFFF            lea edi, dword ptr [ebp+FFFFFF0D]
:00409952 33C0                    xor eax, eax
:00409954 B93C000000              mov ecx, 0000003C
:00409959 F3                      repz
:0040995A AB                      stosd
:0040995B 66AB                    stosw
:0040995D AA                      stosb
:0040995E B90A000000              mov ecx, 0000000A
:00409963 8B450C                  mov eax, dword ptr [ebp+0C]
:00409966 2BD2                    sub edx, edx
:00409968 F7F1                    div ecx
:0040996A 83C030                  add eax, 00000030
:0040996D 888506FFFFFF            mov byte ptr [ebp+FFFFFF06], al
:00409973 B90A000000              mov ecx, 0000000A
:00409978 8B450C                  mov eax, dword ptr [ebp+0C]
:0040997B 2BD2                    sub edx, edx
:0040997D F7F1                    div ecx
:0040997F 8D4230                  lea eax, dword ptr [edx+30]
:00409982 888507FFFFFF            mov byte ptr [ebp+FFFFFF07], al
:00409988 8D8500FFFFFF            lea eax, dword ptr [ebp+FFFFFF00]
:0040998E 50                      push eax
:0040998F 8B4508                  mov eax, dword ptr [ebp+08]
:00409992 50                      push eax
:00409993 E835DA0300              call 004473CD
:00409998 83C408                  add esp, 00000008
:0040999B E900000000              jmp 004099A0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040999B(U)
|
:004099A0 5F                      pop edi
:004099A1 5E                      pop esi
:004099A2 5B                      pop ebx
:004099A3 C9                      leave
:004099A4 C3                      ret



* Referenced by a CALL at Addresses:
|:0040A2C9   , :0040ADE2   , :0040AF94   
|
:004099A5 55                      push ebp
:004099A6 8BEC                    mov ebp, esp
:004099A8 83EC20                  sub esp, 00000020
:004099AB 53                      push ebx
:004099AC 56                      push esi
:004099AD 57                      push edi
:004099AE C745E400000000          mov [ebp-1C], 00000000
:004099B5 B9D0A64600              mov ecx, 0046A6D0
:004099BA E811200000              call 0040B9D0
:004099BF 8845EC                  mov byte ptr [ebp-14], al
:004099C2 B9D0A64600              mov ecx, 0046A6D0
:004099C7 E8E4200000              call 0040BAB0
:004099CC 8945E8                  mov dword ptr [ebp-18], eax
:004099CF B9D0A64600              mov ecx, 0046A6D0
:004099D4 E847200000              call 0040BA20
:004099D9 8945E4                  mov dword ptr [ebp-1C], eax
:004099DC C705982B4500FFFF0000    mov dword ptr [00452B98], 0000FFFF
:004099E6 A1DC564500              mov eax, dword ptr [004556DC]
:004099EB 83C023                  add eax, 00000023
:004099EE 50                      push eax
:004099EF B9D0A64600              mov ecx, 0046A6D0
:004099F4 E8E14C0100              call 0041E6DA
:004099F9 837D0800                cmp dword ptr [ebp+08], 00000000
:004099FD 0F850D010000            jne 00409B10
:00409A03 8B45E4                  mov eax, dword ptr [ebp-1C]
:00409A06 50                      push eax
:00409A07 B9D0A64600              mov ecx, 0046A6D0
:00409A0C E83F200000              call 0040BA50
:00409A11 8B45E8                  mov eax, dword ptr [ebp-18]
:00409A14 50                      push eax
:00409A15 B9D0A64600              mov ecx, 0046A6D0
:00409A1A E8C1200000              call 0040BAE0
:00409A1F 8B45E8                  mov eax, dword ptr [ebp-18]
:00409A22 8945E0                  mov dword ptr [ebp-20], eax
:00409A25 E940000000              jmp 00409A6A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409A6E(C)
|
:00409A2A 68B4000000              push 000000B4
:00409A2F B9D0A64600              mov ecx, 0046A6D0
:00409A34 E8671F0000              call 0040B9A0
:00409A39 E94F000000              jmp 00409A8D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409A78(C)
|
:00409A3E 6A64                    push 00000064
:00409A40 B9D0A64600              mov ecx, 0046A6D0
:00409A45 E8561F0000              call 0040B9A0
:00409A4A E93E000000              jmp 00409A8D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409A82(C)
|
:00409A4F 6A50                    push 00000050
:00409A51 B9D0A64600              mov ecx, 0046A6D0
:00409A56 E8451F0000              call 0040B9A0
:00409A5B E92D000000              jmp 00409A8D
:00409A60 E928000000              jmp 00409A8D
:00409A65 E923000000              jmp 00409A8D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409A25(U)
|
:00409A6A 837DE000                cmp dword ptr [ebp-20], 00000000
:00409A6E 0F84B6FFFFFF            je 00409A2A
:00409A74 837DE001                cmp dword ptr [ebp-20], 00000001
:00409A78 0F84C0FFFFFF            je 00409A3E
:00409A7E 837DE002                cmp dword ptr [ebp-20], 00000002
:00409A82 0F84C7FFFFFF            je 00409A4F
:00409A88 E900000000              jmp 00409A8D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00409A39(U), :00409A4A(U), :00409A5B(U), :00409A60(U), :00409A65(U)
|:00409A88(U)
|
:00409A8D 8B45EC                  mov eax, dword ptr [ebp-14]
:00409A90 50                      push eax
:00409A91 B9D0A64600              mov ecx, 0046A6D0
:00409A96 E8551F0000              call 0040B9F0
:00409A9B 6A02                    push 00000002
:00409A9D B9D0A64600              mov ecx, 0046A6D0
:00409AA2 E869200000              call 0040BB10
:00409AA7 B9D0A64600              mov ecx, 0046A6D0
:00409AAC E8CFF6FFFF              call 00409180
:00409AB1 83E0F2                  and eax, FFFFFFF2
:00409AB4 83C802                  or eax, 00000002
:00409AB7 50                      push eax
:00409AB8 B9D0A64600              mov ecx, 0046A6D0
:00409ABD E8BE1F0000              call 0040BA80
:00409AC2 B9D0A64600              mov ecx, 0046A6D0
:00409AC7 E8B4F6FFFF              call 00409180
:00409ACC 250FFFFFFF              and eax, FFFFFF0F
:00409AD1 50                      push eax
:00409AD2 B9D0A64600              mov ecx, 0046A6D0
:00409AD7 E8A41F0000              call 0040BA80
:00409ADC B9D0A64600              mov ecx, 0046A6D0
:00409AE1 E89AF6FFFF              call 00409180
:00409AE6 0D00010000              or eax, 00000100
:00409AEB 50                      push eax
:00409AEC B9D0A64600              mov ecx, 0046A6D0
:00409AF1 E88A1F0000              call 0040BA80
:00409AF6 B9D0A64600              mov ecx, 0046A6D0
:00409AFB E880F6FFFF              call 00409180
:00409B00 0D00100000              or eax, 00001000
:00409B05 50                      push eax
:00409B06 B9D0A64600              mov ecx, 0046A6D0
:00409B0B E8701F0000              call 0040BA80

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004099FD(C)
|
:00409B10 A1DC564500              mov eax, dword ptr [004556DC]
:00409B15 83C04E                  add eax, 0000004E
:00409B18 8945FC                  mov dword ptr [ebp-04], eax
:00409B1B C745F400AA4600          mov [ebp-0C], 0046AA00
:00409B22 C745F000000000          mov [ebp-10], 00000000
:00409B29 E907000000              jmp 00409B35

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409B4F(U)
|
:00409B2E FF45F0                  inc [ebp-10]
:00409B31 8345F40A                add dword ptr [ebp-0C], 0000000A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409B29(U)
|
:00409B35 837DF002                cmp dword ptr [ebp-10], 00000002
:00409B39 0F8315000000            jnb 00409B54
:00409B3F 8B45FC                  mov eax, dword ptr [ebp-04]
:00409B42 50                      push eax
:00409B43 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00409B46 E8D3510100              call 0041ED1E
:00409B4B 8345FC09                add dword ptr [ebp-04], 00000009
:00409B4F E9DAFFFFFF              jmp 00409B2E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409B39(C)
|
:00409B54 837D0800                cmp dword ptr [ebp+08], 00000000
:00409B58 0F843C000000            je 00409B9A
:00409B5E C745F8D8D54500          mov [ebp-08], 0045D5D8
:00409B65 C745F000000000          mov [ebp-10], 00000000
:00409B6C E90B000000              jmp 00409B7C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409B95(U)
|
:00409B71 FF45F0                  inc [ebp-10]
:00409B74 8345F83E                add dword ptr [ebp-08], 0000003E
:00409B78 8345FC24                add dword ptr [ebp-04], 00000024

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409B6C(U)
|
:00409B7C 817DF080000000          cmp dword ptr [ebp-10], 00000080
:00409B83 0F8311000000            jnb 00409B9A
:00409B89 8B45FC                  mov eax, dword ptr [ebp-04]
:00409B8C 50                      push eax
:00409B8D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00409B90 E801D60000              call 00417196
:00409B95 E9D7FFFFFF              jmp 00409B71

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00409B58(C), :00409B83(C)
|
:00409B9A E900000000              jmp 00409B9F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409B9A(U)
|
:00409B9F 5F                      pop edi
:00409BA0 5E                      pop esi
:00409BA1 5B                      pop ebx
:00409BA2 C9                      leave
:00409BA3 C3                      ret



* Referenced by a CALL at Addresses:
|:0040A31A   , :0040AE04   , :0040AFE9   
|
:00409BA4 55                      push ebp
:00409BA5 8BEC                    mov ebp, esp
:00409BA7 83EC0C                  sub esp, 0000000C
:00409BAA 53                      push ebx
:00409BAB 56                      push esi
:00409BAC 57                      push edi
:00409BAD C745FCE8C24500          mov [ebp-04], 0045C2E8
:00409BB4 A1DC564500              mov eax, dword ptr [004556DC]
:00409BB9 8945F4                  mov dword ptr [ebp-0C], eax
:00409BBC C745F800000000          mov [ebp-08], 00000000
:00409BC3 E90B000000              jmp 00409BD3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409BF0(U)
|
:00409BC8 FF45F8                  inc [ebp-08]
:00409BCB 8345FC10                add dword ptr [ebp-04], 00000010
:00409BCF 8345F409                add dword ptr [ebp-0C], 00000009

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409BC3(U)
|
:00409BD3 817DF800010000          cmp dword ptr [ebp-08], 00000100
:00409BDA 0F8315000000            jnb 00409BF5
:00409BE0 8B45F4                  mov eax, dword ptr [ebp-0C]
:00409BE3 50                      push eax
:00409BE4 8B45F8                  mov eax, dword ptr [ebp-08]
:00409BE7 50                      push eax
:00409BE8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00409BEB E8673F0000              call 0040DB57
:00409BF0 E9D3FFFFFF              jmp 00409BC8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409BDA(C)
|
:00409BF5 E900000000              jmp 00409BFA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409BF5(U)
|
:00409BFA 5F                      pop edi
:00409BFB 5E                      pop esi
:00409BFC 5B                      pop ebx
:00409BFD C9                      leave
:00409BFE C3                      ret



* Referenced by a CALL at Addresses:
|:0040A35A   , :0040AE1D   , :0040B029   
|
:00409BFF 55                      push ebp
:00409C00 8BEC                    mov ebp, esp
:00409C02 83EC0C                  sub esp, 0000000C
:00409C05 53                      push ebx
:00409C06 56                      push esi
:00409C07 57                      push edi
:00409C08 A1DC564500              mov eax, dword ptr [004556DC]
:00409C0D 8945F4                  mov dword ptr [ebp-0C], eax
:00409C10 A1DC564500              mov eax, dword ptr [004556DC]
:00409C15 0500220000              add eax, 00002200
:00409C1A 8945F8                  mov dword ptr [ebp-08], eax
:00409C1D C745FC00000000          mov [ebp-04], 00000000
:00409C24 E90B000000              jmp 00409C34

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409C61(U)
|
:00409C29 FF45FC                  inc [ebp-04]
:00409C2C 8345F411                add dword ptr [ebp-0C], 00000011
:00409C30 8345F81A                add dword ptr [ebp-08], 0000001A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409C24(U)
|
:00409C34 817DFC00020000          cmp dword ptr [ebp-04], 00000200
:00409C3B 0F8325000000            jnb 00409C66
:00409C41 8B45F8                  mov eax, dword ptr [ebp-08]
:00409C44 50                      push eax
:00409C45 8B45F4                  mov eax, dword ptr [ebp-0C]
:00409C48 50                      push eax
:00409C49 8B45FC                  mov eax, dword ptr [ebp-04]
:00409C4C 50                      push eax
:00409C4D 8B45FC                  mov eax, dword ptr [ebp-04]
:00409C50 8D0440                  lea eax, dword ptr [eax+2*eax]
:00409C53 03C0                    add eax, eax
:00409C55 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:00409C5C E8293B0000              call 0040D78A
:00409C61 E9C3FFFFFF              jmp 00409C29

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409C3B(C)
|
:00409C66 E900000000              jmp 00409C6B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409C66(U)
|
:00409C6B 5F                      pop edi
:00409C6C 5E                      pop esi
:00409C6D 5B                      pop ebx
:00409C6E C9                      leave
:00409C6F C3                      ret



* Referenced by a CALL at Addresses:
|:0040A324   , :0040AE0E   , :0040AFF3   
|
:00409C70 55                      push ebp
:00409C71 8BEC                    mov ebp, esp
:00409C73 83EC0C                  sub esp, 0000000C
:00409C76 53                      push ebx
:00409C77 56                      push esi
:00409C78 57                      push edi
:00409C79 C745FC18AA4600          mov [ebp-04], 0046AA18
:00409C80 A1DC564500              mov eax, dword ptr [004556DC]
:00409C85 8945F4                  mov dword ptr [ebp-0C], eax
:00409C88 C645F800                mov [ebp-08], 00
:00409C8C E90B000000              jmp 00409C9C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409CB8(U)
|
:00409C91 FE45F8                  inc [ebp-08]
:00409C94 8345FC11                add dword ptr [ebp-04], 00000011
:00409C98 8345F410                add dword ptr [ebp-0C], 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409C8C(U)
|
:00409C9C 33C0                    xor eax, eax
:00409C9E 8A45F8                  mov al, byte ptr [ebp-08]
:00409CA1 3DFF000000              cmp eax, 000000FF
:00409CA6 0F8D11000000            jnl 00409CBD
:00409CAC 8B45F4                  mov eax, dword ptr [ebp-0C]
:00409CAF 50                      push eax
:00409CB0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00409CB3 E88F480100              call 0041E547
:00409CB8 E9D4FFFFFF              jmp 00409C91

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409CA6(C)
|
:00409CBD E900000000              jmp 00409CC2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409CBD(U)
|
:00409CC2 5F                      pop edi
:00409CC3 5E                      pop esi
:00409CC4 5B                      pop ebx
:00409CC5 C9                      leave
:00409CC6 C3                      ret



* Referenced by a CALL at Addresses:
|:00409D1E   , :0040AE2C   , :0040B816   
|
:00409CC7 55                      push ebp
:00409CC8 8BEC                    mov ebp, esp
:00409CCA 83EC04                  sub esp, 00000004
:00409CCD 53                      push ebx
:00409CCE 56                      push esi
:00409CCF 57                      push edi
:00409CD0 C745FC00000000          mov [ebp-04], 00000000
:00409CD7 E903000000              jmp 00409CDF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409CFF(U)
|
:00409CDC FF45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409CD7(U)
|
:00409CDF 837DFC40                cmp dword ptr [ebp-04], 00000040
:00409CE3 0F831B000000            jnb 00409D04
:00409CE9 8B45FC                  mov eax, dword ptr [ebp-04]
:00409CEC 50                      push eax
:00409CED 8B45FC                  mov eax, dword ptr [ebp-04]
:00409CF0 8D0440                  lea eax, dword ptr [eax+2*eax]
:00409CF3 8D0C8500A74600          lea ecx, dword ptr [4*eax+0046A700]
:00409CFA E8AE530100              call 0041F0AD
:00409CFF E9D8FFFFFF              jmp 00409CDC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409CE3(C)
|
:00409D04 E900000000              jmp 00409D09

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409D04(U)
|
:00409D09 5F                      pop edi
:00409D0A 5E                      pop esi
:00409D0B 5B                      pop ebx
:00409D0C C9                      leave
:00409D0D C3                      ret



* Referenced by a CALL at Addresses:
|:0040A378   , :0040B047   , :00430726   
|
:00409D0E 55                      push ebp
:00409D0F 8BEC                    mov ebp, esp
:00409D11 53                      push ebx
:00409D12 56                      push esi
:00409D13 57                      push edi
:00409D14 837D0806                cmp dword ptr [ebp+08], 00000006
:00409D18 0F8200000000            jb 00409D1E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409D18(C)
|
:00409D1E E8A4FFFFFF              call 00409CC7
:00409D23 33C0                    xor eax, eax
:00409D25 E900000000              jmp 00409D2A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409D25(U)
|
:00409D2A 5F                      pop edi
:00409D2B 5E                      pop esi
:00409D2C 5B                      pop ebx
:00409D2D C9                      leave
:00409D2E C3                      ret



* Referenced by a CALL at Address:
|:00431CE5   
|
:00409D2F 55                      push ebp
:00409D30 8BEC                    mov ebp, esp
:00409D32 83EC14                  sub esp, 00000014
:00409D35 53                      push ebx
:00409D36 56                      push esi
:00409D37 57                      push edi
:00409D38 8B4508                  mov eax, dword ptr [ebp+08]
:00409D3B 8945FC                  mov dword ptr [ebp-04], eax
:00409D3E 6A00                    push 00000000
:00409D40 B9B0C44600              mov ecx, 0046C4B0
:00409D45 E8F61D0000              call 0040BB40
:00409D4A 8945EC                  mov dword ptr [ebp-14], eax
:00409D4D C745F400000000          mov [ebp-0C], 00000000
:00409D54 E907000000              jmp 00409D60

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409D9D(U)
|
:00409D59 FF45F4                  inc [ebp-0C]
:00409D5C 8345EC17                add dword ptr [ebp-14], 00000017

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409D54(U)
|
:00409D60 837DF42D                cmp dword ptr [ebp-0C], 0000002D
:00409D64 0F8338000000            jnb 00409DA2
:00409D6A 8B45EC                  mov eax, dword ptr [ebp-14]
:00409D6D 8B00                    mov eax, dword ptr [eax]
:00409D6F 8945F0                  mov dword ptr [ebp-10], eax
:00409D72 817DF000040000          cmp dword ptr [ebp-10], 00000400
:00409D79 0F831E000000            jnb 00409D9D
:00409D7F 8B45F0                  mov eax, dword ptr [ebp-10]
:00409D82 50                      push eax
:00409D83 E851510100              call 0041EED9
:00409D88 83C404                  add esp, 00000004
:00409D8B 8945F8                  mov dword ptr [ebp-08], eax
:00409D8E 8B45FC                  mov eax, dword ptr [ebp-04]
:00409D91 50                      push eax
:00409D92 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00409D95 E8EA3C0000              call 0040DA84
:00409D9A 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409D79(C)
|
:00409D9D E9B7FFFFFF              jmp 00409D59

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409D64(C)
|
:00409DA2 8B45FC                  mov eax, dword ptr [ebp-04]
:00409DA5 50                      push eax
:00409DA6 B9D0A64600              mov ecx, 0046A6D0
:00409DAB E8E74A0100              call 0041E897
:00409DB0 33C0                    xor eax, eax
:00409DB2 E900000000              jmp 00409DB7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409DB2(U)
|
:00409DB7 5F                      pop edi
:00409DB8 5E                      pop esi
:00409DB9 5B                      pop ebx
:00409DBA C9                      leave
:00409DBB C3                      ret



* Referenced by a CALL at Address:
|:0042575A   
|
:00409DBC 55                      push ebp
:00409DBD 8BEC                    mov ebp, esp
:00409DBF 83EC14                  sub esp, 00000014
:00409DC2 53                      push ebx
:00409DC3 56                      push esi
:00409DC4 57                      push edi
:00409DC5 8B4508                  mov eax, dword ptr [ebp+08]
:00409DC8 8945FC                  mov dword ptr [ebp-04], eax
:00409DCB 6A00                    push 00000000
:00409DCD B9B0C44600              mov ecx, 0046C4B0
:00409DD2 E8691D0000              call 0040BB40
:00409DD7 8945EC                  mov dword ptr [ebp-14], eax
:00409DDA C745F400000000          mov [ebp-0C], 00000000
:00409DE1 E907000000              jmp 00409DED

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409E2C(U)
|
:00409DE6 FF45F4                  inc [ebp-0C]
:00409DE9 8345EC17                add dword ptr [ebp-14], 00000017

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409DE1(U)
|
:00409DED 837DF42D                cmp dword ptr [ebp-0C], 0000002D
:00409DF1 0F833A000000            jnb 00409E31
:00409DF7 8B45EC                  mov eax, dword ptr [ebp-14]
:00409DFA 8B00                    mov eax, dword ptr [eax]
:00409DFC 8945F0                  mov dword ptr [ebp-10], eax
:00409DFF 817DF000040000          cmp dword ptr [ebp-10], 00000400
:00409E06 0F8320000000            jnb 00409E2C
:00409E0C 8B45F0                  mov eax, dword ptr [ebp-10]
:00409E0F 50                      push eax
:00409E10 E8C4500100              call 0041EED9
:00409E15 83C404                  add esp, 00000004
:00409E18 8945F8                  mov dword ptr [ebp-08], eax
:00409E1B 6A01                    push 00000001
:00409E1D 8B45FC                  mov eax, dword ptr [ebp-04]
:00409E20 50                      push eax
:00409E21 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00409E24 E8253B0000              call 0040D94E
:00409E29 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409E06(C)
|
:00409E2C E9B5FFFFFF              jmp 00409DE6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409DF1(C)
|
:00409E31 8B45FC                  mov eax, dword ptr [ebp-04]
:00409E34 50                      push eax
:00409E35 B9D0A64600              mov ecx, 0046A6D0
:00409E3A E89B480100              call 0041E6DA
:00409E3F E900000000              jmp 00409E44

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409E3F(U)
|
:00409E44 5F                      pop edi
:00409E45 5E                      pop esi
:00409E46 5B                      pop ebx
:00409E47 C9                      leave
:00409E48 C3                      ret



* Referenced by a CALL at Addresses:
|:0040A315   , :0040ADFF   , :0040AFE4   
|
:00409E49 55                      push ebp
:00409E4A 8BEC                    mov ebp, esp
:00409E4C 53                      push ebx
:00409E4D 56                      push esi
:00409E4E 57                      push edi
:00409E4F 6800090000              push 00000900
:00409E54 A1DC564500              mov eax, dword ptr [004556DC]
:00409E59 50                      push eax
:00409E5A 6A00                    push 00000000
:00409E5C B9D8564500              mov ecx, 004556D8
:00409E61 E8EAF5FFFF              call 00409450
:00409E66 E900000000              jmp 00409E6B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409E66(U)
|
:00409E6B 5F                      pop edi
:00409E6C 5E                      pop esi
:00409E6D 5B                      pop ebx
:00409E6E C9                      leave
:00409E6F C3                      ret



* Referenced by a CALL at Addresses:
|:0040A31F   , :0040AE09   , :0040AFEE   
|
:00409E70 55                      push ebp
:00409E71 8BEC                    mov ebp, esp
:00409E73 53                      push ebx
:00409E74 56                      push esi
:00409E75 57                      push edi
:00409E76 68F00F0000              push 00000FF0
:00409E7B A1DC564500              mov eax, dword ptr [004556DC]
:00409E80 50                      push eax
:00409E81 6800090000              push 00000900
:00409E86 B9D8564500              mov ecx, 004556D8
:00409E8B E8C0F5FFFF              call 00409450
:00409E90 E900000000              jmp 00409E95

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409E90(U)
|
:00409E95 5F                      pop edi
:00409E96 5E                      pop esi
:00409E97 5B                      pop ebx
:00409E98 C9                      leave
:00409E99 C3                      ret



* Referenced by a CALL at Addresses:
|:0040A329   , :0040AE13   , :0040AFF8   
|
:00409E9A 55                      push ebp
:00409E9B 8BEC                    mov ebp, esp
:00409E9D 53                      push ebx
:00409E9E 56                      push esi
:00409E9F 57                      push edi
:00409EA0 6800220000              push 00002200
:00409EA5 A1DC564500              mov eax, dword ptr [004556DC]
:00409EAA 50                      push eax
:00409EAB 68F0180000              push 000018F0
:00409EB0 B9D8564500              mov ecx, 004556D8
:00409EB5 E896F5FFFF              call 00409450
:00409EBA E900000000              jmp 00409EBF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409EBA(U)
|
:00409EBF 5F                      pop edi
:00409EC0 5E                      pop esi
:00409EC1 5B                      pop ebx
:00409EC2 C9                      leave
:00409EC3 C3                      ret



* Referenced by a CALL at Address:
|:0040AE18   
|
:00409EC4 55                      push ebp
:00409EC5 8BEC                    mov ebp, esp
:00409EC7 53                      push ebx
:00409EC8 56                      push esi
:00409EC9 57                      push edi
:00409ECA 6800340000              push 00003400
:00409ECF A1DC564500              mov eax, dword ptr [004556DC]
:00409ED4 0500220000              add eax, 00002200
:00409ED9 50                      push eax
:00409EDA 68F03A0000              push 00003AF0
:00409EDF B9D8564500              mov ecx, 004556D8
:00409EE4 E867F5FFFF              call 00409450
:00409EE9 E900000000              jmp 00409EEE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409EE9(U)
|
:00409EEE 5F                      pop edi
:00409EEF 5E                      pop esi
:00409EF0 5B                      pop ebx
:00409EF1 C9                      leave
:00409EF2 C3                      ret



* Referenced by a CALL at Addresses:
|:00409F71   , :00409F84   , :00409F96   , :00409FA8   , :0040AE94   
|:0040B087   , :0040B494   , :0040B4A9   , :0040B4BD   
|
:00409EF3 55                      push ebp
:00409EF4 8BEC                    mov ebp, esp
:00409EF6 53                      push ebx
:00409EF7 56                      push esi
:00409EF8 57                      push edi
:00409EF9 837D080A                cmp dword ptr [ebp+08], 0000000A
:00409EFD 0F8310000000            jnb 00409F13
:00409F03 8B4508                  mov eax, dword ptr [ebp+08]
:00409F06 83C030                  add eax, 00000030
:00409F09 E924000000              jmp 00409F32
:00409F0E E915000000              jmp 00409F28

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409EFD(C)
|
:00409F13 837D0843                cmp dword ptr [ebp+08], 00000043
:00409F17 0F830B000000            jnb 00409F28
:00409F1D 8B4508                  mov eax, dword ptr [ebp+08]
:00409F20 83C037                  add eax, 00000037
:00409F23 E90A000000              jmp 00409F32

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00409F0E(U), :00409F17(C)
|
:00409F28 B87A000000              mov eax, 0000007A
:00409F2D E900000000              jmp 00409F32

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00409F09(U), :00409F23(U), :00409F2D(U)
|
:00409F32 5F                      pop edi
:00409F33 5E                      pop esi
:00409F34 5B                      pop ebx
:00409F35 C9                      leave
:00409F36 C3                      ret



* Referenced by a CALL at Address:
|:0040FB1D   
|
:00409F37 55                      push ebp
:00409F38 8BEC                    mov ebp, esp
:00409F3A 81EC38010000            sub esp, 00000138
:00409F40 53                      push ebx
:00409F41 56                      push esi
:00409F42 57                      push edi
:00409F43 8D4DD0                  lea ecx, dword ptr [ebp-30]
:00409F46 E8A5F4FFFF              call 004093F0
:00409F4B 8D45E8                  lea eax, dword ptr [ebp-18]
:00409F4E 50                      push eax
:00409F4F B9B0C44600              mov ecx, 0046C4B0
:00409F54 E8E77AFFFF              call 00401A40

* Possible StringData Ref from Data Obj ->"1111Ұ.E2S"
                                  |
:00409F59 6880E44400              push 0044E480
:00409F5E 8D85CCFEFFFF            lea eax, dword ptr [ebp+FFFFFECC]
:00409F64 50                      push eax
:00409F65 E863D40300              call 004473CD
:00409F6A 83C408                  add esp, 00000008
:00409F6D 8B45E8                  mov eax, dword ptr [ebp-18]
:00409F70 50                      push eax
:00409F71 E87DFFFFFF              call 00409EF3
:00409F76 83C404                  add esp, 00000004
:00409F79 8885CCFEFFFF            mov byte ptr [ebp+FFFFFECC], al
:00409F7F 8B45EC                  mov eax, dword ptr [ebp-14]
:00409F82 40                      inc eax
:00409F83 50                      push eax
:00409F84 E86AFFFFFF              call 00409EF3
:00409F89 83C404                  add esp, 00000004
:00409F8C 8885CDFEFFFF            mov byte ptr [ebp+FFFFFECD], al
:00409F92 8B45F0                  mov eax, dword ptr [ebp-10]
:00409F95 50                      push eax
:00409F96 E858FFFFFF              call 00409EF3
:00409F9B 83C404                  add esp, 00000004
:00409F9E 8885CEFEFFFF            mov byte ptr [ebp+FFFFFECE], al
:00409FA4 8B45F4                  mov eax, dword ptr [ebp-0C]
:00409FA7 50                      push eax
:00409FA8 E846FFFFFF              call 00409EF3
:00409FAD 83C404                  add esp, 00000004
:00409FB0 8885CFFEFFFF            mov byte ptr [ebp+FFFFFECF], al
:00409FB6 6A04                    push 00000004
:00409FB8 8D85D0FEFFFF            lea eax, dword ptr [ebp+FFFFFED0]
:00409FBE 50                      push eax
:00409FBF B900AA4600              mov ecx, 0046AA00
:00409FC4 E86779FFFF              call 00401930
:00409FC9 33C9                    xor ecx, ecx
:00409FCB 8AC8                    mov cl, al
:00409FCD 51                      push ecx
:00409FCE E8B34E0100              call 0041EE86
:00409FD3 83C404                  add esp, 00000004
:00409FD6 50                      push eax
:00409FD7 E871D40300              call 0044744D
:00409FDC 83C40C                  add esp, 0000000C
:00409FDF 8D85CCFEFFFF            lea eax, dword ptr [ebp+FFFFFECC]
:00409FE5 50                      push eax
:00409FE6 6868D34500              push 0045D368
:00409FEB E8DDD30300              call 004473CD
:00409FF0 83C408                  add esp, 00000008
:00409FF3 B9A0E44600              mov ecx, 0046E4A0
:00409FF8 E8E3F0FFFF              call 004090E0
:00409FFD A3DC564500              mov dword ptr [004556DC], eax
:0040A002 A1DC564500              mov eax, dword ptr [004556DC]
:0040A007 83C005                  add eax, 00000005
:0040A00A 8945E4                  mov dword ptr [ebp-1C], eax
:0040A00D 6858CF4600              push 0046CF58
:0040A012 8B45E4                  mov eax, dword ptr [ebp-1C]
:0040A015 50                      push eax
:0040A016 E8B2D30300              call 004473CD
:0040A01B 83C408                  add esp, 00000008
:0040A01E 8345E41E                add dword ptr [ebp-1C], 0000001E
:0040A022 8B45E4                  mov eax, dword ptr [ebp-1C]
:0040A025 50                      push eax
:0040A026 B9D0A64600              mov ecx, 0046A6D0
:0040A02B E867480100              call 0041E897
:0040A030 8945E4                  mov dword ptr [ebp-1C], eax
:0040A033 C745DC00AA4600          mov [ebp-24], 0046AA00
:0040A03A C745D400000000          mov [ebp-2C], 00000000
:0040A041 E907000000              jmp 0040A04D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A066(U)
|
:0040A046 FF45D4                  inc [ebp-2C]
:0040A049 8345DC0A                add dword ptr [ebp-24], 0000000A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A041(U)
|
:0040A04D 837DD402                cmp dword ptr [ebp-2C], 00000002
:0040A051 0F8314000000            jnb 0040A06B
:0040A057 8B45E4                  mov eax, dword ptr [ebp-1C]
:0040A05A 50                      push eax
:0040A05B 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0040A05E E8574D0100              call 0041EDBA
:0040A063 8945E4                  mov dword ptr [ebp-1C], eax
:0040A066 E9DBFFFFFF              jmp 0040A046

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A051(C)
|
:0040A06B C745E0D8D54500          mov [ebp-20], 0045D5D8
:0040A072 C745D400000000          mov [ebp-2C], 00000000
:0040A079 E907000000              jmp 0040A085

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A0A1(U)
|
:0040A07E FF45D4                  inc [ebp-2C]
:0040A081 8345E03E                add dword ptr [ebp-20], 0000003E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A079(U)
|
:0040A085 817DD480000000          cmp dword ptr [ebp-2C], 00000080
:0040A08C 0F8314000000            jnb 0040A0A6
:0040A092 8B45E4                  mov eax, dword ptr [ebp-1C]
:0040A095 50                      push eax
:0040A096 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0040A099 E843D20000              call 004172E1
:0040A09E 8945E4                  mov dword ptr [ebp-1C], eax
:0040A0A1 E9D8FFFFFF              jmp 0040A07E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A08C(C)
|
:0040A0A6 C745D8E8564500          mov [ebp-28], 004556E8
:0040A0AD C745D400000000          mov [ebp-2C], 00000000
:0040A0B4 E907000000              jmp 0040A0C0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A0DC(U)
|
:0040A0B9 FF45D4                  inc [ebp-2C]
:0040A0BC 8345D836                add dword ptr [ebp-28], 00000036

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A0B4(U)
|
:0040A0C0 817DD400020000          cmp dword ptr [ebp-2C], 00000200
:0040A0C7 0F8314000000            jnb 0040A0E1
:0040A0CD 8B45E4                  mov eax, dword ptr [ebp-1C]
:0040A0D0 50                      push eax
:0040A0D1 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0040A0D4 E8AB390000              call 0040DA84
:0040A0D9 8945E4                  mov dword ptr [ebp-1C], eax
:0040A0DC E9D8FFFFFF              jmp 0040A0B9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A0C7(C)
|
:0040A0E1 8B45E4                  mov eax, dword ptr [ebp-1C]
:0040A0E4 2B05DC564500            sub eax, dword ptr [004556DC]
:0040A0EA 8985C8FEFFFF            mov dword ptr [ebp+FFFFFEC8], eax
:0040A0F0 6A05                    push 00000005
:0040A0F2 A1DC564500              mov eax, dword ptr [004556DC]
:0040A0F7 50                      push eax

* Possible StringData Ref from Data Obj ->"63/11"
                                  |
:0040A0F8 6858184500              push 00451858
:0040A0FD E84BD30300              call 0044744D
:0040A102 83C40C                  add esp, 0000000C
:0040A105 6A03                    push 00000003
:0040A107 E81E400000              call 0040E12A
:0040A10C 83C404                  add esp, 00000004
:0040A10F 85C0                    test eax, eax
:0040A111 0F850A000000            jne 0040A121
:0040A117 B8FFFF0000              mov eax, 0000FFFF
:0040A11C E995000000              jmp 0040A1B6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A111(C)
|
:0040A121 6868D34500              push 0045D368
:0040A126 8D85CCFEFFFF            lea eax, dword ptr [ebp+FFFFFECC]
:0040A12C 50                      push eax
:0040A12D E89BD20300              call 004473CD
:0040A132 83C408                  add esp, 00000008
:0040A135 6A03                    push 00000003
:0040A137 8D85CCFEFFFF            lea eax, dword ptr [ebp+FFFFFECC]
:0040A13D 50                      push eax
:0040A13E 8D4DD0                  lea ecx, dword ptr [ebp-30]
:0040A141 E871D40300              call 004475B7
:0040A146 83F8FF                  cmp eax, FFFFFFFF
:0040A149 0F850A000000            jne 0040A159
:0040A14F B8FFFF0000              mov eax, 0000FFFF
:0040A154 E95D000000              jmp 0040A1B6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A149(C)
|
:0040A159 6A72                    push 00000072
:0040A15B E828BD0100              call 00425E88
:0040A160 83C404                  add esp, 00000004
:0040A163 8D45D0                  lea eax, dword ptr [ebp-30]
:0040A166 50                      push eax
:0040A167 B9B0C44600              mov ecx, 0046C4B0
:0040A16C E810470200              call 0042E881
:0040A171 8B85C8FEFFFF            mov eax, dword ptr [ebp+FFFFFEC8]
:0040A177 50                      push eax
:0040A178 A1DC564500              mov eax, dword ptr [004556DC]
:0040A17D 50                      push eax
:0040A17E 68F3070000              push 000007F3
:0040A183 8D4DD0                  lea ecx, dword ptr [ebp-30]
:0040A186 E8E5190000              call 0040BB70
:0040A18B 8D4DD0                  lea ecx, dword ptr [ebp-30]
:0040A18E E88DF2FFFF              call 00409420
:0040A193 6A00                    push 00000000
:0040A195 E8EEBC0100              call 00425E88
:0040A19A 83C404                  add esp, 00000004

* Possible StringData Ref from Data Obj ->"ϡ"
                                  |
:0040A19D 68E4E94400              push 0044E9E4
:0040A1A2 6A03                    push 00000003
:0040A1A4 E88CED0200              call 00438F35
:0040A1A9 83C408                  add esp, 00000008
:0040A1AC B801000000              mov eax, 00000001
:0040A1B1 E900000000              jmp 0040A1B6

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040A11C(U), :0040A154(U), :0040A1B1(U)
|
:0040A1B6 5F                      pop edi
:0040A1B7 5E                      pop esi
:0040A1B8 5B                      pop ebx
:0040A1B9 C9                      leave
:0040A1BA C3                      ret



* Referenced by a CALL at Address:
|:0040FB3E   
|
:0040A1BB 55                      push ebp
:0040A1BC 8BEC                    mov ebp, esp
:0040A1BE 81EC40010000            sub esp, 00000140
:0040A1C4 53                      push ebx
:0040A1C5 56                      push esi
:0040A1C6 57                      push edi
:0040A1C7 8D4DF8                  lea ecx, dword ptr [ebp-08]
:0040A1CA E821F2FFFF              call 004093F0
:0040A1CF 6A04                    push 00000004
:0040A1D1 E8543F0000              call 0040E12A
:0040A1D6 83C404                  add esp, 00000004
:0040A1D9 85C0                    test eax, eax
:0040A1DB 0F850A000000            jne 0040A1EB
:0040A1E1 B8FFFF0000              mov eax, 0000FFFF
:0040A1E6 E9D0010000              jmp 0040A3BB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A1DB(C)
|
:0040A1EB 6868D34500              push 0045D368
:0040A1F0 8D85F4FEFFFF            lea eax, dword ptr [ebp+FFFFFEF4]
:0040A1F6 50                      push eax
:0040A1F7 E8D1D10300              call 004473CD
:0040A1FC 83C408                  add esp, 00000008
:0040A1FF B9D0E44600              mov ecx, 0046E4D0
:0040A204 E8D7EEFFFF              call 004090E0
:0040A209 A3DC564500              mov dword ptr [004556DC], eax
:0040A20E 6A00                    push 00000000
:0040A210 8D85F4FEFFFF            lea eax, dword ptr [ebp+FFFFFEF4]
:0040A216 50                      push eax
:0040A217 8D4DF8                  lea ecx, dword ptr [ebp-08]
:0040A21A E898D30300              call 004475B7
:0040A21F 6A23                    push 00000023
:0040A221 8D85C0FEFFFF            lea eax, dword ptr [ebp+FFFFFEC0]
:0040A227 50                      push eax
:0040A228 68F3070000              push 000007F3
:0040A22D 8D4DF8                  lea ecx, dword ptr [ebp-08]
:0040A230 E81BF2FFFF              call 00409450
:0040A235 8D4DF8                  lea ecx, dword ptr [ebp-08]
:0040A238 E8E3F1FFFF              call 00409420
:0040A23D 8D85C5FEFFFF            lea eax, dword ptr [ebp+FFFFFEC5]
:0040A243 50                      push eax

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:0040A244 68F0E94400              push 0044E9F0
:0040A249 6A02                    push 00000002
:0040A24B E8E5EC0200              call 00438F35
:0040A250 83C40C                  add esp, 0000000C
:0040A253 85C0                    test eax, eax
:0040A255 0F850A000000            jne 0040A265
:0040A25B B8FFFF0000              mov eax, 0000FFFF
:0040A260 E956010000              jmp 0040A3BB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A255(C)
|
:0040A265 6A00                    push 00000000
:0040A267 8D85F4FEFFFF            lea eax, dword ptr [ebp+FFFFFEF4]
:0040A26D 50                      push eax
:0040A26E 8D4DF8                  lea ecx, dword ptr [ebp-08]
:0040A271 E841D30300              call 004475B7
:0040A276 6860460000              push 00004660
:0040A27B B9A0E44600              mov ecx, 0046E4A0
:0040A280 E85BEEFFFF              call 004090E0
:0040A285 50                      push eax
:0040A286 68F3070000              push 000007F3
:0040A28B 8D4DF8                  lea ecx, dword ptr [ebp-08]
:0040A28E E8BDF1FFFF              call 00409450
:0040A293 6860120000              push 00001260
:0040A298 A1DC564500              mov eax, dword ptr [004556DC]
:0040A29D 50                      push eax
:0040A29E B9A0E44600              mov ecx, 0046E4A0
:0040A2A3 E838EEFFFF              call 004090E0
:0040A2A8 50                      push eax
:0040A2A9 E89FD10300              call 0044744D
:0040A2AE 83C40C                  add esp, 0000000C
:0040A2B1 A1DC564500              mov eax, dword ptr [004556DC]
:0040A2B6 83C005                  add eax, 00000005
:0040A2B9 50                      push eax
:0040A2BA 6858CF4600              push 0046CF58
:0040A2BF E809D10300              call 004473CD
:0040A2C4 83C408                  add esp, 00000008
:0040A2C7 6A01                    push 00000001
:0040A2C9 E8D7F6FFFF              call 004099A5
:0040A2CE 83C404                  add esp, 00000004
:0040A2D1 8D4DF8                  lea ecx, dword ptr [ebp-08]
:0040A2D4 E847F1FFFF              call 00409420
:0040A2D9 6A00                    push 00000000
:0040A2DB 8D85F4FEFFFF            lea eax, dword ptr [ebp+FFFFFEF4]
:0040A2E1 50                      push eax
:0040A2E2 8D4DF8                  lea ecx, dword ptr [ebp-08]
:0040A2E5 E8CDD20300              call 004475B7
:0040A2EA 8D45F8                  lea eax, dword ptr [ebp-08]
:0040A2ED 50                      push eax
:0040A2EE B9B0C44600              mov ecx, 0046C4B0
:0040A2F3 E80C420200              call 0042E504
:0040A2F8 8D4DF8                  lea ecx, dword ptr [ebp-08]
:0040A2FB E820F1FFFF              call 00409420
:0040A300 A1442F4500              mov eax, dword ptr [00452F44]
:0040A305 50                      push eax

* Possible StringData Ref from Data Obj ->"C:BAKDATA.E2"
                                  |
:0040A306 68E82B4500              push 00452BE8
:0040A30B B9D8564500              mov ecx, 004556D8
:0040A310 E8A2D20300              call 004475B7
:0040A315 E82FFBFFFF              call 00409E49
:0040A31A E885F8FFFF              call 00409BA4
:0040A31F E84CFBFFFF              call 00409E70
:0040A324 E847F9FFFF              call 00409C70
:0040A329 E86CFBFFFF              call 00409E9A
:0040A32E 6800340000              push 00003400
:0040A333 A1DC564500              mov eax, dword ptr [004556DC]
:0040A338 0500220000              add eax, 00002200
:0040A33D 50                      push eax
:0040A33E 6A04                    push 00000004
:0040A340 6A00                    push 00000000
:0040A342 6860120000              push 00001260
:0040A347 B9A0E44600              mov ecx, 0046E4A0
:0040A34C E8CFD30300              call 00447720
:0040A351 50                      push eax
:0040A352 E8F6D00300              call 0044744D
:0040A357 83C40C                  add esp, 0000000C
:0040A35A E8A0F8FFFF              call 00409BFF
:0040A35F B9D8564500              mov ecx, 004556D8
:0040A364 E8B7F0FFFF              call 00409420
:0040A369 B9D0A64600              mov ecx, 0046A6D0
:0040A36E E86D180000              call 0040BBE0
:0040A373 33C9                    xor ecx, ecx
:0040A375 8AC8                    mov cl, al
:0040A377 51                      push ecx
:0040A378 E891F9FFFF              call 00409D0E
:0040A37D 83C404                  add esp, 00000004
:0040A380 C6054CF9460001          mov byte ptr [0046F94C], 01
:0040A387 B990A64600              mov ecx, 0046A690
:0040A38C E85FEB0000              call 00418EF0
:0040A391 B994A64600              mov ecx, 0046A694
:0040A396 E8FDEC0000              call 00419098
:0040A39B B9D0A64600              mov ecx, 0046A6D0
:0040A3A0 E81B180000              call 0040BBC0
:0040A3A5 33C9                    xor ecx, ecx
:0040A3A7 8AC8                    mov cl, al
:0040A3A9 51                      push ecx
:0040A3AA B990A64600              mov ecx, 0046A690
:0040A3AF E816EB0000              call 00418ECA
:0040A3B4 33C0                    xor eax, eax
:0040A3B6 E900000000              jmp 0040A3BB

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040A1E6(U), :0040A260(U), :0040A3B6(U)
|
:0040A3BB 5F                      pop edi
:0040A3BC 5E                      pop esi
:0040A3BD 5B                      pop ebx
:0040A3BE C9                      leave
:0040A3BF C3                      ret



* Referenced by a CALL at Address:
|:0040ADC1   
|
:0040A3C0 55                      push ebp
:0040A3C1 8BEC                    mov ebp, esp
:0040A3C3 83EC20                  sub esp, 00000020
:0040A3C6 53                      push ebx
:0040A3C7 56                      push esi
:0040A3C8 57                      push edi

* Possible StringData Ref from Data Obj ->"ִ"
                                  |
:0040A3C9 C745F474EA4400          mov [ebp-0C], 0044EA74

* Possible StringData Ref from Data Obj ->""
                                  |
:0040A3D0 C745F87CEA4400          mov [ebp-08], 0044EA7C
:0040A3D7 33C0                    xor eax, eax
:0040A3D9 A0E0564500              mov al, byte ptr [004556E0]
:0040A3DE A801                    test al, 01
:0040A3E0 0F8533000000            jne 0040A419
:0040A3E6 33C0                    xor eax, eax
:0040A3E8 A0E0564500              mov al, byte ptr [004556E0]
:0040A3ED 0C01                    or al, 01
:0040A3EF A2E0564500              mov byte ptr [004556E0], al
:0040A3F4 6870BC4000              push 0040BC70
:0040A3F9 68F0BC4000              push 0040BCF0
:0040A3FE 6A23                    push 00000023
:0040A400 6A17                    push 00000017
:0040A402 68B0534500              push 004553B0
:0040A407 E834D90300              call 00447D40
:0040A40C 6898AD4000              push 0040AD98
:0040A411 E8CAD80300              call 00447CE0
:0040A416 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A3E0(C)
|
:0040A419 66C745E4FF00            mov [ebp-1C], 00FF
:0040A41F 6A01                    push 00000001
:0040A421 B9D0A64600              mov ecx, 0046A6D0
:0040A426 E8B5160000              call 0040BAE0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040AD30(U)
|
:0040A42B B9D0A64600              mov ecx, 0046A6D0
:0040A430 E8EB150000              call 0040BA20
:0040A435 8945EC                  mov dword ptr [ebp-14], eax
:0040A438 C645E800                mov [ebp-18], 00
:0040A43C E856CB0100              call 00426F97
:0040A441 8B45E4                  mov eax, dword ptr [ebp-1C]
:0040A444 25FFFF0000              and eax, 0000FFFF
:0040A449 3DFF000000              cmp eax, 000000FF
:0040A44E 0F853C000000            jne 0040A490
:0040A454 6A00                    push 00000000
:0040A456 6A03                    push 00000003
:0040A458 68B8010000              push 000001B8
:0040A45D 6880020000              push 00000280
:0040A462 6A00                    push 00000000
:0040A464 6A00                    push 00000000
:0040A466 B958BC4600              mov ecx, 0046BC58
:0040A46B E8FA680100              call 00420D6A
:0040A470 6A10                    push 00000010
:0040A472 6A08                    push 00000008
:0040A474 B910BC4600              mov ecx, 0046BC10
:0040A479 E889570100              call 0041FC07

* Possible StringData Ref from Data Obj ->"ѡťٵִУϷʼݡ"
                                  |
:0040A47E 6884EA4400              push 0044EA84
:0040A483 6810BC4600              push 0046BC10
:0040A488 E896660100              call 00420B23
:0040A48D 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A44E(C)
|
:0040A490 C645F000                mov [ebp-10], 00
:0040A494 E906000000              jmp 0040A49F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A51B(U)
|
:0040A499 FE45F0                  inc [ebp-10]
:0040A49C FE45E8                  inc [ebp-18]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A494(U)
|
:0040A49F 33C0                    xor eax, eax
:0040A4A1 8A45F0                  mov al, byte ptr [ebp-10]
:0040A4A4 83F802                  cmp eax, 00000002
:0040A4A7 0F8D73000000            jnl 0040A520
:0040A4AD 8B45E4                  mov eax, dword ptr [ebp-1C]
:0040A4B0 25FFFF0000              and eax, 0000FFFF
:0040A4B5 3DFF000000              cmp eax, 000000FF
:0040A4BA 0F855B000000            jne 0040A51B
:0040A4C0 6A00                    push 00000000
:0040A4C2 6A00                    push 00000000
:0040A4C4 33C0                    xor eax, eax
:0040A4C6 8A45F0                  mov al, byte ptr [ebp-10]
:0040A4C9 8B4485F4                mov eax, dword ptr [ebp+4*eax-0C]
:0040A4CD 50                      push eax
:0040A4CE 6A14                    push 00000014
:0040A4D0 6A18                    push 00000018
:0040A4D2 A1C0E44400              mov eax, dword ptr [0044E4C0]
:0040A4D7 50                      push eax
:0040A4D8 33C0                    xor eax, eax
:0040A4DA 8A45F0                  mov al, byte ptr [ebp-10]
:0040A4DD 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040A4E0 C1E003                  shl eax, 03
:0040A4E3 83C018                  add eax, 00000018
:0040A4E6 50                      push eax
:0040A4E7 33C0                    xor eax, eax
:0040A4E9 8A45E8                  mov al, byte ptr [ebp-18]
:0040A4EC 8BC8                    mov ecx, eax
:0040A4EE 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040A4F1 C1E003                  shl eax, 03
:0040A4F4 2BC1                    sub eax, ecx
:0040A4F6 8D88B0534500            lea ecx, dword ptr [eax+004553B0]
:0040A4FC E82F170000              call 0040BC30
:0040A501 33C0                    xor eax, eax
:0040A503 8A45E8                  mov al, byte ptr [ebp-18]
:0040A506 8BC8                    mov ecx, eax
:0040A508 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040A50B C1E003                  shl eax, 03
:0040A50E 2BC1                    sub eax, ecx
:0040A510 8D88B0534500            lea ecx, dword ptr [eax+004553B0]
:0040A516 E86B710100              call 00421686

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A4BA(C)
|
:0040A51B E979FFFFFF              jmp 0040A499

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A4A7(C)
|
:0040A520 C645F000                mov [ebp-10], 00
:0040A524 E906000000              jmp 0040A52F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A5F6(U)
|
:0040A529 FE45F0                  inc [ebp-10]
:0040A52C FE45E8                  inc [ebp-18]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A524(U)
|
:0040A52F 33C0                    xor eax, eax
:0040A531 8A45F0                  mov al, byte ptr [ebp-10]
:0040A534 83F802                  cmp eax, 00000002
:0040A537 0F8DBE000000            jnl 0040A5FB
:0040A53D 8B45E4                  mov eax, dword ptr [ebp-1C]
:0040A540 25FFFF0000              and eax, 0000FFFF
:0040A545 3DFF000000              cmp eax, 000000FF
:0040A54A 0F840A000000            je 0040A55A
:0040A550 F645E401                test [ebp-1C], 01
:0040A554 0F849C000000            je 0040A5F6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A54A(C)
|
:0040A55A F645ED20                test [ebp-13], 20
:0040A55E 0F840C000000            je 0040A570
:0040A564 C745FC01000000          mov [ebp-04], 00000001
:0040A56B E907000000              jmp 0040A577

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A55E(C)
|
:0040A570 C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A56B(U)
|
:0040A577 33C0                    xor eax, eax
:0040A579 8A45F0                  mov al, byte ptr [ebp-10]
:0040A57C 2B45FC                  sub eax, dword ptr [ebp-04]
:0040A57F 83F801                  cmp eax, 00000001
:0040A582 B800000000              mov eax, 00000000
:0040A587 83D0FF                  adc eax, FFFFFFFF
:0040A58A 83E040                  and eax, 00000040
:0040A58D 50                      push eax
:0040A58E 6A00                    push 00000000
:0040A590 33C0                    xor eax, eax
:0040A592 8A45F0                  mov al, byte ptr [ebp-10]
:0040A595 99                      cdq
:0040A596 33C2                    xor eax, edx
:0040A598 2BC2                    sub eax, edx
:0040A59A 83E001                  and eax, 00000001
:0040A59D 33C2                    xor eax, edx
:0040A59F 2BC2                    sub eax, edx
:0040A5A1 8B0485E8F04400          mov eax, dword ptr [4*eax+0044F0E8]
:0040A5A8 50                      push eax
:0040A5A9 6A14                    push 00000014
:0040A5AB 6A10                    push 00000010
:0040A5AD A1C4E44400              mov eax, dword ptr [0044E4C4]
:0040A5B2 50                      push eax
:0040A5B3 33C0                    xor eax, eax
:0040A5B5 8A45F0                  mov al, byte ptr [ebp-10]
:0040A5B8 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040A5BB C1E003                  shl eax, 03
:0040A5BE 83C01C                  add eax, 0000001C
:0040A5C1 50                      push eax
:0040A5C2 33C0                    xor eax, eax
:0040A5C4 8A45E8                  mov al, byte ptr [ebp-18]
:0040A5C7 8BC8                    mov ecx, eax
:0040A5C9 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040A5CC C1E003                  shl eax, 03
:0040A5CF 2BC1                    sub eax, ecx
:0040A5D1 8D88B0534500            lea ecx, dword ptr [eax+004553B0]
:0040A5D7 E854160000              call 0040BC30
:0040A5DC 33C0                    xor eax, eax
:0040A5DE 8A45E8                  mov al, byte ptr [ebp-18]
:0040A5E1 8BC8                    mov ecx, eax
:0040A5E3 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040A5E6 C1E003                  shl eax, 03
:0040A5E9 2BC1                    sub eax, ecx
:0040A5EB 8D88B0534500            lea ecx, dword ptr [eax+004553B0]
:0040A5F1 E890700100              call 00421686

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A554(C)
|
:0040A5F6 E92EFFFFFF              jmp 0040A529

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A537(C)
|
:0040A5FB C645F000                mov [ebp-10], 00
:0040A5FF E906000000              jmp 0040A60A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A6D1(U)
|
:0040A604 FE45F0                  inc [ebp-10]
:0040A607 FE45E8                  inc [ebp-18]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A5FF(U)
|
:0040A60A 33C0                    xor eax, eax
:0040A60C 8A45F0                  mov al, byte ptr [ebp-10]
:0040A60F 83F802                  cmp eax, 00000002
:0040A612 0F8DBE000000            jnl 0040A6D6
:0040A618 8B45E4                  mov eax, dword ptr [ebp-1C]
:0040A61B 25FFFF0000              and eax, 0000FFFF
:0040A620 3DFF000000              cmp eax, 000000FF
:0040A625 0F840A000000            je 0040A635
:0040A62B F645E402                test [ebp-1C], 02
:0040A62F 0F849C000000            je 0040A6D1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A625(C)
|
:0040A635 F645ED10                test [ebp-13], 10
:0040A639 0F840C000000            je 0040A64B
:0040A63F C745FC01000000          mov [ebp-04], 00000001
:0040A646 E907000000              jmp 0040A652

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A639(C)
|
:0040A64B C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A646(U)
|
:0040A652 33C0                    xor eax, eax
:0040A654 8A45F0                  mov al, byte ptr [ebp-10]
:0040A657 2B45FC                  sub eax, dword ptr [ebp-04]
:0040A65A 83F801                  cmp eax, 00000001
:0040A65D B800000000              mov eax, 00000000
:0040A662 83D0FF                  adc eax, FFFFFFFF
:0040A665 83E040                  and eax, 00000040
:0040A668 50                      push eax
:0040A669 6A00                    push 00000000
:0040A66B 33C0                    xor eax, eax
:0040A66D 8A45F0                  mov al, byte ptr [ebp-10]
:0040A670 99                      cdq
:0040A671 33C2                    xor eax, edx
:0040A673 2BC2                    sub eax, edx
:0040A675 83E001                  and eax, 00000001
:0040A678 33C2                    xor eax, edx
:0040A67A 2BC2                    sub eax, edx
:0040A67C 8B0485E8F04400          mov eax, dword ptr [4*eax+0044F0E8]
:0040A683 50                      push eax
:0040A684 6A14                    push 00000014
:0040A686 6A10                    push 00000010
:0040A688 A1C8E44400              mov eax, dword ptr [0044E4C8]
:0040A68D 50                      push eax
:0040A68E 33C0                    xor eax, eax
:0040A690 8A45F0                  mov al, byte ptr [ebp-10]
:0040A693 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040A696 C1E003                  shl eax, 03
:0040A699 83C01C                  add eax, 0000001C
:0040A69C 50                      push eax
:0040A69D 33C0                    xor eax, eax
:0040A69F 8A45E8                  mov al, byte ptr [ebp-18]
:0040A6A2 8BC8                    mov ecx, eax
:0040A6A4 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040A6A7 C1E003                  shl eax, 03
:0040A6AA 2BC1                    sub eax, ecx
:0040A6AC 8D88B0534500            lea ecx, dword ptr [eax+004553B0]
:0040A6B2 E879150000              call 0040BC30
:0040A6B7 33C0                    xor eax, eax
:0040A6B9 8A45E8                  mov al, byte ptr [ebp-18]
:0040A6BC 8BC8                    mov ecx, eax
:0040A6BE 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040A6C1 C1E003                  shl eax, 03
:0040A6C4 2BC1                    sub eax, ecx
:0040A6C6 8D88B0534500            lea ecx, dword ptr [eax+004553B0]
:0040A6CC E8B56F0100              call 00421686

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A62F(C)
|
:0040A6D1 E92EFFFFFF              jmp 0040A604

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A612(C)
|
:0040A6D6 C645F000                mov [ebp-10], 00
:0040A6DA E906000000              jmp 0040A6E5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A7AC(U)
|
:0040A6DF FE45F0                  inc [ebp-10]
:0040A6E2 FE45E8                  inc [ebp-18]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A6DA(U)
|
:0040A6E5 33C0                    xor eax, eax
:0040A6E7 8A45F0                  mov al, byte ptr [ebp-10]
:0040A6EA 83F802                  cmp eax, 00000002
:0040A6ED 0F8DBE000000            jnl 0040A7B1
:0040A6F3 8B45E4                  mov eax, dword ptr [ebp-1C]
:0040A6F6 25FFFF0000              and eax, 0000FFFF
:0040A6FB 3DFF000000              cmp eax, 000000FF
:0040A700 0F840A000000            je 0040A710
:0040A706 F645E404                test [ebp-1C], 04
:0040A70A 0F849C000000            je 0040A7AC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A700(C)
|
:0040A710 F645ED40                test [ebp-13], 40
:0040A714 0F840C000000            je 0040A726
:0040A71A C745FC01000000          mov [ebp-04], 00000001
:0040A721 E907000000              jmp 0040A72D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A714(C)
|
:0040A726 C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A721(U)
|
:0040A72D 33C0                    xor eax, eax
:0040A72F 8A45F0                  mov al, byte ptr [ebp-10]
:0040A732 2B45FC                  sub eax, dword ptr [ebp-04]
:0040A735 83F801                  cmp eax, 00000001
:0040A738 B800000000              mov eax, 00000000
:0040A73D 83D0FF                  adc eax, FFFFFFFF
:0040A740 83E040                  and eax, 00000040
:0040A743 50                      push eax
:0040A744 6A00                    push 00000000
:0040A746 33C0                    xor eax, eax
:0040A748 8A45F0                  mov al, byte ptr [ebp-10]
:0040A74B 99                      cdq
:0040A74C 33C2                    xor eax, edx
:0040A74E 2BC2                    sub eax, edx
:0040A750 83E001                  and eax, 00000001
:0040A753 33C2                    xor eax, edx
:0040A755 2BC2                    sub eax, edx
:0040A757 8B0485E8F04400          mov eax, dword ptr [4*eax+0044F0E8]
:0040A75E 50                      push eax
:0040A75F 6A14                    push 00000014
:0040A761 6A10                    push 00000010
:0040A763 A1CCE44400              mov eax, dword ptr [0044E4CC]
:0040A768 50                      push eax
:0040A769 33C0                    xor eax, eax
:0040A76B 8A45F0                  mov al, byte ptr [ebp-10]
:0040A76E 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040A771 C1E003                  shl eax, 03
:0040A774 83C01C                  add eax, 0000001C
:0040A777 50                      push eax
:0040A778 33C0                    xor eax, eax
:0040A77A 8A45E8                  mov al, byte ptr [ebp-18]
:0040A77D 8BC8                    mov ecx, eax
:0040A77F 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040A782 C1E003                  shl eax, 03
:0040A785 2BC1                    sub eax, ecx
:0040A787 8D88B0534500            lea ecx, dword ptr [eax+004553B0]
:0040A78D E89E140000              call 0040BC30
:0040A792 33C0                    xor eax, eax
:0040A794 8A45E8                  mov al, byte ptr [ebp-18]
:0040A797 8BC8                    mov ecx, eax
:0040A799 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040A79C C1E003                  shl eax, 03
:0040A79F 2BC1                    sub eax, ecx
:0040A7A1 8D88B0534500            lea ecx, dword ptr [eax+004553B0]
:0040A7A7 E8DA6E0100              call 00421686

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A70A(C)
|
:0040A7AC E92EFFFFFF              jmp 0040A6DF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A6ED(C)
|
:0040A7B1 C645F000                mov [ebp-10], 00
:0040A7B5 E906000000              jmp 0040A7C0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A875(U)
|
:0040A7BA FE45F0                  inc [ebp-10]
:0040A7BD FE45E8                  inc [ebp-18]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A7B5(U)
|
:0040A7C0 33C0                    xor eax, eax
:0040A7C2 8A45F0                  mov al, byte ptr [ebp-10]
:0040A7C5 83F802                  cmp eax, 00000002
:0040A7C8 0F8DAC000000            jnl 0040A87A
:0040A7CE 8B45E4                  mov eax, dword ptr [ebp-1C]
:0040A7D1 25FFFF0000              and eax, 0000FFFF
:0040A7D6 3DFF000000              cmp eax, 000000FF
:0040A7DB 0F840A000000            je 0040A7EB
:0040A7E1 F645E408                test [ebp-1C], 08
:0040A7E5 0F848A000000            je 0040A875

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A7DB(C)
|
:0040A7EB F645ED08                test [ebp-13], 08
:0040A7EF 0F840C000000            je 0040A801
:0040A7F5 C745FC01000000          mov [ebp-04], 00000001
:0040A7FC E907000000              jmp 0040A808

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A7EF(C)
|
:0040A801 C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A7FC(U)
|
:0040A808 33C0                    xor eax, eax
:0040A80A 8A45F0                  mov al, byte ptr [ebp-10]
:0040A80D 2B45FC                  sub eax, dword ptr [ebp-04]
:0040A810 83F801                  cmp eax, 00000001
:0040A813 1BC0                    sbb eax, eax
:0040A815 83E040                  and eax, 00000040
:0040A818 50                      push eax
:0040A819 6A00                    push 00000000
:0040A81B 33C0                    xor eax, eax
:0040A81D 8A45F0                  mov al, byte ptr [ebp-10]
:0040A820 8B0485A0EF4400          mov eax, dword ptr [4*eax+0044EFA0]
:0040A827 50                      push eax
:0040A828 6A14                    push 00000014
:0040A82A 6A10                    push 00000010
:0040A82C A1D0E44400              mov eax, dword ptr [0044E4D0]
:0040A831 50                      push eax
:0040A832 33C0                    xor eax, eax
:0040A834 8A45F0                  mov al, byte ptr [ebp-10]
:0040A837 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040A83A C1E003                  shl eax, 03
:0040A83D 83C01C                  add eax, 0000001C
:0040A840 50                      push eax
:0040A841 33C0                    xor eax, eax
:0040A843 8A45E8                  mov al, byte ptr [ebp-18]
:0040A846 8BC8                    mov ecx, eax
:0040A848 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040A84B C1E003                  shl eax, 03
:0040A84E 2BC1                    sub eax, ecx
:0040A850 8D88B0534500            lea ecx, dword ptr [eax+004553B0]
:0040A856 E8D5130000              call 0040BC30
:0040A85B 33C0                    xor eax, eax
:0040A85D 8A45E8                  mov al, byte ptr [ebp-18]
:0040A860 8BC8                    mov ecx, eax
:0040A862 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040A865 C1E003                  shl eax, 03
:0040A868 2BC1                    sub eax, ecx
:0040A86A 8D88B0534500            lea ecx, dword ptr [eax+004553B0]
:0040A870 E8116E0100              call 00421686

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A7E5(C)
|
:0040A875 E940FFFFFF              jmp 0040A7BA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A7C8(C)
|
:0040A87A C645F000                mov [ebp-10], 00
:0040A87E E906000000              jmp 0040A889

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A927(U)
|
:0040A883 FE45F0                  inc [ebp-10]
:0040A886 FE45E8                  inc [ebp-18]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A87E(U)
|
:0040A889 33C0                    xor eax, eax
:0040A88B 8A45F0                  mov al, byte ptr [ebp-10]
:0040A88E 83F803                  cmp eax, 00000003
:0040A891 0F8D95000000            jnl 0040A92C
:0040A897 8B45E4                  mov eax, dword ptr [ebp-1C]
:0040A89A 25FFFF0000              and eax, 0000FFFF
:0040A89F 3DFF000000              cmp eax, 000000FF
:0040A8A4 0F840A000000            je 0040A8B4
:0040A8AA F645E410                test [ebp-1C], 10
:0040A8AE 0F8473000000            je 0040A927

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A8A4(C)
|
:0040A8B4 B9D0A64600              mov ecx, 0046A6D0
:0040A8B9 E8F2110000              call 0040BAB0
:0040A8BE 33C9                    xor ecx, ecx
:0040A8C0 8A4DF0                  mov cl, byte ptr [ebp-10]
:0040A8C3 2BC1                    sub eax, ecx
:0040A8C5 83F801                  cmp eax, 00000001
:0040A8C8 1BC0                    sbb eax, eax
:0040A8CA 83E040                  and eax, 00000040
:0040A8CD 50                      push eax
:0040A8CE 6A00                    push 00000000
:0040A8D0 33C0                    xor eax, eax
:0040A8D2 8A45F0                  mov al, byte ptr [ebp-10]
:0040A8D5 8B0485C8EF4400          mov eax, dword ptr [4*eax+0044EFC8]
:0040A8DC 50                      push eax
:0040A8DD 6A14                    push 00000014
:0040A8DF 6A10                    push 00000010
:0040A8E1 A1D4E44400              mov eax, dword ptr [0044E4D4]
:0040A8E6 50                      push eax
:0040A8E7 33C0                    xor eax, eax
:0040A8E9 8A45F0                  mov al, byte ptr [ebp-10]
:0040A8EC C1E004                  shl eax, 04
:0040A8EF 83C018                  add eax, 00000018
:0040A8F2 50                      push eax
:0040A8F3 33C0                    xor eax, eax
:0040A8F5 8A45E8                  mov al, byte ptr [ebp-18]
:0040A8F8 8BC8                    mov ecx, eax
:0040A8FA 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040A8FD C1E003                  shl eax, 03
:0040A900 2BC1                    sub eax, ecx
:0040A902 8D88B0534500            lea ecx, dword ptr [eax+004553B0]
:0040A908 E823130000              call 0040BC30
:0040A90D 33C0                    xor eax, eax
:0040A90F 8A45E8                  mov al, byte ptr [ebp-18]
:0040A912 8BC8                    mov ecx, eax
:0040A914 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040A917 C1E003                  shl eax, 03
:0040A91A 2BC1                    sub eax, ecx
:0040A91C 8D88B0534500            lea ecx, dword ptr [eax+004553B0]
:0040A922 E85F6D0100              call 00421686

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A8AE(C)
|
:0040A927 E957FFFFFF              jmp 0040A883

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A891(C)
|
:0040A92C C645F000                mov [ebp-10], 00
:0040A930 E906000000              jmp 0040A93B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A9E0(U)
|
:0040A935 FE45F0                  inc [ebp-10]
:0040A938 FE45E8                  inc [ebp-18]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A930(U)
|
:0040A93B 33C0                    xor eax, eax
:0040A93D 8A45F0                  mov al, byte ptr [ebp-10]
:0040A940 83F804                  cmp eax, 00000004
:0040A943 0F8D9C000000            jnl 0040A9E5
:0040A949 8B45E4                  mov eax, dword ptr [ebp-1C]
:0040A94C 25FFFF0000              and eax, 0000FFFF
:0040A951 3DFF000000              cmp eax, 000000FF
:0040A956 0F840A000000            je 0040A966
:0040A95C F645E420                test [ebp-1C], 20
:0040A960 0F847A000000            je 0040A9E0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A956(C)
|
:0040A966 B9D0A64600              mov ecx, 0046A6D0
:0040A96B E860100000              call 0040B9D0
:0040A970 33C9                    xor ecx, ecx
:0040A972 8AC8                    mov cl, al
:0040A974 33C0                    xor eax, eax
:0040A976 8A45F0                  mov al, byte ptr [ebp-10]
:0040A979 2BC8                    sub ecx, eax
:0040A97B 83F901                  cmp ecx, 00000001
:0040A97E 1BC0                    sbb eax, eax
:0040A980 83E040                  and eax, 00000040
:0040A983 50                      push eax
:0040A984 6A00                    push 00000000
:0040A986 33C0                    xor eax, eax
:0040A988 8A45F0                  mov al, byte ptr [ebp-10]
:0040A98B 8B0485B0EF4400          mov eax, dword ptr [4*eax+0044EFB0]
:0040A992 50                      push eax
:0040A993 6A14                    push 00000014
:0040A995 6A0C                    push 0000000C
:0040A997 A1D8E44400              mov eax, dword ptr [0044E4D8]
:0040A99C 50                      push eax
:0040A99D 33C0                    xor eax, eax
:0040A99F 8A45F0                  mov al, byte ptr [ebp-10]
:0040A9A2 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040A9A5 C1E002                  shl eax, 02
:0040A9A8 83C018                  add eax, 00000018
:0040A9AB 50                      push eax
:0040A9AC 33C0                    xor eax, eax
:0040A9AE 8A45E8                  mov al, byte ptr [ebp-18]
:0040A9B1 8BC8                    mov ecx, eax
:0040A9B3 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040A9B6 C1E003                  shl eax, 03
:0040A9B9 2BC1                    sub eax, ecx
:0040A9BB 8D88B0534500            lea ecx, dword ptr [eax+004553B0]
:0040A9C1 E86A120000              call 0040BC30
:0040A9C6 33C0                    xor eax, eax
:0040A9C8 8A45E8                  mov al, byte ptr [ebp-18]
:0040A9CB 8BC8                    mov ecx, eax
:0040A9CD 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040A9D0 C1E003                  shl eax, 03
:0040A9D3 2BC1                    sub eax, ecx
:0040A9D5 8D88B0534500            lea ecx, dword ptr [eax+004553B0]
:0040A9DB E8A66C0100              call 00421686

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A960(C)
|
:0040A9E0 E950FFFFFF              jmp 0040A935

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A943(C)
|
:0040A9E5 C645F000                mov [ebp-10], 00
:0040A9E9 E906000000              jmp 0040A9F4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040AA94(U)
|
:0040A9EE FE45F0                  inc [ebp-10]
:0040A9F1 FE45E8                  inc [ebp-18]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A9E9(U)
|
:0040A9F4 33C0                    xor eax, eax
:0040A9F6 8A45F0                  mov al, byte ptr [ebp-10]
:0040A9F9 83F808                  cmp eax, 00000008
:0040A9FC 0F8D97000000            jnl 0040AA99
:0040AA02 8B45E4                  mov eax, dword ptr [ebp-1C]
:0040AA05 25FFFF0000              and eax, 0000FFFF
:0040AA0A 3DFF000000              cmp eax, 000000FF
:0040AA0F 0F840A000000            je 0040AA1F
:0040AA15 F645E440                test [ebp-1C], 40
:0040AA19 0F8475000000            je 0040AA94

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040AA0F(C)
|
:0040AA1F B9D0A64600              mov ecx, 0046A6D0
:0040AA24 E8D7110000              call 0040BC00
:0040AA29 33C9                    xor ecx, ecx
:0040AA2B 8A4DF0                  mov cl, byte ptr [ebp-10]
:0040AA2E 2BC1                    sub eax, ecx
:0040AA30 83F801                  cmp eax, 00000001
:0040AA33 1BC0                    sbb eax, eax
:0040AA35 83E040                  and eax, 00000040
:0040AA38 50                      push eax
:0040AA39 6A00                    push 00000000
:0040AA3B 33C0                    xor eax, eax
:0040AA3D 8A45F0                  mov al, byte ptr [ebp-10]
:0040AA40 8B048578EF4400          mov eax, dword ptr [4*eax+0044EF78]
:0040AA47 50                      push eax
:0040AA48 6A14                    push 00000014
:0040AA4A 6A06                    push 00000006
:0040AA4C A1DCE44400              mov eax, dword ptr [0044E4DC]
:0040AA51 50                      push eax
:0040AA52 33C0                    xor eax, eax
:0040AA54 8A45F0                  mov al, byte ptr [ebp-10]
:0040AA57 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040AA5A 03C0                    add eax, eax
:0040AA5C 83C018                  add eax, 00000018
:0040AA5F 50                      push eax
:0040AA60 33C0                    xor eax, eax
:0040AA62 8A45E8                  mov al, byte ptr [ebp-18]
:0040AA65 8BC8                    mov ecx, eax
:0040AA67 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040AA6A C1E003                  shl eax, 03
:0040AA6D 2BC1                    sub eax, ecx
:0040AA6F 8D88B0534500            lea ecx, dword ptr [eax+004553B0]
:0040AA75 E8B6110000              call 0040BC30
:0040AA7A 33C0                    xor eax, eax
:0040AA7C 8A45E8                  mov al, byte ptr [ebp-18]
:0040AA7F 8BC8                    mov ecx, eax
:0040AA81 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040AA84 C1E003                  shl eax, 03
:0040AA87 2BC1                    sub eax, ecx
:0040AA89 8D88B0534500            lea ecx, dword ptr [eax+004553B0]
:0040AA8F E8F26B0100              call 00421686

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040AA19(C)
|
:0040AA94 E955FFFFFF              jmp 0040A9EE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A9FC(C)
|
:0040AA99 C645F000                mov [ebp-10], 00
:0040AA9D E906000000              jmp 0040AAA8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040AB21(U)
|
:0040AAA2 FE45F0                  inc [ebp-10]
:0040AAA5 FE45E8                  inc [ebp-18]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040AA9D(U)
|
:0040AAA8 33C0                    xor eax, eax
:0040AAAA 8A45F0                  mov al, byte ptr [ebp-10]
:0040AAAD 83F807                  cmp eax, 00000007
:0040AAB0 0F8D70000000            jnl 0040AB26
:0040AAB6 8B45E4                  mov eax, dword ptr [ebp-1C]
:0040AAB9 25FFFF0000              and eax, 0000FFFF
:0040AABE 3DFF000000              cmp eax, 000000FF
:0040AAC3 0F8558000000            jne 0040AB21
:0040AAC9 6A00                    push 00000000
:0040AACB 6A00                    push 00000000
:0040AACD 33C0                    xor eax, eax
:0040AACF 8A45F0                  mov al, byte ptr [ebp-10]
:0040AAD2 8B048500EA4400          mov eax, dword ptr [4*eax+0044EA00]
:0040AAD9 50                      push eax
:0040AADA 6A14                    push 00000014
:0040AADC 6A0C                    push 0000000C
:0040AADE 33C0                    xor eax, eax
:0040AAE0 8A45F0                  mov al, byte ptr [ebp-10]
:0040AAE3 8B0485C4E44400          mov eax, dword ptr [4*eax+0044E4C4]
:0040AAEA 50                      push eax
:0040AAEB 6A08                    push 00000008
:0040AAED 33C0                    xor eax, eax
:0040AAEF 8A45E8                  mov al, byte ptr [ebp-18]
:0040AAF2 8BC8                    mov ecx, eax
:0040AAF4 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040AAF7 C1E003                  shl eax, 03
:0040AAFA 2BC1                    sub eax, ecx
:0040AAFC 8D88B0534500            lea ecx, dword ptr [eax+004553B0]
:0040AB02 E829110000              call 0040BC30
:0040AB07 33C0                    xor eax, eax
:0040AB09 8A45E8                  mov al, byte ptr [ebp-18]
:0040AB0C 8BC8                    mov ecx, eax
:0040AB0E 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040AB11 C1E003                  shl eax, 03
:0040AB14 2BC1                    sub eax, ecx
:0040AB16 8D88B0534500            lea ecx, dword ptr [eax+004553B0]
:0040AB1C E8656B0100              call 00421686

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040AAC3(C)
|
:0040AB21 E97CFFFFFF              jmp 0040AAA2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040AAB0(C)
|
:0040AB26 E88CC40100              call 00426FB7
:0040AB2B 66C745E40000            mov [ebp-1C], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040AD2A(C)
|
:0040AB31 C645F000                mov [ebp-10], 00
:0040AB35 E903000000              jmp 0040AB3D
:0040AB3A FE45F0                  inc [ebp-10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040AB35(U)
|
:0040AB3D 33C0                    xor eax, eax
:0040AB3F 8A45F0                  mov al, byte ptr [ebp-10]
:0040AB42 83F823                  cmp eax, 00000023
:0040AB45 0F8DD8010000            jnl 0040AD23
:0040AB4B 33C0                    xor eax, eax
:0040AB4D 8A45F0                  mov al, byte ptr [ebp-10]
:0040AB50 8BC8                    mov ecx, eax
:0040AB52 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040AB55 C1E003                  shl eax, 03
:0040AB58 2BC1                    sub eax, ecx
:0040AB5A 8D88B0534500            lea ecx, dword ptr [eax+004553B0]
:0040AB60 E8556D0100              call 004218BA
:0040AB65 33C9                    xor ecx, ecx
:0040AB67 8AC8                    mov cl, al
:0040AB69 81F9FF000000            cmp ecx, 000000FF
:0040AB6F 0F84A9010000            je 0040AD1E
:0040AB75 33C0                    xor eax, eax
:0040AB77 8A45F0                  mov al, byte ptr [ebp-10]
:0040AB7A 8945E0                  mov dword ptr [ebp-20], eax
:0040AB7D E934010000              jmp 0040ACB6
:0040AB82 33C0                    xor eax, eax
:0040AB84 E9B3010000              jmp 0040AD3C
:0040AB89 E8D4C40100              call 00427062
:0040AB8E E8AE010000              call 0040AD41
:0040AB93 A1DC564500              mov eax, dword ptr [004556DC]
:0040AB98 83C023                  add eax, 00000023
:0040AB9B 50                      push eax
:0040AB9C B9D0A64600              mov ecx, 0046A6D0
:0040ABA1 E8343B0100              call 0041E6DA
:0040ABA6 E85CA60100              call 00425207
:0040ABAB B8FFFF0000              mov eax, 0000FFFF
:0040ABB0 E987010000              jmp 0040AD3C
:0040ABB5 33C0                    xor eax, eax
:0040ABB7 8A45F0                  mov al, byte ptr [ebp-10]
:0040ABBA 83E802                  sub eax, 00000002
:0040ABBD 83F801                  cmp eax, 00000001
:0040ABC0 1BC0                    sbb eax, eax
:0040ABC2 F7D8                    neg eax
:0040ABC4 50                      push eax
:0040ABC5 E805570000              call 004102CF
:0040ABCA 83C404                  add esp, 00000004
:0040ABCD 66C745E40100            mov [ebp-1C], 0001
:0040ABD3 E946010000              jmp 0040AD1E
:0040ABD8 33C0                    xor eax, eax
:0040ABDA 8A45F0                  mov al, byte ptr [ebp-10]
:0040ABDD 83E804                  sub eax, 00000004
:0040ABE0 83F801                  cmp eax, 00000001
:0040ABE3 1BC0                    sbb eax, eax
:0040ABE5 F7D8                    neg eax
:0040ABE7 50                      push eax
:0040ABE8 E872560000              call 0041025F
:0040ABED 83C404                  add esp, 00000004
:0040ABF0 66C745E40200            mov [ebp-1C], 0002
:0040ABF6 E923010000              jmp 0040AD1E
:0040ABFB 33C0                    xor eax, eax
:0040ABFD 8A45F0                  mov al, byte ptr [ebp-10]
:0040AC00 83E806                  sub eax, 00000006
:0040AC03 83F801                  cmp eax, 00000001
:0040AC06 1BC0                    sbb eax, eax
:0040AC08 F7D8                    neg eax
:0040AC0A 50                      push eax
:0040AC0B E8C6580000              call 004104D6
:0040AC10 83C404                  add esp, 00000004
:0040AC13 66C745E40400            mov [ebp-1C], 0004
:0040AC19 E900010000              jmp 0040AD1E
:0040AC1E 33C0                    xor eax, eax
:0040AC20 8A45F0                  mov al, byte ptr [ebp-10]
:0040AC23 83E809                  sub eax, 00000009
:0040AC26 83F801                  cmp eax, 00000001
:0040AC29 1BC0                    sbb eax, eax
:0040AC2B F7D8                    neg eax
:0040AC2D 50                      push eax
:0040AC2E E895520000              call 0040FEC8
:0040AC33 83C404                  add esp, 00000004
:0040AC36 66C745E40800            mov [ebp-1C], 0008
:0040AC3C E9DD000000              jmp 0040AD1E
:0040AC41 33C0                    xor eax, eax
:0040AC43 8A45F0                  mov al, byte ptr [ebp-10]
:0040AC46 83E80A                  sub eax, 0000000A
:0040AC49 50                      push eax
:0040AC4A E837540000              call 00410086
:0040AC4F 83C404                  add esp, 00000004
:0040AC52 66C745E41000            mov [ebp-1C], 0010
:0040AC58 E9C1000000              jmp 0040AD1E
:0040AC5D 33C0                    xor eax, eax
:0040AC5F 8A45F0                  mov al, byte ptr [ebp-10]
:0040AC62 83E80D                  sub eax, 0000000D
:0040AC65 50                      push eax
:0040AC66 E878530000              call 0040FFE3
:0040AC6B 83C404                  add esp, 00000004
:0040AC6E 66C745E42000            mov [ebp-1C], 0020
:0040AC74 E9A5000000              jmp 0040AD1E
:0040AC79 33C0                    xor eax, eax
:0040AC7B 8A45F0                  mov al, byte ptr [ebp-10]
:0040AC7E 83E811                  sub eax, 00000011
:0040AC81 50                      push eax
:0040AC82 E889510000              call 0040FE10
:0040AC87 83C404                  add esp, 00000004
:0040AC8A 66C745E4FF00            mov [ebp-1C], 00FF
:0040AC90 E989000000              jmp 0040AD1E
:0040AC95 33C0                    xor eax, eax
:0040AC97 8A45F0                  mov al, byte ptr [ebp-10]
:0040AC9A 8B04853CE44400          mov eax, dword ptr [4*eax+0044E43C]
:0040ACA1 50                      push eax
:0040ACA2 6A04                    push 00000004
:0040ACA4 E88CE20200              call 00438F35
:0040ACA9 83C408                  add esp, 00000008
:0040ACAC E96D000000              jmp 0040AD1E
:0040ACB1 E968000000              jmp 0040AD1E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040AB7D(U)
|
:0040ACB6 837DE01F                cmp dword ptr [ebp-20], 0000001F
:0040ACBA 0F875E000000            ja 0040AD1E
:0040ACC0 8B45E0                  mov eax, dword ptr [ebp-20]
:0040ACC3 33C9                    xor ecx, ecx
:0040ACC5 8A88FEAC4000            mov cl, byte ptr [eax+0040ACFE]
:0040ACCB FF248DD2AC4000          jmp dword ptr [4*ecx+0040ACD2]

:0040ACD2 82AB4000                DWORD 0040AB82
:0040ACD6 89AB4000                DWORD 0040AB89
:0040ACDA B5AB4000                DWORD 0040ABB5
:0040ACDE D8AB4000                DWORD 0040ABD8
:0040ACE2 FBAB4000                DWORD 0040ABFB
:0040ACE6 1EAC4000                DWORD 0040AC1E
:0040ACEA 41AC4000                DWORD 0040AC41
:0040ACEE 5DAC4000                DWORD 0040AC5D
:0040ACF2 79AC4000                DWORD 0040AC79
:0040ACF6 95AC4000                DWORD 0040AC95
:0040ACFA ACAC4000                DWORD 0040ACAC


:0040ACFE 0001                    add byte ptr [ecx], al
:0040AD00 0202                    add al, byte ptr [edx]
:0040AD02 0303                    add eax, dword ptr [ebx]
:0040AD04 0404                    add al, 04
:0040AD06 0505060606              add eax, 06060605
:0040AD0B 07                      pop es
:0040AD0C 07                      pop es
:0040AD0D 07                      pop es
:0040AD0E 07                      pop es
:0040AD0F 0808                    or byte ptr [eax], cl
:0040AD11 0808                    or byte ptr [eax], cl
:0040AD13 0808                    or byte ptr [eax], cl
:0040AD15 0808                    or byte ptr [eax], cl
:0040AD17 0909                    or dword ptr [ecx], ecx
:0040AD19 0909                    or dword ptr [ecx], ecx
:0040AD1B 0909                    or dword ptr [ecx], ecx
:0040AD1D 09E9                    or ecx, ebp
:0040AD1F 17                      pop ss
:0040AD20 FE                      BYTE 0feh
:0040AD21 FFFF                    BYTE  2 DUP(0ffh)



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040AB45(C)
|
:0040AD23 F745E4FFFF0000          test [ebp-1C], 0000FFFF
:0040AD2A 0F8401FEFFFF            je 0040AB31
:0040AD30 E9F6F6FFFF              jmp 0040A42B
:0040AD35 33C0                    xor eax, eax
:0040AD37 E900000000              jmp 0040AD3C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040AB84(U), :0040ABB0(U), :0040AD37(U)
|
:0040AD3C 5F                      pop edi
:0040AD3D 5E                      pop esi
:0040AD3E 5B                      pop ebx
:0040AD3F C9                      leave
:0040AD40 C3                      ret



* Referenced by a CALL at Addresses:
|:0040AB8E   , :0040ADDB   
|
:0040AD41 55                      push ebp
:0040AD42 8BEC                    mov ebp, esp
:0040AD44 83EC04                  sub esp, 00000004
:0040AD47 53                      push ebx
:0040AD48 56                      push esi
:0040AD49 57                      push edi
:0040AD4A 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0040AD4D E89EE6FFFF              call 004093F0
:0040AD52 B9D0E44600              mov ecx, 0046E4D0
:0040AD57 E884E3FFFF              call 004090E0
:0040AD5C A3DC564500              mov dword ptr [004556DC], eax
:0040AD61 A1442F4500              mov eax, dword ptr [00452F44]
:0040AD66 50                      push eax

* Possible StringData Ref from Data Obj ->"C:MSAVE.E2"
                                  |
:0040AD67 68182C4500              push 00452C18
:0040AD6C 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0040AD6F E843C80300              call 004475B7
:0040AD74 6A60                    push 00000060
:0040AD76 A1DC564500              mov eax, dword ptr [004556DC]
:0040AD7B 50                      push eax
:0040AD7C 6A00                    push 00000000
:0040AD7E 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0040AD81 E8CAE6FFFF              call 00409450
:0040AD86 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0040AD89 E892E6FFFF              call 00409420
:0040AD8E E900000000              jmp 0040AD93

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040AD8E(U)
|
:0040AD93 5F                      pop edi
:0040AD94 5E                      pop esi
:0040AD95 5B                      pop ebx
:0040AD96 C9                      leave
:0040AD97 C3                      ret


:0040AD98 55                      push ebp
:0040AD99 8BEC                    mov ebp, esp
:0040AD9B 53                      push ebx
:0040AD9C 56                      push esi
:0040AD9D 57                      push edi
:0040AD9E 6870BC4000              push 0040BC70
:0040ADA3 6A23                    push 00000023
:0040ADA5 6A17                    push 00000017
:0040ADA7 68B0534500              push 004553B0
:0040ADAC E81FD00300              call 00447DD0
:0040ADB1 E900000000              jmp 0040ADB6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040ADB1(U)
|
:0040ADB6 5F                      pop edi
:0040ADB7 5E                      pop esi
:0040ADB8 5B                      pop ebx
:0040ADB9 C9                      leave
:0040ADBA C3                      ret


:0040ADBB 55                      push ebp
:0040ADBC 8BEC                    mov ebp, esp
:0040ADBE 53                      push ebx
:0040ADBF 56                      push esi
:0040ADC0 57                      push edi
:0040ADC1 E8FAF5FFFF              call 0040A3C0
:0040ADC6 3DFFFF0000              cmp eax, 0000FFFF
:0040ADCB 0F850A000000            jne 0040ADDB
:0040ADD1 B8FFFF0000              mov eax, 0000FFFF
:0040ADD6 E964000000              jmp 0040AE3F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040ADCB(C)
|
:0040ADDB E861FFFFFF              call 0040AD41
:0040ADE0 6A00                    push 00000000
:0040ADE2 E8BEEBFFFF              call 004099A5
:0040ADE7 83C404                  add esp, 00000004
:0040ADEA A1442F4500              mov eax, dword ptr [00452F44]
:0040ADEF 50                      push eax

* Possible StringData Ref from Data Obj ->"C:BAKDATA.E2"
                                  |
:0040ADF0 68E82B4500              push 00452BE8
:0040ADF5 B9D8564500              mov ecx, 004556D8
:0040ADFA E8B8C70300              call 004475B7
:0040ADFF E845F0FFFF              call 00409E49
:0040AE04 E89BEDFFFF              call 00409BA4
:0040AE09 E862F0FFFF              call 00409E70
:0040AE0E E85DEEFFFF              call 00409C70
:0040AE13 E882F0FFFF              call 00409E9A
:0040AE18 E8A7F0FFFF              call 00409EC4
:0040AE1D E8DDEDFFFF              call 00409BFF
:0040AE22 B9D8564500              mov ecx, 004556D8
:0040AE27 E8F4E5FFFF              call 00409420
:0040AE2C E896EEFFFF              call 00409CC7
:0040AE31 C6054CF9460000          mov byte ptr [0046F94C], 00
:0040AE38 33C0                    xor eax, eax
:0040AE3A E900000000              jmp 0040AE3F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040ADD6(U), :0040AE3A(U)
|
:0040AE3F 5F                      pop edi
:0040AE40 5E                      pop esi
:0040AE41 5B                      pop ebx
:0040AE42 C9                      leave
:0040AE43 C3                      ret



* Referenced by a CALL at Addresses:
|:0040B38E   , :00410691   
|
:0040AE44 55                      push ebp
:0040AE45 8BEC                    mov ebp, esp
:0040AE47 53                      push ebx
:0040AE48 56                      push esi
:0040AE49 57                      push edi
:0040AE4A 837D0801                cmp dword ptr [ebp+08], 00000001
:0040AE4E 1BC0                    sbb eax, eax
:0040AE50 40                      inc eax
:0040AE51 50                      push eax
:0040AE52 E80D000000              call 0040AE64
:0040AE57 83C404                  add esp, 00000004
:0040AE5A E900000000              jmp 0040AE5F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040AE5A(U)
|
:0040AE5F 5F                      pop edi
:0040AE60 5E                      pop esi
:0040AE61 5B                      pop ebx
:0040AE62 C9                      leave
:0040AE63 C3                      ret



* Referenced by a CALL at Address:
|:0040AE52   
|
:0040AE64 55                      push ebp
:0040AE65 8BEC                    mov ebp, esp
:0040AE67 81EC24010000            sub esp, 00000124
:0040AE6D 53                      push ebx
:0040AE6E 56                      push esi
:0040AE6F 57                      push edi
:0040AE70 8D4DE4                  lea ecx, dword ptr [ebp-1C]
:0040AE73 E878E5FFFF              call 004093F0
:0040AE78 8D45E8                  lea eax, dword ptr [ebp-18]
:0040AE7B 50                      push eax
:0040AE7C B9B0C44600              mov ecx, 0046C4B0
:0040AE81 E8BA6BFFFF              call 00401A40
:0040AE86 837D0800                cmp dword ptr [ebp+08], 00000000
:0040AE8A 0F853D000000            jne 0040AECD
:0040AE90 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040AE93 50                      push eax
:0040AE94 E85AF0FFFF              call 00409EF3
:0040AE99 83C404                  add esp, 00000004
:0040AE9C 33C9                    xor ecx, ecx
:0040AE9E 8A0D78E44400            mov cl, byte ptr [0044E478]
:0040AEA4 3BC1                    cmp eax, ecx
:0040AEA6 0F8421000000            je 0040AECD

* Possible StringData Ref from Data Obj ->"洢"
                                  |
:0040AEAC 68B0EA4400              push 0044EAB0
:0040AEB1 6A01                    push 00000001
:0040AEB3 E87DE00200              call 00438F35
:0040AEB8 83C408                  add esp, 00000008
:0040AEBB 85C0                    test eax, eax
:0040AEBD 0F850A000000            jne 0040AECD
:0040AEC3 B8FFFF0000              mov eax, 0000FFFF
:0040AEC8 E9D8010000              jmp 0040B0A5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040AE8A(C), :0040AEA6(C), :0040AEBD(C)
|

* Possible StringData Ref from Data Obj ->"ѡȡȡ"
                                  |
:0040AECD 68C0EA4400              push 0044EAC0
:0040AED2 6A00                    push 00000000
:0040AED4 E85CE00200              call 00438F35
:0040AED9 83C408                  add esp, 00000008
:0040AEDC 6A01                    push 00000001
:0040AEDE E8C7010000              call 0040B0AA
:0040AEE3 83C404                  add esp, 00000004
:0040AEE6 8945E0                  mov dword ptr [ebp-20], eax
:0040AEE9 817DE0FFFF0000          cmp dword ptr [ebp-20], 0000FFFF
:0040AEF0 0F850A000000            jne 0040AF00
:0040AEF6 B8FFFF0000              mov eax, 0000FFFF
:0040AEFB E9A5010000              jmp 0040B0A5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040AEF0(C)
|
:0040AF00 6A72                    push 00000072
:0040AF02 E881AF0100              call 00425E88
:0040AF07 83C404                  add esp, 00000004
:0040AF0A 8B45E0                  mov eax, dword ptr [ebp-20]
:0040AF0D 50                      push eax
:0040AF0E 8D85DCFEFFFF            lea eax, dword ptr [ebp+FFFFFEDC]
:0040AF14 50                      push eax
:0040AF15 E805EAFFFF              call 0040991F
:0040AF1A 83C408                  add esp, 00000008
:0040AF1D B9D0E44600              mov ecx, 0046E4D0
:0040AF22 E8B9E1FFFF              call 004090E0
:0040AF27 A3DC564500              mov dword ptr [004556DC], eax
:0040AF2C A1442F4500              mov eax, dword ptr [00452F44]
:0040AF31 50                      push eax
:0040AF32 8D85DCFEFFFF            lea eax, dword ptr [ebp+FFFFFEDC]
:0040AF38 50                      push eax
:0040AF39 8D4DE4                  lea ecx, dword ptr [ebp-1C]
:0040AF3C E876C60300              call 004475B7
:0040AF41 6860460000              push 00004660
:0040AF46 B9A0E44600              mov ecx, 0046E4A0
:0040AF4B E890E1FFFF              call 004090E0
:0040AF50 50                      push eax
:0040AF51 68F3070000              push 000007F3
:0040AF56 8D4DE4                  lea ecx, dword ptr [ebp-1C]
:0040AF59 E8F2E4FFFF              call 00409450
:0040AF5E 6860120000              push 00001260
:0040AF63 A1DC564500              mov eax, dword ptr [004556DC]
:0040AF68 50                      push eax
:0040AF69 B9A0E44600              mov ecx, 0046E4A0
:0040AF6E E86DE1FFFF              call 004090E0
:0040AF73 50                      push eax
:0040AF74 E8D4C40300              call 0044744D
:0040AF79 83C40C                  add esp, 0000000C
:0040AF7C A1DC564500              mov eax, dword ptr [004556DC]
:0040AF81 83C005                  add eax, 00000005
:0040AF84 50                      push eax
:0040AF85 6858CF4600              push 0046CF58
:0040AF8A E83EC40300              call 004473CD
:0040AF8F 83C408                  add esp, 00000008
:0040AF92 6A01                    push 00000001
:0040AF94 E80CEAFFFF              call 004099A5
:0040AF99 83C404                  add esp, 00000004
:0040AF9C 8D4DE4                  lea ecx, dword ptr [ebp-1C]
:0040AF9F E87CE4FFFF              call 00409420
:0040AFA4 A1442F4500              mov eax, dword ptr [00452F44]
:0040AFA9 50                      push eax
:0040AFAA 8D85DCFEFFFF            lea eax, dword ptr [ebp+FFFFFEDC]
:0040AFB0 50                      push eax
:0040AFB1 8D4DE4                  lea ecx, dword ptr [ebp-1C]
:0040AFB4 E8FEC50300              call 004475B7
:0040AFB9 8D45E4                  lea eax, dword ptr [ebp-1C]
:0040AFBC 50                      push eax
:0040AFBD B9B0C44600              mov ecx, 0046C4B0
:0040AFC2 E83D350200              call 0042E504
:0040AFC7 8D4DE4                  lea ecx, dword ptr [ebp-1C]
:0040AFCA E851E4FFFF              call 00409420
:0040AFCF A1442F4500              mov eax, dword ptr [00452F44]
:0040AFD4 50                      push eax

* Possible StringData Ref from Data Obj ->"C:BAKDATA.E2"
                                  |
:0040AFD5 68E82B4500              push 00452BE8
:0040AFDA B9D8564500              mov ecx, 004556D8
:0040AFDF E8D3C50300              call 004475B7
:0040AFE4 E860EEFFFF              call 00409E49
:0040AFE9 E8B6EBFFFF              call 00409BA4
:0040AFEE E87DEEFFFF              call 00409E70
:0040AFF3 E878ECFFFF              call 00409C70
:0040AFF8 E89DEEFFFF              call 00409E9A
:0040AFFD 6800340000              push 00003400
:0040B002 A1DC564500              mov eax, dword ptr [004556DC]
:0040B007 0500220000              add eax, 00002200
:0040B00C 50                      push eax
:0040B00D 6A04                    push 00000004
:0040B00F 6A00                    push 00000000
:0040B011 6860120000              push 00001260
:0040B016 B9A0E44600              mov ecx, 0046E4A0
:0040B01B E800C70300              call 00447720
:0040B020 50                      push eax
:0040B021 E827C40300              call 0044744D
:0040B026 83C40C                  add esp, 0000000C
:0040B029 E8D1EBFFFF              call 00409BFF
:0040B02E B9D8564500              mov ecx, 004556D8
:0040B033 E8E8E3FFFF              call 00409420
:0040B038 B9D0A64600              mov ecx, 0046A6D0
:0040B03D E89E0B0000              call 0040BBE0
:0040B042 33C9                    xor ecx, ecx
:0040B044 8AC8                    mov cl, al
:0040B046 51                      push ecx
:0040B047 E8C2ECFFFF              call 00409D0E
:0040B04C 83C404                  add esp, 00000004
:0040B04F C6054CF9460001          mov byte ptr [0046F94C], 01
:0040B056 B990A64600              mov ecx, 0046A690
:0040B05B E890DE0000              call 00418EF0
:0040B060 B994A64600              mov ecx, 0046A694
:0040B065 E82EE00000              call 00419098
:0040B06A B9D0A64600              mov ecx, 0046A6D0
:0040B06F E84C0B0000              call 0040BBC0
:0040B074 33C9                    xor ecx, ecx
:0040B076 8AC8                    mov cl, al
:0040B078 51                      push ecx
:0040B079 B990A64600              mov ecx, 0046A690
:0040B07E E847DE0000              call 00418ECA
:0040B083 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040B086 50                      push eax
:0040B087 E867EEFFFF              call 00409EF3
:0040B08C 83C404                  add esp, 00000004
:0040B08F A278E44400              mov byte ptr [0044E478], al
:0040B094 6A00                    push 00000000
:0040B096 E8EDAD0100              call 00425E88
:0040B09B 83C404                  add esp, 00000004
:0040B09E 33C0                    xor eax, eax
:0040B0A0 E900000000              jmp 0040B0A5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040AEC8(U), :0040AEFB(U), :0040B0A0(U)
|
:0040B0A5 5F                      pop edi
:0040B0A6 5E                      pop esi
:0040B0A7 5B                      pop ebx
:0040B0A8 C9                      leave
:0040B0A9 C3                      ret



* Referenced by a CALL at Addresses:
|:0040AEDE   , :0040B3E8   
|
:0040B0AA 55                      push ebp
:0040B0AB 8BEC                    mov ebp, esp
:0040B0AD 81ECE8040000            sub esp, 000004E8
:0040B0B3 53                      push ebx
:0040B0B4 56                      push esi
:0040B0B5 57                      push edi
:0040B0B6 8D8DE4FBFFFF            lea ecx, dword ptr [ebp+FFFFFBE4]
:0040B0BC E82FE3FFFF              call 004093F0
:0040B0C1 8D85A4FBFFFF            lea eax, dword ptr [ebp+FFFFFBA4]
:0040B0C7 8945FC                  mov dword ptr [ebp-04], eax
:0040B0CA 8D85F4FBFFFF            lea eax, dword ptr [ebp+FFFFFBF4]
:0040B0D0 8945F8                  mov dword ptr [ebp-08], eax
:0040B0D3 C785A0FBFFFF00000000    mov dword ptr [ebp+FFFFFBA0], 00000000
:0040B0DD E906000000              jmp 0040B0E8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B299(U)
|
:0040B0E2 FF85A0FBFFFF            inc dword ptr [ebp+FFFFFBA0]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B0DD(U)
|
:0040B0E8 83BDA0FBFFFF0A          cmp dword ptr [ebp+FFFFFBA0], 0000000A
:0040B0EF 0F83A9010000            jnb 0040B29E
:0040B0F5 8B85A0FBFFFF            mov eax, dword ptr [ebp+FFFFFBA0]
:0040B0FB C68405E8FBFFFF00        mov byte ptr [ebp+eax-00000418], 00
:0040B103 8B85A0FBFFFF            mov eax, dword ptr [ebp+FFFFFBA0]
:0040B109 8A8405E8FBFFFF          mov al, byte ptr [ebp+eax-00000418]
:0040B110 888518FBFFFF            mov byte ptr [ebp+FFFFFB18], al
:0040B116 8B85A0FBFFFF            mov eax, dword ptr [ebp+FFFFFBA0]
:0040B11C 50                      push eax
:0040B11D 8D8580FBFFFF            lea eax, dword ptr [ebp+FFFFFB80]
:0040B123 50                      push eax
:0040B124 E8F6E7FFFF              call 0040991F
:0040B129 83C408                  add esp, 00000008
:0040B12C A1442F4500              mov eax, dword ptr [00452F44]
:0040B131 50                      push eax
:0040B132 8D8580FBFFFF            lea eax, dword ptr [ebp+FFFFFB80]
:0040B138 50                      push eax
:0040B139 8D8DE4FBFFFF            lea ecx, dword ptr [ebp+FFFFFBE4]
:0040B13F E873C40300              call 004475B7
:0040B144 85C0                    test eax, eax
:0040B146 0F8520000000            jne 0040B16C
:0040B14C A1442F4500              mov eax, dword ptr [00452F44]
:0040B151 83C803                  or eax, 00000003
:0040B154 50                      push eax
:0040B155 8D8580FBFFFF            lea eax, dword ptr [ebp+FFFFFB80]
:0040B15B 50                      push eax
:0040B15C 8D8DE4FBFFFF            lea ecx, dword ptr [ebp+FFFFFBE4]
:0040B162 E850C40300              call 004475B7
:0040B167 E919000000              jmp 0040B185

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B146(C)
|
:0040B16C 6A23                    push 00000023
:0040B16E 8D8518FBFFFF            lea eax, dword ptr [ebp+FFFFFB18]
:0040B174 50                      push eax
:0040B175 68F3070000              push 000007F3
:0040B17A 8D8DE4FBFFFF            lea ecx, dword ptr [ebp+FFFFFBE4]
:0040B180 E8CBE2FFFF              call 00409450

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B167(U)
|
:0040B185 8D8DE4FBFFFF            lea ecx, dword ptr [ebp+FFFFFBE4]
:0040B18B E890E2FFFF              call 00409420
:0040B190 33C0                    xor eax, eax
:0040B192 8A8518FBFFFF            mov al, byte ptr [ebp+FFFFFB18]
:0040B198 85C0                    test eax, eax
:0040B19A 0F84A7000000            je 0040B247
:0040B1A0 8D851DFBFFFF            lea eax, dword ptr [ebp+FFFFFB1D]
:0040B1A6 50                      push eax
:0040B1A7 8D854CFBFFFF            lea eax, dword ptr [ebp+FFFFFB4C]
:0040B1AD 50                      push eax
:0040B1AE E81AC20300              call 004473CD
:0040B1B3 83C408                  add esp, 00000008
:0040B1B6 33C0                    xor eax, eax
:0040B1B8 8A851AFBFFFF            mov al, byte ptr [ebp+FFFFFB1A]
:0040B1BE 83F840                  cmp eax, 00000040
:0040B1C1 0F8D45000000            jnl 0040B20C
:0040B1C7 33C0                    xor eax, eax
:0040B1C9 8A8519FBFFFF            mov al, byte ptr [ebp+FFFFFB19]
:0040B1CF 83F863                  cmp eax, 00000063
:0040B1D2 0F8334000000            jnb 0040B20C
:0040B1D8 8D854CFBFFFF            lea eax, dword ptr [ebp+FFFFFB4C]
:0040B1DE 50                      push eax
:0040B1DF 33C0                    xor eax, eax
:0040B1E1 8A8519FBFFFF            mov al, byte ptr [ebp+FFFFFB19]
:0040B1E7 50                      push eax
:0040B1E8 33C0                    xor eax, eax
:0040B1EA 8A851AFBFFFF            mov al, byte ptr [ebp+FFFFFB1A]
:0040B1F0 50                      push eax
:0040B1F1 E8903C0100              call 0041EE86
:0040B1F6 83C404                  add esp, 00000004
:0040B1F9 50                      push eax

* Possible StringData Ref from Data Obj ->"%s Lv.%2u %s"
                                  |
:0040B1FA 6800EB4400              push 0044EB00
:0040B1FF E848DC0200              call 00438E4C
:0040B204 83C410                  add esp, 00000010
:0040B207 E914000000              jmp 0040B220

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040B1C1(C), :0040B1D2(C)
|
:0040B20C 8D854CFBFFFF            lea eax, dword ptr [ebp+FFFFFB4C]
:0040B212 50                      push eax

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:0040B213 6810EB4400              push 0044EB10
:0040B218 E82FDC0200              call 00438E4C
:0040B21D 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B207(U)
|
:0040B220 68B0F94600              push 0046F9B0
:0040B225 8D854CFBFFFF            lea eax, dword ptr [ebp+FFFFFB4C]
:0040B22B 50                      push eax
:0040B22C E89CC10300              call 004473CD
:0040B231 83C408                  add esp, 00000008
:0040B234 8B85A0FBFFFF            mov eax, dword ptr [ebp+FFFFFBA0]
:0040B23A C68405E8FBFFFF01        mov byte ptr [ebp+eax-00000418], 01
:0040B242 E915000000              jmp 0040B25C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B19A(C)
|

* Possible StringData Ref from Data Obj ->"δʹõĽ"
                                  |
:0040B247 A1D4EA4400              mov eax, dword ptr [0044EAD4]
:0040B24C 50                      push eax
:0040B24D 8D854CFBFFFF            lea eax, dword ptr [ebp+FFFFFB4C]
:0040B253 50                      push eax
:0040B254 E874C10300              call 004473CD
:0040B259 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B242(U)
|
:0040B25C 8D854CFBFFFF            lea eax, dword ptr [ebp+FFFFFB4C]
:0040B262 50                      push eax
:0040B263 E842C10300              call 004473AA
:0040B268 83C404                  add esp, 00000004
:0040B26B 8945F4                  mov dword ptr [ebp-0C], eax
:0040B26E 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040B271 40                      inc eax
:0040B272 50                      push eax
:0040B273 8B45F8                  mov eax, dword ptr [ebp-08]
:0040B276 50                      push eax
:0040B277 8D854CFBFFFF            lea eax, dword ptr [ebp+FFFFFB4C]
:0040B27D 50                      push eax
:0040B27E E8CAC10300              call 0044744D
:0040B283 83C40C                  add esp, 0000000C
:0040B286 8B45F8                  mov eax, dword ptr [ebp-08]
:0040B289 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040B28C 8901                    mov dword ptr [ecx], eax
:0040B28E 8345FC04                add dword ptr [ebp-04], 00000004
:0040B292 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040B295 40                      inc eax
:0040B296 0145F8                  add dword ptr [ebp-08], eax
:0040B299 E944FEFFFF              jmp 0040B0E2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B0EF(C)
|
:0040B29E 8B45FC                  mov eax, dword ptr [ebp-04]
:0040B2A1 C70000000000            mov dword ptr [eax], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040B36C(U), :0040B37C(U)
|
:0040B2A7 6A00                    push 00000000
:0040B2A9 6A1E                    push 0000001E
:0040B2AB 6A00                    push 00000000
:0040B2AD 6A20                    push 00000020
:0040B2AF 6A0A                    push 0000000A
:0040B2B1 8D85A4FBFFFF            lea eax, dword ptr [ebp+FFFFFBA4]
:0040B2B7 50                      push eax
:0040B2B8 6A78                    push 00000078
:0040B2BA 68C8000000              push 000000C8
:0040B2BF E830CB0200              call 00437DF4
:0040B2C4 83C420                  add esp, 00000020
:0040B2C7 33C9                    xor ecx, ecx
:0040B2C9 8AC8                    mov cl, al
:0040B2CB 898DA0FBFFFF            mov dword ptr [ebp+FFFFFBA0], ecx
:0040B2D1 81BDA0FBFFFFFF000000    cmp dword ptr [ebp+FFFFFBA0], 000000FF
:0040B2DB 0F850A000000            jne 0040B2EB
:0040B2E1 B8FFFF0000              mov eax, 0000FFFF
:0040B2E6 E996000000              jmp 0040B381

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B2DB(C)
|
:0040B2EB 8B85A0FBFFFF            mov eax, dword ptr [ebp+FFFFFBA0]
:0040B2F1 33C9                    xor ecx, ecx
:0040B2F3 8A8C05E8FBFFFF          mov cl, byte ptr [ebp+eax-00000418]
:0040B2FA 85C9                    test ecx, ecx
:0040B2FC 0F8450000000            je 0040B352
:0040B302 B814EB4400              mov eax, 0044EB14

* Possible StringData Ref from Data Obj ->"C2C7"
                                  |
:0040B307 B918EB4400              mov ecx, 0044EB18
:0040B30C 33D2                    xor edx, edx
:0040B30E 837D0800                cmp dword ptr [ebp+08], 00000000
:0040B312 0F95C2                  setne dl
:0040B315 4A                      dec edx
:0040B316 2BC8                    sub ecx, eax
:0040B318 23D1                    and edx, ecx
:0040B31A 03D0                    add edx, eax
:0040B31C 52                      push edx
:0040B31D 8B85A0FBFFFF            mov eax, dword ptr [ebp+FFFFFBA0]
:0040B323 8B8485A4FBFFFF          mov eax, dword ptr [ebp+4*eax-0000045C]
:0040B32A 50                      push eax

* Possible StringData Ref from Data Obj ->"%s%s"
                                  |
:0040B32B 6824EB4400              push 0044EB24
:0040B330 6A02                    push 00000002
:0040B332 E8FEDB0200              call 00438F35
:0040B337 83C410                  add esp, 00000010
:0040B33A 85C0                    test eax, eax
:0040B33C 0F840B000000            je 0040B34D
:0040B342 8B85A0FBFFFF            mov eax, dword ptr [ebp+FFFFFBA0]
:0040B348 E934000000              jmp 0040B381

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B33C(C)
|
:0040B34D E92A000000              jmp 0040B37C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B2FC(C)
|
:0040B352 837D0800                cmp dword ptr [ebp+08], 00000000
:0040B356 0F8415000000            je 0040B371

* Possible StringData Ref from Data Obj ->"޷ʹ"
                                  |
:0040B35C A1D8EA4400              mov eax, dword ptr [0044EAD8]
:0040B361 50                      push eax
:0040B362 6A00                    push 00000000
:0040B364 E8CCDB0200              call 00438F35
:0040B369 83C408                  add esp, 00000008
:0040B36C E936FFFFFF              jmp 0040B2A7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B356(C)
|
:0040B371 8B85A0FBFFFF            mov eax, dword ptr [ebp+FFFFFBA0]
:0040B377 E905000000              jmp 0040B381

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B34D(U)
|
:0040B37C E926FFFFFF              jmp 0040B2A7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040B2E6(U), :0040B348(U), :0040B377(U)
|
:0040B381 5F                      pop edi
:0040B382 5E                      pop esi
:0040B383 5B                      pop ebx
:0040B384 C9                      leave
:0040B385 C3                      ret


:0040B386 55                      push ebp
:0040B387 8BEC                    mov ebp, esp
:0040B389 53                      push ebx
:0040B38A 56                      push esi
:0040B38B 57                      push edi
:0040B38C 6A01                    push 00000001
:0040B38E E8B1FAFFFF              call 0040AE44
:0040B393 83C404                  add esp, 00000004
:0040B396 E900000000              jmp 0040B39B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B396(U)
|
:0040B39B 5F                      pop edi
:0040B39C 5E                      pop esi
:0040B39D 5B                      pop ebx
:0040B39E C9                      leave
:0040B39F C3                      ret



* Referenced by a CALL at Address:
|:004105DB   
|
:0040B3A0 55                      push ebp
:0040B3A1 8BEC                    mov ebp, esp
:0040B3A3 53                      push ebx
:0040B3A4 56                      push esi
:0040B3A5 57                      push edi
:0040B3A6 E80A000000              call 0040B3B5
:0040B3AB E900000000              jmp 0040B3B0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B3AB(U)
|
:0040B3B0 5F                      pop edi
:0040B3B1 5E                      pop esi
:0040B3B2 5B                      pop ebx
:0040B3B3 C9                      leave
:0040B3B4 C3                      ret



* Referenced by a CALL at Address:
|:0040B3A6   
|
:0040B3B5 55                      push ebp
:0040B3B6 8BEC                    mov ebp, esp
:0040B3B8 81EC3C010000            sub esp, 0000013C
:0040B3BE 53                      push ebx
:0040B3BF 56                      push esi
:0040B3C0 57                      push edi
:0040B3C1 8D4DD0                  lea ecx, dword ptr [ebp-30]
:0040B3C4 E827E0FFFF              call 004093F0
:0040B3C9 8D45E8                  lea eax, dword ptr [ebp-18]
:0040B3CC 50                      push eax
:0040B3CD B9B0C44600              mov ecx, 0046C4B0
:0040B3D2 E86966FFFF              call 00401A40

* Possible StringData Ref from Data Obj ->"ѡ񴢴ȡ"
                                  |
:0040B3D7 6838EB4400              push 0044EB38
:0040B3DC 6A00                    push 00000000
:0040B3DE E852DB0200              call 00438F35
:0040B3E3 83C408                  add esp, 00000008
:0040B3E6 6A00                    push 00000000
:0040B3E8 E8BDFCFFFF              call 0040B0AA
:0040B3ED 83C404                  add esp, 00000004
:0040B3F0 8945CC                  mov dword ptr [ebp-34], eax
:0040B3F3 817DCCFFFF0000          cmp dword ptr [ebp-34], 0000FFFF
:0040B3FA 0F850A000000            jne 0040B40A
:0040B400 B8FFFF0000              mov eax, 0000FFFF
:0040B405 E90B020000              jmp 0040B615

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B3FA(C)
|
:0040B40A 8B45CC                  mov eax, dword ptr [ebp-34]
:0040B40D 50                      push eax
:0040B40E 8D85C8FEFFFF            lea eax, dword ptr [ebp+FFFFFEC8]
:0040B414 50                      push eax
:0040B415 E805E5FFFF              call 0040991F
:0040B41A 83C408                  add esp, 00000008
:0040B41D A1442F4500              mov eax, dword ptr [00452F44]
:0040B422 83C802                  or eax, 00000002
:0040B425 50                      push eax
:0040B426 8D85C8FEFFFF            lea eax, dword ptr [ebp+FFFFFEC8]
:0040B42C 50                      push eax
:0040B42D 8D4DD0                  lea ecx, dword ptr [ebp-30]
:0040B430 E882C10300              call 004475B7
:0040B435 85C0                    test eax, eax
:0040B437 0F850A000000            jne 0040B447
:0040B43D B8FFFF0000              mov eax, 0000FFFF
:0040B442 E9CE010000              jmp 0040B615

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B437(C)
|
:0040B447 B9A0E44600              mov ecx, 0046E4A0
:0040B44C E88FDCFFFF              call 004090E0
:0040B451 A3DC564500              mov dword ptr [004556DC], eax
:0040B456 A1DC564500              mov eax, dword ptr [004556DC]
:0040B45B 8945E4                  mov dword ptr [ebp-1C], eax
:0040B45E 8B45E4                  mov eax, dword ptr [ebp-1C]
:0040B461 C60001                  mov byte ptr [eax], 01
:0040B464 FF45E4                  inc [ebp-1C]
:0040B467 C745D8E8564500          mov [ebp-28], 004556E8
:0040B46E 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0040B471 E80ADEFFFF              call 00409280
:0040B476 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0040B479 8801                    mov byte ptr [ecx], al
:0040B47B FF45E4                  inc [ebp-1C]
:0040B47E B900AA4600              mov ecx, 0046AA00
:0040B483 E8A864FFFF              call 00401930
:0040B488 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0040B48B 8801                    mov byte ptr [ecx], al
:0040B48D FF45E4                  inc [ebp-1C]
:0040B490 8B45E8                  mov eax, dword ptr [ebp-18]
:0040B493 50                      push eax
:0040B494 E85AEAFFFF              call 00409EF3
:0040B499 83C404                  add esp, 00000004
:0040B49C 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0040B49F 8801                    mov byte ptr [ecx], al
:0040B4A1 FF45E4                  inc [ebp-1C]
:0040B4A4 8B45EC                  mov eax, dword ptr [ebp-14]
:0040B4A7 40                      inc eax
:0040B4A8 50                      push eax
:0040B4A9 E845EAFFFF              call 00409EF3
:0040B4AE 83C404                  add esp, 00000004
:0040B4B1 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0040B4B4 8801                    mov byte ptr [ecx], al
:0040B4B6 FF45E4                  inc [ebp-1C]
:0040B4B9 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040B4BC 50                      push eax
:0040B4BD E831EAFFFF              call 00409EF3
:0040B4C2 83C404                  add esp, 00000004
:0040B4C5 A278E44400              mov byte ptr [0044E478], al
:0040B4CA A1DC564500              mov eax, dword ptr [004556DC]
:0040B4CF 83C005                  add eax, 00000005
:0040B4D2 8945E4                  mov dword ptr [ebp-1C], eax
:0040B4D5 6858CF4600              push 0046CF58
:0040B4DA 8B45E4                  mov eax, dword ptr [ebp-1C]
:0040B4DD 50                      push eax
:0040B4DE E8EABE0300              call 004473CD
:0040B4E3 83C408                  add esp, 00000008
:0040B4E6 8345E41E                add dword ptr [ebp-1C], 0000001E
:0040B4EA 8B45E4                  mov eax, dword ptr [ebp-1C]
:0040B4ED 50                      push eax
:0040B4EE B9D0A64600              mov ecx, 0046A6D0
:0040B4F3 E89F330100              call 0041E897
:0040B4F8 8945E4                  mov dword ptr [ebp-1C], eax
:0040B4FB C745DC00AA4600          mov [ebp-24], 0046AA00
:0040B502 C745D400000000          mov [ebp-2C], 00000000
:0040B509 E907000000              jmp 0040B515

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B52E(U)
|
:0040B50E FF45D4                  inc [ebp-2C]
:0040B511 8345DC0A                add dword ptr [ebp-24], 0000000A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B509(U)
|
:0040B515 837DD402                cmp dword ptr [ebp-2C], 00000002
:0040B519 0F8314000000            jnb 0040B533
:0040B51F 8B45E4                  mov eax, dword ptr [ebp-1C]
:0040B522 50                      push eax
:0040B523 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0040B526 E88F380100              call 0041EDBA
:0040B52B 8945E4                  mov dword ptr [ebp-1C], eax
:0040B52E E9DBFFFFFF              jmp 0040B50E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B519(C)
|
:0040B533 C745E0D8D54500          mov [ebp-20], 0045D5D8
:0040B53A C745D400000000          mov [ebp-2C], 00000000
:0040B541 E907000000              jmp 0040B54D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B569(U)
|
:0040B546 FF45D4                  inc [ebp-2C]
:0040B549 8345E03E                add dword ptr [ebp-20], 0000003E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B541(U)
|
:0040B54D 817DD480000000          cmp dword ptr [ebp-2C], 00000080
:0040B554 0F8314000000            jnb 0040B56E
:0040B55A 8B45E4                  mov eax, dword ptr [ebp-1C]
:0040B55D 50                      push eax
:0040B55E 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0040B561 E87BBD0000              call 004172E1
:0040B566 8945E4                  mov dword ptr [ebp-1C], eax
:0040B569 E9D8FFFFFF              jmp 0040B546

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B554(C)
|
:0040B56E C745D8E8564500          mov [ebp-28], 004556E8
:0040B575 C745D400000000          mov [ebp-2C], 00000000
:0040B57C E907000000              jmp 0040B588

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B5A4(U)
|
:0040B581 FF45D4                  inc [ebp-2C]
:0040B584 8345D836                add dword ptr [ebp-28], 00000036

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B57C(U)
|
:0040B588 817DD400020000          cmp dword ptr [ebp-2C], 00000200
:0040B58F 0F8314000000            jnb 0040B5A9
:0040B595 8B45E4                  mov eax, dword ptr [ebp-1C]
:0040B598 50                      push eax
:0040B599 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0040B59C E8E3240000              call 0040DA84
:0040B5A1 8945E4                  mov dword ptr [ebp-1C], eax
:0040B5A4 E9D8FFFFFF              jmp 0040B581

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B58F(C)
|
:0040B5A9 8B45E4                  mov eax, dword ptr [ebp-1C]
:0040B5AC 2B05DC564500            sub eax, dword ptr [004556DC]
:0040B5B2 8985C4FEFFFF            mov dword ptr [ebp+FFFFFEC4], eax
:0040B5B8 6A72                    push 00000072
:0040B5BA E8C9A80100              call 00425E88
:0040B5BF 83C404                  add esp, 00000004
:0040B5C2 8D45D0                  lea eax, dword ptr [ebp-30]
:0040B5C5 50                      push eax
:0040B5C6 B9B0C44600              mov ecx, 0046C4B0
:0040B5CB E8B1320200              call 0042E881
:0040B5D0 8B85C4FEFFFF            mov eax, dword ptr [ebp+FFFFFEC4]
:0040B5D6 50                      push eax
:0040B5D7 A1DC564500              mov eax, dword ptr [004556DC]
:0040B5DC 50                      push eax
:0040B5DD 68F3070000              push 000007F3
:0040B5E2 8D4DD0                  lea ecx, dword ptr [ebp-30]
:0040B5E5 E886050000              call 0040BB70
:0040B5EA 8D4DD0                  lea ecx, dword ptr [ebp-30]
:0040B5ED E82EDEFFFF              call 00409420
:0040B5F2 6A00                    push 00000000
:0040B5F4 E88FA80100              call 00425E88
:0040B5F9 83C404                  add esp, 00000004

* Possible StringData Ref from Data Obj ->"ϡ"
                                  |
:0040B5FC 684CEB4400              push 0044EB4C
:0040B601 6A03                    push 00000003
:0040B603 E82DD90200              call 00438F35
:0040B608 83C408                  add esp, 00000008
:0040B60B B801000000              mov eax, 00000001
:0040B610 E900000000              jmp 0040B615

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040B405(U), :0040B442(U), :0040B610(U)
|
:0040B615 5F                      pop edi
:0040B616 5E                      pop esi
:0040B617 5B                      pop ebx
:0040B618 C9                      leave
:0040B619 C3                      ret


:0040B61A 55                      push ebp
:0040B61B 8BEC                    mov ebp, esp
:0040B61D 83EC04                  sub esp, 00000004
:0040B620 53                      push ebx
:0040B621 56                      push esi
:0040B622 57                      push edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B668(U)
|
:0040B623 6A00                    push 00000000
:0040B625 6A00                    push 00000000
:0040B627 6A00                    push 00000000
:0040B629 6A00                    push 00000000
:0040B62B 6A07                    push 00000007

* Possible Indirect StringData Ref from Data Obj ->"Ϸ"
                                  |
:0040B62D B8E02D4500              mov eax, 00452DE0
:0040B632 83C014                  add eax, 00000014
:0040B635 50                      push eax
:0040B636 6A48                    push 00000048
:0040B638 6820010000              push 00000120
:0040B63D E8B2C70200              call 00437DF4
:0040B642 83C420                  add esp, 00000020
:0040B645 33C9                    xor ecx, ecx
:0040B647 8AC8                    mov cl, al
:0040B649 894DFC                  mov dword ptr [ebp-04], ecx
:0040B64C 817DFCFF000000          cmp dword ptr [ebp-04], 000000FF
:0040B653 0F8505000000            jne 0040B65E
:0040B659 E90F000000              jmp 0040B66D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B653(C)
|
:0040B65E 8B45FC                  mov eax, dword ptr [ebp-04]
:0040B661 FF1485E0E44400          call dword ptr [4*eax+0044E4E0]
:0040B668 E9B6FFFFFF              jmp 0040B623

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B659(U)
|
:0040B66D B8FFFF0000              mov eax, 0000FFFF
:0040B672 E900000000              jmp 0040B677

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B672(U)
|
:0040B677 5F                      pop edi
:0040B678 5E                      pop esi
:0040B679 5B                      pop ebx
:0040B67A C9                      leave
:0040B67B C3                      ret



* Referenced by a CALL at Address:
|:0040FFB1   
|
:0040B67C 55                      push ebp
:0040B67D 8BEC                    mov ebp, esp
:0040B67F 83EC08                  sub esp, 00000008
:0040B682 53                      push ebx
:0040B683 56                      push esi
:0040B684 57                      push edi
:0040B685 C645F800                mov [ebp-08], 00
:0040B689 B990A64600              mov ecx, 0046A690
:0040B68E E85DD80000              call 00418EF0
:0040B693 B994A64600              mov ecx, 0046A694
:0040B698 E8FBD90000              call 00419098
:0040B69D E845BE0200              call 004374E7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B701(U)
|
:0040B6A2 E859B80100              call 00426F00
:0040B6A7 8D45F8                  lea eax, dword ptr [ebp-08]
:0040B6AA 50                      push eax
:0040B6AB 6A00                    push 00000000
:0040B6AD 6A00                    push 00000000
:0040B6AF 68A0000000              push 000000A0
:0040B6B4 6A14                    push 00000014

* Possible Indirect StringData Ref from Data Obj ->""
                                  |
:0040B6B6 6800E54400              push 0044E500
:0040B6BB 6A28                    push 00000028
:0040B6BD 6820010000              push 00000120
:0040B6C2 E82DC70200              call 00437DF4
:0040B6C7 83C420                  add esp, 00000020
:0040B6CA 33C9                    xor ecx, ecx
:0040B6CC 8AC8                    mov cl, al
:0040B6CE 894DFC                  mov dword ptr [ebp-04], ecx
:0040B6D1 837DFC4A                cmp dword ptr [ebp-04], 0000004A
:0040B6D5 0F8205000000            jb 0040B6E0
:0040B6DB E926000000              jmp 0040B706

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B6D5(C)
|
:0040B6E0 E819B60100              call 00426CFE
:0040B6E5 E878B90100              call 00427062
:0040B6EA E8F8BD0200              call 004374E7
:0040B6EF 6A00                    push 00000000
:0040B6F1 6A01                    push 00000001
:0040B6F3 6A00                    push 00000000
:0040B6F5 8B45FC                  mov eax, dword ptr [ebp-04]
:0040B6F8 50                      push eax
:0040B6F9 E808B20100              call 00426906
:0040B6FE 83C410                  add esp, 00000010
:0040B701 E99CFFFFFF              jmp 0040B6A2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B6DB(U)
|

* Possible StringData Ref from Data Obj ->"C:PALET.E2"
                                  |
:0040B706 68A82B4500              push 00452BA8
:0040B70B E808B60100              call 00426D18
:0040B710 83C404                  add esp, 00000004
:0040B713 E84AB90100              call 00427062
:0040B718 B8FFFF0000              mov eax, 0000FFFF
:0040B71D E900000000              jmp 0040B722

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B71D(U)
|
:0040B722 5F                      pop edi
:0040B723 5E                      pop esi
:0040B724 5B                      pop ebx
:0040B725 C9                      leave
:0040B726 C3                      ret


:0040B727 55                      push ebp
:0040B728 8BEC                    mov ebp, esp
:0040B72A 53                      push ebx
:0040B72B 56                      push esi
:0040B72C 57                      push edi

* Possible StringData Ref from Data Obj ->"ѡ񶯻ֵĴС"
                                  |
:0040B72D 6858EB4400              push 0044EB58
:0040B732 6A00                    push 00000000
:0040B734 E8FCD70200              call 00438F35
:0040B739 83C408                  add esp, 00000008
:0040B73C E8FA470000              call 0040FF3B
:0040B741 B990A64600              mov ecx, 0046A690
:0040B746 E8A5D70000              call 00418EF0
:0040B74B B994A64600              mov ecx, 0046A694
:0040B750 E843D90000              call 00419098
:0040B755 E88DBD0200              call 004374E7
:0040B75A E803B90100              call 00427062
:0040B75F 6A00                    push 00000000
:0040B761 6A01                    push 00000001
:0040B763 6A00                    push 00000000
:0040B765 6A48                    push 00000048
:0040B767 E89AB10100              call 00426906
:0040B76C 83C410                  add esp, 00000010
:0040B76F E88AB50100              call 00426CFE

* Possible StringData Ref from Data Obj ->"C:PALET.E2"
                                  |
:0040B774 68A82B4500              push 00452BA8
:0040B779 E89AB50100              call 00426D18
:0040B77E 83C404                  add esp, 00000004
:0040B781 E8DCB80100              call 00427062
:0040B786 E8F2B70100              call 00426F7D
:0040B78B B8FFFF0000              mov eax, 0000FFFF
:0040B790 E900000000              jmp 0040B795

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B790(U)
|
:0040B795 5F                      pop edi
:0040B796 5E                      pop esi
:0040B797 5B                      pop ebx
:0040B798 C9                      leave
:0040B799 C3                      ret



* Referenced by a CALL at Address:
|:00425902   
|
:0040B79A 55                      push ebp
:0040B79B 8BEC                    mov ebp, esp
:0040B79D 83EC20                  sub esp, 00000020
:0040B7A0 53                      push ebx
:0040B7A1 56                      push esi
:0040B7A2 57                      push edi
:0040B7A3 C745E401000000          mov [ebp-1C], 00000001
:0040B7AA C645F300                mov [ebp-0D], 00
:0040B7AE 8A45F3                  mov al, byte ptr [ebp-0D]
:0040B7B1 8845F2                  mov byte ptr [ebp-0E], al
:0040B7B4 8A45F2                  mov al, byte ptr [ebp-0E]
:0040B7B7 8845F1                  mov byte ptr [ebp-0F], al
:0040B7BA 8A45F1                  mov al, byte ptr [ebp-0F]
:0040B7BD 8845F0                  mov byte ptr [ebp-10], al
:0040B7C0 B9D0A64600              mov ecx, 0046A6D0
:0040B7C5 E856020000              call 0040BA20
:0040B7CA 8945EC                  mov dword ptr [ebp-14], eax
:0040B7CD C745F800000000          mov [ebp-08], 00000000
:0040B7D4 6A04                    push 00000004
:0040B7D6 6A00                    push 00000000
:0040B7D8 68D8600000              push 000060D8
:0040B7DD B918E54600              mov ecx, 0046E518
:0040B7E2 E839BF0300              call 00447720
:0040B7E7 A3DC564500              mov dword ptr [004556DC], eax
:0040B7EC 6A00                    push 00000000
:0040B7EE 6A1E                    push 0000001E
:0040B7F0 6858CF4600              push 0046CF58
:0040B7F5 E869BC0300              call 00447463
:0040B7FA 83C40C                  add esp, 0000000C
:0040B7FD C745E800000000          mov [ebp-18], 00000000

* Possible StringData Ref from Data Obj ->"C:PALET.E2"
                                  |
:0040B804 68A82B4500              push 00452BA8
:0040B809 E80AB50100              call 00426D18
:0040B80E 83C404                  add esp, 00000004
:0040B811 E84CB80100              call 00427062
:0040B816 E8ACE4FFFF              call 00409CC7
:0040B81B E8EC280000              call 0040E10C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B970(U)
|
:0040B820 6A00                    push 00000000
:0040B822 B990A64600              mov ecx, 0046A690
:0040B827 E89ED60000              call 00418ECA
:0040B82C E8CFB60100              call 00426F00
:0040B831 33C0                    xor eax, eax
:0040B833 8A45F1                  mov al, byte ptr [ebp-0F]
:0040B836 85C0                    test eax, eax
:0040B838 0F8426000000            je 0040B864
:0040B83E 33C0                    xor eax, eax
:0040B840 8A45F2                  mov al, byte ptr [ebp-0E]
:0040B843 85C0                    test eax, eax
:0040B845 0F8419000000            je 0040B864
:0040B84B 33C0                    xor eax, eax
:0040B84D 8A45F0                  mov al, byte ptr [ebp-10]
:0040B850 85C0                    test eax, eax
:0040B852 0F840C000000            je 0040B864
:0040B858 C745FC01000000          mov [ebp-04], 00000001
:0040B85F E907000000              jmp 0040B86B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040B838(C), :0040B845(C), :0040B852(C)
|
:0040B864 C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B85F(U)
|
:0040B86B 6A00                    push 00000000
:0040B86D 6A00                    push 00000000
:0040B86F 6A00                    push 00000000
:0040B871 837DFC01                cmp dword ptr [ebp-04], 00000001
:0040B875 1BC0                    sbb eax, eax
:0040B877 F7D8                    neg eax
:0040B879 50                      push eax
:0040B87A B9D0A64600              mov ecx, 0046A6D0
:0040B87F E89C010000              call 0040BA20
:0040B884 2500020000              and eax, 00000200
:0040B889 83F801                  cmp eax, 00000001
:0040B88C 1BC0                    sbb eax, eax
:0040B88E 83E0FE                  and eax, FFFFFFFE
:0040B891 83C005                  add eax, 00000005
:0040B894 50                      push eax

* Possible Indirect StringData Ref from Data Obj ->"ʼϷ"
                                  |
:0040B895 6848E64400              push 0044E648
:0040B89A 6880000000              push 00000080
:0040B89F 68E0000000              push 000000E0
:0040B8A4 E84BC50200              call 00437DF4
:0040B8A9 83C420                  add esp, 00000020
:0040B8AC 8845E0                  mov byte ptr [ebp-20], al
:0040B8AF 33C0                    xor eax, eax
:0040B8B1 8A45E0                  mov al, byte ptr [ebp-20]
:0040B8B4 3DFF000000              cmp eax, 000000FF
:0040B8B9 0F854C000000            jne 0040B90B
:0040B8BF 837DFC00                cmp dword ptr [ebp-04], 00000000
:0040B8C3 0F843D000000            je 0040B906
:0040B8C9 837DE400                cmp dword ptr [ebp-1C], 00000000
:0040B8CD 0F8413000000            je 0040B8E6
:0040B8D3 6A27                    push 00000027
:0040B8D5 B994A64600              mov ecx, 0046A694
:0040B8DA E845D70000              call 00419024
:0040B8DF C745E400000000          mov [ebp-1C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B8CD(C)
|
:0040B8E6 B9D0A64600              mov ecx, 0046A6D0
:0040B8EB E830010000              call 0040BA20
:0040B8F0 8945EC                  mov dword ptr [ebp-14], eax
:0040B8F3 8B45EC                  mov eax, dword ptr [ebp-14]
:0040B8F6 0D00020000              or eax, 00000200
:0040B8FB 50                      push eax
:0040B8FC B9D0A64600              mov ecx, 0046A6D0
:0040B901 E84A010000              call 0040BA50

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B8C3(C)
|
:0040B906 E965000000              jmp 0040B970

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B8B9(C)
|
:0040B90B 33C0                    xor eax, eax
:0040B90D 8A45E0                  mov al, byte ptr [ebp-20]
:0040B910 33C9                    xor ecx, ecx
:0040B912 8A4C05F0                mov cl, byte ptr [ebp+eax-10]
:0040B916 80F101                  xor cl, 01
:0040B919 33C0                    xor eax, eax
:0040B91B 8A45E0                  mov al, byte ptr [ebp-20]
:0040B91E 884C05F0                mov byte ptr [ebp+eax-10], cl
:0040B922 33C0                    xor eax, eax
:0040B924 8A45E0                  mov al, byte ptr [ebp-20]
:0040B927 FF148530E64400          call dword ptr [4*eax+0044E630]
:0040B92E 3DFFFF0000              cmp eax, 0000FFFF
:0040B933 0F8437000000            je 0040B970
:0040B939 33C0                    xor eax, eax
:0040B93B 8A45E0                  mov al, byte ptr [ebp-20]
:0040B93E 8945E8                  mov dword ptr [ebp-18], eax
:0040B941 B9D0A64600              mov ecx, 0046A6D0
:0040B946 E8D5000000              call 0040BA20
:0040B94B 8945EC                  mov dword ptr [ebp-14], eax
:0040B94E F645ED02                test [ebp-13], 02
:0040B952 0F8413000000            je 0040B96B
:0040B958 8B45EC                  mov eax, dword ptr [ebp-14]
:0040B95B 25FFFDFFFF              and eax, FFFFFDFF
:0040B960 50                      push eax
:0040B961 B9D0A64600              mov ecx, 0046A6D0
:0040B966 E8E5000000              call 0040BA50

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B952(C)
|
:0040B96B E905000000              jmp 0040B975

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040B906(U), :0040B933(C)
|
:0040B970 E9ABFEFFFF              jmp 0040B820

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B96B(U)
|
:0040B975 E884B30100              call 00426CFE
:0040B97A E8E3B60100              call 00427062
:0040B97F E87CB50100              call 00426F00
:0040B984 C705902B4500FFFF0000    mov dword ptr [00452B90], 0000FFFF
:0040B98E 8B45E8                  mov eax, dword ptr [ebp-18]
:0040B991 E900000000              jmp 0040B996

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B991(U)
|
:0040B996 5F                      pop edi
:0040B997 5E                      pop esi
:0040B998 5B                      pop ebx
:0040B999 C9                      leave
:0040B99A C3                      ret


:0040B99B CC                      int 03
:0040B99C CC                      int 03
:0040B99D CC                      int 03
:0040B99E CC                      int 03
:0040B99F CC                      int 03

* Referenced by a CALL at Addresses:
|:00409A34   , :00409A45   , :00409A56   , :004163D4   , :0041EC67   
|:0041ECAD   , :0044187F   , :004418B9   , :0044353C   
|
:0040B9A0 55                      push ebp
:0040B9A1 8BEC                    mov ebp, esp
:0040B9A3 83EC04                  sub esp, 00000004
:0040B9A6 53                      push ebx
:0040B9A7 56                      push esi
:0040B9A8 57                      push edi
:0040B9A9 894DFC                  mov dword ptr [ebp-04], ecx
:0040B9AC 8B4508                  mov eax, dword ptr [ebp+08]
:0040B9AF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040B9B2 894104                  mov dword ptr [ecx+04], eax
:0040B9B5 E900000000              jmp 0040B9BA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B9B5(U)
|
:0040B9BA 5F                      pop edi
:0040B9BB 5E                      pop esi
:0040B9BC 5B                      pop ebx
:0040B9BD C9                      leave
:0040B9BE C20400                  ret 0004


:0040B9C1 CC                      int 03
:0040B9C2 CC                      int 03
:0040B9C3 CC                      int 03
:0040B9C4 CC                      int 03
:0040B9C5 CC                      int 03
:0040B9C6 CC                      int 03
:0040B9C7 CC                      int 03
:0040B9C8 CC                      int 03
:0040B9C9 CC                      int 03
:0040B9CA CC                      int 03
:0040B9CB CC                      int 03
:0040B9CC CC                      int 03
:0040B9CD CC                      int 03
:0040B9CE CC                      int 03
:0040B9CF CC                      int 03

* Referenced by a CALL at Addresses:
|:004099BA   , :0040A96B   , :0040ED65   , :0040EF55   , :0040EFB7   
|:00410029   , :00416D80   , :00425D24   , :00437A07   
|
:0040B9D0 55                      push ebp
:0040B9D1 8BEC                    mov ebp, esp
:0040B9D3 83EC04                  sub esp, 00000004
:0040B9D6 53                      push ebx
:0040B9D7 56                      push esi
:0040B9D8 57                      push edi
:0040B9D9 894DFC                  mov dword ptr [ebp-04], ecx
:0040B9DC 8B45FC                  mov eax, dword ptr [ebp-04]
:0040B9DF 8A4017                  mov al, byte ptr [eax+17]
:0040B9E2 E900000000              jmp 0040B9E7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B9E2(U)
|
:0040B9E7 5F                      pop edi
:0040B9E8 5E                      pop esi
:0040B9E9 5B                      pop ebx
:0040B9EA C9                      leave
:0040B9EB C3                      ret


:0040B9EC CC                      int 03
:0040B9ED CC                      int 03
:0040B9EE CC                      int 03
:0040B9EF CC                      int 03

* Referenced by a CALL at Addresses:
|:00409A96   , :0040FFFC   , :004252BB   
|
:0040B9F0 55                      push ebp
:0040B9F1 8BEC                    mov ebp, esp
:0040B9F3 83EC04                  sub esp, 00000004
:0040B9F6 53                      push ebx
:0040B9F7 56                      push esi
:0040B9F8 57                      push edi
:0040B9F9 894DFC                  mov dword ptr [ebp-04], ecx
:0040B9FC 8A4508                  mov al, byte ptr [ebp+08]
:0040B9FF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040BA02 884117                  mov byte ptr [ecx+17], al
:0040BA05 E900000000              jmp 0040BA0A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BA05(U)
|
:0040BA0A 5F                      pop edi
:0040BA0B 5E                      pop esi
:0040BA0C 5B                      pop ebx
:0040BA0D C9                      leave
:0040BA0E C20400                  ret 0004


:0040BA11 CC                      int 03
:0040BA12 CC                      int 03
:0040BA13 CC                      int 03
:0040BA14 CC                      int 03
:0040BA15 CC                      int 03
:0040BA16 CC                      int 03
:0040BA17 CC                      int 03
:0040BA18 CC                      int 03
:0040BA19 CC                      int 03
:0040BA1A CC                      int 03
:0040BA1B CC                      int 03
:0040BA1C CC                      int 03
:0040BA1D CC                      int 03
:0040BA1E CC                      int 03
:0040BA1F CC                      int 03

* Referenced by a CALL at Addresses:
|:004099D4   , :0040A430   , :0040B7C5   , :0040B87F   , :0040B8EB   
|:0040B946   , :0040FE28   , :0040FED6   , :0040FF59   , :00410274   
|:004102E4   , :004103D8   , :004104E4   , :00410567   , :00418E90   
|:00418F99   , :00425D89   , :00425E08   , :00425E4D   , :004261B1   
|:00437FFC   , :00439168   , :0043FDCF   , :0043FE18   , :0043FF7A   
|:00441FB7   
|
:0040BA20 55                      push ebp
:0040BA21 8BEC                    mov ebp, esp
:0040BA23 83EC04                  sub esp, 00000004
:0040BA26 53                      push ebx
:0040BA27 56                      push esi
:0040BA28 57                      push edi
:0040BA29 894DFC                  mov dword ptr [ebp-04], ecx
:0040BA2C 8B45FC                  mov eax, dword ptr [ebp-04]
:0040BA2F 33C9                    xor ecx, ecx
:0040BA31 668B480E                mov cx, word ptr [eax+0E]
:0040BA35 8BC1                    mov eax, ecx
:0040BA37 E900000000              jmp 0040BA3C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BA37(U)
|
:0040BA3C 5F                      pop edi
:0040BA3D 5E                      pop esi
:0040BA3E 5B                      pop ebx
:0040BA3F C9                      leave
:0040BA40 C3                      ret


:0040BA41 CC                      int 03
:0040BA42 CC                      int 03
:0040BA43 CC                      int 03
:0040BA44 CC                      int 03
:0040BA45 CC                      int 03
:0040BA46 CC                      int 03
:0040BA47 CC                      int 03
:0040BA48 CC                      int 03
:0040BA49 CC                      int 03
:0040BA4A CC                      int 03
:0040BA4B CC                      int 03
:0040BA4C CC                      int 03
:0040BA4D CC                      int 03
:0040BA4E CC                      int 03
:0040BA4F CC                      int 03

* Referenced by a CALL at Addresses:
|:00409A0C   , :0040B901   , :0040B966   , :0040FE40   , :0040FF00   
|:0040FF2C   , :00410229   , :004102A0   , :004102C0   , :0041031A   
|:00410344   , :0041050E   , :0041053A   , :00425220   , :004420D6   
|
:0040BA50 55                      push ebp
:0040BA51 8BEC                    mov ebp, esp
:0040BA53 83EC04                  sub esp, 00000004
:0040BA56 53                      push ebx
:0040BA57 56                      push esi
:0040BA58 57                      push edi
:0040BA59 894DFC                  mov dword ptr [ebp-04], ecx
:0040BA5C 8B4508                  mov eax, dword ptr [ebp+08]
:0040BA5F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040BA62 6689410E                mov word ptr [ecx+0E], ax
:0040BA66 E900000000              jmp 0040BA6B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BA66(U)
|
:0040BA6B 5F                      pop edi
:0040BA6C 5E                      pop esi
:0040BA6D 5B                      pop ebx
:0040BA6E C9                      leave
:0040BA6F C20400                  ret 0004


:0040BA72 CC                      int 03
:0040BA73 CC                      int 03
:0040BA74 CC                      int 03
:0040BA75 CC                      int 03
:0040BA76 CC                      int 03
:0040BA77 CC                      int 03
:0040BA78 CC                      int 03
:0040BA79 CC                      int 03
:0040BA7A CC                      int 03
:0040BA7B CC                      int 03
:0040BA7C CC                      int 03
:0040BA7D CC                      int 03
:0040BA7E CC                      int 03
:0040BA7F CC                      int 03

* Referenced by a CALL at Addresses:
|:00409ABD   , :00409AD7   , :00409AF1   , :00409B0B   , :00441D45   
|:00441DDC   , :00441EA5   , :004420C0   
|
:0040BA80 55                      push ebp
:0040BA81 8BEC                    mov ebp, esp
:0040BA83 83EC04                  sub esp, 00000004
:0040BA86 53                      push ebx
:0040BA87 56                      push esi
:0040BA88 57                      push edi
:0040BA89 894DFC                  mov dword ptr [ebp-04], ecx
:0040BA8C 8B4508                  mov eax, dword ptr [ebp+08]
:0040BA8F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040BA92 66894108                mov word ptr [ecx+08], ax
:0040BA96 E900000000              jmp 0040BA9B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BA96(U)
|
:0040BA9B 5F                      pop edi
:0040BA9C 5E                      pop esi
:0040BA9D 5B                      pop ebx
:0040BA9E C9                      leave
:0040BA9F C20400                  ret 0004


:0040BAA2 CC                      int 03
:0040BAA3 CC                      int 03
:0040BAA4 CC                      int 03
:0040BAA5 CC                      int 03
:0040BAA6 CC                      int 03
:0040BAA7 CC                      int 03
:0040BAA8 CC                      int 03
:0040BAA9 CC                      int 03
:0040BAAA CC                      int 03
:0040BAAB CC                      int 03
:0040BAAC CC                      int 03
:0040BAAD CC                      int 03
:0040BAAE CC                      int 03
:0040BAAF CC                      int 03

* Referenced by a CALL at Addresses:
|:004099C7   , :0040A8B9   , :004100CE   , :0041A5D3   , :0041A6E6   
|:0041C044   , :0041C0E6   , :0041C99C   , :0041C9AE   , :0041D328   
|:00423ADF   , :00423B02   , :004418C8   
|
:0040BAB0 55                      push ebp
:0040BAB1 8BEC                    mov ebp, esp
:0040BAB3 83EC04                  sub esp, 00000004
:0040BAB6 53                      push ebx
:0040BAB7 56                      push esi
:0040BAB8 57                      push edi
:0040BAB9 894DFC                  mov dword ptr [ebp-04], ecx
:0040BABC 8B45FC                  mov eax, dword ptr [ebp-04]
:0040BABF 33C9                    xor ecx, ecx
:0040BAC1 668B480A                mov cx, word ptr [eax+0A]
:0040BAC5 8BC1                    mov eax, ecx
:0040BAC7 E900000000              jmp 0040BACC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BAC7(U)
|
:0040BACC 5F                      pop edi
:0040BACD 5E                      pop esi
:0040BACE 5B                      pop ebx
:0040BACF C9                      leave
:0040BAD0 C3                      ret


:0040BAD1 CC                      int 03
:0040BAD2 CC                      int 03
:0040BAD3 CC                      int 03
:0040BAD4 CC                      int 03
:0040BAD5 CC                      int 03
:0040BAD6 CC                      int 03
:0040BAD7 CC                      int 03
:0040BAD8 CC                      int 03
:0040BAD9 CC                      int 03
:0040BADA CC                      int 03
:0040BADB CC                      int 03
:0040BADC CC                      int 03
:0040BADD CC                      int 03
:0040BADE CC                      int 03
:0040BADF CC                      int 03

* Referenced by a CALL at Addresses:
|:00409A1A   , :0040A426   , :004100A1   , :0044194A   , :0044195B   
|:0044196C   
|
:0040BAE0 55                      push ebp
:0040BAE1 8BEC                    mov ebp, esp
:0040BAE3 83EC04                  sub esp, 00000004
:0040BAE6 53                      push ebx
:0040BAE7 56                      push esi
:0040BAE8 57                      push edi
:0040BAE9 894DFC                  mov dword ptr [ebp-04], ecx
:0040BAEC 8B4508                  mov eax, dword ptr [ebp+08]
:0040BAEF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040BAF2 6689410A                mov word ptr [ecx+0A], ax
:0040BAF6 E900000000              jmp 0040BAFB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BAF6(U)
|
:0040BAFB 5F                      pop edi
:0040BAFC 5E                      pop esi
:0040BAFD 5B                      pop ebx
:0040BAFE C9                      leave
:0040BAFF C20400                  ret 0004


:0040BB02 CC                      int 03
:0040BB03 CC                      int 03
:0040BB04 CC                      int 03
:0040BB05 CC                      int 03
:0040BB06 CC                      int 03
:0040BB07 CC                      int 03
:0040BB08 CC                      int 03
:0040BB09 CC                      int 03
:0040BB0A CC                      int 03
:0040BB0B CC                      int 03
:0040BB0C CC                      int 03
:0040BB0D CC                      int 03
:0040BB0E CC                      int 03
:0040BB0F CC                      int 03

* Referenced by a CALL at Addresses:
|:00409AA2   , :00441F78   
|
:0040BB10 55                      push ebp
:0040BB11 8BEC                    mov ebp, esp
:0040BB13 83EC04                  sub esp, 00000004
:0040BB16 53                      push ebx
:0040BB17 56                      push esi
:0040BB18 57                      push edi
:0040BB19 894DFC                  mov dword ptr [ebp-04], ecx
:0040BB1C 8A4508                  mov al, byte ptr [ebp+08]
:0040BB1F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040BB22 884115                  mov byte ptr [ecx+15], al
:0040BB25 E900000000              jmp 0040BB2A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BB25(U)
|
:0040BB2A 5F                      pop edi
:0040BB2B 5E                      pop esi
:0040BB2C 5B                      pop ebx
:0040BB2D C9                      leave
:0040BB2E C20400                  ret 0004


:0040BB31 CC                      int 03
:0040BB32 CC                      int 03
:0040BB33 CC                      int 03
:0040BB34 CC                      int 03
:0040BB35 CC                      int 03
:0040BB36 CC                      int 03
:0040BB37 CC                      int 03
:0040BB38 CC                      int 03
:0040BB39 CC                      int 03
:0040BB3A CC                      int 03
:0040BB3B CC                      int 03
:0040BB3C CC                      int 03
:0040BB3D CC                      int 03
:0040BB3E CC                      int 03
:0040BB3F CC                      int 03

* Referenced by a CALL at Addresses:
|:00409D45   , :00409DD2   , :00427986   , :00433BA6   , :00433BFD   
|:00433E67   , :00433FE7   , :00440B68   , :00440C64   , :00440DD0   
|
:0040BB40 55                      push ebp
:0040BB41 8BEC                    mov ebp, esp
:0040BB43 83EC04                  sub esp, 00000004
:0040BB46 53                      push ebx
:0040BB47 56                      push esi
:0040BB48 57                      push edi
:0040BB49 894DFC                  mov dword ptr [ebp-04], ecx
:0040BB4C 8B4508                  mov eax, dword ptr [ebp+08]
:0040BB4F 8BC8                    mov ecx, eax
:0040BB51 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040BB54 C1E003                  shl eax, 03
:0040BB57 2BC1                    sub eax, ecx
:0040BB59 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040BB5C 8D840881030000          lea eax, dword ptr [eax+ecx+00000381]
:0040BB63 E900000000              jmp 0040BB68

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BB63(U)
|
:0040BB68 5F                      pop edi
:0040BB69 5E                      pop esi
:0040BB6A 5B                      pop ebx
:0040BB6B C9                      leave
:0040BB6C C20400                  ret 0004


:0040BB6F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040A186   , :0040B5E5   
|
:0040BB70 55                      push ebp
:0040BB71 8BEC                    mov ebp, esp
:0040BB73 83EC04                  sub esp, 00000004
:0040BB76 53                      push ebx
:0040BB77 56                      push esi
:0040BB78 57                      push edi
:0040BB79 894DFC                  mov dword ptr [ebp-04], ecx
:0040BB7C 6A00                    push 00000000
:0040BB7E 8B4508                  mov eax, dword ptr [ebp+08]
:0040BB81 50                      push eax
:0040BB82 8B45FC                  mov eax, dword ptr [ebp-04]
:0040BB85 8B00                    mov eax, dword ptr [eax]
:0040BB87 50                      push eax
:0040BB88 E810BD0300              call 0044789D
:0040BB8D 83C40C                  add esp, 0000000C
:0040BB90 8B4510                  mov eax, dword ptr [ebp+10]
:0040BB93 50                      push eax
:0040BB94 8B450C                  mov eax, dword ptr [ebp+0C]
:0040BB97 50                      push eax
:0040BB98 8B45FC                  mov eax, dword ptr [ebp-04]
:0040BB9B 8B00                    mov eax, dword ptr [eax]
:0040BB9D 50                      push eax
:0040BB9E E8D8BC0300              call 0044787B
:0040BBA3 83C40C                  add esp, 0000000C
:0040BBA6 E900000000              jmp 0040BBAB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BBA6(U)
|
:0040BBAB 5F                      pop edi
:0040BBAC 5E                      pop esi
:0040BBAD 5B                      pop ebx
:0040BBAE C9                      leave
:0040BBAF C20C00                  ret 000C


:0040BBB2 CC                      int 03
:0040BBB3 CC                      int 03
:0040BBB4 CC                      int 03
:0040BBB5 CC                      int 03
:0040BBB6 CC                      int 03
:0040BBB7 CC                      int 03
:0040BBB8 CC                      int 03
:0040BBB9 CC                      int 03
:0040BBBA CC                      int 03
:0040BBBB CC                      int 03
:0040BBBC CC                      int 03
:0040BBBD CC                      int 03
:0040BBBE CC                      int 03
:0040BBBF CC                      int 03

* Referenced by a CALL at Addresses:
|:0040A3A0   , :0040B06F   , :00410139   , :0041034E   , :0043966A   
|:00442109   
|
:0040BBC0 55                      push ebp
:0040BBC1 8BEC                    mov ebp, esp
:0040BBC3 83EC04                  sub esp, 00000004
:0040BBC6 53                      push ebx
:0040BBC7 56                      push esi
:0040BBC8 57                      push edi
:0040BBC9 894DFC                  mov dword ptr [ebp-04], ecx
:0040BBCC 8B45FC                  mov eax, dword ptr [ebp-04]
:0040BBCF 8A4012                  mov al, byte ptr [eax+12]
:0040BBD2 E900000000              jmp 0040BBD7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BBD2(U)
|
:0040BBD7 5F                      pop edi
:0040BBD8 5E                      pop esi
:0040BBD9 5B                      pop ebx
:0040BBDA C9                      leave
:0040BBDB C3                      ret


:0040BBDC CC                      int 03
:0040BBDD CC                      int 03
:0040BBDE CC                      int 03
:0040BBDF CC                      int 03

* Referenced by a CALL at Addresses:
|:0040A36E   , :0040B03D   , :004155E7   , :0041F092   
|
:0040BBE0 55                      push ebp
:0040BBE1 8BEC                    mov ebp, esp
:0040BBE3 83EC04                  sub esp, 00000004
:0040BBE6 53                      push ebx
:0040BBE7 56                      push esi
:0040BBE8 57                      push edi
:0040BBE9 894DFC                  mov dword ptr [ebp-04], ecx
:0040BBEC 8B45FC                  mov eax, dword ptr [ebp-04]
:0040BBEF 8A4016                  mov al, byte ptr [eax+16]
:0040BBF2 E900000000              jmp 0040BBF7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BBF2(U)
|
:0040BBF7 5F                      pop edi
:0040BBF8 5E                      pop esi
:0040BBF9 5B                      pop ebx
:0040BBFA C9                      leave
:0040BBFB C3                      ret


:0040BBFC CC                      int 03
:0040BBFD CC                      int 03
:0040BBFE CC                      int 03
:0040BBFF CC                      int 03

* Referenced by a CALL at Addresses:
|:0040AA24   , :0040FE6D   , :00427232   
|
:0040BC00 55                      push ebp
:0040BC01 8BEC                    mov ebp, esp
:0040BC03 83EC04                  sub esp, 00000004
:0040BC06 53                      push ebx
:0040BC07 56                      push esi
:0040BC08 57                      push edi
:0040BC09 894DFC                  mov dword ptr [ebp-04], ecx
:0040BC0C 8B45FC                  mov eax, dword ptr [ebp-04]
:0040BC0F 33C9                    xor ecx, ecx
:0040BC11 668B480E                mov cx, word ptr [eax+0E]
:0040BC15 83E10F                  and ecx, 0000000F
:0040BC18 8BC1                    mov eax, ecx
:0040BC1A E900000000              jmp 0040BC1F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BC1A(U)
|
:0040BC1F 5F                      pop edi
:0040BC20 5E                      pop esi
:0040BC21 5B                      pop ebx
:0040BC22 C9                      leave
:0040BC23 C3                      ret


:0040BC24 CC                      int 03
:0040BC25 CC                      int 03
:0040BC26 CC                      int 03
:0040BC27 CC                      int 03
:0040BC28 CC                      int 03
:0040BC29 CC                      int 03
:0040BC2A CC                      int 03
:0040BC2B CC                      int 03
:0040BC2C CC                      int 03
:0040BC2D CC                      int 03
:0040BC2E CC                      int 03
:0040BC2F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040A4FC   , :0040A5D7   , :0040A6B2   , :0040A78D   , :0040A856   
|:0040A908   , :0040A9C1   , :0040AA75   , :0040AB02   , :00439246   
|:00439280   , :0043C4BF   , :0043F9FE   , :0043FB44   , :00443FB6   
|
:0040BC30 55                      push ebp
:0040BC31 8BEC                    mov ebp, esp
:0040BC33 83EC04                  sub esp, 00000004
:0040BC36 53                      push ebx
:0040BC37 56                      push esi
:0040BC38 57                      push edi
:0040BC39 894DFC                  mov dword ptr [ebp-04], ecx
:0040BC3C 8B4520                  mov eax, dword ptr [ebp+20]
:0040BC3F 50                      push eax
:0040BC40 8B451C                  mov eax, dword ptr [ebp+1C]
:0040BC43 50                      push eax
:0040BC44 8B4518                  mov eax, dword ptr [ebp+18]
:0040BC47 50                      push eax
:0040BC48 8B4514                  mov eax, dword ptr [ebp+14]
:0040BC4B 50                      push eax
:0040BC4C 8B4510                  mov eax, dword ptr [ebp+10]
:0040BC4F 50                      push eax
:0040BC50 8B450C                  mov eax, dword ptr [ebp+0C]
:0040BC53 50                      push eax
:0040BC54 8B4508                  mov eax, dword ptr [ebp+08]
:0040BC57 50                      push eax
:0040BC58 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040BC5B E830000000              call 0040BC90
:0040BC60 E900000000              jmp 0040BC65

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BC60(U)
|
:0040BC65 5F                      pop edi
:0040BC66 5E                      pop esi
:0040BC67 5B                      pop ebx
:0040BC68 C9                      leave
:0040BC69 C21C00                  ret 001C


:0040BC6C CC                      int 03
:0040BC6D CC                      int 03
:0040BC6E CC                      int 03
:0040BC6F CC                      int 03

* Referenced by a CALL at Addresses:
|:00439536   , :0043953F   , :0043962D   , :00439636   , :0043CA73   
|:0043FD4F   , :0043FD5B   , :00444038   
|
:0040BC70 55                      push ebp
:0040BC71 8BEC                    mov ebp, esp
:0040BC73 83EC04                  sub esp, 00000004
:0040BC76 53                      push ebx
:0040BC77 56                      push esi
:0040BC78 57                      push edi
:0040BC79 894DFC                  mov dword ptr [ebp-04], ecx
:0040BC7C E900000000              jmp 0040BC81

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BC7C(U)
|
:0040BC81 5F                      pop edi
:0040BC82 5E                      pop esi
:0040BC83 5B                      pop ebx
:0040BC84 C9                      leave
:0040BC85 C3                      ret


:0040BC86 CC                      int 03
:0040BC87 CC                      int 03
:0040BC88 CC                      int 03
:0040BC89 CC                      int 03
:0040BC8A CC                      int 03
:0040BC8B CC                      int 03
:0040BC8C CC                      int 03
:0040BC8D CC                      int 03
:0040BC8E CC                      int 03
:0040BC8F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040BC5B   , :0040BD4B   , :00421CE0   
|
:0040BC90 55                      push ebp
:0040BC91 8BEC                    mov ebp, esp
:0040BC93 83EC04                  sub esp, 00000004
:0040BC96 53                      push ebx
:0040BC97 56                      push esi
:0040BC98 57                      push edi
:0040BC99 894DFC                  mov dword ptr [ebp-04], ecx
:0040BC9C 8B4508                  mov eax, dword ptr [ebp+08]
:0040BC9F C1E003                  shl eax, 03
:0040BCA2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040BCA5 8901                    mov dword ptr [ecx], eax
:0040BCA7 8B450C                  mov eax, dword ptr [ebp+0C]
:0040BCAA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040BCAD 894104                  mov dword ptr [ecx+04], eax
:0040BCB0 8B4510                  mov eax, dword ptr [ebp+10]
:0040BCB3 C1E003                  shl eax, 03
:0040BCB6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040BCB9 894108                  mov dword ptr [ecx+08], eax
:0040BCBC 8B4514                  mov eax, dword ptr [ebp+14]
:0040BCBF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040BCC2 89410C                  mov dword ptr [ecx+0C], eax
:0040BCC5 8B4518                  mov eax, dword ptr [ebp+18]
:0040BCC8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040BCCB 894110                  mov dword ptr [ecx+10], eax
:0040BCCE 8A451C                  mov al, byte ptr [ebp+1C]
:0040BCD1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040BCD4 884114                  mov byte ptr [ecx+14], al
:0040BCD7 8A4520                  mov al, byte ptr [ebp+20]
:0040BCDA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040BCDD 884115                  mov byte ptr [ecx+15], al
:0040BCE0 E900000000              jmp 0040BCE5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BCE0(U)
|
:0040BCE5 5F                      pop edi
:0040BCE6 5E                      pop esi
:0040BCE7 5B                      pop ebx
:0040BCE8 C9                      leave
:0040BCE9 C21C00                  ret 001C


:0040BCEC CC                      int 03
:0040BCED CC                      int 03
:0040BCEE CC                      int 03
:0040BCEF CC                      int 03
:0040BCF0 55                      push ebp
:0040BCF1 8BEC                    mov ebp, esp
:0040BCF3 83EC04                  sub esp, 00000004
:0040BCF6 53                      push ebx
:0040BCF7 56                      push esi
:0040BCF8 57                      push edi
:0040BCF9 894DFC                  mov dword ptr [ebp-04], ecx
:0040BCFC 6A00                    push 00000000
:0040BCFE 6A00                    push 00000000
:0040BD00 6A00                    push 00000000
:0040BD02 6A00                    push 00000000
:0040BD04 6A00                    push 00000000
:0040BD06 6A00                    push 00000000
:0040BD08 6A00                    push 00000000
:0040BD0A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040BD0D E80E000000              call 0040BD20
:0040BD12 E900000000              jmp 0040BD17

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BD12(U)
|
:0040BD17 5F                      pop edi
:0040BD18 5E                      pop esi
:0040BD19 5B                      pop ebx
:0040BD1A C9                      leave
:0040BD1B C3                      ret


:0040BD1C CC                      int 03
:0040BD1D CC                      int 03
:0040BD1E CC                      int 03
:0040BD1F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040BD0D   , :00439222   , :0043925F   , :0043C3D6   , :0043F9DB   
|:0043FA2A   , :00443F93   
|
:0040BD20 55                      push ebp
:0040BD21 8BEC                    mov ebp, esp
:0040BD23 83EC04                  sub esp, 00000004
:0040BD26 53                      push ebx
:0040BD27 56                      push esi
:0040BD28 57                      push edi
:0040BD29 894DFC                  mov dword ptr [ebp-04], ecx
:0040BD2C 8B4520                  mov eax, dword ptr [ebp+20]
:0040BD2F 50                      push eax
:0040BD30 8B451C                  mov eax, dword ptr [ebp+1C]
:0040BD33 50                      push eax
:0040BD34 8B4518                  mov eax, dword ptr [ebp+18]
:0040BD37 50                      push eax
:0040BD38 8B4514                  mov eax, dword ptr [ebp+14]
:0040BD3B 50                      push eax
:0040BD3C 8B4510                  mov eax, dword ptr [ebp+10]
:0040BD3F 50                      push eax
:0040BD40 8B450C                  mov eax, dword ptr [ebp+0C]
:0040BD43 50                      push eax
:0040BD44 8B4508                  mov eax, dword ptr [ebp+08]
:0040BD47 50                      push eax
:0040BD48 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040BD4B E840FFFFFF              call 0040BC90
:0040BD50 E900000000              jmp 0040BD55

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BD50(U)
|
:0040BD55 8B45FC                  mov eax, dword ptr [ebp-04]
:0040BD58 5F                      pop edi
:0040BD59 5E                      pop esi
:0040BD5A 5B                      pop ebx
:0040BD5B C9                      leave
:0040BD5C C21C00                  ret 001C


:0040BD5F CC                      int 03
:0040BD60 55                      push ebp
:0040BD61 8BEC                    mov ebp, esp
:0040BD63 53                      push ebx
:0040BD64 56                      push esi
:0040BD65 57                      push edi
:0040BD66 E80F000000              call 0040BD7A
:0040BD6B E835000000              call 0040BDA5
:0040BD70 E900000000              jmp 0040BD75

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BD70(U)
|
:0040BD75 5F                      pop edi
:0040BD76 5E                      pop esi
:0040BD77 5B                      pop ebx
:0040BD78 C9                      leave
:0040BD79 C3                      ret



* Referenced by a CALL at Address:
|:0040BD66   
|
:0040BD7A 55                      push ebp
:0040BD7B 8BEC                    mov ebp, esp
:0040BD7D 53                      push ebx
:0040BD7E 56                      push esi
:0040BD7F 57                      push edi
:0040BD80 6860DD4000              push 0040DD60
:0040BD85 6890DC4000              push 0040DC90
:0040BD8A 6800020000              push 00000200
:0040BD8F 6A36                    push 00000036
:0040BD91 68E8564500              push 004556E8
:0040BD96 E8A5BF0300              call 00447D40
:0040BD9B E900000000              jmp 0040BDA0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BD9B(U)
|
:0040BDA0 5F                      pop edi
:0040BDA1 5E                      pop esi
:0040BDA2 5B                      pop ebx
:0040BDA3 C9                      leave
:0040BDA4 C3                      ret



* Referenced by a CALL at Address:
|:0040BD6B   
|
:0040BDA5 55                      push ebp
:0040BDA6 8BEC                    mov ebp, esp
:0040BDA8 53                      push ebx
:0040BDA9 56                      push esi
:0040BDAA 57                      push edi
:0040BDAB 68C2BD4000              push 0040BDC2
:0040BDB0 E82BBF0300              call 00447CE0
:0040BDB5 83C404                  add esp, 00000004
:0040BDB8 E900000000              jmp 0040BDBD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BDB8(U)
|
:0040BDBD 5F                      pop edi
:0040BDBE 5E                      pop esi
:0040BDBF 5B                      pop ebx
:0040BDC0 C9                      leave
:0040BDC1 C3                      ret


:0040BDC2 55                      push ebp
:0040BDC3 8BEC                    mov ebp, esp
:0040BDC5 53                      push ebx
:0040BDC6 56                      push esi
:0040BDC7 57                      push edi
:0040BDC8 6860DD4000              push 0040DD60
:0040BDCD 6800020000              push 00000200
:0040BDD2 6A36                    push 00000036
:0040BDD4 68E8564500              push 004556E8
:0040BDD9 E8F2BF0300              call 00447DD0
:0040BDDE E900000000              jmp 0040BDE3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BDDE(U)
|
:0040BDE3 5F                      pop edi
:0040BDE4 5E                      pop esi
:0040BDE5 5B                      pop ebx
:0040BDE6 C9                      leave
:0040BDE7 C3                      ret



* Referenced by a CALL at Addresses:
|:004038A8   , :0040D2CF   , :00434377   , :00434EA4   , :00434F4B   
|:00434F89   , :00434FDD   , :00435020   , :0043599E   , :00435F34   
|:004364D8   , :00436782   , :004368EE   , :0043697B   , :00436BC3   
|
:0040BDE8 55                      push ebp
:0040BDE9 8BEC                    mov ebp, esp
:0040BDEB 53                      push ebx
:0040BDEC 56                      push esi
:0040BDED 57                      push edi
:0040BDEE 817D0800020000          cmp dword ptr [ebp+08], 00000200
:0040BDF5 0F8207000000            jb 0040BE02
:0040BDFB 33C0                    xor eax, eax
:0040BDFD E919000000              jmp 0040BE1B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BDF5(C)
|
:0040BE02 8B4508                  mov eax, dword ptr [ebp+08]
:0040BE05 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040BE08 03C0                    add eax, eax
:0040BE0A 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:0040BE11 E8CAD6FFFF              call 004094E0
:0040BE16 E900000000              jmp 0040BE1B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040BDFD(U), :0040BE16(U)
|
:0040BE1B 5F                      pop edi
:0040BE1C 5E                      pop esi
:0040BE1D 5B                      pop ebx
:0040BE1E C9                      leave
:0040BE1F C3                      ret



* Referenced by a CALL at Addresses:
|:00404170   , :00407D72   , :00410735   , :00431A6C   , :004339CB   
|:004339EE   
|
:0040BE20 55                      push ebp
:0040BE21 8BEC                    mov ebp, esp
:0040BE23 83EC04                  sub esp, 00000004
:0040BE26 53                      push ebx
:0040BE27 56                      push esi
:0040BE28 57                      push edi
:0040BE29 8B450C                  mov eax, dword ptr [ebp+0C]
:0040BE2C 8945FC                  mov dword ptr [ebp-04], eax
:0040BE2F E94D010000              jmp 0040BF81
:0040BE34 8B4508                  mov eax, dword ptr [ebp+08]
:0040BE37 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040BE3A 03C0                    add eax, eax
:0040BE3C 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:0040BE43 E8981F0000              call 0040DDE0
:0040BE48 33C9                    xor ecx, ecx
:0040BE4A 8AC8                    mov cl, al
:0040BE4C 8BC1                    mov eax, ecx
:0040BE4E E975010000              jmp 0040BFC8
:0040BE53 8B4508                  mov eax, dword ptr [ebp+08]
:0040BE56 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040BE59 03C0                    add eax, eax
:0040BE5B 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:0040BE62 E8A9D2FFFF              call 00409110
:0040BE67 33C9                    xor ecx, ecx
:0040BE69 8AC8                    mov cl, al
:0040BE6B 8BC1                    mov eax, ecx
:0040BE6D E956010000              jmp 0040BFC8
:0040BE72 8B4508                  mov eax, dword ptr [ebp+08]
:0040BE75 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040BE78 03C0                    add eax, eax
:0040BE7A 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:0040BE81 E83A1F0000              call 0040DDC0
:0040BE86 33C9                    xor ecx, ecx
:0040BE88 8AC8                    mov cl, al
:0040BE8A 8BC1                    mov eax, ecx
:0040BE8C E937010000              jmp 0040BFC8
:0040BE91 8B4508                  mov eax, dword ptr [ebp+08]
:0040BE94 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040BE97 03C0                    add eax, eax
:0040BE99 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:0040BEA0 E8EBD8FFFF              call 00409790
:0040BEA5 E91E010000              jmp 0040BFC8
:0040BEAA 8B4508                  mov eax, dword ptr [ebp+08]
:0040BEAD 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040BEB0 03C0                    add eax, eax
:0040BEB2 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:0040BEB9 E822D3FFFF              call 004091E0
:0040BEBE 33C9                    xor ecx, ecx
:0040BEC0 8AC8                    mov cl, al
:0040BEC2 8BC1                    mov eax, ecx
:0040BEC4 E9FF000000              jmp 0040BFC8
:0040BEC9 8B4508                  mov eax, dword ptr [ebp+08]
:0040BECC 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040BECF 03C0                    add eax, eax
:0040BED1 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:0040BED8 E803D7FFFF              call 004095E0
:0040BEDD 33C9                    xor ecx, ecx
:0040BEDF 8AC8                    mov cl, al
:0040BEE1 8BC1                    mov eax, ecx
:0040BEE3 E9E0000000              jmp 0040BFC8
:0040BEE8 8B4508                  mov eax, dword ptr [ebp+08]
:0040BEEB 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040BEEE 03C0                    add eax, eax
:0040BEF0 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:0040BEF7 E86F0C0000              call 0040CB6B
:0040BEFC E9C7000000              jmp 0040BFC8
:0040BF01 8B4508                  mov eax, dword ptr [ebp+08]
:0040BF04 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040BF07 03C0                    add eax, eax
:0040BF09 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:0040BF10 E8970C0000              call 0040CBAC
:0040BF15 E9AE000000              jmp 0040BFC8
:0040BF1A 8B4508                  mov eax, dword ptr [ebp+08]
:0040BF1D 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040BF20 03C0                    add eax, eax
:0040BF22 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:0040BF29 E8BF0C0000              call 0040CBED
:0040BF2E 33C9                    xor ecx, ecx
:0040BF30 8AC8                    mov cl, al
:0040BF32 8BC1                    mov eax, ecx
:0040BF34 E98F000000              jmp 0040BFC8
:0040BF39 8B4508                  mov eax, dword ptr [ebp+08]
:0040BF3C 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040BF3F 03C0                    add eax, eax
:0040BF41 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:0040BF48 E883D3FFFF              call 004092D0
:0040BF4D 33C9                    xor ecx, ecx
:0040BF4F 8AC8                    mov cl, al
:0040BF51 8BC1                    mov eax, ecx
:0040BF53 E970000000              jmp 0040BFC8
:0040BF58 8B4508                  mov eax, dword ptr [ebp+08]
:0040BF5B 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040BF5E 03C0                    add eax, eax
:0040BF60 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:0040BF67 E814D3FFFF              call 00409280
:0040BF6C 33C9                    xor ecx, ecx
:0040BF6E 8AC8                    mov cl, al
:0040BF70 8BC1                    mov eax, ecx
:0040BF72 E951000000              jmp 0040BFC8
:0040BF77 E945000000              jmp 0040BFC1
:0040BF7C E940000000              jmp 0040BFC1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BE2F(U)
|
:0040BF81 837DFC0A                cmp dword ptr [ebp-04], 0000000A
:0040BF85 0F8736000000            ja 0040BFC1
:0040BF8B 8B45FC                  mov eax, dword ptr [ebp-04]
:0040BF8E FF248595BF4000          jmp dword ptr [4*eax+0040BF95]

:0040BF95 34BE4000                DWORD 0040BE34
:0040BF99 53BE4000                DWORD 0040BE53
:0040BF9D 72BE4000                DWORD 0040BE72
:0040BFA1 91BE4000                DWORD 0040BE91
:0040BFA5 AABE4000                DWORD 0040BEAA
:0040BFA9 C9BE4000                DWORD 0040BEC9
:0040BFAD E8BE4000                DWORD 0040BEE8
:0040BFB1 01BF4000                DWORD 0040BF01
:0040BFB5 1ABF4000                DWORD 0040BF1A
:0040BFB9 58BF4000                DWORD 0040BF58
:0040BFBD 39BF4000                DWORD 0040BF39



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040BF77(U), :0040BF7C(U), :0040BF85(C)
|
:0040BFC1 33C0                    xor eax, eax
:0040BFC3 E900000000              jmp 0040BFC8

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040BE4E(U), :0040BE6D(U), :0040BE8C(U), :0040BEA5(U), :0040BEC4(U)
|:0040BEE3(U), :0040BEFC(U), :0040BF15(U), :0040BF34(U), :0040BF53(U)
|:0040BF72(U), :0040BFC3(U)
|
:0040BFC8 5F                      pop edi
:0040BFC9 5E                      pop esi
:0040BFCA 5B                      pop ebx
:0040BFCB C9                      leave
:0040BFCC C3                      ret



* Referenced by a CALL at Addresses:
|:00404159   , :0040C8F8   , :0040C93B   , :0040C97E   , :0040C9EC   
|:0040CA2F   , :0042B2B1   , :0042B2EA   , :0042B323   , :0042B359   
|:0042B392   
|
:0040BFCD 55                      push ebp
:0040BFCE 8BEC                    mov ebp, esp
:0040BFD0 83EC0C                  sub esp, 0000000C
:0040BFD3 53                      push ebx
:0040BFD4 56                      push esi
:0040BFD5 57                      push edi
:0040BFD6 8B4508                  mov eax, dword ptr [ebp+08]
:0040BFD9 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040BFDC 03C0                    add eax, eax
:0040BFDE 8D04C0                  lea eax, dword ptr [eax+8*eax]
:0040BFE1 05E8564500              add eax, 004556E8
:0040BFE6 8945FC                  mov dword ptr [ebp-04], eax
:0040BFE9 8B450C                  mov eax, dword ptr [ebp+0C]
:0040BFEC 8945F4                  mov dword ptr [ebp-0C], eax
:0040BFEF E900010000              jmp 0040C0F4
:0040BFF4 68FF000000              push 000000FF
:0040BFF9 8B4510                  mov eax, dword ptr [ebp+10]
:0040BFFC 50                      push eax
:0040BFFD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040C000 E8DB1D0000              call 0040DDE0
:0040C005 33C9                    xor ecx, ecx
:0040C007 8AC8                    mov cl, al
:0040C009 51                      push ecx
:0040C00A E8A7B20300              call 004472B6
:0040C00F 83C40C                  add esp, 0000000C
:0040C012 8945F8                  mov dword ptr [ebp-08], eax
:0040C015 8B45F8                  mov eax, dword ptr [ebp-08]
:0040C018 50                      push eax
:0040C019 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040C01C E80F1E0000              call 0040DE30
:0040C021 E90A010000              jmp 0040C130
:0040C026 68FF000000              push 000000FF
:0040C02B 8B4510                  mov eax, dword ptr [ebp+10]
:0040C02E 50                      push eax
:0040C02F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040C032 E8D9D0FFFF              call 00409110
:0040C037 33C9                    xor ecx, ecx
:0040C039 8AC8                    mov cl, al
:0040C03B 51                      push ecx
:0040C03C E875B20300              call 004472B6
:0040C041 83C40C                  add esp, 0000000C
:0040C044 8945F8                  mov dword ptr [ebp-08], eax
:0040C047 8B45F8                  mov eax, dword ptr [ebp-08]
:0040C04A 50                      push eax
:0040C04B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040C04E E80D1E0000              call 0040DE60
:0040C053 E9D8000000              jmp 0040C130
:0040C058 68FF000000              push 000000FF
:0040C05D 8B4510                  mov eax, dword ptr [ebp+10]
:0040C060 50                      push eax
:0040C061 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040C064 E8571D0000              call 0040DDC0
:0040C069 33C9                    xor ecx, ecx
:0040C06B 8AC8                    mov cl, al
:0040C06D 51                      push ecx
:0040C06E E843B20300              call 004472B6
:0040C073 83C40C                  add esp, 0000000C
:0040C076 8945F8                  mov dword ptr [ebp-08], eax
:0040C079 8B45F8                  mov eax, dword ptr [ebp-08]
:0040C07C 50                      push eax
:0040C07D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040C080 E87B1D0000              call 0040DE00
:0040C085 E9A6000000              jmp 0040C130
:0040C08A 68E8030000              push 000003E8
:0040C08F 8B4510                  mov eax, dword ptr [ebp+10]
:0040C092 50                      push eax
:0040C093 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040C096 E8F5D6FFFF              call 00409790
:0040C09B 50                      push eax
:0040C09C E815B20300              call 004472B6
:0040C0A1 83C40C                  add esp, 0000000C
:0040C0A4 8945F8                  mov dword ptr [ebp-08], eax
:0040C0A7 8B45F8                  mov eax, dword ptr [ebp-08]
:0040C0AA 50                      push eax
:0040C0AB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040C0AE E80D1E0000              call 0040DEC0
:0040C0B3 E978000000              jmp 0040C130
:0040C0B8 68FF000000              push 000000FF
:0040C0BD 8B4510                  mov eax, dword ptr [ebp+10]
:0040C0C0 50                      push eax
:0040C0C1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040C0C4 E817D1FFFF              call 004091E0
:0040C0C9 33C9                    xor ecx, ecx
:0040C0CB 8AC8                    mov cl, al
:0040C0CD 51                      push ecx
:0040C0CE E8E3B10300              call 004472B6
:0040C0D3 83C40C                  add esp, 0000000C
:0040C0D6 8945F8                  mov dword ptr [ebp-08], eax
:0040C0D9 8B45F8                  mov eax, dword ptr [ebp-08]
:0040C0DC 50                      push eax
:0040C0DD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040C0E0 E8AB1D0000              call 0040DE90
:0040C0E5 E946000000              jmp 0040C130
:0040C0EA E941000000              jmp 0040C130
:0040C0EF E93C000000              jmp 0040C130

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BFEF(U)
|
:0040C0F4 837DF409                cmp dword ptr [ebp-0C], 00000009
:0040C0F8 0F8732000000            ja 0040C130
:0040C0FE 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040C101 FF248508C14000          jmp dword ptr [4*eax+0040C108]

:0040C108 F4BF4000                DWORD 0040BFF4
:0040C10C 26C04000                DWORD 0040C026
:0040C110 58C04000                DWORD 0040C058
:0040C114 8AC04000                DWORD 0040C08A
:0040C118 B8C04000                DWORD 0040C0B8
:0040C11C EAC04000                DWORD 0040C0EA
:0040C120 EAC04000                DWORD 0040C0EA
:0040C124 EAC04000                DWORD 0040C0EA
:0040C128 EAC04000                DWORD 0040C0EA
:0040C12C EAC04000                DWORD 0040C0EA



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040C021(U), :0040C053(U), :0040C085(U), :0040C0B3(U), :0040C0E5(U)
|:0040C0EA(U), :0040C0EF(U), :0040C0F8(C)
|
:0040C130 E900000000              jmp 0040C135
:0040C135 5F                      pop edi
:0040C136 5E                      pop esi
:0040C137 5B                      pop ebx
:0040C138 C9                      leave
:0040C139 C3                      ret



* Referenced by a CALL at Addresses:
|:00402FFF   , :00434087   , :00435FBB   , :0043641D   
|
:0040C13A 55                      push ebp
:0040C13B 8BEC                    mov ebp, esp
:0040C13D 83EC08                  sub esp, 00000008
:0040C140 53                      push ebx
:0040C141 56                      push esi
:0040C142 57                      push edi
:0040C143 8B4508                  mov eax, dword ptr [ebp+08]
:0040C146 8BC8                    mov ecx, eax
:0040C148 C1E004                  shl eax, 04
:0040C14B 8D8C0818AA4600          lea ecx, dword ptr [eax+ecx+0046AA18]
:0040C152 E8C9D4FFFF              call 00409620
:0040C157 8845FC                  mov byte ptr [ebp-04], al
:0040C15A 33C0                    xor eax, eax
:0040C15C 8A45FC                  mov al, byte ptr [ebp-04]
:0040C15F 83F80E                  cmp eax, 0000000E
:0040C162 0F8F12000000            jg 0040C17A
:0040C168 33C0                    xor eax, eax
:0040C16A 8A45FC                  mov al, byte ptr [ebp-04]
:0040C16D B903000000              mov ecx, 00000003
:0040C172 99                      cdq
:0040C173 F7F9                    idiv ecx
:0040C175 E9D2000000              jmp 0040C24C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C162(C)
|
:0040C17A 33C0                    xor eax, eax
:0040C17C 8A45FC                  mov al, byte ptr [ebp-04]
:0040C17F 83F812                  cmp eax, 00000012
:0040C182 0F8F18000000            jg 0040C1A0
:0040C188 33C0                    xor eax, eax
:0040C18A 8A45FC                  mov al, byte ptr [ebp-04]
:0040C18D 83E80F                  sub eax, 0000000F
:0040C190 99                      cdq
:0040C191 2BC2                    sub eax, edx
:0040C193 C1F801                  sar eax, 01
:0040C196 8D4805                  lea ecx, dword ptr [eax+05]
:0040C199 8AC1                    mov al, cl
:0040C19B E9AC000000              jmp 0040C24C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C182(C)
|
:0040C1A0 33C0                    xor eax, eax
:0040C1A2 8A45FC                  mov al, byte ptr [ebp-04]
:0040C1A5 83F818                  cmp eax, 00000018
:0040C1A8 0F8F12000000            jg 0040C1C0
:0040C1AE 33C0                    xor eax, eax
:0040C1B0 8A45FC                  mov al, byte ptr [ebp-04]
:0040C1B3 83E80C                  sub eax, 0000000C
:0040C1B6 E991000000              jmp 0040C24C
:0040C1BB E915000000              jmp 0040C1D5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C1A8(C)
|
:0040C1C0 33C0                    xor eax, eax
:0040C1C2 8A45FC                  mov al, byte ptr [ebp-04]
:0040C1C5 83F820                  cmp eax, 00000020
:0040C1C8 0F8F07000000            jg 0040C1D5
:0040C1CE B00D                    mov al, 0D
:0040C1D0 E977000000              jmp 0040C24C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040C1BB(U), :0040C1C8(C)
|
:0040C1D5 33C0                    xor eax, eax
:0040C1D7 8A45FC                  mov al, byte ptr [ebp-04]
:0040C1DA 83F826                  cmp eax, 00000026
:0040C1DD 0F8F07000000            jg 0040C1EA
:0040C1E3 B00E                    mov al, 0E
:0040C1E5 E962000000              jmp 0040C24C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C1DD(C)
|
:0040C1EA 33C0                    xor eax, eax
:0040C1EC 8A45FC                  mov al, byte ptr [ebp-04]
:0040C1EF 8945F8                  mov dword ptr [ebp-08], eax
:0040C1F2 E926000000              jmp 0040C21D
:0040C1F7 B00F                    mov al, 0F
:0040C1F9 E94E000000              jmp 0040C24C
:0040C1FE B010                    mov al, 10
:0040C200 E947000000              jmp 0040C24C
:0040C205 B011                    mov al, 11
:0040C207 E940000000              jmp 0040C24C
:0040C20C B012                    mov al, 12
:0040C20E E939000000              jmp 0040C24C
:0040C213 E92D000000              jmp 0040C245
:0040C218 E928000000              jmp 0040C245

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C1F2(U)
|
:0040C21D 836DF827                sub dword ptr [ebp-08], 00000027
:0040C221 837DF803                cmp dword ptr [ebp-08], 00000003
:0040C225 0F871A000000            ja 0040C245
:0040C22B 8B45F8                  mov eax, dword ptr [ebp-08]
:0040C22E FF248535C24000          jmp dword ptr [4*eax+0040C235]

:0040C235 F7C14000                DWORD 0040C1F7
:0040C239 FEC14000                DWORD 0040C1FE
:0040C23D 05C24000                DWORD 0040C205
:0040C241 0CC24000                DWORD 0040C20C



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040C213(U), :0040C218(U), :0040C225(C)
|
:0040C245 B00E                    mov al, 0E
:0040C247 E900000000              jmp 0040C24C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040C175(U), :0040C19B(U), :0040C1B6(U), :0040C1D0(U), :0040C1E5(U)
|:0040C1F9(U), :0040C200(U), :0040C207(U), :0040C20E(U), :0040C247(U)
|
:0040C24C 5F                      pop edi
:0040C24D 5E                      pop esi
:0040C24E 5B                      pop ebx
:0040C24F C9                      leave
:0040C250 C3                      ret



* Referenced by a CALL at Addresses:
|:0040C3AD   , :0040CAB5   , :00435FF1   , :00436892   
|
:0040C251 55                      push ebp
:0040C252 8BEC                    mov ebp, esp
:0040C254 83EC04                  sub esp, 00000004
:0040C257 53                      push ebx
:0040C258 56                      push esi
:0040C259 57                      push edi
:0040C25A 8B4508                  mov eax, dword ptr [ebp+08]
:0040C25D 8BC8                    mov ecx, eax
:0040C25F C1E004                  shl eax, 04
:0040C262 8D8C0818AA4600          lea ecx, dword ptr [eax+ecx+0046AA18]
:0040C269 E8B2D3FFFF              call 00409620
:0040C26E 8845FC                  mov byte ptr [ebp-04], al
:0040C271 33C0                    xor eax, eax
:0040C273 8A45FC                  mov al, byte ptr [ebp-04]
:0040C276 83F815                  cmp eax, 00000015
:0040C279 0F8D07000000            jnl 0040C286
:0040C27F 32C0                    xor al, al
:0040C281 E931000000              jmp 0040C2B7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C279(C)
|
:0040C286 33C0                    xor eax, eax
:0040C288 8A45FC                  mov al, byte ptr [ebp-04]
:0040C28B 83F816                  cmp eax, 00000016
:0040C28E 0F8F07000000            jg 0040C29B
:0040C294 B001                    mov al, 01
:0040C296 E91C000000              jmp 0040C2B7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C28E(C)
|
:0040C29B 33C0                    xor eax, eax
:0040C29D 8A45FC                  mov al, byte ptr [ebp-04]
:0040C2A0 83F818                  cmp eax, 00000018
:0040C2A3 0F8F07000000            jg 0040C2B0
:0040C2A9 B002                    mov al, 02
:0040C2AB E907000000              jmp 0040C2B7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C2A3(C)
|
:0040C2B0 B003                    mov al, 03
:0040C2B2 E900000000              jmp 0040C2B7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040C281(U), :0040C296(U), :0040C2AB(U), :0040C2B2(U)
|
:0040C2B7 5F                      pop edi
:0040C2B8 5E                      pop esi
:0040C2B9 5B                      pop ebx
:0040C2BA C9                      leave
:0040C2BB C3                      ret



* Referenced by a CALL at Addresses:
|:004088B0   , :00408AAB   , :0040C3D3   , :0041A988   , :0041A9A1   
|:0042AC95   
|
:0040C2BC 55                      push ebp
:0040C2BD 8BEC                    mov ebp, esp
:0040C2BF 83EC08                  sub esp, 00000008
:0040C2C2 53                      push ebx
:0040C2C3 56                      push esi
:0040C2C4 57                      push edi
:0040C2C5 8B4508                  mov eax, dword ptr [ebp+08]
:0040C2C8 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040C2CB 03C0                    add eax, eax
:0040C2CD 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:0040C2D4 E8F7CFFFFF              call 004092D0
:0040C2D9 8845FC                  mov byte ptr [ebp-04], al
:0040C2DC 33C0                    xor eax, eax
:0040C2DE 8A45FC                  mov al, byte ptr [ebp-04]
:0040C2E1 83F814                  cmp eax, 00000014
:0040C2E4 0F8F12000000            jg 0040C2FC
:0040C2EA 33C0                    xor eax, eax
:0040C2EC 8A45FC                  mov al, byte ptr [ebp-04]
:0040C2EF B903000000              mov ecx, 00000003
:0040C2F4 99                      cdq
:0040C2F5 F7F9                    idiv ecx
:0040C2F7 E970000000              jmp 0040C36C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C2E4(C)
|
:0040C2FC 33C0                    xor eax, eax
:0040C2FE 8A45FC                  mov al, byte ptr [ebp-04]
:0040C301 83F81C                  cmp eax, 0000001C
:0040C304 0F8F18000000            jg 0040C322
:0040C30A 33C0                    xor eax, eax
:0040C30C 8A45FC                  mov al, byte ptr [ebp-04]
:0040C30F 83E815                  sub eax, 00000015
:0040C312 99                      cdq
:0040C313 2BC2                    sub eax, edx
:0040C315 C1F801                  sar eax, 01
:0040C318 8D4807                  lea ecx, dword ptr [eax+07]
:0040C31B 8AC1                    mov al, cl
:0040C31D E94A000000              jmp 0040C36C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C304(C)
|
:0040C322 33C0                    xor eax, eax
:0040C324 8A45FC                  mov al, byte ptr [ebp-04]
:0040C327 8945F8                  mov dword ptr [ebp-08], eax
:0040C32A E913000000              jmp 0040C342

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C346(C)
|
:0040C32F B00B                    mov al, 0B
:0040C331 E936000000              jmp 0040C36C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C35A(C)
|
:0040C336 B00C                    mov al, 0C
:0040C338 E92F000000              jmp 0040C36C
:0040C33D E923000000              jmp 0040C365

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C32A(U)
|
:0040C342 837DF81D                cmp dword ptr [ebp-08], 0000001D
:0040C346 0F84E3FFFFFF            je 0040C32F
:0040C34C 837DF81E                cmp dword ptr [ebp-08], 0000001E
:0040C350 0F8C0F000000            jl 0040C365
:0040C356 837DF81F                cmp dword ptr [ebp-08], 0000001F
:0040C35A 0F8ED6FFFFFF            jle 0040C336
:0040C360 E900000000              jmp 0040C365

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040C33D(U), :0040C350(C), :0040C360(U)
|
:0040C365 B00E                    mov al, 0E
:0040C367 E900000000              jmp 0040C36C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040C2F7(U), :0040C31D(U), :0040C331(U), :0040C338(U), :0040C367(U)
|
:0040C36C 5F                      pop edi
:0040C36D 5E                      pop esi
:0040C36E 5B                      pop ebx
:0040C36F C9                      leave
:0040C370 C3                      ret



* Referenced by a CALL at Addresses:
|:00403878   , :0040CAEC   , :00435F04   
|
:0040C371 55                      push ebp
:0040C372 8BEC                    mov ebp, esp
:0040C374 83EC14                  sub esp, 00000014
:0040C377 53                      push ebx
:0040C378 56                      push esi
:0040C379 57                      push edi
:0040C37A 8B4508                  mov eax, dword ptr [ebp+08]
:0040C37D 8BC8                    mov ecx, eax
:0040C37F C1E004                  shl eax, 04
:0040C382 8D8C0818AA4600          lea ecx, dword ptr [eax+ecx+0046AA18]
:0040C389 E892D2FFFF              call 00409620
:0040C38E 8845F4                  mov byte ptr [ebp-0C], al
:0040C391 33C0                    xor eax, eax
:0040C393 8A45F4                  mov al, byte ptr [ebp-0C]
:0040C396 83F819                  cmp eax, 00000019
:0040C399 0F8C0A000000            jl 0040C3A9
:0040C39F B801000000              mov eax, 00000001
:0040C3A4 E906040000              jmp 0040C7AF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C399(C)
|
:0040C3A9 8B4508                  mov eax, dword ptr [ebp+08]
:0040C3AC 50                      push eax
:0040C3AD E89FFEFFFF              call 0040C251
:0040C3B2 83C404                  add esp, 00000004
:0040C3B5 8845F8                  mov byte ptr [ebp-08], al
:0040C3B8 8B450C                  mov eax, dword ptr [ebp+0C]
:0040C3BB 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040C3BE 03C0                    add eax, eax
:0040C3C0 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:0040C3C7 E804CFFFFF              call 004092D0
:0040C3CC 8845FC                  mov byte ptr [ebp-04], al
:0040C3CF 8B450C                  mov eax, dword ptr [ebp+0C]
:0040C3D2 50                      push eax
:0040C3D3 E8E4FEFFFF              call 0040C2BC
:0040C3D8 83C404                  add esp, 00000004
:0040C3DB 33C9                    xor ecx, ecx
:0040C3DD 8AC8                    mov cl, al
:0040C3DF 894DF0                  mov dword ptr [ebp-10], ecx
:0040C3E2 33C0                    xor eax, eax
:0040C3E4 8A45F4                  mov al, byte ptr [ebp-0C]
:0040C3E7 8945EC                  mov dword ptr [ebp-14], eax
:0040C3EA E941030000              jmp 0040C730
:0040C3EF 837DF000                cmp dword ptr [ebp-10], 00000000
:0040C3F3 0F8418000000            je 0040C411
:0040C3F9 837DF007                cmp dword ptr [ebp-10], 00000007
:0040C3FD 0F840E000000            je 0040C411
:0040C403 33C0                    xor eax, eax
:0040C405 8A45FC                  mov al, byte ptr [ebp-04]
:0040C408 83F81E                  cmp eax, 0000001E
:0040C40B 0F850A000000            jne 0040C41B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040C3F3(C), :0040C3FD(C)
|
:0040C411 B801000000              mov eax, 00000001
:0040C416 E902000000              jmp 0040C41D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C40B(C)
|
:0040C41B 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C416(U)
|
:0040C41D E98D030000              jmp 0040C7AF
:0040C422 33C0                    xor eax, eax
:0040C424 8A45FC                  mov al, byte ptr [ebp-04]
:0040C427 83F801                  cmp eax, 00000001
:0040C42A 0F842A000000            je 0040C45A
:0040C430 33C0                    xor eax, eax
:0040C432 8A45FC                  mov al, byte ptr [ebp-04]
:0040C435 83F802                  cmp eax, 00000002
:0040C438 0F841C000000            je 0040C45A
:0040C43E 33C0                    xor eax, eax
:0040C440 8A45FC                  mov al, byte ptr [ebp-04]
:0040C443 83F816                  cmp eax, 00000016
:0040C446 0F840E000000            je 0040C45A
:0040C44C 33C0                    xor eax, eax
:0040C44E 8A45FC                  mov al, byte ptr [ebp-04]
:0040C451 83F81E                  cmp eax, 0000001E
:0040C454 0F850A000000            jne 0040C464

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040C42A(C), :0040C438(C), :0040C446(C)
|
:0040C45A B801000000              mov eax, 00000001
:0040C45F E902000000              jmp 0040C466

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C454(C)
|
:0040C464 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C45F(U)
|
:0040C466 E944030000              jmp 0040C7AF
:0040C46B 33C0                    xor eax, eax
:0040C46D 8A45FC                  mov al, byte ptr [ebp-04]
:0040C470 83F802                  cmp eax, 00000002
:0040C473 0F850A000000            jne 0040C483
:0040C479 B801000000              mov eax, 00000001
:0040C47E E902000000              jmp 0040C485

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C473(C)
|
:0040C483 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C47E(U)
|
:0040C485 E925030000              jmp 0040C7AF
:0040C48A 837DF005                cmp dword ptr [ebp-10], 00000005
:0040C48E 0F850A000000            jne 0040C49E
:0040C494 B801000000              mov eax, 00000001
:0040C499 E911030000              jmp 0040C7AF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C48E(C)
|
:0040C49E 837DF002                cmp dword ptr [ebp-10], 00000002
:0040C4A2 0F8418000000            je 0040C4C0
:0040C4A8 837DF003                cmp dword ptr [ebp-10], 00000003
:0040C4AC 0F840E000000            je 0040C4C0
:0040C4B2 33C0                    xor eax, eax
:0040C4B4 8A45FC                  mov al, byte ptr [ebp-04]
:0040C4B7 83F81F                  cmp eax, 0000001F
:0040C4BA 0F850A000000            jne 0040C4CA

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040C4A2(C), :0040C4AC(C)
|
:0040C4C0 B801000000              mov eax, 00000001
:0040C4C5 E902000000              jmp 0040C4CC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C4BA(C)
|
:0040C4CA 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C4C5(U)
|
:0040C4CC E9DE020000              jmp 0040C7AF
:0040C4D1 33C0                    xor eax, eax
:0040C4D3 8A45FC                  mov al, byte ptr [ebp-04]
:0040C4D6 83F807                  cmp eax, 00000007
:0040C4D9 0F841C000000            je 0040C4FB
:0040C4DF 33C0                    xor eax, eax
:0040C4E1 8A45FC                  mov al, byte ptr [ebp-04]
:0040C4E4 83F80A                  cmp eax, 0000000A
:0040C4E7 0F840E000000            je 0040C4FB
:0040C4ED 33C0                    xor eax, eax
:0040C4EF 8A45FC                  mov al, byte ptr [ebp-04]
:0040C4F2 83F81F                  cmp eax, 0000001F
:0040C4F5 0F850A000000            jne 0040C505

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040C4D9(C), :0040C4E7(C)
|
:0040C4FB B801000000              mov eax, 00000001
:0040C500 E9AA020000              jmp 0040C7AF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C4F5(C)
|
:0040C505 33C0                    xor eax, eax
:0040C507 8A45FC                  mov al, byte ptr [ebp-04]
:0040C50A 83F808                  cmp eax, 00000008
:0040C50D 0F840E000000            je 0040C521
:0040C513 33C0                    xor eax, eax
:0040C515 8A45FC                  mov al, byte ptr [ebp-04]
:0040C518 83F80B                  cmp eax, 0000000B
:0040C51B 0F850A000000            jne 0040C52B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C50D(C)
|
:0040C521 B801000000              mov eax, 00000001
:0040C526 E902000000              jmp 0040C52D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C51B(C)
|
:0040C52B 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C526(U)
|
:0040C52D E97D020000              jmp 0040C7AF
:0040C532 837DF001                cmp dword ptr [ebp-10], 00000001
:0040C536 0F840A000000            je 0040C546
:0040C53C 837DF005                cmp dword ptr [ebp-10], 00000005
:0040C540 0F850A000000            jne 0040C550

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C536(C)
|
:0040C546 B801000000              mov eax, 00000001
:0040C54B E902000000              jmp 0040C552

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C540(C)
|
:0040C550 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C54B(U)
|
:0040C552 E958020000              jmp 0040C7AF
:0040C557 33C0                    xor eax, eax
:0040C559 8A45FC                  mov al, byte ptr [ebp-04]
:0040C55C 83F804                  cmp eax, 00000004
:0040C55F 0F840E000000            je 0040C573
:0040C565 33C0                    xor eax, eax
:0040C567 8A45FC                  mov al, byte ptr [ebp-04]
:0040C56A 83F810                  cmp eax, 00000010
:0040C56D 0F850A000000            jne 0040C57D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C55F(C)
|
:0040C573 B801000000              mov eax, 00000001
:0040C578 E932020000              jmp 0040C7AF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C56D(C)
|
:0040C57D 33C0                    xor eax, eax
:0040C57F 8A45FC                  mov al, byte ptr [ebp-04]
:0040C582 83F805                  cmp eax, 00000005
:0040C585 0F840E000000            je 0040C599
:0040C58B 33C0                    xor eax, eax
:0040C58D 8A45FC                  mov al, byte ptr [ebp-04]
:0040C590 83F811                  cmp eax, 00000011
:0040C593 0F850A000000            jne 0040C5A3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C585(C)
|
:0040C599 B801000000              mov eax, 00000001
:0040C59E E902000000              jmp 0040C5A5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C593(C)
|
:0040C5A3 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C59E(U)
|
:0040C5A5 E905020000              jmp 0040C7AF
:0040C5AA 837DF004                cmp dword ptr [ebp-10], 00000004
:0040C5AE 0F850A000000            jne 0040C5BE
:0040C5B4 B801000000              mov eax, 00000001
:0040C5B9 E902000000              jmp 0040C5C0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C5AE(C)
|
:0040C5BE 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C5B9(U)
|
:0040C5C0 E9EA010000              jmp 0040C7AF
:0040C5C5 33C0                    xor eax, eax
:0040C5C7 8A45FC                  mov al, byte ptr [ebp-04]
:0040C5CA 83F80D                  cmp eax, 0000000D
:0040C5CD 0F850A000000            jne 0040C5DD
:0040C5D3 B801000000              mov eax, 00000001
:0040C5D8 E9D2010000              jmp 0040C7AF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C5CD(C)
|
:0040C5DD 33C0                    xor eax, eax
:0040C5DF 8A45FC                  mov al, byte ptr [ebp-04]
:0040C5E2 83F80E                  cmp eax, 0000000E
:0040C5E5 0F850A000000            jne 0040C5F5
:0040C5EB B801000000              mov eax, 00000001
:0040C5F0 E902000000              jmp 0040C5F7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C5E5(C)
|
:0040C5F5 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C5F0(U)
|
:0040C5F7 E9B3010000              jmp 0040C7AF
:0040C5FC 837DF006                cmp dword ptr [ebp-10], 00000006
:0040C600 0F850A000000            jne 0040C610
:0040C606 B801000000              mov eax, 00000001
:0040C60B E902000000              jmp 0040C612

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C600(C)
|
:0040C610 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C60B(U)
|
:0040C612 E998010000              jmp 0040C7AF
:0040C617 33C0                    xor eax, eax
:0040C619 8A45FC                  mov al, byte ptr [ebp-04]
:0040C61C 83F813                  cmp eax, 00000013
:0040C61F 0F850A000000            jne 0040C62F
:0040C625 B801000000              mov eax, 00000001
:0040C62A E980010000              jmp 0040C7AF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C61F(C)
|
:0040C62F 33C0                    xor eax, eax
:0040C631 8A45FC                  mov al, byte ptr [ebp-04]
:0040C634 83F814                  cmp eax, 00000014
:0040C637 0F850A000000            jne 0040C647
:0040C63D B801000000              mov eax, 00000001
:0040C642 E902000000              jmp 0040C649

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C637(C)
|
:0040C647 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C642(U)
|
:0040C649 E961010000              jmp 0040C7AF
:0040C64E 33C0                    xor eax, eax
:0040C650 8A45FC                  mov al, byte ptr [ebp-04]
:0040C653 83F819                  cmp eax, 00000019
:0040C656 0F850A000000            jne 0040C666
:0040C65C B801000000              mov eax, 00000001
:0040C661 E949010000              jmp 0040C7AF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C656(C)
|
:0040C666 33C0                    xor eax, eax
:0040C668 8A45FC                  mov al, byte ptr [ebp-04]
:0040C66B 83F81A                  cmp eax, 0000001A
:0040C66E 0F850A000000            jne 0040C67E
:0040C674 B801000000              mov eax, 00000001
:0040C679 E902000000              jmp 0040C680

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C66E(C)
|
:0040C67E 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C679(U)
|
:0040C680 E92A010000              jmp 0040C7AF
:0040C685 33C0                    xor eax, eax
:0040C687 8A45FC                  mov al, byte ptr [ebp-04]
:0040C68A 83F817                  cmp eax, 00000017
:0040C68D 0F850A000000            jne 0040C69D
:0040C693 B801000000              mov eax, 00000001
:0040C698 E912010000              jmp 0040C7AF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C68D(C)
|
:0040C69D 33C0                    xor eax, eax
:0040C69F 8A45FC                  mov al, byte ptr [ebp-04]
:0040C6A2 83F818                  cmp eax, 00000018
:0040C6A5 0F850A000000            jne 0040C6B5
:0040C6AB B801000000              mov eax, 00000001
:0040C6B0 E902000000              jmp 0040C6B7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C6A5(C)
|
:0040C6B5 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C6B0(U)
|
:0040C6B7 E9F3000000              jmp 0040C7AF
:0040C6BC 33C0                    xor eax, eax
:0040C6BE 8A45FC                  mov al, byte ptr [ebp-04]
:0040C6C1 83F81D                  cmp eax, 0000001D
:0040C6C4 0F850A000000            jne 0040C6D4
:0040C6CA B801000000              mov eax, 00000001
:0040C6CF E902000000              jmp 0040C6D6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C6C4(C)
|
:0040C6D4 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C6CF(U)
|
:0040C6D6 E9D4000000              jmp 0040C7AF
:0040C6DB 837DF004                cmp dword ptr [ebp-10], 00000004
:0040C6DF 0F840A000000            je 0040C6EF
:0040C6E5 837DF003                cmp dword ptr [ebp-10], 00000003
:0040C6E9 0F850A000000            jne 0040C6F9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C6DF(C)
|
:0040C6EF B801000000              mov eax, 00000001
:0040C6F4 E9B6000000              jmp 0040C7AF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C6E9(C)
|
:0040C6F9 33C0                    xor eax, eax
:0040C6FB 8A45FC                  mov al, byte ptr [ebp-04]
:0040C6FE 83F81B                  cmp eax, 0000001B
:0040C701 0F840E000000            je 0040C715
:0040C707 33C0                    xor eax, eax
:0040C709 8A45FC                  mov al, byte ptr [ebp-04]
:0040C70C 83F81C                  cmp eax, 0000001C
:0040C70F 0F850A000000            jne 0040C71F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C701(C)
|
:0040C715 B801000000              mov eax, 00000001
:0040C71A E902000000              jmp 0040C721

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C70F(C)
|
:0040C71F 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C71A(U)
|
:0040C721 E989000000              jmp 0040C7AF
:0040C726 E97D000000              jmp 0040C7A8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C764(C)
|
:0040C72B E978000000              jmp 0040C7A8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C3EA(U)
|
:0040C730 837DEC18                cmp dword ptr [ebp-14], 00000018
:0040C734 0F876E000000            ja 0040C7A8
:0040C73A 8B45EC                  mov eax, dword ptr [ebp-14]
:0040C73D FF248544C74000          jmp dword ptr [4*eax+0040C744]

:0040C744 EFC34000                DWORD 0040C3EF
:0040C748 22C44000                DWORD 0040C422
:0040C74C 6BC44000                DWORD 0040C46B
:0040C750 9EC44000                DWORD 0040C49E
:0040C754 D1C44000                DWORD 0040C4D1
:0040C758 05C54000                DWORD 0040C505
:0040C75C 32C54000                DWORD 0040C532
:0040C760 57C54000                DWORD 0040C557
:0040C764 7DC54000                DWORD 0040C57D
:0040C768 AAC54000                DWORD 0040C5AA
:0040C76C C5C54000                DWORD 0040C5C5
:0040C770 DDC54000                DWORD 0040C5DD
:0040C774 FCC54000                DWORD 0040C5FC
:0040C778 17C64000                DWORD 0040C617
:0040C77C 2FC64000                DWORD 0040C62F
:0040C780 4EC64000                DWORD 0040C64E
:0040C784 66C64000                DWORD 0040C666
:0040C788 85C64000                DWORD 0040C685
:0040C78C 9DC64000                DWORD 0040C69D
:0040C790 BCC64000                DWORD 0040C6BC
:0040C794 F9C64000                DWORD 0040C6F9
:0040C798 8AC44000                DWORD 0040C48A
:0040C79C EFC34000                DWORD 0040C3EF
:0040C7A0 8AC44000                DWORD 0040C48A
:0040C7A4 DBC64000                DWORD 0040C6DB



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040C726(U), :0040C72B(U), :0040C734(C)
|
:0040C7A8 33C0                    xor eax, eax
:0040C7AA E900000000              jmp 0040C7AF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040C3A4(U), :0040C41D(U), :0040C466(U), :0040C485(U), :0040C499(U)
|:0040C4CC(U), :0040C500(U), :0040C52D(U), :0040C552(U), :0040C578(U)
|:0040C5A5(U), :0040C5C0(U), :0040C5D8(U), :0040C5F7(U), :0040C612(U)
|:0040C62A(U), :0040C649(U), :0040C661(U), :0040C680(U), :0040C698(U)
|:0040C6B7(U), :0040C6D6(U), :0040C6F4(U), :0040C721(U)
|
:0040C7AF 5F                      pop edi
:0040C7B0 5E                      pop esi
:0040C7B1 5B                      pop ebx
:0040C7B2 C9                      leave
:0040C7B3 C3                      ret



* Referenced by a CALL at Addresses:
|:0040D2A9   , :00431E13   , :004414FD   
|
:0040C7B4 55                      push ebp
:0040C7B5 8BEC                    mov ebp, esp
:0040C7B7 83EC24                  sub esp, 00000024
:0040C7BA 53                      push ebx
:0040C7BB 56                      push esi
:0040C7BC 57                      push edi
:0040C7BD 894DDC                  mov dword ptr [ebp-24], ecx
:0040C7C0 C745E400000000          mov [ebp-1C], 00000000
:0040C7C7 C745E800000000          mov [ebp-18], 00000000
:0040C7CE C745EC00000000          mov [ebp-14], 00000000
:0040C7D5 C745F000000000          mov [ebp-10], 00000000
:0040C7DC 8B45DC                  mov eax, dword ptr [ebp-24]
:0040C7DF 33C9                    xor ecx, ecx
:0040C7E1 668B08                  mov cx, word ptr [eax]
:0040C7E4 81E1FF01FFFF            and ecx, FFFF01FF
:0040C7EA 894DF4                  mov dword ptr [ebp-0C], ecx
:0040C7ED 8B45DC                  mov eax, dword ptr [ebp-24]
:0040C7F0 33C9                    xor ecx, ecx
:0040C7F2 8A4825                  mov cl, byte ptr [eax+25]
:0040C7F5 B863000000              mov eax, 00000063
:0040C7FA 33D2                    xor edx, edx
:0040C7FC 8A5508                  mov dl, byte ptr [ebp+08]
:0040C7FF 2BC2                    sub eax, edx
:0040C801 3BC8                    cmp ecx, eax
:0040C803 0F8617000000            jbe 0040C820
:0040C809 B863000000              mov eax, 00000063
:0040C80E 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0040C811 33D2                    xor edx, edx
:0040C813 8A5125                  mov dl, byte ptr [ecx+25]
:0040C816 2BC2                    sub eax, edx
:0040C818 8845F8                  mov byte ptr [ebp-08], al
:0040C81B E906000000              jmp 0040C826

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C803(C)
|
:0040C820 8A4508                  mov al, byte ptr [ebp+08]
:0040C823 8845F8                  mov byte ptr [ebp-08], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C81B(U)
|
:0040C826 C745FC00000000          mov [ebp-04], 00000000
:0040C82D E903000000              jmp 0040C835

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C8B8(U)
|
:0040C832 FF45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C82D(U)
|
:0040C835 33C0                    xor eax, eax
:0040C837 8A45F8                  mov al, byte ptr [ebp-08]
:0040C83A 3B45FC                  cmp eax, dword ptr [ebp-04]
:0040C83D 0F8E7A000000            jle 0040C8BD
:0040C843 C745E000000000          mov [ebp-20], 00000000
:0040C84A E903000000              jmp 0040C852

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C8B3(U)
|
:0040C84F FF45E0                  inc [ebp-20]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C84A(U)
|
:0040C852 837DE004                cmp dword ptr [ebp-20], 00000004
:0040C856 0F8D5C000000            jnl 0040C8B8
:0040C85C 6A63                    push 00000063
:0040C85E E8C5AA0300              call 00447328
:0040C863 83C404                  add esp, 00000004
:0040C866 B903000000              mov ecx, 00000003
:0040C86B 2BD2                    sub edx, edx
:0040C86D F7F1                    div ecx
:0040C86F 85D2                    test edx, edx
:0040C871 0F8435000000            je 0040C8AC
:0040C877 6A02                    push 00000002
:0040C879 E8AAAA0300              call 00447328
:0040C87E 83C404                  add esp, 00000004
:0040C881 83F801                  cmp eax, 00000001
:0040C884 0F8C0C000000            jl 0040C896
:0040C88A 8B45E0                  mov eax, dword ptr [ebp-20]
:0040C88D FF4485E4                inc [ebp+4*eax-1C]
:0040C891 E911000000              jmp 0040C8A7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C884(C)
|
:0040C896 6A02                    push 00000002
:0040C898 E88BAA0300              call 00447328
:0040C89D 83C404                  add esp, 00000004
:0040C8A0 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0040C8A3 01448DE4                add dword ptr [ebp+4*ecx-1C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C891(U)
|
:0040C8A7 E907000000              jmp 0040C8B3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C871(C)
|
:0040C8AC 8B45E0                  mov eax, dword ptr [ebp-20]
:0040C8AF FF4C85E4                dec [ebp+4*eax-1C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C8A7(U)
|
:0040C8B3 E997FFFFFF              jmp 0040C84F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C856(C)
|
:0040C8B8 E975FFFFFF              jmp 0040C832

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C83D(C)
|
:0040C8BD 8B45DC                  mov eax, dword ptr [ebp-24]
:0040C8C0 33C9                    xor ecx, ecx
:0040C8C2 8A4824                  mov cl, byte ptr [eax+24]
:0040C8C5 33C0                    xor eax, eax
:0040C8C7 8A8170EB4400            mov al, byte ptr [ecx+0044EB70]
:0040C8CD 85C0                    test eax, eax
:0040C8CF 0F8E2B000000            jle 0040C900
:0040C8D5 8B45DC                  mov eax, dword ptr [ebp-24]
:0040C8D8 33C9                    xor ecx, ecx
:0040C8DA 8A4824                  mov cl, byte ptr [eax+24]
:0040C8DD 33C0                    xor eax, eax
:0040C8DF 8A8170EB4400            mov al, byte ptr [ecx+0044EB70]
:0040C8E5 40                      inc eax
:0040C8E6 33C9                    xor ecx, ecx
:0040C8E8 8A4DF8                  mov cl, byte ptr [ebp-08]
:0040C8EB 0FAFC1                  imul eax, ecx
:0040C8EE 0345E4                  add eax, dword ptr [ebp-1C]
:0040C8F1 50                      push eax
:0040C8F2 6A00                    push 00000000
:0040C8F4 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040C8F7 50                      push eax
:0040C8F8 E8D0F6FFFF              call 0040BFCD
:0040C8FD 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C8CF(C)
|
:0040C900 8B45DC                  mov eax, dword ptr [ebp-24]
:0040C903 33C9                    xor ecx, ecx
:0040C905 8A4824                  mov cl, byte ptr [eax+24]
:0040C908 33C0                    xor eax, eax
:0040C90A 8A8191EB4400            mov al, byte ptr [ecx+0044EB91]
:0040C910 85C0                    test eax, eax
:0040C912 0F8E2B000000            jle 0040C943
:0040C918 8B45DC                  mov eax, dword ptr [ebp-24]
:0040C91B 33C9                    xor ecx, ecx
:0040C91D 8A4824                  mov cl, byte ptr [eax+24]
:0040C920 33C0                    xor eax, eax
:0040C922 8A8191EB4400            mov al, byte ptr [ecx+0044EB91]
:0040C928 40                      inc eax
:0040C929 33C9                    xor ecx, ecx
:0040C92B 8A4DF8                  mov cl, byte ptr [ebp-08]
:0040C92E 0FAFC1                  imul eax, ecx
:0040C931 0345E8                  add eax, dword ptr [ebp-18]
:0040C934 50                      push eax
:0040C935 6A01                    push 00000001
:0040C937 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040C93A 50                      push eax
:0040C93B E88DF6FFFF              call 0040BFCD
:0040C940 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C912(C)
|
:0040C943 8B45DC                  mov eax, dword ptr [ebp-24]
:0040C946 33C9                    xor ecx, ecx
:0040C948 8A4824                  mov cl, byte ptr [eax+24]
:0040C94B 33C0                    xor eax, eax
:0040C94D 8A81B2EB4400            mov al, byte ptr [ecx+0044EBB2]
:0040C953 85C0                    test eax, eax
:0040C955 0F8E2B000000            jle 0040C986
:0040C95B 8B45DC                  mov eax, dword ptr [ebp-24]
:0040C95E 33C9                    xor ecx, ecx
:0040C960 8A4824                  mov cl, byte ptr [eax+24]
:0040C963 33C0                    xor eax, eax
:0040C965 8A81B2EB4400            mov al, byte ptr [ecx+0044EBB2]
:0040C96B 40                      inc eax
:0040C96C 33C9                    xor ecx, ecx
:0040C96E 8A4DF8                  mov cl, byte ptr [ebp-08]
:0040C971 0FAFC1                  imul eax, ecx
:0040C974 0345EC                  add eax, dword ptr [ebp-14]
:0040C977 50                      push eax
:0040C978 6A02                    push 00000002
:0040C97A 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040C97D 50                      push eax
:0040C97E E84AF6FFFF              call 0040BFCD
:0040C983 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C955(C)
|
:0040C986 8B45DC                  mov eax, dword ptr [ebp-24]
:0040C989 33C9                    xor ecx, ecx
:0040C98B 8A4824                  mov cl, byte ptr [eax+24]
:0040C98E 33C0                    xor eax, eax
:0040C990 8A81D3EB4400            mov al, byte ptr [ecx+0044EBD3]
:0040C996 85C0                    test eax, eax
:0040C998 0F8E56000000            jle 0040C9F4
:0040C99E 8B45DC                  mov eax, dword ptr [ebp-24]
:0040C9A1 33C9                    xor ecx, ecx
:0040C9A3 8A4824                  mov cl, byte ptr [eax+24]
:0040C9A6 33C0                    xor eax, eax
:0040C9A8 8A81D3EB4400            mov al, byte ptr [ecx+0044EBD3]
:0040C9AE 83C00B                  add eax, 0000000B
:0040C9B1 50                      push eax
:0040C9B2 E871A90300              call 00447328
:0040C9B7 83C404                  add esp, 00000004
:0040C9BA 8BC8                    mov ecx, eax
:0040C9BC C1E902                  shr ecx, 02
:0040C9BF 8B45DC                  mov eax, dword ptr [ebp-24]
:0040C9C2 33D2                    xor edx, edx
:0040C9C4 8A5024                  mov dl, byte ptr [eax+24]
:0040C9C7 33C0                    xor eax, eax
:0040C9C9 8A82D3EB4400            mov al, byte ptr [edx+0044EBD3]
:0040C9CF 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040C9D2 99                      cdq
:0040C9D3 83E203                  and edx, 00000003
:0040C9D6 03C2                    add eax, edx
:0040C9D8 C1F802                  sar eax, 02
:0040C9DB 03C8                    add ecx, eax
:0040C9DD 33C0                    xor eax, eax
:0040C9DF 8A45F8                  mov al, byte ptr [ebp-08]
:0040C9E2 0FAFC8                  imul ecx, eax
:0040C9E5 51                      push ecx
:0040C9E6 6A03                    push 00000003
:0040C9E8 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040C9EB 50                      push eax
:0040C9EC E8DCF5FFFF              call 0040BFCD
:0040C9F1 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C998(C)
|
:0040C9F4 8B45DC                  mov eax, dword ptr [ebp-24]
:0040C9F7 33C9                    xor ecx, ecx
:0040C9F9 8A4824                  mov cl, byte ptr [eax+24]
:0040C9FC 33C0                    xor eax, eax
:0040C9FE 8A81F4EB4400            mov al, byte ptr [ecx+0044EBF4]
:0040CA04 85C0                    test eax, eax
:0040CA06 0F8E2B000000            jle 0040CA37
:0040CA0C 8B45DC                  mov eax, dword ptr [ebp-24]
:0040CA0F 33C9                    xor ecx, ecx
:0040CA11 8A4824                  mov cl, byte ptr [eax+24]
:0040CA14 33C0                    xor eax, eax
:0040CA16 8A81F4EB4400            mov al, byte ptr [ecx+0044EBF4]
:0040CA1C 40                      inc eax
:0040CA1D 33C9                    xor ecx, ecx
:0040CA1F 8A4DF8                  mov cl, byte ptr [ebp-08]
:0040CA22 0FAFC1                  imul eax, ecx
:0040CA25 0345F0                  add eax, dword ptr [ebp-10]
:0040CA28 50                      push eax
:0040CA29 6A04                    push 00000004
:0040CA2B 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040CA2E 50                      push eax
:0040CA2F E899F5FFFF              call 0040BFCD
:0040CA34 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CA06(C)
|
:0040CA37 8B45DC                  mov eax, dword ptr [ebp-24]
:0040CA3A 33C9                    xor ecx, ecx
:0040CA3C 8A4825                  mov cl, byte ptr [eax+25]
:0040CA3F 33C0                    xor eax, eax
:0040CA41 8A45F8                  mov al, byte ptr [ebp-08]
:0040CA44 03C8                    add ecx, eax
:0040CA46 8B45DC                  mov eax, dword ptr [ebp-24]
:0040CA49 884825                  mov byte ptr [eax+25], cl
:0040CA4C 8B45DC                  mov eax, dword ptr [ebp-24]
:0040CA4F 8A4025                  mov al, byte ptr [eax+25]
:0040CA52 E900000000              jmp 0040CA57

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CA52(U)
|
:0040CA57 5F                      pop edi
:0040CA58 5E                      pop esi
:0040CA59 5B                      pop ebx
:0040CA5A C9                      leave
:0040CA5B C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:004088EC   , :00408AE7   , :0040CB83   , :0040CBC4   , :0040CC05   
|:0043FA58   , :0043FAA8   , :0043FAF8   
|
:0040CA5E 55                      push ebp
:0040CA5F 8BEC                    mov ebp, esp
:0040CA61 83EC18                  sub esp, 00000018
:0040CA64 53                      push ebx
:0040CA65 56                      push esi
:0040CA66 57                      push edi
:0040CA67 894DE8                  mov dword ptr [ebp-18], ecx
:0040CA6A C645EC00                mov [ebp-14], 00
:0040CA6E C645F0FF                mov [ebp-10], FF
:0040CA72 C645FC00                mov [ebp-04], 00
:0040CA76 E903000000              jmp 0040CA7E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CB45(U)
|
:0040CA7B FE45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CA76(U)
|
:0040CA7E 33C0                    xor eax, eax
:0040CA80 8A45FC                  mov al, byte ptr [ebp-04]
:0040CA83 83F80F                  cmp eax, 0000000F
:0040CA86 0F8DBE000000            jnl 0040CB4A
:0040CA8C 33C0                    xor eax, eax
:0040CA8E 8A45FC                  mov al, byte ptr [ebp-04]
:0040CA91 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0040CA94 33D2                    xor edx, edx
:0040CA96 8A540827                mov dl, byte ptr [eax+ecx+27]
:0040CA9A 81FAFF000000            cmp edx, 000000FF
:0040CAA0 0F849F000000            je 0040CB45
:0040CAA6 33C0                    xor eax, eax
:0040CAA8 8A45FC                  mov al, byte ptr [ebp-04]
:0040CAAB 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0040CAAE 33D2                    xor edx, edx
:0040CAB0 8A540827                mov dl, byte ptr [eax+ecx+27]
:0040CAB4 52                      push edx
:0040CAB5 E897F7FFFF              call 0040C251
:0040CABA 83C404                  add esp, 00000004
:0040CABD 8845F4                  mov byte ptr [ebp-0C], al
:0040CAC0 33C0                    xor eax, eax
:0040CAC2 8A45F4                  mov al, byte ptr [ebp-0C]
:0040CAC5 3B4508                  cmp eax, dword ptr [ebp+08]
:0040CAC8 0F8577000000            jne 0040CB45
:0040CACE 8B45E8                  mov eax, dword ptr [ebp-18]
:0040CAD1 33C9                    xor ecx, ecx
:0040CAD3 668B08                  mov cx, word ptr [eax]
:0040CAD6 81E1FFFDFFFF            and ecx, FFFFFDFF
:0040CADC 51                      push ecx
:0040CADD 33C0                    xor eax, eax
:0040CADF 8A45FC                  mov al, byte ptr [ebp-04]
:0040CAE2 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0040CAE5 33D2                    xor edx, edx
:0040CAE7 8A540827                mov dl, byte ptr [eax+ecx+27]
:0040CAEB 52                      push edx
:0040CAEC E880F8FFFF              call 0040C371
:0040CAF1 83C408                  add esp, 00000008
:0040CAF4 85C0                    test eax, eax
:0040CAF6 0F8449000000            je 0040CB45
:0040CAFC 33C0                    xor eax, eax
:0040CAFE 8A45FC                  mov al, byte ptr [ebp-04]
:0040CB01 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0040CB04 33D2                    xor edx, edx
:0040CB06 8A540827                mov dl, byte ptr [eax+ecx+27]
:0040CB0A 8BC2                    mov eax, edx
:0040CB0C C1E204                  shl edx, 04
:0040CB0F 8D8C0218AA4600          lea ecx, dword ptr [edx+eax+0046AA18]
:0040CB16 E8E5CAFFFF              call 00409600
:0040CB1B 8845F8                  mov byte ptr [ebp-08], al
:0040CB1E 33C0                    xor eax, eax
:0040CB20 8A45EC                  mov al, byte ptr [ebp-14]
:0040CB23 33C9                    xor ecx, ecx
:0040CB25 8A4DF8                  mov cl, byte ptr [ebp-08]
:0040CB28 3BC1                    cmp eax, ecx
:0040CB2A 0F8D15000000            jnl 0040CB45
:0040CB30 33C0                    xor eax, eax
:0040CB32 8A45FC                  mov al, byte ptr [ebp-04]
:0040CB35 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0040CB38 8A440827                mov al, byte ptr [eax+ecx+27]
:0040CB3C 8845F0                  mov byte ptr [ebp-10], al
:0040CB3F 8A45F8                  mov al, byte ptr [ebp-08]
:0040CB42 8845EC                  mov byte ptr [ebp-14], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040CAA0(C), :0040CAC8(C), :0040CAF6(C), :0040CB2A(C)
|
:0040CB45 E931FFFFFF              jmp 0040CA7B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CA86(C)
|
:0040CB4A 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0040CB4E 0F8508000000            jne 0040CB5C
:0040CB54 8A45EC                  mov al, byte ptr [ebp-14]
:0040CB57 E903000000              jmp 0040CB5F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CB4E(C)
|
:0040CB5C 8A45F0                  mov al, byte ptr [ebp-10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CB57(U)
|
:0040CB5F E900000000              jmp 0040CB64

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CB5F(U)
|
:0040CB64 5F                      pop edi
:0040CB65 5E                      pop esi
:0040CB66 5B                      pop ebx
:0040CB67 C9                      leave
:0040CB68 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0040BEF7   , :0042A15B   , :0043F860   
|
:0040CB6B 55                      push ebp
:0040CB6C 8BEC                    mov ebp, esp
:0040CB6E 83EC04                  sub esp, 00000004
:0040CB71 53                      push ebx
:0040CB72 56                      push esi
:0040CB73 57                      push edi
:0040CB74 894DFC                  mov dword ptr [ebp-04], ecx
:0040CB77 68F4010000              push 000001F4
:0040CB7C 6A00                    push 00000000
:0040CB7E 6A00                    push 00000000
:0040CB80 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040CB83 E8D6FEFFFF              call 0040CA5E
:0040CB88 33C9                    xor ecx, ecx
:0040CB8A 8AC8                    mov cl, al
:0040CB8C 51                      push ecx
:0040CB8D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040CB90 E84B120000              call 0040DDE0
:0040CB95 33C9                    xor ecx, ecx
:0040CB97 8AC8                    mov cl, al
:0040CB99 51                      push ecx
:0040CB9A E817A70300              call 004472B6
:0040CB9F 83C40C                  add esp, 0000000C
:0040CBA2 E900000000              jmp 0040CBA7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CBA2(U)
|
:0040CBA7 5F                      pop edi
:0040CBA8 5E                      pop esi
:0040CBA9 5B                      pop ebx
:0040CBAA C9                      leave
:0040CBAB C3                      ret



* Referenced by a CALL at Addresses:
|:0040BF10   , :0042A24B   , :0043F8CB   
|
:0040CBAC 55                      push ebp
:0040CBAD 8BEC                    mov ebp, esp
:0040CBAF 83EC04                  sub esp, 00000004
:0040CBB2 53                      push ebx
:0040CBB3 56                      push esi
:0040CBB4 57                      push edi
:0040CBB5 894DFC                  mov dword ptr [ebp-04], ecx
:0040CBB8 68F4010000              push 000001F4
:0040CBBD 6A00                    push 00000000
:0040CBBF 6A01                    push 00000001
:0040CBC1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040CBC4 E895FEFFFF              call 0040CA5E
:0040CBC9 33C9                    xor ecx, ecx
:0040CBCB 8AC8                    mov cl, al
:0040CBCD 51                      push ecx
:0040CBCE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040CBD1 E8EA110000              call 0040DDC0
:0040CBD6 33C9                    xor ecx, ecx
:0040CBD8 8AC8                    mov cl, al
:0040CBDA 51                      push ecx
:0040CBDB E8D6A60300              call 004472B6
:0040CBE0 83C40C                  add esp, 0000000C
:0040CBE3 E900000000              jmp 0040CBE8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CBE3(U)
|
:0040CBE8 5F                      pop edi
:0040CBE9 5E                      pop esi
:0040CBEA 5B                      pop ebx
:0040CBEB C9                      leave
:0040CBEC C3                      ret



* Referenced by a CALL at Addresses:
|:0040BF29   , :0042A280   , :0043F936   
|
:0040CBED 55                      push ebp
:0040CBEE 8BEC                    mov ebp, esp
:0040CBF0 83EC04                  sub esp, 00000004
:0040CBF3 53                      push ebx
:0040CBF4 56                      push esi
:0040CBF5 57                      push edi
:0040CBF6 894DFC                  mov dword ptr [ebp-04], ecx
:0040CBF9 68FF000000              push 000000FF
:0040CBFE 6A00                    push 00000000
:0040CC00 6A02                    push 00000002
:0040CC02 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040CC05 E854FEFFFF              call 0040CA5E
:0040CC0A 50                      push eax
:0040CC0B 8B45FC                  mov eax, dword ptr [ebp-04]
:0040CC0E 33C9                    xor ecx, ecx
:0040CC10 8A4824                  mov cl, byte ptr [eax+24]
:0040CC13 8A8118EC4400            mov al, byte ptr [ecx+0044EC18]
:0040CC19 50                      push eax
:0040CC1A E8C2A60300              call 004472E1
:0040CC1F 83C40C                  add esp, 0000000C
:0040CC22 E900000000              jmp 0040CC27

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CC22(U)
|
:0040CC27 5F                      pop edi
:0040CC28 5E                      pop esi
:0040CC29 5B                      pop ebx
:0040CC2A C9                      leave
:0040CC2B C3                      ret



* Referenced by a CALL at Addresses:
|:0040368D   , :0040377B   , :0040432F   , :0040D155   , :0041616C   
|:0041627B   
|
:0040CC2C 55                      push ebp
:0040CC2D 8BEC                    mov ebp, esp
:0040CC2F 83EC08                  sub esp, 00000008
:0040CC32 53                      push ebx
:0040CC33 56                      push esi
:0040CC34 57                      push edi
:0040CC35 894DF8                  mov dword ptr [ebp-08], ecx
:0040CC38 C645FC00                mov [ebp-04], 00
:0040CC3C E903000000              jmp 0040CC44

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CC75(U)
|
:0040CC41 FE45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CC3C(U)
|
:0040CC44 33C0                    xor eax, eax
:0040CC46 8A45FC                  mov al, byte ptr [ebp-04]
:0040CC49 83F80F                  cmp eax, 0000000F
:0040CC4C 0F8D28000000            jnl 0040CC7A
:0040CC52 33C0                    xor eax, eax
:0040CC54 8A45FC                  mov al, byte ptr [ebp-04]
:0040CC57 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040CC5A 33D2                    xor edx, edx
:0040CC5C 8A540827                mov dl, byte ptr [eax+ecx+27]
:0040CC60 33C0                    xor eax, eax
:0040CC62 8A4508                  mov al, byte ptr [ebp+08]
:0040CC65 3BD0                    cmp edx, eax
:0040CC67 0F8508000000            jne 0040CC75
:0040CC6D 8A45FC                  mov al, byte ptr [ebp-04]
:0040CC70 E90C000000              jmp 0040CC81

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CC67(C)
|
:0040CC75 E9C7FFFFFF              jmp 0040CC41

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CC4C(C)
|
:0040CC7A B0FF                    mov al, FF
:0040CC7C E900000000              jmp 0040CC81

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040CC70(U), :0040CC7C(U)
|
:0040CC81 5F                      pop edi
:0040CC82 5E                      pop esi
:0040CC83 5B                      pop ebx
:0040CC84 C9                      leave
:0040CC85 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0040273D   , :00434BE1   , :0043FA11   
|
:0040CC88 55                      push ebp
:0040CC89 8BEC                    mov ebp, esp
:0040CC8B 83EC0C                  sub esp, 0000000C
:0040CC8E 53                      push ebx
:0040CC8F 56                      push esi
:0040CC90 57                      push edi
:0040CC91 894DF4                  mov dword ptr [ebp-0C], ecx
:0040CC94 C745F800000000          mov [ebp-08], 00000000
:0040CC9B 8B45F8                  mov eax, dword ptr [ebp-08]
:0040CC9E 8945FC                  mov dword ptr [ebp-04], eax
:0040CCA1 E903000000              jmp 0040CCA9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CCCE(U)
|
:0040CCA6 FF45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CCA1(U)
|
:0040CCA9 837DFC0F                cmp dword ptr [ebp-04], 0000000F
:0040CCAD 0F8320000000            jnb 0040CCD3
:0040CCB3 8B45FC                  mov eax, dword ptr [ebp-04]
:0040CCB6 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040CCB9 33D2                    xor edx, edx
:0040CCBB 8A540827                mov dl, byte ptr [eax+ecx+27]
:0040CCBF 81FAFF000000            cmp edx, 000000FF
:0040CCC5 0F8403000000            je 0040CCCE
:0040CCCB FF45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CCC5(C)
|
:0040CCCE E9D3FFFFFF              jmp 0040CCA6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CCAD(C)
|
:0040CCD3 8A45F8                  mov al, byte ptr [ebp-08]
:0040CCD6 E900000000              jmp 0040CCDB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CCD6(U)
|
:0040CCDB 5F                      pop edi
:0040CCDC 5E                      pop esi
:0040CCDD 5B                      pop ebx
:0040CCDE C9                      leave
:0040CCDF C3                      ret



* Referenced by a CALL at Addresses:
|:0040365F   , :0040CE6B   
|
:0040CCE0 55                      push ebp
:0040CCE1 8BEC                    mov ebp, esp
:0040CCE3 83EC08                  sub esp, 00000008
:0040CCE6 53                      push ebx
:0040CCE7 56                      push esi
:0040CCE8 57                      push edi
:0040CCE9 894DF8                  mov dword ptr [ebp-08], ecx
:0040CCEC C745FC00000000          mov [ebp-04], 00000000
:0040CCF3 E903000000              jmp 0040CCFB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CD2F(U)
|
:0040CCF8 FF45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CCF3(U)
|
:0040CCFB 837DFC0F                cmp dword ptr [ebp-04], 0000000F
:0040CCFF 0F832F000000            jnb 0040CD34
:0040CD05 8B45FC                  mov eax, dword ptr [ebp-04]
:0040CD08 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040CD0B 33D2                    xor edx, edx
:0040CD0D 8A540827                mov dl, byte ptr [eax+ecx+27]
:0040CD11 81FAFF000000            cmp edx, 000000FF
:0040CD17 0F8512000000            jne 0040CD2F
:0040CD1D 8A4508                  mov al, byte ptr [ebp+08]
:0040CD20 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040CD23 8B55F8                  mov edx, dword ptr [ebp-08]
:0040CD26 88441127                mov byte ptr [ecx+edx+27], al
:0040CD2A E905000000              jmp 0040CD34

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CD17(C)
|
:0040CD2F E9C4FFFFFF              jmp 0040CCF8

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040CCFF(C), :0040CD2A(U)
|
:0040CD34 8A45FC                  mov al, byte ptr [ebp-04]
:0040CD37 E900000000              jmp 0040CD3C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CD37(U)
|
:0040CD3C 5F                      pop edi
:0040CD3D 5E                      pop esi
:0040CD3E 5B                      pop ebx
:0040CD3F C9                      leave
:0040CD40 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0040CF58   
|
:0040CD43 55                      push ebp
:0040CD44 8BEC                    mov ebp, esp
:0040CD46 83EC10                  sub esp, 00000010
:0040CD49 53                      push ebx
:0040CD4A 56                      push esi
:0040CD4B 57                      push edi
:0040CD4C 68FF000000              push 000000FF
:0040CD51 6A0F                    push 0000000F
:0040CD53 8B450C                  mov eax, dword ptr [ebp+0C]
:0040CD56 50                      push eax
:0040CD57 E807A70300              call 00447463
:0040CD5C 83C40C                  add esp, 0000000C
:0040CD5F C745F800000000          mov [ebp-08], 00000000
:0040CD66 C745F400000000          mov [ebp-0C], 00000000
:0040CD6D E903000000              jmp 0040CD75

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CDAD(U)
|
:0040CD72 FF45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CD6D(U)
|
:0040CD75 837DF40F                cmp dword ptr [ebp-0C], 0000000F
:0040CD79 0F8333000000            jnb 0040CDB2
:0040CD7F 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040CD82 50                      push eax
:0040CD83 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040CD86 E875C7FFFF              call 00409500
:0040CD8B 8845FC                  mov byte ptr [ebp-04], al
:0040CD8E 33C0                    xor eax, eax
:0040CD90 8A45FC                  mov al, byte ptr [ebp-04]
:0040CD93 3DFF000000              cmp eax, 000000FF
:0040CD98 0F840F000000            je 0040CDAD
:0040CD9E 8A45FC                  mov al, byte ptr [ebp-04]
:0040CDA1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040CDA4 8B550C                  mov edx, dword ptr [ebp+0C]
:0040CDA7 880411                  mov byte ptr [ecx+edx], al
:0040CDAA FF45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CD98(C)
|
:0040CDAD E9C0FFFFFF              jmp 0040CD72

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CD79(C)
|
:0040CDB2 837DF800                cmp dword ptr [ebp-08], 00000000
:0040CDB6 0F8507000000            jne 0040CDC3
:0040CDBC 33C0                    xor eax, eax
:0040CDBE E990000000              jmp 0040CE53

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CDB6(C)
|
:0040CDC3 C745F400000000          mov [ebp-0C], 00000000
:0040CDCA E903000000              jmp 0040CDD2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CE46(U)
|
:0040CDCF FF45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CDCA(U)
|
:0040CDD2 8B45F8                  mov eax, dword ptr [ebp-08]
:0040CDD5 3945F4                  cmp dword ptr [ebp-0C], eax
:0040CDD8 0F836D000000            jnb 0040CE4B
:0040CDDE 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040CDE1 40                      inc eax
:0040CDE2 8945F0                  mov dword ptr [ebp-10], eax
:0040CDE5 E903000000              jmp 0040CDED

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CE41(U)
|
:0040CDEA FF45F0                  inc [ebp-10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CDE5(U)
|
:0040CDED 8B45F8                  mov eax, dword ptr [ebp-08]
:0040CDF0 3945F0                  cmp dword ptr [ebp-10], eax
:0040CDF3 0F834D000000            jnb 0040CE46
:0040CDF9 8B45F0                  mov eax, dword ptr [ebp-10]
:0040CDFC 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0040CDFF 33D2                    xor edx, edx
:0040CE01 8A1408                  mov dl, byte ptr [eax+ecx]
:0040CE04 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040CE07 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0040CE0A 33DB                    xor ebx, ebx
:0040CE0C 8A1C08                  mov bl, byte ptr [eax+ecx]
:0040CE0F 3BD3                    cmp edx, ebx
:0040CE11 0F8D2A000000            jnl 0040CE41
:0040CE17 8B45F0                  mov eax, dword ptr [ebp-10]
:0040CE1A 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0040CE1D 8A0408                  mov al, byte ptr [eax+ecx]
:0040CE20 8845FC                  mov byte ptr [ebp-04], al
:0040CE23 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040CE26 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0040CE29 8A0408                  mov al, byte ptr [eax+ecx]
:0040CE2C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040CE2F 8B550C                  mov edx, dword ptr [ebp+0C]
:0040CE32 880411                  mov byte ptr [ecx+edx], al
:0040CE35 8A45FC                  mov al, byte ptr [ebp-04]
:0040CE38 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040CE3B 8B550C                  mov edx, dword ptr [ebp+0C]
:0040CE3E 880411                  mov byte ptr [ecx+edx], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CE11(C)
|
:0040CE41 E9A4FFFFFF              jmp 0040CDEA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CDF3(C)
|
:0040CE46 E984FFFFFF              jmp 0040CDCF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CDD8(C)
|
:0040CE4B 8B45F8                  mov eax, dword ptr [ebp-08]
:0040CE4E E900000000              jmp 0040CE53

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040CDBE(U), :0040CE4E(U)
|
:0040CE53 5F                      pop edi
:0040CE54 5E                      pop esi
:0040CE55 5B                      pop ebx
:0040CE56 C9                      leave
:0040CE57 C3                      ret



* Referenced by a CALL at Address:
|:00430A55   
|
:0040CE58 55                      push ebp
:0040CE59 8BEC                    mov ebp, esp
:0040CE5B 83EC34                  sub esp, 00000034
:0040CE5E 53                      push ebx
:0040CE5F 56                      push esi
:0040CE60 57                      push edi
:0040CE61 894DCC                  mov dword ptr [ebp-34], ecx
:0040CE64 8B4508                  mov eax, dword ptr [ebp+08]
:0040CE67 50                      push eax
:0040CE68 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0040CE6B E870FEFFFF              call 0040CCE0
:0040CE70 8845F0                  mov byte ptr [ebp-10], al
:0040CE73 33C0                    xor eax, eax
:0040CE75 8A4508                  mov al, byte ptr [ebp+08]
:0040CE78 8BC8                    mov ecx, eax
:0040CE7A C1E004                  shl eax, 04
:0040CE7D 8D8C0818AA4600          lea ecx, dword ptr [eax+ecx+0046AA18]
:0040CE84 E8D7C6FFFF              call 00409560
:0040CE89 8945FC                  mov dword ptr [ebp-04], eax
:0040CE8C C645F8FF                mov [ebp-08], FF
:0040CE90 33C0                    xor eax, eax
:0040CE92 8A45F0                  mov al, byte ptr [ebp-10]
:0040CE95 83F80F                  cmp eax, 0000000F
:0040CE98 0F850C030000            jne 0040D1AA
:0040CE9E 8B45FC                  mov eax, dword ptr [ebp-04]
:0040CEA1 50                      push eax

* Possible StringData Ref from Data Obj ->"ĿǰƷ̫࣬
Я%sˡ
ҪЩ"
                                        ->"Ʒ"
                                  |
:0040CEA2 6868EC4400              push 0044EC68
:0040CEA7 6A02                    push 00000002
:0040CEA9 E887C00200              call 00438F35
:0040CEAE 83C40C                  add esp, 0000000C
:0040CEB1 85C0                    test eax, eax
:0040CEB3 0F84D9020000            je 0040D192
:0040CEB9 8B45CC                  mov eax, dword ptr [ebp-34]
:0040CEBC 33C9                    xor ecx, ecx
:0040CEBE 668B08                  mov cx, word ptr [eax]
:0040CEC1 51                      push ecx
:0040CEC2 E8B0200100              call 0041EF77
:0040CEC7 83C404                  add esp, 00000004
:0040CECA 8945F4                  mov dword ptr [ebp-0C], eax

* Possible StringData Ref from Data Obj ->"ǼƷ"
                                  |
:0040CECD 68A4EC4400              push 0044ECA4
:0040CED2 6A00                    push 00000000
:0040CED4 E85CC00200              call 00438F35
:0040CED9 83C408                  add esp, 00000008
:0040CEDC E806A60200              call 004374E7
:0040CEE1 6A00                    push 00000000
:0040CEE3 68E0000000              push 000000E0
:0040CEE8 6810010000              push 00000110
:0040CEED 6A50                    push 00000050
:0040CEEF 68B8000000              push 000000B8
:0040CEF4 B958BC4600              mov ecx, 0046BC58
:0040CEF9 E864400100              call 00420F62
:0040CEFE 6A04                    push 00000004
:0040CF00 B910BC4600              mov ecx, 0046BC10
:0040CF05 E8772F0100              call 0041FE81
:0040CF0A 6A60                    push 00000060
:0040CF0C BB06000000              mov ebx, 00000006
:0040CF11 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040CF14 E8C7C5FFFF              call 004094E0
:0040CF19 50                      push eax
:0040CF1A E88BA40300              call 004473AA
:0040CF1F 83C404                  add esp, 00000004
:0040CF22 2BD8                    sub ebx, eax
:0040CF24 C1EB01                  shr ebx, 01
:0040CF27 83C325                  add ebx, 00000025
:0040CF2A 53                      push ebx
:0040CF2B B910BC4600              mov ecx, 0046BC10
:0040CF30 E8D22C0100              call 0041FC07
:0040CF35 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040CF38 E8A3C5FFFF              call 004094E0
:0040CF3D 50                      push eax

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:0040CF3E 68B4EC4400              push 0044ECB4
:0040CF43 6810BC4600              push 0046BC10
:0040CF48 E8D63B0100              call 00420B23
:0040CF4D 83C40C                  add esp, 0000000C
:0040CF50 8D45DC                  lea eax, dword ptr [ebp-24]
:0040CF53 50                      push eax
:0040CF54 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040CF57 50                      push eax
:0040CF58 E8E6FDFFFF              call 0040CD43
:0040CF5D 83C408                  add esp, 00000008
:0040CF60 8945D8                  mov dword ptr [ebp-28], eax
:0040CF63 E89C5FFFFF              call 00402F04
:0040CF68 8B45D8                  mov eax, dword ptr [ebp-28]
:0040CF6B 50                      push eax
:0040CF6C 8D45DC                  lea eax, dword ptr [ebp-24]
:0040CF6F 50                      push eax
:0040CF70 E8EB5FFFFF              call 00402F60
:0040CF75 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D107(U)
|
:0040CF78 B988534500              mov ecx, 00455388
:0040CF7D E81A4EFFFF              call 00401D9C
:0040CF82 85C0                    test eax, eax
:0040CF84 0F8424000000            je 0040CFAE
:0040CF8A 8B45FC                  mov eax, dword ptr [ebp-04]
:0040CF8D 50                      push eax

* Possible StringData Ref from Data Obj ->"%s𣿡"
                                  |
:0040CF8E 6850EC4400              push 0044EC50
:0040CF93 6A02                    push 00000002
:0040CF95 E89BBF0200              call 00438F35
:0040CF9A 83C40C                  add esp, 0000000C
:0040CF9D 85C0                    test eax, eax
:0040CF9F 0F8409000000            je 0040CFAE
:0040CFA5 C645F8FF                mov [ebp-08], FF
:0040CFA9 E95E010000              jmp 0040D10C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040CF84(C), :0040CF9F(C)
|
:0040CFAE E88A60FFFF              call 0040303D
:0040CFB3 8845F8                  mov byte ptr [ebp-08], al
:0040CFB6 33C0                    xor eax, eax
:0040CFB8 8A45F8                  mov al, byte ptr [ebp-08]
:0040CFBB 3DFF000000              cmp eax, 000000FF
:0040CFC0 0F84A3000000            je 0040D069
:0040CFC6 33C0                    xor eax, eax
:0040CFC8 A064EC4400              mov al, byte ptr [0044EC64]
:0040CFCD 33C9                    xor ecx, ecx
:0040CFCF 8A4DF8                  mov cl, byte ptr [ebp-08]
:0040CFD2 3BC1                    cmp eax, ecx
:0040CFD4 0F848F000000            je 0040D069
:0040CFDA 6A02                    push 00000002
:0040CFDC 6A10                    push 00000010
:0040CFDE 68B0000000              push 000000B0
:0040CFE3 6A78                    push 00000078
:0040CFE5 68E8000000              push 000000E8
:0040CFEA E81BA20100              call 0042720A
:0040CFEF 83C414                  add esp, 00000014
:0040CFF2 6A04                    push 00000004
:0040CFF4 B910BC4600              mov ecx, 0046BC10
:0040CFF9 E8832E0100              call 0041FE81
:0040CFFE 6A78                    push 00000078
:0040D000 BB16000000              mov ebx, 00000016
:0040D005 33C0                    xor eax, eax
:0040D007 8A45F8                  mov al, byte ptr [ebp-08]
:0040D00A 33C9                    xor ecx, ecx
:0040D00C 8A4C05DC                mov cl, byte ptr [ebp+eax-24]
:0040D010 51                      push ecx
:0040D011 E8F8150100              call 0041E60E
:0040D016 83C404                  add esp, 00000004
:0040D019 50                      push eax
:0040D01A E88BA30300              call 004473AA
:0040D01F 83C404                  add esp, 00000004
:0040D022 2BD8                    sub ebx, eax
:0040D024 C1EB01                  shr ebx, 01
:0040D027 83C31D                  add ebx, 0000001D
:0040D02A 53                      push ebx
:0040D02B B910BC4600              mov ecx, 0046BC10
:0040D030 E8D22B0100              call 0041FC07
:0040D035 33C0                    xor eax, eax
:0040D037 8A45F8                  mov al, byte ptr [ebp-08]
:0040D03A 33C9                    xor ecx, ecx
:0040D03C 8A4C05DC                mov cl, byte ptr [ebp+eax-24]
:0040D040 51                      push ecx
:0040D041 E8C8150100              call 0041E60E
:0040D046 83C404                  add esp, 00000004
:0040D049 50                      push eax

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:0040D04A 68B8EC4400              push 0044ECB8
:0040D04F 6810BC4600              push 0046BC10
:0040D054 E8CA3A0100              call 00420B23
:0040D059 83C40C                  add esp, 0000000C
:0040D05C 8A45F8                  mov al, byte ptr [ebp-08]
:0040D05F A264EC4400              mov byte ptr [0044EC64], al
:0040D064 E918000000              jmp 0040D081

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040CFC0(C), :0040CFD4(C)
|
:0040D069 33C0                    xor eax, eax
:0040D06B 8A45F8                  mov al, byte ptr [ebp-08]
:0040D06E 3DFF000000              cmp eax, 000000FF
:0040D073 0F8508000000            jne 0040D081
:0040D079 8A45F8                  mov al, byte ptr [ebp-08]
:0040D07C A264EC4400              mov byte ptr [0044EC64], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040D064(U), :0040D073(C)
|
:0040D081 B988534500              mov ecx, 00455388
:0040D086 E8F14CFFFF              call 00401D7C
:0040D08B 85C0                    test eax, eax
:0040D08D 0F8474000000            je 0040D107
:0040D093 33C0                    xor eax, eax
:0040D095 8A45F8                  mov al, byte ptr [ebp-08]
:0040D098 3DFF000000              cmp eax, 000000FF
:0040D09D 0F850B000000            jne 0040D0AE
:0040D0A3 8B45FC                  mov eax, dword ptr [ebp-04]
:0040D0A6 8945D4                  mov dword ptr [ebp-2C], eax
:0040D0A9 E917000000              jmp 0040D0C5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D09D(C)
|
:0040D0AE 33C0                    xor eax, eax
:0040D0B0 8A45F8                  mov al, byte ptr [ebp-08]
:0040D0B3 33C9                    xor ecx, ecx
:0040D0B5 8A4C05DC                mov cl, byte ptr [ebp+eax-24]
:0040D0B9 51                      push ecx
:0040D0BA E84F150100              call 0041E60E
:0040D0BF 83C404                  add esp, 00000004
:0040D0C2 8945D4                  mov dword ptr [ebp-2C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D0A9(U)
|
:0040D0C5 33C0                    xor eax, eax
:0040D0C7 8A45F8                  mov al, byte ptr [ebp-08]
:0040D0CA 3DFF000000              cmp eax, 000000FF
:0040D0CF 0F850C000000            jne 0040D0E1

* Possible StringData Ref from Data Obj ->"%s𣿡"
                                  |
:0040D0D5 C745D050EC4400          mov [ebp-30], 0044EC50
:0040D0DC E907000000              jmp 0040D0E8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D0CF(C)
|

* Possible StringData Ref from Data Obj ->"%s𣿡"
                                  |
:0040D0E1 C745D0BCEC4400          mov [ebp-30], 0044ECBC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D0DC(U)
|
:0040D0E8 8B45D4                  mov eax, dword ptr [ebp-2C]
:0040D0EB 50                      push eax
:0040D0EC 8B45D0                  mov eax, dword ptr [ebp-30]
:0040D0EF 50                      push eax
:0040D0F0 6A02                    push 00000002
:0040D0F2 E83EBE0200              call 00438F35
:0040D0F7 83C40C                  add esp, 0000000C
:0040D0FA 85C0                    test eax, eax
:0040D0FC 0F8405000000            je 0040D107
:0040D102 E905000000              jmp 0040D10C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040D08D(C), :0040D0FC(C)
|
:0040D107 E96CFEFFFF              jmp 0040CF78

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040CFA9(U), :0040D102(U)
|
:0040D10C B958BC4600              mov ecx, 0046BC58
:0040D111 E8C63E0100              call 00420FDC
:0040D116 33C0                    xor eax, eax
:0040D118 8A45F8                  mov al, byte ptr [ebp-08]
:0040D11B 3DFF000000              cmp eax, 000000FF
:0040D120 0F8518000000            jne 0040D13E
:0040D126 8B45FC                  mov eax, dword ptr [ebp-04]
:0040D129 50                      push eax
:0040D12A 6840EC4400              push 0044EC40
:0040D12F 6A00                    push 00000000
:0040D131 E8FFBD0200              call 00438F35
:0040D136 83C40C                  add esp, 0000000C
:0040D139 E94F000000              jmp 0040D18D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D120(C)
|
:0040D13E 33C0                    xor eax, eax
:0040D140 8A45F8                  mov al, byte ptr [ebp-08]
:0040D143 8A4405DC                mov al, byte ptr [ebp+eax-24]
:0040D147 8845EC                  mov byte ptr [ebp-14], al
:0040D14A 8B4508                  mov eax, dword ptr [ebp+08]
:0040D14D 50                      push eax
:0040D14E 8B45EC                  mov eax, dword ptr [ebp-14]
:0040D151 50                      push eax
:0040D152 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0040D155 E8D2FAFFFF              call 0040CC2C
:0040D15A 50                      push eax
:0040D15B 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0040D15E E8CDC3FFFF              call 00409530
:0040D163 8B45FC                  mov eax, dword ptr [ebp-04]
:0040D166 50                      push eax
:0040D167 33C0                    xor eax, eax
:0040D169 8A45EC                  mov al, byte ptr [ebp-14]
:0040D16C 8BC8                    mov ecx, eax
:0040D16E C1E004                  shl eax, 04
:0040D171 8D8C0818AA4600          lea ecx, dword ptr [eax+ecx+0046AA18]
:0040D178 E8E3C3FFFF              call 00409560
:0040D17D 50                      push eax

* Possible StringData Ref from Data Obj ->"%sõ%s"
                                  |
:0040D17E 68D0EC4400              push 0044ECD0
:0040D183 6A00                    push 00000000
:0040D185 E8ABBD0200              call 00438F35
:0040D18A 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D139(U)
|
:0040D18D E913000000              jmp 0040D1A5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CEB3(C)
|
:0040D192 8B45FC                  mov eax, dword ptr [ebp-04]
:0040D195 50                      push eax
:0040D196 6840EC4400              push 0044EC40
:0040D19B 6A00                    push 00000000
:0040D19D E893BD0200              call 00438F35
:0040D1A2 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D18D(U)
|
:0040D1A5 E913000000              jmp 0040D1BD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CE98(C)
|
:0040D1AA 8B45FC                  mov eax, dword ptr [ebp-04]
:0040D1AD 50                      push eax

* Possible StringData Ref from Data Obj ->"õ%s"
                                  |
:0040D1AE 68E8EC4400              push 0044ECE8
:0040D1B3 6A00                    push 00000000
:0040D1B5 E87BBD0200              call 00438F35
:0040D1BA 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D1A5(U)
|
:0040D1BD 8A45F0                  mov al, byte ptr [ebp-10]
:0040D1C0 E900000000              jmp 0040D1C5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D1C0(U)
|
:0040D1C5 5F                      pop edi
:0040D1C6 5E                      pop esi
:0040D1C7 5B                      pop ebx
:0040D1C8 C9                      leave
:0040D1C9 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:004042E4   , :0040544F   , :00423FCF   , :00443833   
|
:0040D1CC 55                      push ebp
:0040D1CD 8BEC                    mov ebp, esp
:0040D1CF 81ECA4010000            sub esp, 000001A4
:0040D1D5 53                      push ebx
:0040D1D6 56                      push esi
:0040D1D7 57                      push edi
:0040D1D8 898D5CFEFFFF            mov dword ptr [ebp+FFFFFE5C], ecx
:0040D1DE C78568FEFFFF00000000    mov dword ptr [ebp+FFFFFE68], 00000000
:0040D1E8 8B855CFEFFFF            mov eax, dword ptr [ebp+FFFFFE5C]
:0040D1EE 33C9                    xor ecx, ecx
:0040D1F0 668B08                  mov cx, word ptr [eax]
:0040D1F3 81E1FF01FFFF            and ecx, FFFF01FF
:0040D1F9 898D6CFEFFFF            mov dword ptr [ebp+FFFFFE6C], ecx
:0040D1FF 81BD6CFEFFFFEB000000    cmp dword ptr [ebp+FFFFFE6C], 000000EB
:0040D209 0F8718000000            ja 0040D227
:0040D20F 8B8D5CFEFFFF            mov ecx, dword ptr [ebp+FFFFFE5C]
:0040D215 E866C0FFFF              call 00409280
:0040D21A 33C9                    xor ecx, ecx
:0040D21C 8AC8                    mov cl, al
:0040D21E 83F963                  cmp ecx, 00000063
:0040D221 0F820B000000            jb 0040D232

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D209(C)
|
:0040D227 8B8568FEFFFF            mov eax, dword ptr [ebp+FFFFFE68]
:0040D22D E94E020000              jmp 0040D480

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D221(C)
|
:0040D232 E904000000              jmp 0040D23B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D464(U)
|
:0040D237 836D0864                sub dword ptr [ebp+08], 00000064

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D232(U)
|
:0040D23B 837D0864                cmp dword ptr [ebp+08], 00000064
:0040D23F 0F8224020000            jb 0040D469
:0040D245 6A07                    push 00000007
:0040D247 B994A64600              mov ecx, 0046A694
:0040D24C E8D3BD0000              call 00419024
:0040D251 8B855CFEFFFF            mov eax, dword ptr [ebp+FFFFFE5C]
:0040D257 33C9                    xor ecx, ecx
:0040D259 8A481B                  mov cl, byte ptr [eax+1B]
:0040D25C 898D64FEFFFF            mov dword ptr [ebp+FFFFFE64], ecx
:0040D262 8B855CFEFFFF            mov eax, dword ptr [ebp+FFFFFE5C]
:0040D268 33C9                    xor ecx, ecx
:0040D26A 8A481D                  mov cl, byte ptr [eax+1D]
:0040D26D 898D74FEFFFF            mov dword ptr [ebp+FFFFFE74], ecx
:0040D273 8B855CFEFFFF            mov eax, dword ptr [ebp+FFFFFE5C]
:0040D279 33C9                    xor ecx, ecx
:0040D27B 8A481C                  mov cl, byte ptr [eax+1C]
:0040D27E 894DFC                  mov dword ptr [ebp-04], ecx
:0040D281 8B855CFEFFFF            mov eax, dword ptr [ebp+FFFFFE5C]
:0040D287 8B401E                  mov eax, dword ptr [eax+1E]
:0040D28A 898578FEFFFF            mov dword ptr [ebp+FFFFFE78], eax
:0040D290 8B855CFEFFFF            mov eax, dword ptr [ebp+FFFFFE5C]
:0040D296 33C9                    xor ecx, ecx
:0040D298 8A4822                  mov cl, byte ptr [eax+22]
:0040D29B 898D70FEFFFF            mov dword ptr [ebp+FFFFFE70], ecx
:0040D2A1 6A01                    push 00000001
:0040D2A3 8B8D5CFEFFFF            mov ecx, dword ptr [ebp+FFFFFE5C]
:0040D2A9 E806F5FFFF              call 0040C7B4
:0040D2AE 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0040D2B2 0F84CD000000            je 0040D385
:0040D2B8 8B8D5CFEFFFF            mov ecx, dword ptr [ebp+FFFFFE5C]
:0040D2BE E8BDBFFFFF              call 00409280
:0040D2C3 33C9                    xor ecx, ecx
:0040D2C5 8AC8                    mov cl, al
:0040D2C7 51                      push ecx
:0040D2C8 8B856CFEFFFF            mov eax, dword ptr [ebp+FFFFFE6C]
:0040D2CE 50                      push eax
:0040D2CF E814EBFFFF              call 0040BDE8
:0040D2D4 83C404                  add esp, 00000004
:0040D2D7 50                      push eax

* Possible StringData Ref from Data Obj ->"%sĵȼΪ%u"
                                  |
:0040D2D8 68F4EC4400              push 0044ECF4
:0040D2DD 6A00                    push 00000000
:0040D2DF E851BC0200              call 00438F35
:0040D2E4 83C410                  add esp, 00000010
:0040D2E7 8B855CFEFFFF            mov eax, dword ptr [ebp+FFFFFE5C]
:0040D2ED 33C9                    xor ecx, ecx
:0040D2EF 8A4822                  mov cl, byte ptr [eax+22]
:0040D2F2 2B8D70FEFFFF            sub ecx, dword ptr [ebp+FFFFFE70]
:0040D2F8 51                      push ecx
:0040D2F9 8B855CFEFFFF            mov eax, dword ptr [ebp+FFFFFE5C]
:0040D2FF 33C9                    xor ecx, ecx
:0040D301 8A4822                  mov cl, byte ptr [eax+22]
:0040D304 51                      push ecx
:0040D305 8B855CFEFFFF            mov eax, dword ptr [ebp+FFFFFE5C]
:0040D30B 8B401E                  mov eax, dword ptr [eax+1E]
:0040D30E 2B8578FEFFFF            sub eax, dword ptr [ebp+FFFFFE78]
:0040D314 50                      push eax
:0040D315 8B855CFEFFFF            mov eax, dword ptr [ebp+FFFFFE5C]
:0040D31B 8B401E                  mov eax, dword ptr [eax+1E]
:0040D31E 50                      push eax
:0040D31F 8B855CFEFFFF            mov eax, dword ptr [ebp+FFFFFE5C]
:0040D325 33C9                    xor ecx, ecx
:0040D327 8A481C                  mov cl, byte ptr [eax+1C]
:0040D32A 2B4DFC                  sub ecx, dword ptr [ebp-04]
:0040D32D 51                      push ecx
:0040D32E 8B855CFEFFFF            mov eax, dword ptr [ebp+FFFFFE5C]
:0040D334 33C9                    xor ecx, ecx
:0040D336 8A481C                  mov cl, byte ptr [eax+1C]
:0040D339 51                      push ecx
:0040D33A 8B855CFEFFFF            mov eax, dword ptr [ebp+FFFFFE5C]
:0040D340 33C9                    xor ecx, ecx
:0040D342 8A481D                  mov cl, byte ptr [eax+1D]
:0040D345 2B8D74FEFFFF            sub ecx, dword ptr [ebp+FFFFFE74]
:0040D34B 51                      push ecx
:0040D34C 8B855CFEFFFF            mov eax, dword ptr [ebp+FFFFFE5C]
:0040D352 33C9                    xor ecx, ecx
:0040D354 8A481D                  mov cl, byte ptr [eax+1D]
:0040D357 51                      push ecx
:0040D358 8B855CFEFFFF            mov eax, dword ptr [ebp+FFFFFE5C]
:0040D35E 33C9                    xor ecx, ecx
:0040D360 8A481B                  mov cl, byte ptr [eax+1B]
:0040D363 2B8D64FEFFFF            sub ecx, dword ptr [ebp+FFFFFE64]
:0040D369 51                      push ecx
:0040D36A 8B855CFEFFFF            mov eax, dword ptr [ebp+FFFFFE5C]
:0040D370 33C9                    xor ecx, ecx
:0040D372 8A481B                  mov cl, byte ptr [eax+1B]
:0040D375 51                      push ecx

* Possible StringData Ref from Data Obj ->"Ϊ%3u (+ %2u )
Ϊ%3u "
                                        ->"(+ %2u )
ͳΪ%3u (+ "
                                        ->"%2u )
;Ϊ%3u (+ %2u "
                                        ->")
ֵΪ%3u (+ %2u )"
                                  |
:0040D376 6808ED4400              push 0044ED08
:0040D37B 6A00                    push 00000000
:0040D37D E8B3BB0200              call 00438F35
:0040D382 83C430                  add esp, 00000030

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D2B2(C)
|
:0040D385 C6857CFEFFFF00          mov byte ptr [ebp+FFFFFE7C], 00
:0040D38C C78560FEFFFF00000000    mov dword ptr [ebp+FFFFFE60], 00000000
:0040D396 E906000000              jmp 0040D3A1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D423(U)
|
:0040D39B FF8560FEFFFF            inc dword ptr [ebp+FFFFFE60]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D396(U)
|
:0040D3A1 83BD60FEFFFF30          cmp dword ptr [ebp+FFFFFE60], 00000030
:0040D3A8 0F837A000000            jnb 0040D428
:0040D3AE 8B855CFEFFFF            mov eax, dword ptr [ebp+FFFFFE5C]
:0040D3B4 33C9                    xor ecx, ecx
:0040D3B6 8A4824                  mov cl, byte ptr [eax+24]
:0040D3B9 8B8560FEFFFF            mov eax, dword ptr [ebp+FFFFFE60]
:0040D3BF 8D0480                  lea eax, dword ptr [eax+4*eax]
:0040D3C2 33D2                    xor edx, edx
:0040D3C4 8A94C118D34400          mov dl, byte ptr [ecx+8*eax+0044D318]
:0040D3CB 8B855CFEFFFF            mov eax, dword ptr [ebp+FFFFFE5C]
:0040D3D1 33C9                    xor ecx, ecx
:0040D3D3 8A4825                  mov cl, byte ptr [eax+25]
:0040D3D6 3BD1                    cmp edx, ecx
:0040D3D8 0F8545000000            jne 0040D423

* Possible StringData Ref from Data Obj ->""
                                  |
:0040D3DE 6890ED4400              push 0044ED90
:0040D3E3 8D857CFEFFFF            lea eax, dword ptr [ebp+FFFFFE7C]
:0040D3E9 50                      push eax
:0040D3EA E801A00300              call 004473F0
:0040D3EF 83C408                  add esp, 00000008
:0040D3F2 8B8560FEFFFF            mov eax, dword ptr [ebp+FFFFFE60]
:0040D3F8 8B0485F0D14400          mov eax, dword ptr [4*eax+0044D1F0]
:0040D3FF 50                      push eax
:0040D400 8D857CFEFFFF            lea eax, dword ptr [ebp+FFFFFE7C]
:0040D406 50                      push eax
:0040D407 E8E49F0300              call 004473F0
:0040D40C 83C408                  add esp, 00000008

* Possible StringData Ref from Data Obj ->""
                                  |
:0040D40F 6894ED4400              push 0044ED94
:0040D414 8D857CFEFFFF            lea eax, dword ptr [ebp+FFFFFE7C]
:0040D41A 50                      push eax
:0040D41B E8D09F0300              call 004473F0
:0040D420 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D3D8(C)
|
:0040D423 E973FFFFFF              jmp 0040D39B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D3A8(C)
|
:0040D428 33C0                    xor eax, eax
:0040D42A 8A857CFEFFFF            mov al, byte ptr [ebp+FFFFFE7C]
:0040D430 85C0                    test eax, eax
:0040D432 0F842C000000            je 0040D464
:0040D438 6A07                    push 00000007
:0040D43A B994A64600              mov ecx, 0046A694
:0040D43F E8E0BB0000              call 00419024
:0040D444 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0040D448 0F8416000000            je 0040D464
:0040D44E 8D857CFEFFFF            lea eax, dword ptr [ebp+FFFFFE7C]
:0040D454 50                      push eax

* Possible StringData Ref from Data Obj ->"ѧ%sˣ"
                                  |
:0040D455 6898ED4400              push 0044ED98
:0040D45A 6A00                    push 00000000
:0040D45C E8D4BA0200              call 00438F35
:0040D461 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040D432(C), :0040D448(C)
|
:0040D464 E9CEFDFFFF              jmp 0040D237

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D23F(C)
|
:0040D469 8A4508                  mov al, byte ptr [ebp+08]
:0040D46C 8B8D5CFEFFFF            mov ecx, dword ptr [ebp+FFFFFE5C]
:0040D472 884126                  mov byte ptr [ecx+26], al
:0040D475 8B8568FEFFFF            mov eax, dword ptr [ebp+FFFFFE68]
:0040D47B E900000000              jmp 0040D480

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040D22D(U), :0040D47B(U)
|
:0040D480 5F                      pop edi
:0040D481 5E                      pop esi
:0040D482 5B                      pop ebx
:0040D483 C9                      leave
:0040D484 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0042B2A3   , :0042B2DC   , :0042B315   , :0042B34B   , :0042B384   
|
:0040D487 55                      push ebp
:0040D488 8BEC                    mov ebp, esp
:0040D48A 83EC14                  sub esp, 00000014
:0040D48D 53                      push ebx
:0040D48E 56                      push esi
:0040D48F 57                      push edi
:0040D490 894DF0                  mov dword ptr [ebp-10], ecx
:0040D493 8B45F0                  mov eax, dword ptr [ebp-10]
:0040D496 33C9                    xor ecx, ecx
:0040D498 8A4825                  mov cl, byte ptr [eax+25]
:0040D49B 894DF8                  mov dword ptr [ebp-08], ecx
:0040D49E 8B45F0                  mov eax, dword ptr [ebp-10]
:0040D4A1 8A4024                  mov al, byte ptr [eax+24]
:0040D4A4 8845FC                  mov byte ptr [ebp-04], al
:0040D4A7 C745F400000000          mov [ebp-0C], 00000000
:0040D4AE 33C0                    xor eax, eax
:0040D4B0 8A45FC                  mov al, byte ptr [ebp-04]
:0040D4B3 83F81F                  cmp eax, 0000001F
:0040D4B6 0F8E4E000000            jle 0040D50A
:0040D4BC 33C0                    xor eax, eax
:0040D4BE 8A45FC                  mov al, byte ptr [ebp-04]
:0040D4C1 83F828                  cmp eax, 00000028
:0040D4C4 0F8340000000            jnb 0040D50A
:0040D4CA 33C0                    xor eax, eax
:0040D4CC 8A45FC                  mov al, byte ptr [ebp-04]
:0040D4CF 83F820                  cmp eax, 00000020
:0040D4D2 0F840E000000            je 0040D4E6
:0040D4D8 33C0                    xor eax, eax
:0040D4DA 8A45FC                  mov al, byte ptr [ebp-04]
:0040D4DD 83F821                  cmp eax, 00000021
:0040D4E0 0F8509000000            jne 0040D4EF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D4D2(C)
|
:0040D4E6 C645FC20                mov [ebp-04], 20
:0040D4EA E91B000000              jmp 0040D50A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D4E0(C)
|
:0040D4EF 33C0                    xor eax, eax
:0040D4F1 8A45FC                  mov al, byte ptr [ebp-04]
:0040D4F4 83F826                  cmp eax, 00000026
:0040D4F7 0F8509000000            jne 0040D506
:0040D4FD C645FC12                mov [ebp-04], 12
:0040D501 E904000000              jmp 0040D50A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D4F7(C)
|
:0040D506 C645FC1E                mov [ebp-04], 1E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040D4B6(C), :0040D4C4(C), :0040D4EA(U), :0040D501(U)
|
:0040D50A 8B45F0                  mov eax, dword ptr [ebp-10]
:0040D50D 33C9                    xor ecx, ecx
:0040D50F 8A4824                  mov cl, byte ptr [eax+24]
:0040D512 51                      push ecx
:0040D513 E82D010000              call 0040D645
:0040D518 83C404                  add esp, 00000004
:0040D51B 8945EC                  mov dword ptr [ebp-14], eax
:0040D51E E9E2000000              jmp 0040D605

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D61D(C)
|
:0040D523 33C0                    xor eax, eax
:0040D525 8A45FC                  mov al, byte ptr [ebp-04]
:0040D528 33C9                    xor ecx, ecx
:0040D52A 8A4D08                  mov cl, byte ptr [ebp+08]
:0040D52D 8BD1                    mov edx, ecx
:0040D52F C1E105                  shl ecx, 05
:0040D532 03CA                    add ecx, edx
:0040D534 33D2                    xor edx, edx
:0040D536 8A94086EEB4400          mov dl, byte ptr [eax+ecx+0044EB6E]
:0040D53D 85D2                    test edx, edx
:0040D53F 0F8E24000000            jle 0040D569
:0040D545 33C0                    xor eax, eax
:0040D547 8A45FC                  mov al, byte ptr [ebp-04]
:0040D54A 33C9                    xor ecx, ecx
:0040D54C 8A4D08                  mov cl, byte ptr [ebp+08]
:0040D54F 8BD1                    mov edx, ecx
:0040D551 C1E105                  shl ecx, 05
:0040D554 03CA                    add ecx, edx
:0040D556 33D2                    xor edx, edx
:0040D558 8A94086EEB4400          mov dl, byte ptr [eax+ecx+0044EB6E]
:0040D55F 8D445203                lea eax, dword ptr [edx+2*edx+03]
:0040D563 8D0480                  lea eax, dword ptr [eax+4*eax]
:0040D566 0145F4                  add dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D53F(C)
|
:0040D569 836DF80F                sub dword ptr [ebp-08], 0000000F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D613(C)
|
:0040D56D 33C0                    xor eax, eax
:0040D56F 8A45FC                  mov al, byte ptr [ebp-04]
:0040D572 33C9                    xor ecx, ecx
:0040D574 8A4D08                  mov cl, byte ptr [ebp+08]
:0040D577 8BD1                    mov edx, ecx
:0040D579 C1E105                  shl ecx, 05
:0040D57C 03CA                    add ecx, edx
:0040D57E 33D2                    xor edx, edx
:0040D580 8A94086FEB4400          mov dl, byte ptr [eax+ecx+0044EB6F]
:0040D587 85D2                    test edx, edx
:0040D589 0F8E24000000            jle 0040D5B3
:0040D58F 33C0                    xor eax, eax
:0040D591 8A45FC                  mov al, byte ptr [ebp-04]
:0040D594 33C9                    xor ecx, ecx
:0040D596 8A4D08                  mov cl, byte ptr [ebp+08]
:0040D599 8BD1                    mov edx, ecx
:0040D59B C1E105                  shl ecx, 05
:0040D59E 03CA                    add ecx, edx
:0040D5A0 33D2                    xor edx, edx
:0040D5A2 8A94086FEB4400          mov dl, byte ptr [eax+ecx+0044EB6F]
:0040D5A9 8D445203                lea eax, dword ptr [edx+2*edx+03]
:0040D5AD 8D0480                  lea eax, dword ptr [eax+4*eax]
:0040D5B0 0145F4                  add dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D589(C)
|
:0040D5B3 836DF80F                sub dword ptr [ebp-08], 0000000F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D609(C)
|
:0040D5B7 33C0                    xor eax, eax
:0040D5B9 8A45FC                  mov al, byte ptr [ebp-04]
:0040D5BC 33C9                    xor ecx, ecx
:0040D5BE 8A4D08                  mov cl, byte ptr [ebp+08]
:0040D5C1 8BD1                    mov edx, ecx
:0040D5C3 C1E105                  shl ecx, 05
:0040D5C6 03CA                    add ecx, edx
:0040D5C8 33D2                    xor edx, edx
:0040D5CA 8A940870EB4400          mov dl, byte ptr [eax+ecx+0044EB70]
:0040D5D1 85D2                    test edx, edx
:0040D5D3 0F8E22000000            jle 0040D5FB
:0040D5D9 33C0                    xor eax, eax
:0040D5DB 8A4508                  mov al, byte ptr [ebp+08]
:0040D5DE 8BC8                    mov ecx, eax
:0040D5E0 C1E005                  shl eax, 05
:0040D5E3 03C1                    add eax, ecx
:0040D5E5 33C9                    xor ecx, ecx
:0040D5E7 8A4DFC                  mov cl, byte ptr [ebp-04]
:0040D5EA 33D2                    xor edx, edx
:0040D5EC 8A940870EB4400          mov dl, byte ptr [eax+ecx+0044EB70]
:0040D5F3 42                      inc edx
:0040D5F4 0FAF55F8                imul edx, dword ptr [ebp-08]
:0040D5F8 0155F4                  add dword ptr [ebp-0C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D5D3(C)
|
:0040D5FB E928000000              jmp 0040D628
:0040D600 E923000000              jmp 0040D628

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D51E(U)
|
:0040D605 837DEC00                cmp dword ptr [ebp-14], 00000000
:0040D609 0F84A8FFFFFF            je 0040D5B7
:0040D60F 837DEC01                cmp dword ptr [ebp-14], 00000001
:0040D613 0F8454FFFFFF            je 0040D56D
:0040D619 837DEC02                cmp dword ptr [ebp-14], 00000002
:0040D61D 0F8400FFFFFF            je 0040D523
:0040D623 E900000000              jmp 0040D628

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040D5FB(U), :0040D600(U), :0040D623(U)
|
:0040D628 33C0                    xor eax, eax
:0040D62A 8A4508                  mov al, byte ptr [ebp+08]
:0040D62D 83F803                  cmp eax, 00000003
:0040D630 0F8400000000            je 0040D636

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D630(C)
|
:0040D636 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040D639 E900000000              jmp 0040D63E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D639(U)
|
:0040D63E 5F                      pop edi
:0040D63F 5E                      pop esi
:0040D640 5B                      pop ebx
:0040D641 C9                      leave
:0040D642 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0040D513   
|
:0040D645 55                      push ebp
:0040D646 8BEC                    mov ebp, esp
:0040D648 83EC08                  sub esp, 00000008
:0040D64B 53                      push ebx
:0040D64C 56                      push esi
:0040D64D 57                      push edi
:0040D64E 8B4508                  mov eax, dword ptr [ebp+08]
:0040D651 8945F8                  mov dword ptr [ebp-08], eax
:0040D654 E9A8000000              jmp 0040D701
:0040D659 8B4508                  mov eax, dword ptr [ebp+08]
:0040D65C 8945FC                  mov dword ptr [ebp-04], eax
:0040D65F E919010000              jmp 0040D77D
:0040D664 8B4508                  mov eax, dword ptr [ebp+08]
:0040D667 83E803                  sub eax, 00000003
:0040D66A 8945FC                  mov dword ptr [ebp-04], eax
:0040D66D E90B010000              jmp 0040D77D
:0040D672 8B4508                  mov eax, dword ptr [ebp+08]
:0040D675 83E806                  sub eax, 00000006
:0040D678 8945FC                  mov dword ptr [ebp-04], eax
:0040D67B E9FD000000              jmp 0040D77D
:0040D680 8B4508                  mov eax, dword ptr [ebp+08]
:0040D683 83E809                  sub eax, 00000009
:0040D686 8945FC                  mov dword ptr [ebp-04], eax
:0040D689 E9EF000000              jmp 0040D77D
:0040D68E 8B4508                  mov eax, dword ptr [ebp+08]
:0040D691 83E80C                  sub eax, 0000000C
:0040D694 8945FC                  mov dword ptr [ebp-04], eax
:0040D697 E9E1000000              jmp 0040D77D
:0040D69C 8B4508                  mov eax, dword ptr [ebp+08]
:0040D69F 83E80F                  sub eax, 0000000F
:0040D6A2 8945FC                  mov dword ptr [ebp-04], eax
:0040D6A5 E9D3000000              jmp 0040D77D
:0040D6AA 8B4508                  mov eax, dword ptr [ebp+08]
:0040D6AD 83E812                  sub eax, 00000012
:0040D6B0 8945FC                  mov dword ptr [ebp-04], eax
:0040D6B3 E9C5000000              jmp 0040D77D
:0040D6B8 8B4508                  mov eax, dword ptr [ebp+08]
:0040D6BB 83E815                  sub eax, 00000015
:0040D6BE 8945FC                  mov dword ptr [ebp-04], eax
:0040D6C1 E9B7000000              jmp 0040D77D
:0040D6C6 8B4508                  mov eax, dword ptr [ebp+08]
:0040D6C9 83E817                  sub eax, 00000017
:0040D6CC 8945FC                  mov dword ptr [ebp-04], eax
:0040D6CF E9A9000000              jmp 0040D77D
:0040D6D4 8B4508                  mov eax, dword ptr [ebp+08]
:0040D6D7 83E819                  sub eax, 00000019
:0040D6DA 8945FC                  mov dword ptr [ebp-04], eax
:0040D6DD E99B000000              jmp 0040D77D
:0040D6E2 8B4508                  mov eax, dword ptr [ebp+08]
:0040D6E5 83E81E                  sub eax, 0000001E
:0040D6E8 8945FC                  mov dword ptr [ebp-04], eax
:0040D6EB E98D000000              jmp 0040D77D
:0040D6F0 C745FC00000000          mov [ebp-04], 00000000
:0040D6F7 E981000000              jmp 0040D77D
:0040D6FC E97C000000              jmp 0040D77D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D654(U)
|
:0040D701 837DF827                cmp dword ptr [ebp-08], 00000027
:0040D705 0F8772000000            ja 0040D77D
:0040D70B 8B45F8                  mov eax, dword ptr [ebp-08]
:0040D70E 33C9                    xor ecx, ecx
:0040D710 8A8855D74000            mov cl, byte ptr [eax+0040D755]
:0040D716 FF248D1DD74000          jmp dword ptr [4*ecx+0040D71D]

:0040D71D 59D64000                DWORD 0040D659
:0040D721 64D64000                DWORD 0040D664
:0040D725 72D64000                DWORD 0040D672
:0040D729 80D64000                DWORD 0040D680
:0040D72D 8ED64000                DWORD 0040D68E
:0040D731 9CD64000                DWORD 0040D69C
:0040D735 AAD64000                DWORD 0040D6AA
:0040D739 B8D64000                DWORD 0040D6B8
:0040D73D C6D64000                DWORD 0040D6C6
:0040D741 D4D64000                DWORD 0040D6D4
:0040D745 F0D64000                DWORD 0040D6F0
:0040D749 E2D64000                DWORD 0040D6E2
:0040D74D F0D64000                DWORD 0040D6F0
:0040D751 7DD74000                DWORD 0040D77D


:0040D755 000000                  BYTE  3 DUP(0)


:0040D758 0101                    add dword ptr [ecx], eax
:0040D75A 0102                    add dword ptr [edx], eax
:0040D75C 0202                    add al, byte ptr [edx]
:0040D75E 0303                    add eax, dword ptr [ebx]
:0040D760 030404                  add eax, dword ptr [esp+eax]
:0040D763 0405                    add al, 05
:0040D765 0505060606              add eax, 06060605
:0040D76A 07                      pop es
:0040D76B 07                      pop es
:0040D76C 0808                    or byte ptr [eax], cl
:0040D76E 0909                    or dword ptr [ecx], ecx
:0040D770 0A0A                    or cl, byte ptr [edx]
:0040D772 0A0B                    or cl, byte ptr [ebx]
:0040D774 0B0C0C                  or ecx, dword ptr [esp+ecx]
:0040D777 0C0C                    or al, 0C
:0040D779 0C0C                    or al, 0C
:0040D77B 0C0C                    or al, 0C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040D65F(U), :0040D66D(U), :0040D67B(U), :0040D689(U), :0040D697(U)
|:0040D6A5(U), :0040D6B3(U), :0040D6C1(U), :0040D6CF(U), :0040D6DD(U)
|:0040D6EB(U), :0040D6F7(U), :0040D6FC(U), :0040D705(C)
|
:0040D77D 8B45FC                  mov eax, dword ptr [ebp-04]
:0040D780 E900000000              jmp 0040D785

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D780(U)
|
:0040D785 5F                      pop edi
:0040D786 5E                      pop esi
:0040D787 5B                      pop ebx
:0040D788 C9                      leave
:0040D789 C3                      ret



* Referenced by a CALL at Address:
|:00409C5C   
|
:0040D78A 55                      push ebp
:0040D78B 8BEC                    mov ebp, esp
:0040D78D 83EC14                  sub esp, 00000014
:0040D790 53                      push ebx
:0040D791 56                      push esi
:0040D792 57                      push edi
:0040D793 894DEC                  mov dword ptr [ebp-14], ecx
:0040D796 8B4508                  mov eax, dword ptr [ebp+08]
:0040D799 0D00020000              or eax, 00000200
:0040D79E 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040D7A1 668901                  mov word ptr [ecx], ax
:0040D7A4 8B450C                  mov eax, dword ptr [ebp+0C]
:0040D7A7 8945FC                  mov dword ptr [ebp-04], eax
:0040D7AA 8B45EC                  mov eax, dword ptr [ebp-14]
:0040D7AD 83C006                  add eax, 00000006
:0040D7B0 8945F8                  mov dword ptr [ebp-08], eax
:0040D7B3 C745F000000000          mov [ebp-10], 00000000
:0040D7BA E903000000              jmp 0040D7C2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D7DC(U)
|
:0040D7BF FF45F0                  inc [ebp-10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D7BA(U)
|
:0040D7C2 837DF006                cmp dword ptr [ebp-10], 00000006
:0040D7C6 0F8315000000            jnb 0040D7E1
:0040D7CC 8B45FC                  mov eax, dword ptr [ebp-04]
:0040D7CF 8A00                    mov al, byte ptr [eax]
:0040D7D1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040D7D4 8801                    mov byte ptr [ecx], al
:0040D7D6 FF45FC                  inc [ebp-04]
:0040D7D9 FF45F8                  inc [ebp-08]
:0040D7DC E9DEFFFFFF              jmp 0040D7BF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D7C6(C)
|
:0040D7E1 8B45F8                  mov eax, dword ptr [ebp-08]
:0040D7E4 C60000                  mov byte ptr [eax], 00
:0040D7E7 83450C06                add dword ptr [ebp+0C], 00000006
:0040D7EB 8B450C                  mov eax, dword ptr [ebp+0C]
:0040D7EE 8945FC                  mov dword ptr [ebp-04], eax
:0040D7F1 8B45EC                  mov eax, dword ptr [ebp-14]
:0040D7F4 83C00D                  add eax, 0000000D
:0040D7F7 8945F8                  mov dword ptr [ebp-08], eax
:0040D7FA C745F000000000          mov [ebp-10], 00000000
:0040D801 E903000000              jmp 0040D809

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D823(U)
|
:0040D806 FF45F0                  inc [ebp-10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D801(U)
|
:0040D809 837DF008                cmp dword ptr [ebp-10], 00000008
:0040D80D 0F8315000000            jnb 0040D828
:0040D813 8B45FC                  mov eax, dword ptr [ebp-04]
:0040D816 8A00                    mov al, byte ptr [eax]
:0040D818 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040D81B 8801                    mov byte ptr [ecx], al
:0040D81D FF45FC                  inc [ebp-04]
:0040D820 FF45F8                  inc [ebp-08]
:0040D823 E9DEFFFFFF              jmp 0040D806

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D80D(C)
|
:0040D828 8B45F8                  mov eax, dword ptr [ebp-08]
:0040D82B C60000                  mov byte ptr [eax], 00
:0040D82E 83450C08                add dword ptr [ebp+0C], 00000008
:0040D832 8B450C                  mov eax, dword ptr [ebp+0C]
:0040D835 33C9                    xor ecx, ecx
:0040D837 8A08                    mov cl, byte ptr [eax]
:0040D839 894DF4                  mov dword ptr [ebp-0C], ecx
:0040D83C FF450C                  inc [ebp+0C]
:0040D83F 8B450C                  mov eax, dword ptr [ebp+0C]
:0040D842 33C9                    xor ecx, ecx
:0040D844 8A08                    mov cl, byte ptr [eax]
:0040D846 C1E108                  shl ecx, 08
:0040D849 014DF4                  add dword ptr [ebp-0C], ecx
:0040D84C FF450C                  inc [ebp+0C]
:0040D84F 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040D852 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040D855 894116                  mov dword ptr [ecx+16], eax
:0040D858 8B450C                  mov eax, dword ptr [ebp+0C]
:0040D85B 8A00                    mov al, byte ptr [eax]
:0040D85D 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040D860 884105                  mov byte ptr [ecx+05], al
:0040D863 FF450C                  inc [ebp+0C]
:0040D866 8B4510                  mov eax, dword ptr [ebp+10]
:0040D869 8A00                    mov al, byte ptr [eax]
:0040D86B 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040D86E 88411A                  mov byte ptr [ecx+1A], al
:0040D871 FF4510                  inc [ebp+10]
:0040D874 8B4510                  mov eax, dword ptr [ebp+10]
:0040D877 8A00                    mov al, byte ptr [eax]
:0040D879 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040D87C 88411B                  mov byte ptr [ecx+1B], al
:0040D87F FF4510                  inc [ebp+10]
:0040D882 8B4510                  mov eax, dword ptr [ebp+10]
:0040D885 8A00                    mov al, byte ptr [eax]
:0040D887 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040D88A 88411C                  mov byte ptr [ecx+1C], al
:0040D88D FF4510                  inc [ebp+10]
:0040D890 8B4510                  mov eax, dword ptr [ebp+10]
:0040D893 8A00                    mov al, byte ptr [eax]
:0040D895 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040D898 88411D                  mov byte ptr [ecx+1D], al
:0040D89B FF4510                  inc [ebp+10]
:0040D89E 8B4510                  mov eax, dword ptr [ebp+10]
:0040D8A1 33C9                    xor ecx, ecx
:0040D8A3 8A08                    mov cl, byte ptr [eax]
:0040D8A5 894DF4                  mov dword ptr [ebp-0C], ecx
:0040D8A8 FF4510                  inc [ebp+10]
:0040D8AB 8B4510                  mov eax, dword ptr [ebp+10]
:0040D8AE 33C9                    xor ecx, ecx
:0040D8B0 8A08                    mov cl, byte ptr [eax]
:0040D8B2 C1E108                  shl ecx, 08
:0040D8B5 014DF4                  add dword ptr [ebp-0C], ecx
:0040D8B8 FF4510                  inc [ebp+10]
:0040D8BB 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040D8BE 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040D8C1 89411E                  mov dword ptr [ecx+1E], eax
:0040D8C4 8B4510                  mov eax, dword ptr [ebp+10]
:0040D8C7 8A00                    mov al, byte ptr [eax]
:0040D8C9 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040D8CC 884122                  mov byte ptr [ecx+22], al
:0040D8CF FF4510                  inc [ebp+10]
:0040D8D2 8B4510                  mov eax, dword ptr [ebp+10]
:0040D8D5 33C9                    xor ecx, ecx
:0040D8D7 8A08                    mov cl, byte ptr [eax]
:0040D8D9 83C102                  add ecx, 00000002
:0040D8DC 8B45EC                  mov eax, dword ptr [ebp-14]
:0040D8DF 884823                  mov byte ptr [eax+23], cl
:0040D8E2 FF4510                  inc [ebp+10]
:0040D8E5 8B4510                  mov eax, dword ptr [ebp+10]
:0040D8E8 8A00                    mov al, byte ptr [eax]
:0040D8EA 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040D8ED 884124                  mov byte ptr [ecx+24], al
:0040D8F0 FF4510                  inc [ebp+10]
:0040D8F3 8B4510                  mov eax, dword ptr [ebp+10]
:0040D8F6 8A00                    mov al, byte ptr [eax]
:0040D8F8 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040D8FB 884125                  mov byte ptr [ecx+25], al
:0040D8FE FF4510                  inc [ebp+10]
:0040D901 8B4510                  mov eax, dword ptr [ebp+10]
:0040D904 8A00                    mov al, byte ptr [eax]
:0040D906 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040D909 884126                  mov byte ptr [ecx+26], al
:0040D90C FF4510                  inc [ebp+10]
:0040D90F 6A0F                    push 0000000F
:0040D911 8B45EC                  mov eax, dword ptr [ebp-14]
:0040D914 83C027                  add eax, 00000027
:0040D917 50                      push eax
:0040D918 8B4510                  mov eax, dword ptr [ebp+10]
:0040D91B 50                      push eax
:0040D91C E82C9B0300              call 0044744D
:0040D921 83C40C                  add esp, 0000000C
:0040D924 8345100F                add dword ptr [ebp+10], 0000000F
:0040D928 8B45EC                  mov eax, dword ptr [ebp-14]
:0040D92B 81781EE8030000          cmp dword ptr [eax+1E], 000003E8
:0040D932 0F860A000000            jbe 0040D942
:0040D938 8B45EC                  mov eax, dword ptr [ebp-14]
:0040D93B C7401EE8030000          mov [eax+1E], 000003E8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D932(C)
|
:0040D942 E900000000              jmp 0040D947

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D942(U)
|
:0040D947 5F                      pop edi
:0040D948 5E                      pop esi
:0040D949 5B                      pop ebx
:0040D94A C9                      leave
:0040D94B C20C00                  ret 000C



* Referenced by a CALL at Address:
|:00409E24   
|
:0040D94E 55                      push ebp
:0040D94F 8BEC                    mov ebp, esp
:0040D951 83EC08                  sub esp, 00000008
:0040D954 53                      push ebx
:0040D955 56                      push esi
:0040D956 57                      push edi
:0040D957 894DF8                  mov dword ptr [ebp-08], ecx
:0040D95A 8B4508                  mov eax, dword ptr [ebp+08]
:0040D95D 8A00                    mov al, byte ptr [eax]
:0040D95F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040D962 88411A                  mov byte ptr [ecx+1A], al
:0040D965 FF4508                  inc [ebp+08]
:0040D968 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0040D96C 0F840E000000            je 0040D980
:0040D972 FF4508                  inc [ebp+08]
:0040D975 FF4508                  inc [ebp+08]
:0040D978 FF4508                  inc [ebp+08]
:0040D97B E92A000000              jmp 0040D9AA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D96C(C)
|
:0040D980 8B4508                  mov eax, dword ptr [ebp+08]
:0040D983 8A00                    mov al, byte ptr [eax]
:0040D985 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040D988 88411B                  mov byte ptr [ecx+1B], al
:0040D98B FF4508                  inc [ebp+08]
:0040D98E 8B4508                  mov eax, dword ptr [ebp+08]
:0040D991 8A00                    mov al, byte ptr [eax]
:0040D993 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040D996 88411C                  mov byte ptr [ecx+1C], al
:0040D999 FF4508                  inc [ebp+08]
:0040D99C 8B4508                  mov eax, dword ptr [ebp+08]
:0040D99F 8A00                    mov al, byte ptr [eax]
:0040D9A1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040D9A4 88411D                  mov byte ptr [ecx+1D], al
:0040D9A7 FF4508                  inc [ebp+08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D97B(U)
|
:0040D9AA 8B4508                  mov eax, dword ptr [ebp+08]
:0040D9AD 33C9                    xor ecx, ecx
:0040D9AF 8A08                    mov cl, byte ptr [eax]
:0040D9B1 894DFC                  mov dword ptr [ebp-04], ecx
:0040D9B4 FF4508                  inc [ebp+08]
:0040D9B7 8B4508                  mov eax, dword ptr [ebp+08]
:0040D9BA 33C9                    xor ecx, ecx
:0040D9BC 8A08                    mov cl, byte ptr [eax]
:0040D9BE C1E108                  shl ecx, 08
:0040D9C1 014DFC                  add dword ptr [ebp-04], ecx
:0040D9C4 FF4508                  inc [ebp+08]
:0040D9C7 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0040D9CB 0F8408000000            je 0040D9D9
:0040D9D1 FF4508                  inc [ebp+08]
:0040D9D4 E917000000              jmp 0040D9F0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D9CB(C)
|
:0040D9D9 8B45FC                  mov eax, dword ptr [ebp-04]
:0040D9DC 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040D9DF 89411E                  mov dword ptr [ecx+1E], eax
:0040D9E2 8B4508                  mov eax, dword ptr [ebp+08]
:0040D9E5 8A00                    mov al, byte ptr [eax]
:0040D9E7 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040D9EA 884122                  mov byte ptr [ecx+22], al
:0040D9ED FF4508                  inc [ebp+08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D9D4(U)
|
:0040D9F0 8B4508                  mov eax, dword ptr [ebp+08]
:0040D9F3 33C9                    xor ecx, ecx
:0040D9F5 8A08                    mov cl, byte ptr [eax]
:0040D9F7 83C102                  add ecx, 00000002
:0040D9FA 8B45F8                  mov eax, dword ptr [ebp-08]
:0040D9FD 884823                  mov byte ptr [eax+23], cl
:0040DA00 FF4508                  inc [ebp+08]
:0040DA03 8B4508                  mov eax, dword ptr [ebp+08]
:0040DA06 8A00                    mov al, byte ptr [eax]
:0040DA08 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040DA0B 884124                  mov byte ptr [ecx+24], al
:0040DA0E FF4508                  inc [ebp+08]
:0040DA11 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0040DA15 0F840B000000            je 0040DA26
:0040DA1B FF4508                  inc [ebp+08]
:0040DA1E FF4508                  inc [ebp+08]
:0040DA21 E91C000000              jmp 0040DA42

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DA15(C)
|
:0040DA26 8B4508                  mov eax, dword ptr [ebp+08]
:0040DA29 8A00                    mov al, byte ptr [eax]
:0040DA2B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040DA2E 884125                  mov byte ptr [ecx+25], al
:0040DA31 FF4508                  inc [ebp+08]
:0040DA34 8B4508                  mov eax, dword ptr [ebp+08]
:0040DA37 8A00                    mov al, byte ptr [eax]
:0040DA39 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040DA3C 884126                  mov byte ptr [ecx+26], al
:0040DA3F FF4508                  inc [ebp+08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DA21(U)
|
:0040DA42 6A0F                    push 0000000F
:0040DA44 8B45F8                  mov eax, dword ptr [ebp-08]
:0040DA47 83C027                  add eax, 00000027
:0040DA4A 50                      push eax
:0040DA4B 8B4508                  mov eax, dword ptr [ebp+08]
:0040DA4E 50                      push eax
:0040DA4F E8F9990300              call 0044744D
:0040DA54 83C40C                  add esp, 0000000C
:0040DA57 8345080F                add dword ptr [ebp+08], 0000000F
:0040DA5B 8B45F8                  mov eax, dword ptr [ebp-08]
:0040DA5E 81781EE8030000          cmp dword ptr [eax+1E], 000003E8
:0040DA65 0F860A000000            jbe 0040DA75
:0040DA6B 8B45F8                  mov eax, dword ptr [ebp-08]
:0040DA6E C7401EE8030000          mov [eax+1E], 000003E8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DA65(C)
|
:0040DA75 8B4508                  mov eax, dword ptr [ebp+08]
:0040DA78 E900000000              jmp 0040DA7D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DA78(U)
|
:0040DA7D 5F                      pop edi
:0040DA7E 5E                      pop esi
:0040DA7F 5B                      pop ebx
:0040DA80 C9                      leave
:0040DA81 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:00409D95   , :0040A0D4   , :0040B59C   
|
:0040DA84 55                      push ebp
:0040DA85 8BEC                    mov ebp, esp
:0040DA87 83EC04                  sub esp, 00000004
:0040DA8A 53                      push ebx
:0040DA8B 56                      push esi
:0040DA8C 57                      push edi
:0040DA8D 894DFC                  mov dword ptr [ebp-04], ecx
:0040DA90 8B45FC                  mov eax, dword ptr [ebp-04]
:0040DA93 8A401A                  mov al, byte ptr [eax+1A]
:0040DA96 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040DA99 8801                    mov byte ptr [ecx], al
:0040DA9B FF4508                  inc [ebp+08]
:0040DA9E 8B45FC                  mov eax, dword ptr [ebp-04]
:0040DAA1 8A401B                  mov al, byte ptr [eax+1B]
:0040DAA4 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040DAA7 8801                    mov byte ptr [ecx], al
:0040DAA9 FF4508                  inc [ebp+08]
:0040DAAC 8B45FC                  mov eax, dword ptr [ebp-04]
:0040DAAF 8A401C                  mov al, byte ptr [eax+1C]
:0040DAB2 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040DAB5 8801                    mov byte ptr [ecx], al
:0040DAB7 FF4508                  inc [ebp+08]
:0040DABA 8B45FC                  mov eax, dword ptr [ebp-04]
:0040DABD 8A401D                  mov al, byte ptr [eax+1D]
:0040DAC0 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040DAC3 8801                    mov byte ptr [ecx], al
:0040DAC5 FF4508                  inc [ebp+08]
:0040DAC8 8B45FC                  mov eax, dword ptr [ebp-04]
:0040DACB 8A401E                  mov al, byte ptr [eax+1E]
:0040DACE 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040DAD1 8801                    mov byte ptr [ecx], al
:0040DAD3 FF4508                  inc [ebp+08]
:0040DAD6 8B45FC                  mov eax, dword ptr [ebp-04]
:0040DAD9 8B401E                  mov eax, dword ptr [eax+1E]
:0040DADC 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040DADF 8821                    mov byte ptr [ecx], ah
:0040DAE1 FF4508                  inc [ebp+08]
:0040DAE4 8B45FC                  mov eax, dword ptr [ebp-04]
:0040DAE7 8A4022                  mov al, byte ptr [eax+22]
:0040DAEA 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040DAED 8801                    mov byte ptr [ecx], al
:0040DAEF FF4508                  inc [ebp+08]
:0040DAF2 8B45FC                  mov eax, dword ptr [ebp-04]
:0040DAF5 33C9                    xor ecx, ecx
:0040DAF7 8A4823                  mov cl, byte ptr [eax+23]
:0040DAFA 83E902                  sub ecx, 00000002
:0040DAFD 8B4508                  mov eax, dword ptr [ebp+08]
:0040DB00 8808                    mov byte ptr [eax], cl
:0040DB02 FF4508                  inc [ebp+08]
:0040DB05 8B45FC                  mov eax, dword ptr [ebp-04]
:0040DB08 8A4024                  mov al, byte ptr [eax+24]
:0040DB0B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040DB0E 8801                    mov byte ptr [ecx], al
:0040DB10 FF4508                  inc [ebp+08]
:0040DB13 8B45FC                  mov eax, dword ptr [ebp-04]
:0040DB16 8A4025                  mov al, byte ptr [eax+25]
:0040DB19 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040DB1C 8801                    mov byte ptr [ecx], al
:0040DB1E FF4508                  inc [ebp+08]
:0040DB21 8B45FC                  mov eax, dword ptr [ebp-04]
:0040DB24 8A4026                  mov al, byte ptr [eax+26]
:0040DB27 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040DB2A 8801                    mov byte ptr [ecx], al
:0040DB2C FF4508                  inc [ebp+08]
:0040DB2F 6A0F                    push 0000000F
:0040DB31 8B4508                  mov eax, dword ptr [ebp+08]
:0040DB34 50                      push eax
:0040DB35 8B45FC                  mov eax, dword ptr [ebp-04]
:0040DB38 83C027                  add eax, 00000027
:0040DB3B 50                      push eax
:0040DB3C E80C990300              call 0044744D
:0040DB41 83C40C                  add esp, 0000000C
:0040DB44 8345080F                add dword ptr [ebp+08], 0000000F
:0040DB48 8B4508                  mov eax, dword ptr [ebp+08]
:0040DB4B E900000000              jmp 0040DB50

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DB4B(U)
|
:0040DB50 5F                      pop edi
:0040DB51 5E                      pop esi
:0040DB52 5B                      pop ebx
:0040DB53 C9                      leave
:0040DB54 C20400                  ret 0004



* Referenced by a CALL at Address:
|:00409BEB   
|
:0040DB57 55                      push ebp
:0040DB58 8BEC                    mov ebp, esp
:0040DB5A 83EC10                  sub esp, 00000010
:0040DB5D 53                      push ebx
:0040DB5E 56                      push esi
:0040DB5F 57                      push edi
:0040DB60 894DF0                  mov dword ptr [ebp-10], ecx
:0040DB63 8B4508                  mov eax, dword ptr [ebp+08]
:0040DB66 0D00040000              or eax, 00000400
:0040DB6B 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040DB6E 668901                  mov word ptr [ecx], ax
:0040DB71 8B450C                  mov eax, dword ptr [ebp+0C]
:0040DB74 8945FC                  mov dword ptr [ebp-04], eax
:0040DB77 8B45F0                  mov eax, dword ptr [ebp-10]
:0040DB7A 83C006                  add eax, 00000006
:0040DB7D 8945F8                  mov dword ptr [ebp-08], eax
:0040DB80 C745F400000000          mov [ebp-0C], 00000000
:0040DB87 E903000000              jmp 0040DB8F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DBA9(U)
|
:0040DB8C FF45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DB87(U)
|
:0040DB8F 837DF408                cmp dword ptr [ebp-0C], 00000008
:0040DB93 0F8315000000            jnb 0040DBAE
:0040DB99 8B45FC                  mov eax, dword ptr [ebp-04]
:0040DB9C 8A00                    mov al, byte ptr [eax]
:0040DB9E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040DBA1 8801                    mov byte ptr [ecx], al
:0040DBA3 FF45FC                  inc [ebp-04]
:0040DBA6 FF45F8                  inc [ebp-08]
:0040DBA9 E9DEFFFFFF              jmp 0040DB8C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DB93(C)
|
:0040DBAE 8B45F8                  mov eax, dword ptr [ebp-08]
:0040DBB1 C60000                  mov byte ptr [eax], 00
:0040DBB4 83450C08                add dword ptr [ebp+0C], 00000008
:0040DBB8 8B450C                  mov eax, dword ptr [ebp+0C]
:0040DBBB 8A00                    mov al, byte ptr [eax]
:0040DBBD 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040DBC0 884105                  mov byte ptr [ecx+05], al
:0040DBC3 FF450C                  inc [ebp+0C]
:0040DBC6 8B450C                  mov eax, dword ptr [ebp+0C]
:0040DBC9 8A00                    mov al, byte ptr [eax]
:0040DBCB 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040DBCE 884104                  mov byte ptr [ecx+04], al
:0040DBD1 FF450C                  inc [ebp+0C]
:0040DBD4 8B450C                  mov eax, dword ptr [ebp+0C]
:0040DBD7 8A00                    mov al, byte ptr [eax]
:0040DBD9 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040DBDC 884102                  mov byte ptr [ecx+02], al
:0040DBDF FF450C                  inc [ebp+0C]
:0040DBE2 8B450C                  mov eax, dword ptr [ebp+0C]
:0040DBE5 8A00                    mov al, byte ptr [eax]
:0040DBE7 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040DBEA 884103                  mov byte ptr [ecx+03], al
:0040DBED FF450C                  inc [ebp+0C]
:0040DBF0 E900000000              jmp 0040DBF5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DBF0(U)
|
:0040DBF5 5F                      pop edi
:0040DBF6 5E                      pop esi
:0040DBF7 5B                      pop ebx
:0040DBF8 C9                      leave
:0040DBF9 C20800                  ret 0008


:0040DBFC 55                      push ebp
:0040DBFD 8BEC                    mov ebp, esp
:0040DBFF 53                      push ebx
:0040DC00 56                      push esi
:0040DC01 57                      push edi
:0040DC02 E80F000000              call 0040DC16
:0040DC07 E835000000              call 0040DC41
:0040DC0C E900000000              jmp 0040DC11

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DC0C(U)
|
:0040DC11 5F                      pop edi
:0040DC12 5E                      pop esi
:0040DC13 5B                      pop ebx
:0040DC14 C9                      leave
:0040DC15 C3                      ret



* Referenced by a CALL at Address:
|:0040DC02   
|
:0040DC16 55                      push ebp
:0040DC17 8BEC                    mov ebp, esp
:0040DC19 53                      push ebx
:0040DC1A 56                      push esi
:0040DC1B 57                      push edi
:0040DC1C 6860DF4000              push 0040DF60
:0040DC21 68F0DE4000              push 0040DEF0
:0040DC26 6800010000              push 00000100
:0040DC2B 6A10                    push 00000010
:0040DC2D 68E8C24500              push 0045C2E8
:0040DC32 E809A10300              call 00447D40
:0040DC37 E900000000              jmp 0040DC3C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DC37(U)
|
:0040DC3C 5F                      pop edi
:0040DC3D 5E                      pop esi
:0040DC3E 5B                      pop ebx
:0040DC3F C9                      leave
:0040DC40 C3                      ret



* Referenced by a CALL at Address:
|:0040DC07   
|
:0040DC41 55                      push ebp
:0040DC42 8BEC                    mov ebp, esp
:0040DC44 53                      push ebx
:0040DC45 56                      push esi
:0040DC46 57                      push edi
:0040DC47 685EDC4000              push 0040DC5E
:0040DC4C E88FA00300              call 00447CE0
:0040DC51 83C404                  add esp, 00000004
:0040DC54 E900000000              jmp 0040DC59

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DC54(U)
|
:0040DC59 5F                      pop edi
:0040DC5A 5E                      pop esi
:0040DC5B 5B                      pop ebx
:0040DC5C C9                      leave
:0040DC5D C3                      ret


:0040DC5E 55                      push ebp
:0040DC5F 8BEC                    mov ebp, esp
:0040DC61 53                      push ebx
:0040DC62 56                      push esi
:0040DC63 57                      push edi
:0040DC64 6860DF4000              push 0040DF60
:0040DC69 6800010000              push 00000100
:0040DC6E 6A10                    push 00000010
:0040DC70 68E8C24500              push 0045C2E8
:0040DC75 E856A10300              call 00447DD0
:0040DC7A E900000000              jmp 0040DC7F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DC7A(U)
|
:0040DC7F 5F                      pop edi
:0040DC80 5E                      pop esi
:0040DC81 5B                      pop ebx
:0040DC82 C9                      leave
:0040DC83 C3                      ret


:0040DC84 CC                      int 03
:0040DC85 CC                      int 03
:0040DC86 CC                      int 03
:0040DC87 CC                      int 03
:0040DC88 CC                      int 03
:0040DC89 CC                      int 03
:0040DC8A CC                      int 03
:0040DC8B CC                      int 03
:0040DC8C CC                      int 03
:0040DC8D CC                      int 03
:0040DC8E CC                      int 03
:0040DC8F CC                      int 03
:0040DC90 55                      push ebp
:0040DC91 8BEC                    mov ebp, esp
:0040DC93 6AFF                    push FFFFFFFF
:0040DC95 68EBDC4000              push 0040DCEB
:0040DC9A 64A100000000            mov eax, dword ptr fs:[00000000]
:0040DCA0 50                      push eax
:0040DCA1 64892500000000          mov dword ptr fs:[00000000], esp
:0040DCA8 83EC04                  sub esp, 00000004
:0040DCAB 53                      push ebx
:0040DCAC 56                      push esi
:0040DCAD 57                      push edi
:0040DCAE 894DF0                  mov dword ptr [ebp-10], ecx
:0040DCB1 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040DCB4 E857000000              call 0040DD10
:0040DCB9 C745FC00000000          mov [ebp-04], 00000000
:0040DCC0 8B45F0                  mov eax, dword ptr [ebp-10]
:0040DCC3 C6400600                mov [eax+06], 00
:0040DCC7 8B45F0                  mov eax, dword ptr [ebp-10]
:0040DCCA C6400D00                mov [eax+0D], 00
:0040DCCE E900000000              jmp 0040DCD3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DCCE(U)
|
:0040DCD3 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0040DCDA 8B45F0                  mov eax, dword ptr [ebp-10]
:0040DCDD E913000000              jmp 0040DCF5
:0040DCE2 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040DCE5 E856000000              call 0040DD40
:0040DCEA C3                      ret


:0040DCEB B820C14400              mov eax, 0044C120
:0040DCF0 E9CBA30300              jmp 004480C0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DCDD(U)
|
:0040DCF5 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040DCF8 64890D00000000          mov dword ptr fs:[00000000], ecx
:0040DCFF 5F                      pop edi
:0040DD00 5E                      pop esi
:0040DD01 5B                      pop ebx
:0040DD02 C9                      leave
:0040DD03 C3                      ret


:0040DD04 CC                      int 03
:0040DD05 CC                      int 03
:0040DD06 CC                      int 03
:0040DD07 CC                      int 03
:0040DD08 CC                      int 03
:0040DD09 CC                      int 03
:0040DD0A CC                      int 03
:0040DD0B CC                      int 03
:0040DD0C CC                      int 03
:0040DD0D CC                      int 03
:0040DD0E CC                      int 03
:0040DD0F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040DCB4   , :0040DF14   , :00417934   
|
:0040DD10 55                      push ebp
:0040DD11 8BEC                    mov ebp, esp
:0040DD13 83EC04                  sub esp, 00000004
:0040DD16 53                      push ebx
:0040DD17 56                      push esi
:0040DD18 57                      push edi
:0040DD19 894DFC                  mov dword ptr [ebp-04], ecx
:0040DD1C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040DD1F 83C102                  add ecx, 00000002
:0040DD22 E8493BFFFF              call 00401870
:0040DD27 8B45FC                  mov eax, dword ptr [ebp-04]
:0040DD2A 66C700FFFF              mov word ptr [eax], FFFF
:0040DD2F E900000000              jmp 0040DD34

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DD2F(U)
|
:0040DD34 8B45FC                  mov eax, dword ptr [ebp-04]
:0040DD37 5F                      pop edi
:0040DD38 5E                      pop esi
:0040DD39 5B                      pop ebx
:0040DD3A C9                      leave
:0040DD3B C3                      ret


:0040DD3C CC                      int 03
:0040DD3D CC                      int 03
:0040DD3E CC                      int 03
:0040DD3F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040DCE5   , :0040DDA1   , :0040DF3E   , :0040DFA1   , :00417966   
|:004179D1   
|
:0040DD40 55                      push ebp
:0040DD41 8BEC                    mov ebp, esp
:0040DD43 83EC04                  sub esp, 00000004
:0040DD46 53                      push ebx
:0040DD47 56                      push esi
:0040DD48 57                      push edi
:0040DD49 894DFC                  mov dword ptr [ebp-04], ecx
:0040DD4C E900000000              jmp 0040DD51

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DD4C(U)
|
:0040DD51 5F                      pop edi
:0040DD52 5E                      pop esi
:0040DD53 5B                      pop ebx
:0040DD54 C9                      leave
:0040DD55 C3                      ret


:0040DD56 CC                      int 03
:0040DD57 CC                      int 03
:0040DD58 CC                      int 03
:0040DD59 CC                      int 03
:0040DD5A CC                      int 03
:0040DD5B CC                      int 03
:0040DD5C CC                      int 03
:0040DD5D CC                      int 03
:0040DD5E CC                      int 03
:0040DD5F CC                      int 03
:0040DD60 55                      push ebp
:0040DD61 8BEC                    mov ebp, esp
:0040DD63 6AFF                    push FFFFFFFF
:0040DD65 68A7DD4000              push 0040DDA7
:0040DD6A 64A100000000            mov eax, dword ptr fs:[00000000]
:0040DD70 50                      push eax
:0040DD71 64892500000000          mov dword ptr fs:[00000000], esp
:0040DD78 83EC04                  sub esp, 00000004
:0040DD7B 53                      push ebx
:0040DD7C 56                      push esi
:0040DD7D 57                      push edi
:0040DD7E 894DF0                  mov dword ptr [ebp-10], ecx
:0040DD81 C745FC00000000          mov [ebp-04], 00000000
:0040DD88 E900000000              jmp 0040DD8D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DD88(U)
|
:0040DD8D C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0040DD94 E805000000              call 0040DD9E
:0040DD99 E913000000              jmp 0040DDB1

* Referenced by a CALL at Address:
|:0040DD94   
|
:0040DD9E 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040DDA1 E89AFFFFFF              call 0040DD40
:0040DDA6 C3                      ret


:0040DDA7 B848C14400              mov eax, 0044C148
:0040DDAC E90FA30300              jmp 004480C0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DD99(U)
|
:0040DDB1 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040DDB4 64A300000000            mov dword ptr fs:[00000000], eax
:0040DDBA 5F                      pop edi
:0040DDBB 5E                      pop esi
:0040DDBC 5B                      pop ebx
:0040DDBD C9                      leave
:0040DDBE C3                      ret


:0040DDBF CC                      int 03

* Referenced by a CALL at Addresses:
|:0040BE81   , :0040C064   , :0040CBD1   
|
:0040DDC0 55                      push ebp
:0040DDC1 8BEC                    mov ebp, esp
:0040DDC3 83EC04                  sub esp, 00000004
:0040DDC6 53                      push ebx
:0040DDC7 56                      push esi
:0040DDC8 57                      push edi
:0040DDC9 894DFC                  mov dword ptr [ebp-04], ecx
:0040DDCC 8B45FC                  mov eax, dword ptr [ebp-04]
:0040DDCF 8A401C                  mov al, byte ptr [eax+1C]
:0040DDD2 E900000000              jmp 0040DDD7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DDD2(U)
|
:0040DDD7 5F                      pop edi
:0040DDD8 5E                      pop esi
:0040DDD9 5B                      pop ebx
:0040DDDA C9                      leave
:0040DDDB C3                      ret


:0040DDDC CC                      int 03
:0040DDDD CC                      int 03
:0040DDDE CC                      int 03
:0040DDDF CC                      int 03

* Referenced by a CALL at Addresses:
|:0040BE43   , :0040C000   , :0040CB90   
|
:0040DDE0 55                      push ebp
:0040DDE1 8BEC                    mov ebp, esp
:0040DDE3 83EC04                  sub esp, 00000004
:0040DDE6 53                      push ebx
:0040DDE7 56                      push esi
:0040DDE8 57                      push edi
:0040DDE9 894DFC                  mov dword ptr [ebp-04], ecx
:0040DDEC 8B45FC                  mov eax, dword ptr [ebp-04]
:0040DDEF 8A401B                  mov al, byte ptr [eax+1B]
:0040DDF2 E900000000              jmp 0040DDF7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DDF2(U)
|
:0040DDF7 5F                      pop edi
:0040DDF8 5E                      pop esi
:0040DDF9 5B                      pop ebx
:0040DDFA C9                      leave
:0040DDFB C3                      ret


:0040DDFC CC                      int 03
:0040DDFD CC                      int 03
:0040DDFE CC                      int 03
:0040DDFF CC                      int 03

* Referenced by a CALL at Addresses:
|:0040C080   , :00416441   , :0041648B   , :0042B306   , :00440E8D   
|
:0040DE00 55                      push ebp
:0040DE01 8BEC                    mov ebp, esp
:0040DE03 83EC04                  sub esp, 00000004
:0040DE06 53                      push ebx
:0040DE07 56                      push esi
:0040DE08 57                      push edi
:0040DE09 894DFC                  mov dword ptr [ebp-04], ecx
:0040DE0C 8A4508                  mov al, byte ptr [ebp+08]
:0040DE0F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040DE12 88411C                  mov byte ptr [ecx+1C], al
:0040DE15 E900000000              jmp 0040DE1A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DE15(U)
|
:0040DE1A 5F                      pop edi
:0040DE1B 5E                      pop esi
:0040DE1C 5B                      pop ebx
:0040DE1D C9                      leave
:0040DE1E C20400                  ret 0004


:0040DE21 CC                      int 03
:0040DE22 CC                      int 03
:0040DE23 CC                      int 03
:0040DE24 CC                      int 03
:0040DE25 CC                      int 03
:0040DE26 CC                      int 03
:0040DE27 CC                      int 03
:0040DE28 CC                      int 03
:0040DE29 CC                      int 03
:0040DE2A CC                      int 03
:0040DE2B CC                      int 03
:0040DE2C CC                      int 03
:0040DE2D CC                      int 03
:0040DE2E CC                      int 03
:0040DE2F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040C01C   , :00416434   , :00416481   , :0042B294   , :00440E76   
|
:0040DE30 55                      push ebp
:0040DE31 8BEC                    mov ebp, esp
:0040DE33 83EC04                  sub esp, 00000004
:0040DE36 53                      push ebx
:0040DE37 56                      push esi
:0040DE38 57                      push edi
:0040DE39 894DFC                  mov dword ptr [ebp-04], ecx
:0040DE3C 8A4508                  mov al, byte ptr [ebp+08]
:0040DE3F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040DE42 88411B                  mov byte ptr [ecx+1B], al
:0040DE45 E900000000              jmp 0040DE4A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DE45(U)
|
:0040DE4A 5F                      pop edi
:0040DE4B 5E                      pop esi
:0040DE4C 5B                      pop ebx
:0040DE4D C9                      leave
:0040DE4E C20400                  ret 0004


:0040DE51 CC                      int 03
:0040DE52 CC                      int 03
:0040DE53 CC                      int 03
:0040DE54 CC                      int 03
:0040DE55 CC                      int 03
:0040DE56 CC                      int 03
:0040DE57 CC                      int 03
:0040DE58 CC                      int 03
:0040DE59 CC                      int 03
:0040DE5A CC                      int 03
:0040DE5B CC                      int 03
:0040DE5C CC                      int 03
:0040DE5D CC                      int 03
:0040DE5E CC                      int 03
:0040DE5F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040C04E   , :0041644E   , :00416495   , :0042B2CD   , :00440EA4   
|
:0040DE60 55                      push ebp
:0040DE61 8BEC                    mov ebp, esp
:0040DE63 83EC04                  sub esp, 00000004
:0040DE66 53                      push ebx
:0040DE67 56                      push esi
:0040DE68 57                      push edi
:0040DE69 894DFC                  mov dword ptr [ebp-04], ecx
:0040DE6C 8A4508                  mov al, byte ptr [ebp+08]
:0040DE6F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040DE72 88411D                  mov byte ptr [ecx+1D], al
:0040DE75 E900000000              jmp 0040DE7A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DE75(U)
|
:0040DE7A 5F                      pop edi
:0040DE7B 5E                      pop esi
:0040DE7C 5B                      pop ebx
:0040DE7D C9                      leave
:0040DE7E C20400                  ret 0004


:0040DE81 CC                      int 03
:0040DE82 CC                      int 03
:0040DE83 CC                      int 03
:0040DE84 CC                      int 03
:0040DE85 CC                      int 03
:0040DE86 CC                      int 03
:0040DE87 CC                      int 03
:0040DE88 CC                      int 03
:0040DE89 CC                      int 03
:0040DE8A CC                      int 03
:0040DE8B CC                      int 03
:0040DE8C CC                      int 03
:0040DE8D CC                      int 03
:0040DE8E CC                      int 03
:0040DE8F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040C0E0   , :00416468   , :004164A9   , :0042B375   , :00440EE4   
|
:0040DE90 55                      push ebp
:0040DE91 8BEC                    mov ebp, esp
:0040DE93 83EC04                  sub esp, 00000004
:0040DE96 53                      push ebx
:0040DE97 56                      push esi
:0040DE98 57                      push edi
:0040DE99 894DFC                  mov dword ptr [ebp-04], ecx
:0040DE9C 8A4508                  mov al, byte ptr [ebp+08]
:0040DE9F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040DEA2 884122                  mov byte ptr [ecx+22], al
:0040DEA5 E900000000              jmp 0040DEAA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DEA5(U)
|
:0040DEAA 5F                      pop edi
:0040DEAB 5E                      pop esi
:0040DEAC 5B                      pop ebx
:0040DEAD C9                      leave
:0040DEAE C20400                  ret 0004


:0040DEB1 CC                      int 03
:0040DEB2 CC                      int 03
:0040DEB3 CC                      int 03
:0040DEB4 CC                      int 03
:0040DEB5 CC                      int 03
:0040DEB6 CC                      int 03
:0040DEB7 CC                      int 03
:0040DEB8 CC                      int 03
:0040DEB9 CC                      int 03
:0040DEBA CC                      int 03
:0040DEBB CC                      int 03
:0040DEBC CC                      int 03
:0040DEBD CC                      int 03
:0040DEBE CC                      int 03
:0040DEBF CC                      int 03

* Referenced by a CALL at Addresses:
|:0040C0AE   , :0041645B   , :0041649F   , :0042B33C   , :00433EDF   
|:00440ECD   
|
:0040DEC0 55                      push ebp
:0040DEC1 8BEC                    mov ebp, esp
:0040DEC3 83EC04                  sub esp, 00000004
:0040DEC6 53                      push ebx
:0040DEC7 56                      push esi
:0040DEC8 57                      push edi
:0040DEC9 894DFC                  mov dword ptr [ebp-04], ecx
:0040DECC 8B4508                  mov eax, dword ptr [ebp+08]
:0040DECF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040DED2 89411E                  mov dword ptr [ecx+1E], eax
:0040DED5 E900000000              jmp 0040DEDA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DED5(U)
|
:0040DEDA 5F                      pop edi
:0040DEDB 5E                      pop esi
:0040DEDC 5B                      pop ebx
:0040DEDD C9                      leave
:0040DEDE C20400                  ret 0004


:0040DEE1 CC                      int 03
:0040DEE2 CC                      int 03
:0040DEE3 CC                      int 03
:0040DEE4 CC                      int 03
:0040DEE5 CC                      int 03
:0040DEE6 CC                      int 03
:0040DEE7 CC                      int 03
:0040DEE8 CC                      int 03
:0040DEE9 CC                      int 03
:0040DEEA CC                      int 03
:0040DEEB CC                      int 03
:0040DEEC CC                      int 03
:0040DEED CC                      int 03
:0040DEEE CC                      int 03
:0040DEEF CC                      int 03
:0040DEF0 55                      push ebp
:0040DEF1 8BEC                    mov ebp, esp
:0040DEF3 6AFF                    push FFFFFFFF
:0040DEF5 6844DF4000              push 0040DF44
:0040DEFA 64A100000000            mov eax, dword ptr fs:[00000000]
:0040DF00 50                      push eax
:0040DF01 64892500000000          mov dword ptr fs:[00000000], esp
:0040DF08 83EC04                  sub esp, 00000004
:0040DF0B 53                      push ebx
:0040DF0C 56                      push esi
:0040DF0D 57                      push edi
:0040DF0E 894DF0                  mov dword ptr [ebp-10], ecx
:0040DF11 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040DF14 E8F7FDFFFF              call 0040DD10
:0040DF19 C745FC00000000          mov [ebp-04], 00000000
:0040DF20 8B45F0                  mov eax, dword ptr [ebp-10]
:0040DF23 C6400600                mov [eax+06], 00
:0040DF27 E900000000              jmp 0040DF2C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DF27(U)
|
:0040DF2C C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0040DF33 8B45F0                  mov eax, dword ptr [ebp-10]
:0040DF36 E913000000              jmp 0040DF4E
:0040DF3B 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040DF3E E8FDFDFFFF              call 0040DD40
:0040DF43 C3                      ret


:0040DF44 B870C14400              mov eax, 0044C170
:0040DF49 E972A10300              jmp 004480C0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DF36(U)
|
:0040DF4E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040DF51 64890D00000000          mov dword ptr fs:[00000000], ecx
:0040DF58 5F                      pop edi
:0040DF59 5E                      pop esi
:0040DF5A 5B                      pop ebx
:0040DF5B C9                      leave
:0040DF5C C3                      ret


:0040DF5D CC                      int 03
:0040DF5E CC                      int 03
:0040DF5F CC                      int 03
:0040DF60 55                      push ebp
:0040DF61 8BEC                    mov ebp, esp
:0040DF63 6AFF                    push FFFFFFFF
:0040DF65 68A7DF4000              push 0040DFA7
:0040DF6A 64A100000000            mov eax, dword ptr fs:[00000000]
:0040DF70 50                      push eax
:0040DF71 64892500000000          mov dword ptr fs:[00000000], esp
:0040DF78 83EC04                  sub esp, 00000004
:0040DF7B 53                      push ebx
:0040DF7C 56                      push esi
:0040DF7D 57                      push edi
:0040DF7E 894DF0                  mov dword ptr [ebp-10], ecx
:0040DF81 C745FC00000000          mov [ebp-04], 00000000
:0040DF88 E900000000              jmp 0040DF8D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DF88(U)
|
:0040DF8D C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0040DF94 E805000000              call 0040DF9E
:0040DF99 E913000000              jmp 0040DFB1

* Referenced by a CALL at Address:
|:0040DF94   
|
:0040DF9E 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040DFA1 E89AFDFFFF              call 0040DD40
:0040DFA6 C3                      ret


:0040DFA7 B898C14400              mov eax, 0044C198
:0040DFAC E90FA10300              jmp 004480C0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DF99(U)
|
:0040DFB1 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040DFB4 64A300000000            mov dword ptr fs:[00000000], eax
:0040DFBA 5F                      pop edi
:0040DFBB 5E                      pop esi
:0040DFBC 5B                      pop ebx
:0040DFBD C9                      leave
:0040DFBE C3                      ret


:0040DFBF CC                      int 03

* Referenced by a CALL at Address:
|:0040E118   
|
:0040DFC0 55                      push ebp
:0040DFC1 8BEC                    mov ebp, esp
:0040DFC3 53                      push ebx
:0040DFC4 56                      push esi
:0040DFC5 57                      push edi
:0040DFC6 C705F0D245004C000000    mov dword ptr [0045D2F0], 0000004C
:0040DFD0 8B4508                  mov eax, dword ptr [ebp+08]
:0040DFD3 A3F4D24500              mov dword ptr [0045D2F4], eax
:0040DFD8 C705F8D2450000000000    mov dword ptr [0045D2F8], 00000000

* Possible StringData Ref from Data Obj ->"ļ(*.E2S)"
                                  |
:0040DFE2 C705FCD24500D8ED4400    mov dword ptr [0045D2FC], 0044EDD8
:0040DFEC C70500D3450000000000    mov dword ptr [0045D300], 00000000
:0040DFF6 C70504D3450000000000    mov dword ptr [0045D304], 00000000
:0040E000 C70508D3450000000000    mov dword ptr [0045D308], 00000000
:0040E00A C7050CD3450000000000    mov dword ptr [0045D30C], 00000000
:0040E014 C70510D3450004010000    mov dword ptr [0045D310], 00000104
:0040E01E C70514D3450000000000    mov dword ptr [0045D314], 00000000
:0040E028 C70518D3450000020000    mov dword ptr [0045D318], 00000200
:0040E032 C7051CD3450000000000    mov dword ptr [0045D31C], 00000000
:0040E03C C70520D3450000000000    mov dword ptr [0045D320], 00000000
:0040E046 C70524D3450000000000    mov dword ptr [0045D324], 00000000
:0040E050 66C70528D345000000      mov word ptr [0045D328], 0000
:0040E059 66C7052AD345000000      mov word ptr [0045D32A], 0000

* Possible StringData Ref from Data Obj ->"e2s"
                                  |
:0040E062 C7052CD34500F8ED4400    mov dword ptr [0045D32C], 0044EDF8
:0040E06C C70530D3450000000000    mov dword ptr [0045D330], 00000000
:0040E076 C70534D3450000000000    mov dword ptr [0045D334], 00000000
:0040E080 C70538D3450000000000    mov dword ptr [0045D338], 00000000
:0040E08A E900000000              jmp 0040E08F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E08A(U)
|
:0040E08F 5F                      pop edi
:0040E090 5E                      pop esi
:0040E091 5B                      pop ebx
:0040E092 C9                      leave
:0040E093 C3                      ret



* Referenced by a CALL at Address:
|:0040E155   
|
:0040E094 55                      push ebp
:0040E095 8BEC                    mov ebp, esp
:0040E097 53                      push ebx
:0040E098 56                      push esi
:0040E099 57                      push edi
:0040E09A 8B4508                  mov eax, dword ptr [ebp+08]
:0040E09D A3F4D24500              mov dword ptr [0045D2F4], eax
:0040E0A2 8B450C                  mov eax, dword ptr [ebp+0C]
:0040E0A5 A30CD34500              mov dword ptr [0045D30C], eax
:0040E0AA 8B4510                  mov eax, dword ptr [ebp+10]
:0040E0AD A314D34500              mov dword ptr [0045D314], eax
:0040E0B2 C70524D3450008200000    mov dword ptr [0045D324], 00002008
:0040E0BC 68F0D24500              push 0045D2F0

* Reference To: comdlg32.GetOpenFileNameA, Ord:0009h
                                  |
:0040E0C1 E8D2610300              Call 00444298
:0040E0C6 E900000000              jmp 0040E0CB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E0C6(U)
|
:0040E0CB 5F                      pop edi
:0040E0CC 5E                      pop esi
:0040E0CD 5B                      pop ebx
:0040E0CE C9                      leave
:0040E0CF C3                      ret



* Referenced by a CALL at Address:
|:0040E19F   
|
:0040E0D0 55                      push ebp
:0040E0D1 8BEC                    mov ebp, esp
:0040E0D3 53                      push ebx
:0040E0D4 56                      push esi
:0040E0D5 57                      push edi
:0040E0D6 8B4508                  mov eax, dword ptr [ebp+08]
:0040E0D9 A3F4D24500              mov dword ptr [0045D2F4], eax
:0040E0DE 8B450C                  mov eax, dword ptr [ebp+0C]
:0040E0E1 A30CD34500              mov dword ptr [0045D30C], eax
:0040E0E6 8B4510                  mov eax, dword ptr [ebp+10]
:0040E0E9 A314D34500              mov dword ptr [0045D314], eax
:0040E0EE C70524D345000A000000    mov dword ptr [0045D324], 0000000A
:0040E0F8 68F0D24500              push 0045D2F0

* Reference To: comdlg32.GetSaveFileNameA, Ord:000Bh
                                  |
:0040E0FD E89C610300              Call 0044429E
:0040E102 E900000000              jmp 0040E107

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E102(U)
|
:0040E107 5F                      pop edi
:0040E108 5E                      pop esi
:0040E109 5B                      pop ebx
:0040E10A C9                      leave
:0040E10B C3                      ret



* Referenced by a CALL at Address:
|:0040B81B   
|
:0040E10C 55                      push ebp
:0040E10D 8BEC                    mov ebp, esp
:0040E10F 53                      push ebx
:0040E110 56                      push esi
:0040E111 57                      push edi
:0040E112 A198D44500              mov eax, dword ptr [0045D498]
:0040E117 50                      push eax
:0040E118 E8A3FEFFFF              call 0040DFC0
:0040E11D 83C404                  add esp, 00000004
:0040E120 E900000000              jmp 0040E125

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E120(U)
|
:0040E125 5F                      pop edi
:0040E126 5E                      pop esi
:0040E127 5B                      pop ebx
:0040E128 C9                      leave
:0040E129 C3                      ret



* Referenced by a CALL at Addresses:
|:0040A107   , :0040A1D1   
|
:0040E12A 55                      push ebp
:0040E12B 8BEC                    mov ebp, esp
:0040E12D 83EC04                  sub esp, 00000004
:0040E130 53                      push ebx
:0040E131 56                      push esi
:0040E132 57                      push edi
:0040E133 8B4508                  mov eax, dword ptr [ebp+08]
:0040E136 8945FC                  mov dword ptr [ebp-04], eax
:0040E139 E987000000              jmp 0040E1C5
:0040E13E 33C0                    xor eax, eax
:0040E140 E9AF000000              jmp 0040E1F4

* Possible StringData Ref from Data Obj ->"־ for Windows95"
                                  |
:0040E145 68A8ED4400              push 0044EDA8
:0040E14A 6868D34500              push 0045D368
:0040E14F A198D44500              mov eax, dword ptr [0045D498]
:0040E154 50                      push eax
:0040E155 E83AFFFFFF              call 0040E094
:0040E15A 83C40C                  add esp, 0000000C
:0040E15D 85C0                    test eax, eax
:0040E15F 0F840A000000            je 0040E16F
:0040E165 B801000000              mov eax, 00000001
:0040E16A E985000000              jmp 0040E1F4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E15F(C)
|
:0040E16F 33C0                    xor eax, eax
:0040E171 E97E000000              jmp 0040E1F4
:0040E176 0FBE0568D34500          movsx eax, byte ptr [0045D368]
:0040E17D 85C0                    test eax, eax
:0040E17F 0F840A000000            je 0040E18F
:0040E185 B801000000              mov eax, 00000001
:0040E18A E965000000              jmp 0040E1F4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E17F(C)
|

* Possible StringData Ref from Data Obj ->"־ for Windows95"
                                  |
:0040E18F 68A8ED4400              push 0044EDA8
:0040E194 6868D34500              push 0045D368
:0040E199 A198D44500              mov eax, dword ptr [0045D498]
:0040E19E 50                      push eax
:0040E19F E82CFFFFFF              call 0040E0D0
:0040E1A4 83C40C                  add esp, 0000000C
:0040E1A7 85C0                    test eax, eax
:0040E1A9 0F840A000000            je 0040E1B9
:0040E1AF B801000000              mov eax, 00000001
:0040E1B4 E93B000000              jmp 0040E1F4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E1A9(C)
|
:0040E1B9 33C0                    xor eax, eax
:0040E1BB E934000000              jmp 0040E1F4
:0040E1C0 E928000000              jmp 0040E1ED

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E139(U)
|
:0040E1C5 837DFC04                cmp dword ptr [ebp-04], 00000004
:0040E1C9 0F871E000000            ja 0040E1ED
:0040E1CF 8B45FC                  mov eax, dword ptr [ebp-04]
:0040E1D2 FF2485D9E14000          jmp dword ptr [4*eax+0040E1D9]

:0040E1D9 3EE14000                DWORD 0040E13E
:0040E1DD 45E14000                DWORD 0040E145
:0040E1E1 76E14000                DWORD 0040E176
:0040E1E5 8FE14000                DWORD 0040E18F
:0040E1E9 45E14000                DWORD 0040E145



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040E1C0(U), :0040E1C9(C)
|
:0040E1ED 33C0                    xor eax, eax
:0040E1EF E900000000              jmp 0040E1F4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040E140(U), :0040E16A(U), :0040E171(U), :0040E18A(U), :0040E1B4(U)
|:0040E1BB(U)
|
:0040E1F4 5F                      pop edi
:0040E1F5 5E                      pop esi
:0040E1F6 5B                      pop ebx
:0040E1F7 C9                      leave
:0040E1F8 C3                      ret



* Referenced by a CALL at Address:
|:00438FE0   
|
:0040E1F9 55                      push ebp
:0040E1FA 8BEC                    mov ebp, esp
:0040E1FC 53                      push ebx
:0040E1FD 56                      push esi
:0040E1FE 57                      push edi
:0040E1FF 6824200000              push 00002024

* Possible StringData Ref from Data Obj ->"־ for Windows95"
                                  |
:0040E204 68FCED4400              push 0044EDFC
:0040E209 8B4508                  mov eax, dword ptr [ebp+08]
:0040E20C 50                      push eax
:0040E20D A198D44500              mov eax, dword ptr [0045D498]
:0040E212 50                      push eax

* Reference To: USER32.MessageBoxA, Ord:0188h
                                  |
:0040E213 FF151C744700            Call dword ptr [0047741C]
:0040E219 83F806                  cmp eax, 00000006
:0040E21C 0F850A000000            jne 0040E22C
:0040E222 B801000000              mov eax, 00000001
:0040E227 E907000000              jmp 0040E233

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E21C(C)
|
:0040E22C 33C0                    xor eax, eax
:0040E22E E900000000              jmp 0040E233

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040E227(U), :0040E22E(U)
|
:0040E233 5F                      pop edi
:0040E234 5E                      pop esi
:0040E235 5B                      pop ebx
:0040E236 C9                      leave
:0040E237 C3                      ret



* Referenced by a CALL at Address:
|:00438FCC   
|
:0040E238 55                      push ebp
:0040E239 8BEC                    mov ebp, esp
:0040E23B 53                      push ebx
:0040E23C 56                      push esi
:0040E23D 57                      push edi
:0040E23E 6830200000              push 00002030

* Possible StringData Ref from Data Obj ->"־ for Windows95"
                                  |
:0040E243 6818EE4400              push 0044EE18
:0040E248 8B4508                  mov eax, dword ptr [ebp+08]
:0040E24B 50                      push eax
:0040E24C A198D44500              mov eax, dword ptr [0045D498]
:0040E251 50                      push eax

* Reference To: USER32.MessageBoxA, Ord:0188h
                                  |
:0040E252 FF151C744700            Call dword ptr [0047741C]
:0040E258 E900000000              jmp 0040E25D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E258(U)
|
:0040E25D 5F                      pop edi
:0040E25E 5E                      pop esi
:0040E25F 5B                      pop ebx
:0040E260 C9                      leave
:0040E261 C3                      ret


:0040E262 55                      push ebp
:0040E263 8BEC                    mov ebp, esp
:0040E265 53                      push ebx
:0040E266 56                      push esi
:0040E267 57                      push edi
:0040E268 833DD4ED440000          cmp dword ptr [0044EDD4], 00000000
:0040E26F 0F8549000000            jne 0040E2BE
:0040E275 6841200000              push 00002041

* Possible StringData Ref from Data Obj ->"˳־"
                                  |
:0040E27A 6834EE4400              push 0044EE34

* Possible StringData Ref from Data Obj ->"˳־"
                                  |
:0040E27F 684CEE4400              push 0044EE4C
:0040E284 A198D44500              mov eax, dword ptr [0045D498]
:0040E289 50                      push eax

* Reference To: USER32.MessageBoxA, Ord:0188h
                                  |
:0040E28A FF151C744700            Call dword ptr [0047741C]
:0040E290 83F801                  cmp eax, 00000001
:0040E293 0F8525000000            jne 0040E2BE
:0040E299 A198D44500              mov eax, dword ptr [0045D498]
:0040E29E 50                      push eax
:0040E29F E855800100              call 004262F9
:0040E2A4 83C404                  add esp, 00000004
:0040E2A7 6A00                    push 00000000
:0040E2A9 6A00                    push 00000000
:0040E2AB 6A10                    push 00000010
:0040E2AD A198D44500              mov eax, dword ptr [0045D498]
:0040E2B2 50                      push eax

* Reference To: USER32.PostMessageA, Ord:01A3h
                                  |
:0040E2B3 FF1524744700            Call dword ptr [00477424]
:0040E2B9 E8346F0100              call 004251F2

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040E26F(C), :0040E293(C)
|
:0040E2BE E900000000              jmp 0040E2C3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E2BE(U)
|
:0040E2C3 5F                      pop edi
:0040E2C4 5E                      pop esi
:0040E2C5 5B                      pop ebx
:0040E2C6 C9                      leave
:0040E2C7 C3                      ret



* Referenced by a CALL at Addresses:
|:0040E753   , :0040E7CA   , :0040E808   
|
:0040E2C8 55                      push ebp
:0040E2C9 8BEC                    mov ebp, esp
:0040E2CB 81EC80000000            sub esp, 00000080
:0040E2D1 53                      push ebx
:0040E2D2 56                      push esi
:0040E2D3 57                      push edi
:0040E2D4 8D450C                  lea eax, dword ptr [ebp+0C]
:0040E2D7 50                      push eax
:0040E2D8 8B4508                  mov eax, dword ptr [ebp+08]
:0040E2DB 50                      push eax
:0040E2DC 8D4580                  lea eax, dword ptr [ebp-80]
:0040E2DF 50                      push eax

* Reference To: USER32.wvsprintfA, Ord:024Bh
                                  |
:0040E2E0 FF1520744700            Call dword ptr [00477420]
:0040E2E6 6830200000              push 00002030

* Possible StringData Ref from Data Obj ->"־ ִд"
                                  |
:0040E2EB 686CEE4400              push 0044EE6C
:0040E2F0 8D4580                  lea eax, dword ptr [ebp-80]
:0040E2F3 50                      push eax
:0040E2F4 A198D44500              mov eax, dword ptr [0045D498]
:0040E2F9 50                      push eax

* Reference To: USER32.MessageBoxA, Ord:0188h
                                  |
:0040E2FA FF151C744700            Call dword ptr [0047741C]
:0040E300 E900000000              jmp 0040E305

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E300(U)
|
:0040E305 5F                      pop edi
:0040E306 5E                      pop esi
:0040E307 5B                      pop ebx
:0040E308 C9                      leave
:0040E309 C3                      ret



* Referenced by a CALL at Address:
|:00426A09   
|
:0040E30A 55                      push ebp
:0040E30B 8BEC                    mov ebp, esp
:0040E30D 81EC80000000            sub esp, 00000080
:0040E313 53                      push ebx
:0040E314 56                      push esi
:0040E315 57                      push edi
:0040E316 8D450C                  lea eax, dword ptr [ebp+0C]
:0040E319 50                      push eax
:0040E31A 8B4508                  mov eax, dword ptr [ebp+08]
:0040E31D 50                      push eax
:0040E31E 8D4580                  lea eax, dword ptr [ebp-80]
:0040E321 50                      push eax

* Reference To: USER32.wvsprintfA, Ord:024Bh
                                  |
:0040E322 FF1520744700            Call dword ptr [00477420]
:0040E328 6835200000              push 00002035

* Possible StringData Ref from Data Obj ->"־ ִд"
                                  |
:0040E32D 6888EE4400              push 0044EE88
:0040E332 8D4580                  lea eax, dword ptr [ebp-80]
:0040E335 50                      push eax
:0040E336 A198D44500              mov eax, dword ptr [0045D498]
:0040E33B 50                      push eax

* Reference To: USER32.MessageBoxA, Ord:0188h
                                  |
:0040E33C FF151C744700            Call dword ptr [0047741C]
:0040E342 83F804                  cmp eax, 00000004
:0040E345 0F850A000000            jne 0040E355
:0040E34B B801000000              mov eax, 00000001
:0040E350 E907000000              jmp 0040E35C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E345(C)
|
:0040E355 33C0                    xor eax, eax
:0040E357 E900000000              jmp 0040E35C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040E350(U), :0040E357(U)
|
:0040E35C 5F                      pop edi
:0040E35D 5E                      pop esi
:0040E35E 5B                      pop ebx
:0040E35F C9                      leave
:0040E360 C3                      ret


:0040E361 55                      push ebp
:0040E362 8BEC                    mov ebp, esp
:0040E364 83EC04                  sub esp, 00000004
:0040E367 53                      push ebx
:0040E368 56                      push esi
:0040E369 57                      push edi
:0040E36A 8B450C                  mov eax, dword ptr [ebp+0C]
:0040E36D 8945FC                  mov dword ptr [ebp-04], eax
:0040E370 E942000000              jmp 0040E3B7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E3CB(C)
|
:0040E375 8B4510                  mov eax, dword ptr [ebp+10]
:0040E378 25FFFF0000              and eax, 0000FFFF
:0040E37D 83F801                  cmp eax, 00000001
:0040E380 0F8411000000            je 0040E397
:0040E386 8B4510                  mov eax, dword ptr [ebp+10]
:0040E389 25FFFF0000              and eax, 0000FFFF
:0040E38E 83F802                  cmp eax, 00000002
:0040E391 0F850C000000            jne 0040E3A3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E380(C)
|
:0040E397 6A01                    push 00000001
:0040E399 8B4508                  mov eax, dword ptr [ebp+08]
:0040E39C 50                      push eax

* Reference To: USER32.EndDialog, Ord:00ADh
                                  |
:0040E39D FF1574744700            Call dword ptr [00477474]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E391(C)
|
:0040E3A3 E92E000000              jmp 0040E3D6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E3BE(C)
|
:0040E3A8 B801000000              mov eax, 00000001
:0040E3AD E92B000000              jmp 0040E3DD
:0040E3B2 E91F000000              jmp 0040E3D6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E370(U)
|
:0040E3B7 817DFC10010000          cmp dword ptr [ebp-04], 00000110
:0040E3BE 0F84E4FFFFFF            je 0040E3A8
:0040E3C4 817DFC11010000          cmp dword ptr [ebp-04], 00000111
:0040E3CB 0F84A4FFFFFF            je 0040E375
:0040E3D1 E900000000              jmp 0040E3D6

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040E3A3(U), :0040E3B2(U), :0040E3D1(U)
|
:0040E3D6 33C0                    xor eax, eax
:0040E3D8 E900000000              jmp 0040E3DD

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040E3AD(U), :0040E3D8(U)
|
:0040E3DD 5F                      pop edi
:0040E3DE 5E                      pop esi
:0040E3DF 5B                      pop ebx
:0040E3E0 C9                      leave
:0040E3E1 C21000                  ret 0010



* Referenced by a CALL at Address:
|:0040E58D   
|
:0040E3E4 55                      push ebp
:0040E3E5 8BEC                    mov ebp, esp
:0040E3E7 83EC08                  sub esp, 00000008
:0040E3EA 53                      push ebx
:0040E3EB 56                      push esi
:0040E3EC 57                      push edi
:0040E3ED 8B4510                  mov eax, dword ptr [ebp+10]
:0040E3F0 8945F8                  mov dword ptr [ebp-08], eax
:0040E3F3 E9C4000000              jmp 0040E4BC
:0040E3F8 6A00                    push 00000000
:0040E3FA 6A03                    push 00000003

* Possible StringData Ref from Data Obj ->"EKD2W95.HLP"
                                  |
:0040E3FC 68C8ED4400              push 0044EDC8
:0040E401 8B4508                  mov eax, dword ptr [ebp+08]
:0040E404 50                      push eax

* Reference To: USER32.WinHelpA, Ord:0243h
                                  |
:0040E405 FF1528744700            Call dword ptr [00477428]
:0040E40B E948010000              jmp 0040E558
:0040E410 C645FC00                mov [ebp-04], 00
:0040E414 8D45FC                  lea eax, dword ptr [ebp-04]
:0040E417 50                      push eax
:0040E418 6805010000              push 00000105

* Possible StringData Ref from Data Obj ->"EKD2W95.HLP"
                                  |
:0040E41D 68C8ED4400              push 0044EDC8
:0040E422 8B4508                  mov eax, dword ptr [ebp+08]
:0040E425 50                      push eax

* Reference To: USER32.WinHelpA, Ord:0243h
                                  |
:0040E426 FF1528744700            Call dword ptr [00477428]
:0040E42C E927010000              jmp 0040E558
:0040E431 6A00                    push 00000000
:0040E433 6A04                    push 00000004

* Possible StringData Ref from Data Obj ->"EKD2W95.HLP"
                                  |
:0040E435 68C8ED4400              push 0044EDC8
:0040E43A 8B4508                  mov eax, dword ptr [ebp+08]
:0040E43D 50                      push eax

* Reference To: USER32.WinHelpA, Ord:0243h
                                  |
:0040E43E FF1528744700            Call dword ptr [00477428]
:0040E444 E90F010000              jmp 0040E558
:0040E449 6A00                    push 00000000
:0040E44B 6861E34000              push 0040E361
:0040E450 8B4508                  mov eax, dword ptr [ebp+08]
:0040E453 50                      push eax

* Possible StringData Ref from Data Obj ->"AppVersion"
                                  |
:0040E454 68A0EE4400              push 0044EEA0
:0040E459 A1E8D24500              mov eax, dword ptr [0045D2E8]
:0040E45E 50                      push eax

* Reference To: USER32.DialogBoxParamA, Ord:008Ah
                                  |
:0040E45F FF1570744700            Call dword ptr [00477470]
:0040E465 E9EE000000              jmp 0040E558
:0040E46A 6A00                    push 00000000
:0040E46C 6A00                    push 00000000
:0040E46E 6A10                    push 00000010
:0040E470 A198D44500              mov eax, dword ptr [0045D498]
:0040E475 50                      push eax

* Reference To: USER32.PostMessageA, Ord:01A3h
                                  |
:0040E476 FF1524744700            Call dword ptr [00477424]
:0040E47C E9D7000000              jmp 0040E558
:0040E481 833DA02B4500FF          cmp dword ptr [00452BA0], FFFFFFFF
:0040E488 0F8417000000            je 0040E4A5
:0040E48E A1A02B4500              mov eax, dword ptr [00452BA0]
:0040E493 50                      push eax
:0040E494 6A01                    push 00000001

* Possible StringData Ref from Data Obj ->"EKD2W95.HLP"
                                  |
:0040E496 68C8ED4400              push 0044EDC8
:0040E49B 8B4508                  mov eax, dword ptr [ebp+08]
:0040E49E 50                      push eax

* Reference To: USER32.WinHelpA, Ord:0243h
                                  |
:0040E49F FF1528744700            Call dword ptr [00477428]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E488(C)
|
:0040E4A5 E9AE000000              jmp 0040E558

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E4C7(C)
|
:0040E4AA 8B4510                  mov eax, dword ptr [ebp+10]
:0040E4AD A364F94600              mov dword ptr [0046F964], eax
:0040E4B2 E9A1000000              jmp 0040E558
:0040E4B7 E99C000000              jmp 0040E558

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E3F3(U)
|
:0040E4BC 816DF8419C0000          sub dword ptr [ebp-08], 00009C41
:0040E4C3 837DF85C                cmp dword ptr [ebp-08], 0000005C
:0040E4C7 0F87DDFFFFFF            ja 0040E4AA
:0040E4CD 8B45F8                  mov eax, dword ptr [ebp-08]
:0040E4D0 33C9                    xor ecx, ecx
:0040E4D2 8A88FBE44000            mov cl, byte ptr [eax+0040E4FB]
:0040E4D8 FF248DDFE44000          jmp dword ptr [4*ecx+0040E4DF]

:0040E4DF 6AE44000                DWORD 0040E46A
:0040E4E3 F8E34000                DWORD 0040E3F8
:0040E4E7 10E44000                DWORD 0040E410
:0040E4EB 31E44000                DWORD 0040E431
:0040E4EF 49E44000                DWORD 0040E449
:0040E4F3 81E44000                DWORD 0040E481
:0040E4F7 AAE44000                DWORD 0040E4AA


:0040E4FB 0006                    add byte ptr [esi], al
:0040E4FD 06                      push es
:0040E4FE 06                      push es
:0040E4FF 06                      push es
:0040E500 06                      push es
:0040E501 06                      push es
:0040E502 06                      push es
:0040E503 06                      push es
:0040E504 06                      push es
:0040E505 06                      push es
:0040E506 06                      push es
:0040E507 06                      push es
:0040E508 06                      push es
:0040E509 06                      push es
:0040E50A 06                      push es
:0040E50B 06                      push es
:0040E50C 06                      push es
:0040E50D 06                      push es
:0040E50E 06                      push es
:0040E50F 06                      push es
:0040E510 06                      push es
:0040E511 06                      push es
:0040E512 06                      push es
:0040E513 06                      push es
:0040E514 06                      push es
:0040E515 06                      push es
:0040E516 06                      push es
:0040E517 06                      push es
:0040E518 06                      push es
:0040E519 06                      push es
:0040E51A 06                      push es
:0040E51B 06                      push es
:0040E51C 06                      push es
:0040E51D 06                      push es
:0040E51E 06                      push es
:0040E51F 06                      push es
:0040E520 06                      push es
:0040E521 06                      push es
:0040E522 06                      push es
:0040E523 06                      push es
:0040E524 06                      push es
:0040E525 06                      push es
:0040E526 06                      push es
:0040E527 06                      push es
:0040E528 06                      push es
:0040E529 06                      push es
:0040E52A 06                      push es
:0040E52B 06                      push es
:0040E52C 06                      push es
:0040E52D 06                      push es
:0040E52E 06                      push es
:0040E52F 06                      push es
:0040E530 06                      push es
:0040E531 06                      push es
:0040E532 06                      push es
:0040E533 06                      push es
:0040E534 06                      push es
:0040E535 06                      push es
:0040E536 06                      push es
:0040E537 06                      push es
:0040E538 06                      push es
:0040E539 06                      push es
:0040E53A 06                      push es
:0040E53B 06                      push es
:0040E53C 06                      push es
:0040E53D 06                      push es
:0040E53E 06                      push es
:0040E53F 0102                    add dword ptr [edx], eax
:0040E541 0306                    add eax, dword ptr [esi]
:0040E543 0406                    add al, 06
:0040E545 06                      push es
:0040E546 06                      push es
:0040E547 06                      push es
:0040E548 06                      push es
:0040E549 06                      push es
:0040E54A 06                      push es
:0040E54B 06                      push es
:0040E54C 06                      push es
:0040E54D 06                      push es
:0040E54E 06                      push es
:0040E54F 06                      push es
:0040E550 06                      push es
:0040E551 06                      push es
:0040E552 06                      push es
:0040E553 06                      push es
:0040E554 06                      push es
:0040E555 06                      push es
:0040E556 06                      push es
:0040E557 0533C0E900              add eax, 00E9C033
:0040E55C 000000                  BYTE  3 DUP(0)


:0040E55F 5F                      pop edi
:0040E560 5E                      pop esi
:0040E561 5B                      pop ebx
:0040E562 C9                      leave
:0040E563 C3                      ret


:0040E564 55                      push ebp
:0040E565 8BEC                    mov ebp, esp
:0040E567 83EC08                  sub esp, 00000008
:0040E56A 53                      push ebx
:0040E56B 56                      push esi
:0040E56C 57                      push edi
:0040E56D 8B450C                  mov eax, dword ptr [ebp+0C]
:0040E570 8945FC                  mov dword ptr [ebp-04], eax
:0040E573 E9C6000000              jmp 0040E63E
:0040E578 E935010000              jmp 0040E6B2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E68D(C)
|
:0040E57D 8B4514                  mov eax, dword ptr [ebp+14]
:0040E580 50                      push eax
:0040E581 8B4510                  mov eax, dword ptr [ebp+10]
:0040E584 50                      push eax
:0040E585 8B450C                  mov eax, dword ptr [ebp+0C]
:0040E588 50                      push eax
:0040E589 8B4508                  mov eax, dword ptr [ebp+08]
:0040E58C 50                      push eax
:0040E58D E852FEFFFF              call 0040E3E4
:0040E592 83C410                  add esp, 00000010
:0040E595 E935010000              jmp 0040E6CF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E671(C)
|
:0040E59A 8B4508                  mov eax, dword ptr [ebp+08]
:0040E59D 50                      push eax
:0040E59E E8A77B0100              call 0042614A
:0040E5A3 83C404                  add esp, 00000004
:0040E5A6 E907010000              jmp 0040E6B2
:0040E5AB E902010000              jmp 0040E6B2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E65C(C)
|
:0040E5B0 6A00                    push 00000000
:0040E5B2 6A02                    push 00000002

* Possible StringData Ref from Data Obj ->"EKD2W95.HLP"
                                  |
:0040E5B4 68C8ED4400              push 0044EDC8
:0040E5B9 8B4508                  mov eax, dword ptr [ebp+08]
:0040E5BC 50                      push eax

* Reference To: USER32.WinHelpA, Ord:0243h
                                  |
:0040E5BD FF1528744700            Call dword ptr [00477428]
:0040E5C3 E9EA000000              jmp 0040E6B2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E69A(C)
|
:0040E5C8 8B4510                  mov eax, dword ptr [ebp+10]
:0040E5CB 8945F8                  mov dword ptr [ebp-08], eax
:0040E5CE E90A000000              jmp 0040E5DD
:0040E5D3 E90A000000              jmp 0040E5E2
:0040E5D8 E905000000              jmp 0040E5E2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E5CE(U)
|
:0040E5DD E900000000              jmp 0040E5E2

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040E5D3(U), :0040E5D8(U), :0040E5DD(U)
|
:0040E5E2 E9CB000000              jmp 0040E6B2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E6A7(C)
|
:0040E5E7 8B4514                  mov eax, dword ptr [ebp+14]
:0040E5EA 50                      push eax
:0040E5EB 8B4510                  mov eax, dword ptr [ebp+10]
:0040E5EE 50                      push eax
:0040E5EF E8C57F0100              call 004265B9
:0040E5F4 83C408                  add esp, 00000008
:0040E5F7 8B4514                  mov eax, dword ptr [ebp+14]
:0040E5FA 50                      push eax
:0040E5FB 8B4510                  mov eax, dword ptr [ebp+10]
:0040E5FE 50                      push eax
:0040E5FF E893A70000              call 00418D97
:0040E604 83C408                  add esp, 00000008
:0040E607 E9A6000000              jmp 0040E6B2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E67B(C)
|
:0040E60C 8B4514                  mov eax, dword ptr [ebp+14]
:0040E60F 50                      push eax
:0040E610 8B4510                  mov eax, dword ptr [ebp+10]
:0040E613 50                      push eax
:0040E614 E8F97F0100              call 00426612
:0040E619 83C408                  add esp, 00000008
:0040E61C 85C0                    test eax, eax
:0040E61E 0F8415000000            je 0040E639
:0040E624 6A00                    push 00000000
:0040E626 6A00                    push 00000000
:0040E628 6801020000              push 00000201
:0040E62D A198D44500              mov eax, dword ptr [0045D498]
:0040E632 50                      push eax

* Reference To: USER32.PostMessageA, Ord:01A3h
                                  |
:0040E633 FF1524744700            Call dword ptr [00477424]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E61E(C)
|
:0040E639 E974000000              jmp 0040E6B2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E573(U)
|
:0040E63E 837DFC10                cmp dword ptr [ebp-04], 00000010
:0040E642 0F871F000000            ja 0040E667
:0040E648 0F8464000000            je 0040E6B2
:0040E64E 837DFC01                cmp dword ptr [ebp-04], 00000001
:0040E652 0F845A000000            je 0040E6B2
:0040E658 837DFC02                cmp dword ptr [ebp-04], 00000002
:0040E65C 0F844EFFFFFF            je 0040E5B0
:0040E662 E94B000000              jmp 0040E6B2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E642(C)
|
:0040E667 837DFC47                cmp dword ptr [ebp-04], 00000047
:0040E66B 0F8715000000            ja 0040E686
:0040E671 0F8423FFFFFF            je 0040E59A
:0040E677 837DFC20                cmp dword ptr [ebp-04], 00000020
:0040E67B 0F848BFFFFFF            je 0040E60C
:0040E681 E92C000000              jmp 0040E6B2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E66B(C)
|
:0040E686 817DFC11010000          cmp dword ptr [ebp-04], 00000111
:0040E68D 0F84EAFEFFFF            je 0040E57D
:0040E693 817DFC12010000          cmp dword ptr [ebp-04], 00000112
:0040E69A 0F8428FFFFFF            je 0040E5C8
:0040E6A0 817DFCB9030000          cmp dword ptr [ebp-04], 000003B9
:0040E6A7 0F843AFFFFFF            je 0040E5E7
:0040E6AD E900000000              jmp 0040E6B2

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040E578(U), :0040E5A6(U), :0040E5AB(U), :0040E5C3(U), :0040E5E2(U)
|:0040E607(U), :0040E639(U), :0040E648(C), :0040E652(C), :0040E662(U)
|:0040E681(U), :0040E6AD(U)
|
:0040E6B2 8B4514                  mov eax, dword ptr [ebp+14]
:0040E6B5 50                      push eax
:0040E6B6 8B4510                  mov eax, dword ptr [ebp+10]
:0040E6B9 50                      push eax
:0040E6BA 8B450C                  mov eax, dword ptr [ebp+0C]
:0040E6BD 50                      push eax
:0040E6BE 8B4508                  mov eax, dword ptr [ebp+08]
:0040E6C1 50                      push eax
:0040E6C2 E890810300              call 00446857
:0040E6C7 83C410                  add esp, 00000010
:0040E6CA E900000000              jmp 0040E6CF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040E595(U), :0040E6CA(U)
|
:0040E6CF 5F                      pop edi
:0040E6D0 5E                      pop esi
:0040E6D1 5B                      pop ebx
:0040E6D2 C9                      leave
:0040E6D3 C21000                  ret 0010



* Referenced by a CALL at Address:
|:0040EAE3   
|
:0040E6D6 55                      push ebp
:0040E6D7 8BEC                    mov ebp, esp
:0040E6D9 83EC4C                  sub esp, 0000004C
:0040E6DC 53                      push ebx
:0040E6DD 56                      push esi
:0040E6DE 57                      push edi
:0040E6DF 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->"־ for Windows95"
                                  |
:0040E6E1 68A8ED4400              push 0044EDA8

* Reference To: USER32.FindWindowA, Ord:00C6h
                                  |
:0040E6E6 FF158C744700            Call dword ptr [0047748C]
:0040E6EC 8945F0                  mov dword ptr [ebp-10], eax
:0040E6EF 837DF000                cmp dword ptr [ebp-10], 00000000
:0040E6F3 0F8469000000            je 0040E762
:0040E6F9 8B45F0                  mov eax, dword ptr [ebp-10]
:0040E6FC 50                      push eax

* Reference To: USER32.IsIconic, Ord:0159h
                                  |
:0040E6FD FF1590744700            Call dword ptr [00477490]
:0040E703 85C0                    test eax, eax
:0040E705 0F8416000000            je 0040E721
:0040E70B 6A00                    push 00000000
:0040E70D 6820F10000              push 0000F120
:0040E712 6812010000              push 00000112
:0040E717 8B45F0                  mov eax, dword ptr [ebp-10]
:0040E71A 50                      push eax

* Reference To: USER32.SendMessageA, Ord:01C6h
                                  |
:0040E71B FF1594744700            Call dword ptr [00477494]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E705(C)
|
:0040E721 8B45F0                  mov eax, dword ptr [ebp-10]
:0040E724 50                      push eax

* Reference To: USER32.GetLastActivePopup, Ord:0100h
                                  |
:0040E725 FF1598744700            Call dword ptr [00477498]
:0040E72B 8945F4                  mov dword ptr [ebp-0C], eax
:0040E72E 8B45F0                  mov eax, dword ptr [ebp-10]
:0040E731 50                      push eax

* Reference To: USER32.BringWindowToTop, Ord:000Ah
                                  |
:0040E732 FF159C744700            Call dword ptr [0047749C]
:0040E738 8B45F0                  mov eax, dword ptr [ebp-10]
:0040E73B 3945F4                  cmp dword ptr [ebp-0C], eax
:0040E73E 0F840A000000            je 0040E74E
:0040E744 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040E747 50                      push eax

* Reference To: USER32.BringWindowToTop, Ord:000Ah
                                  |
:0040E748 FF159C744700            Call dword ptr [0047749C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E73E(C)
|

* Possible StringData Ref from Data Obj ->"ѾִС"
                                  |
:0040E74E 68ACEE4400              push 0044EEAC
:0040E753 E870FBFFFF              call 0040E2C8
:0040E758 83C404                  add esp, 00000004
:0040E75B 33C0                    xor eax, eax
:0040E75D E969030000              jmp 0040EACB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E6F3(C)
|
:0040E762 8B4508                  mov eax, dword ptr [ebp+08]
:0040E765 A3E8D24500              mov dword ptr [0045D2E8], eax
:0040E76A 6A00                    push 00000000

* Reference To: USER32.GetDC, Ord:00E6h
                                  |
:0040E76C FF15A0744700            Call dword ptr [004774A0]
:0040E772 8945C4                  mov dword ptr [ebp-3C], eax
:0040E775 837DC400                cmp dword ptr [ebp-3C], 00000000
:0040E779 0F845A000000            je 0040E7D9
:0040E77F 6A26                    push 00000026
:0040E781 8B45C4                  mov eax, dword ptr [ebp-3C]
:0040E784 50                      push eax

* Reference To: GDI32.GetDeviceCaps, Ord:00BCh
                                  |
:0040E785 FF15AC724700            Call dword ptr [004772AC]
:0040E78B 2500010000              and eax, 00000100
:0040E790 8945B4                  mov dword ptr [ebp-4C], eax
:0040E793 6A68                    push 00000068
:0040E795 8B45C4                  mov eax, dword ptr [ebp-3C]
:0040E798 50                      push eax

* Reference To: GDI32.GetDeviceCaps, Ord:00BCh
                                  |
:0040E799 FF15AC724700            Call dword ptr [004772AC]
:0040E79F 8945B8                  mov dword ptr [ebp-48], eax
:0040E7A2 8B45C4                  mov eax, dword ptr [ebp-3C]
:0040E7A5 50                      push eax
:0040E7A6 6A00                    push 00000000

* Reference To: USER32.ReleaseDC, Ord:01B9h
                                  |
:0040E7A8 FF15A4744700            Call dword ptr [004774A4]
:0040E7AE 837DB400                cmp dword ptr [ebp-4C], 00000000
:0040E7B2 0F840D000000            je 0040E7C5
:0040E7B8 817DB800010000          cmp dword ptr [ebp-48], 00000100
:0040E7BF 0F8414000000            je 0040E7D9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E7B2(C)
|

* Possible StringData Ref from Data Obj ->"ʹãɫʾװá"
                                  |
:0040E7C5 68BCEE4400              push 0044EEBC
:0040E7CA E8F9FAFFFF              call 0040E2C8
:0040E7CF 83C404                  add esp, 00000004
:0040E7D2 33C0                    xor eax, eax
:0040E7D4 E9F2020000              jmp 0040EACB

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040E779(C), :0040E7BF(C)
|
:0040E7D9 8D45F8                  lea eax, dword ptr [ebp-08]
:0040E7DC 50                      push eax
:0040E7DD 8D45FC                  lea eax, dword ptr [ebp-04]
:0040E7E0 50                      push eax
:0040E7E1 E8277D0300              call 0044650D
:0040E7E6 83C408                  add esp, 00000008
:0040E7E9 817DFC80020000          cmp dword ptr [ebp-04], 00000280
:0040E7F0 0F8C0D000000            jl 0040E803
:0040E7F6 817DF890010000          cmp dword ptr [ebp-08], 00000190
:0040E7FD 0F8F14000000            jg 0040E817

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E7F0(C)
|

* Possible StringData Ref from Data Obj ->"640480ϵʾ"
                                  |
:0040E803 68D8EE4400              push 0044EED8
:0040E808 E8BBFAFFFF              call 0040E2C8
:0040E80D 83C404                  add esp, 00000004
:0040E810 33C0                    xor eax, eax
:0040E812 E9B4020000              jmp 0040EACB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E7FD(C)
|
:0040E817 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0040E81B 0F856C000000            jne 0040E88D
:0040E821 C745C80B100000          mov [ebp-38], 0000100B
:0040E828 C745CC64E54000          mov [ebp-34], 0040E564
:0040E82F C745D400000000          mov [ebp-2C], 00000000
:0040E836 C745D000000000          mov [ebp-30], 00000000
:0040E83D 8B4508                  mov eax, dword ptr [ebp+08]
:0040E840 8945D8                  mov dword ptr [ebp-28], eax
:0040E843 6888000000              push 00000088
:0040E848 8B4508                  mov eax, dword ptr [ebp+08]
:0040E84B 50                      push eax

* Reference To: USER32.LoadIconA, Ord:016Bh
                                  |
:0040E84C FF15A8744700            Call dword ptr [004774A8]
:0040E852 8945DC                  mov dword ptr [ebp-24], eax
:0040E855 C745E000000000          mov [ebp-20], 00000000
:0040E85C C745E406000000          mov [ebp-1C], 00000006

* Possible StringData Ref from Data Obj ->"APPMENU"
                                  |
:0040E863 C745E8F8EE4400          mov [ebp-18], 0044EEF8

* Possible StringData Ref from Data Obj ->"־ for Windows95"
                                  |
:0040E86A C745ECA8ED4400          mov [ebp-14], 0044EDA8
:0040E871 8D45C8                  lea eax, dword ptr [ebp-38]
:0040E874 50                      push eax

* Reference To: USER32.RegisterClassA, Ord:01ABh
                                  |
:0040E875 FF15AC744700            Call dword ptr [004774AC]
:0040E87B 0FB7C0                  movzx eax, ax
:0040E87E 85C0                    test eax, eax
:0040E880 0F8507000000            jne 0040E88D
:0040E886 33C0                    xor eax, eax
:0040E888 E93E020000              jmp 0040EACB

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040E81B(C), :0040E880(C)
|
:0040E88D C745C080020000          mov [ebp-40], 00000280
:0040E894 C745BCB8010000          mov [ebp-44], 000001B8
:0040E89B 6A00                    push 00000000
:0040E89D 8B4508                  mov eax, dword ptr [ebp+08]
:0040E8A0 50                      push eax
:0040E8A1 6A00                    push 00000000
:0040E8A3 6A00                    push 00000000
:0040E8A5 6800000080              push 80000000
:0040E8AA 6800000080              push 80000000
:0040E8AF 6800000080              push 80000000
:0040E8B4 6800000080              push 80000000
:0040E8B9 6800000A00              push 000A0000

* Possible StringData Ref from Data Obj ->"־ for Windows95"
                                  |
:0040E8BE 68A8ED4400              push 0044EDA8

* Possible StringData Ref from Data Obj ->"־ for Windows95"
                                  |
:0040E8C3 68A8ED4400              push 0044EDA8
:0040E8C8 6A00                    push 00000000

* Reference To: USER32.CreateWindowExA, Ord:0052h
                                  |
:0040E8CA FF15B0744700            Call dword ptr [004774B0]
:0040E8D0 A398D44500              mov dword ptr [0045D498], eax
:0040E8D5 833D98D4450000          cmp dword ptr [0045D498], 00000000
:0040E8DC 0F84E2010000            je 0040EAC4
:0040E8E2 6A01                    push 00000001
:0040E8E4 8B45BC                  mov eax, dword ptr [ebp-44]
:0040E8E7 50                      push eax
:0040E8E8 8B45C0                  mov eax, dword ptr [ebp-40]
:0040E8EB 50                      push eax
:0040E8EC A198D44500              mov eax, dword ptr [0045D498]
:0040E8F1 50                      push eax
:0040E8F2 E8DC5C0300              call 004445D3
:0040E8F7 83C410                  add esp, 00000010
:0040E8FA 6A7B                    push 0000007B
:0040E8FC A1E8D24500              mov eax, dword ptr [0045D2E8]
:0040E901 50                      push eax

* Reference To: USER32.LoadCursorA, Ord:0167h
                                  |
:0040E902 FF15B4744700            Call dword ptr [004774B4]
:0040E908 A3A0D44500              mov dword ptr [0045D4A0], eax
:0040E90D 6A7F                    push 0000007F
:0040E90F A1E8D24500              mov eax, dword ptr [0045D2E8]
:0040E914 50                      push eax

* Reference To: USER32.LoadCursorA, Ord:0167h
                                  |
:0040E915 FF15B4744700            Call dword ptr [004774B4]
:0040E91B A3A4D44500              mov dword ptr [0045D4A4], eax
:0040E920 6A79                    push 00000079
:0040E922 A1E8D24500              mov eax, dword ptr [0045D2E8]
:0040E927 50                      push eax

* Reference To: USER32.LoadCursorA, Ord:0167h
                                  |
:0040E928 FF15B4744700            Call dword ptr [004774B4]
:0040E92E A3A8D44500              mov dword ptr [0045D4A8], eax
:0040E933 6A78                    push 00000078
:0040E935 A1E8D24500              mov eax, dword ptr [0045D2E8]
:0040E93A 50                      push eax

* Reference To: USER32.LoadCursorA, Ord:0167h
                                  |
:0040E93B FF15B4744700            Call dword ptr [004774B4]
:0040E941 A3ACD44500              mov dword ptr [0045D4AC], eax
:0040E946 6A7A                    push 0000007A
:0040E948 A1E8D24500              mov eax, dword ptr [0045D2E8]
:0040E94D 50                      push eax

* Reference To: USER32.LoadCursorA, Ord:0167h
                                  |
:0040E94E FF15B4744700            Call dword ptr [004774B4]
:0040E954 A3B0D44500              mov dword ptr [0045D4B0], eax
:0040E959 6A75                    push 00000075
:0040E95B A1E8D24500              mov eax, dword ptr [0045D2E8]
:0040E960 50                      push eax

* Reference To: USER32.LoadCursorA, Ord:0167h
                                  |
:0040E961 FF15B4744700            Call dword ptr [004774B4]
:0040E967 A3B4D44500              mov dword ptr [0045D4B4], eax
:0040E96C 6A76                    push 00000076
:0040E96E A1E8D24500              mov eax, dword ptr [0045D2E8]
:0040E973 50                      push eax

* Reference To: USER32.LoadCursorA, Ord:0167h
                                  |
:0040E974 FF15B4744700            Call dword ptr [004774B4]
:0040E97A A3B8D44500              mov dword ptr [0045D4B8], eax
:0040E97F 6A74                    push 00000074
:0040E981 A1E8D24500              mov eax, dword ptr [0045D2E8]
:0040E986 50                      push eax

* Reference To: USER32.LoadCursorA, Ord:0167h
                                  |
:0040E987 FF15B4744700            Call dword ptr [004774B4]
:0040E98D A3BCD44500              mov dword ptr [0045D4BC], eax
:0040E992 6A73                    push 00000073
:0040E994 A1E8D24500              mov eax, dword ptr [0045D2E8]
:0040E999 50                      push eax

* Reference To: USER32.LoadCursorA, Ord:0167h
                                  |
:0040E99A FF15B4744700            Call dword ptr [004774B4]
:0040E9A0 A3C0D44500              mov dword ptr [0045D4C0], eax
:0040E9A5 6A77                    push 00000077
:0040E9A7 A1E8D24500              mov eax, dword ptr [0045D2E8]
:0040E9AC 50                      push eax

* Reference To: USER32.LoadCursorA, Ord:0167h
                                  |
:0040E9AD FF15B4744700            Call dword ptr [004774B4]
:0040E9B3 A3C4D44500              mov dword ptr [0045D4C4], eax
:0040E9B8 6A7D                    push 0000007D
:0040E9BA A1E8D24500              mov eax, dword ptr [0045D2E8]
:0040E9BF 50                      push eax

* Reference To: USER32.LoadCursorA, Ord:0167h
                                  |
:0040E9C0 FF15B4744700            Call dword ptr [004774B4]
:0040E9C6 A3C8D44500              mov dword ptr [0045D4C8], eax
:0040E9CB 6A7E                    push 0000007E
:0040E9CD A1E8D24500              mov eax, dword ptr [0045D2E8]
:0040E9D2 50                      push eax

* Reference To: USER32.LoadCursorA, Ord:0167h
                                  |
:0040E9D3 FF15B4744700            Call dword ptr [004774B4]
:0040E9D9 A3CCD44500              mov dword ptr [0045D4CC], eax
:0040E9DE 688D000000              push 0000008D
:0040E9E3 A1E8D24500              mov eax, dword ptr [0045D2E8]
:0040E9E8 50                      push eax

* Reference To: USER32.LoadCursorA, Ord:0167h
                                  |
:0040E9E9 FF15B4744700            Call dword ptr [004774B4]
:0040E9EF A3D0D44500              mov dword ptr [0045D4D0], eax
:0040E9F4 688E000000              push 0000008E
:0040E9F9 A1E8D24500              mov eax, dword ptr [0045D2E8]
:0040E9FE 50                      push eax

* Reference To: USER32.LoadCursorA, Ord:0167h
                                  |
:0040E9FF FF15B4744700            Call dword ptr [004774B4]
:0040EA05 A3D4D44500              mov dword ptr [0045D4D4], eax
:0040EA0A 688F000000              push 0000008F
:0040EA0F A1E8D24500              mov eax, dword ptr [0045D2E8]
:0040EA14 50                      push eax

* Reference To: USER32.LoadCursorA, Ord:0167h
                                  |
:0040EA15 FF15B4744700            Call dword ptr [004774B4]
:0040EA1B A3D8D44500              mov dword ptr [0045D4D8], eax
:0040EA20 6890000000              push 00000090
:0040EA25 A1E8D24500              mov eax, dword ptr [0045D2E8]
:0040EA2A 50                      push eax

* Reference To: USER32.LoadCursorA, Ord:0167h
                                  |
:0040EA2B FF15B4744700            Call dword ptr [004774B4]
:0040EA31 A3DCD44500              mov dword ptr [0045D4DC], eax
:0040EA36 6898000000              push 00000098
:0040EA3B A1E8D24500              mov eax, dword ptr [0045D2E8]
:0040EA40 50                      push eax

* Reference To: USER32.LoadCursorA, Ord:0167h
                                  |
:0040EA41 FF15B4744700            Call dword ptr [004774B4]
:0040EA47 A3E0D44500              mov dword ptr [0045D4E0], eax
:0040EA4C 6895000000              push 00000095
:0040EA51 A1E8D24500              mov eax, dword ptr [0045D2E8]
:0040EA56 50                      push eax

* Reference To: USER32.LoadCursorA, Ord:0167h
                                  |
:0040EA57 FF15B4744700            Call dword ptr [004774B4]
:0040EA5D A3E4D44500              mov dword ptr [0045D4E4], eax
:0040EA62 6896000000              push 00000096
:0040EA67 A1E8D24500              mov eax, dword ptr [0045D2E8]
:0040EA6C 50                      push eax

* Reference To: USER32.LoadCursorA, Ord:0167h
                                  |
:0040EA6D FF15B4744700            Call dword ptr [004774B4]
:0040EA73 A3E8D44500              mov dword ptr [0045D4E8], eax
:0040EA78 6897000000              push 00000097
:0040EA7D A1E8D24500              mov eax, dword ptr [0045D2E8]
:0040EA82 50                      push eax

* Reference To: USER32.LoadCursorA, Ord:0167h
                                  |
:0040EA83 FF15B4744700            Call dword ptr [004774B4]
:0040EA89 A3ECD44500              mov dword ptr [0045D4EC], eax
:0040EA8E 6899000000              push 00000099
:0040EA93 A1E8D24500              mov eax, dword ptr [0045D2E8]
:0040EA98 50                      push eax

* Reference To: USER32.LoadCursorA, Ord:0167h
                                  |
:0040EA99 FF15B4744700            Call dword ptr [004774B4]
:0040EA9F A3F0D44500              mov dword ptr [0045D4F0], eax
:0040EAA4 689A000000              push 0000009A
:0040EAA9 A1E8D24500              mov eax, dword ptr [0045D2E8]
:0040EAAE 50                      push eax

* Reference To: USER32.LoadCursorA, Ord:0167h
                                  |
:0040EAAF FF15B4744700            Call dword ptr [004774B4]
:0040EAB5 A3F4D44500              mov dword ptr [0045D4F4], eax
:0040EABA B801000000              mov eax, 00000001
:0040EABF E907000000              jmp 0040EACB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E8DC(C)
|
:0040EAC4 33C0                    xor eax, eax
:0040EAC6 E900000000              jmp 0040EACB

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040E75D(U), :0040E7D4(U), :0040E812(U), :0040E888(U), :0040EABF(U)
|:0040EAC6(U)
|
:0040EACB 5F                      pop edi
:0040EACC 5E                      pop esi
:0040EACD 5B                      pop ebx
:0040EACE C9                      leave
:0040EACF C20800                  ret 0008



* Referenced by a CALL at Address:
|:004485A8   
|
:0040EAD2 55                      push ebp
:0040EAD3 8BEC                    mov ebp, esp
:0040EAD5 83EC20                  sub esp, 00000020
:0040EAD8 53                      push ebx
:0040EAD9 56                      push esi
:0040EADA 57                      push edi
:0040EADB 8B450C                  mov eax, dword ptr [ebp+0C]
:0040EADE 50                      push eax
:0040EADF 8B4508                  mov eax, dword ptr [ebp+08]
:0040EAE2 50                      push eax
:0040EAE3 E8EEFBFFFF              call 0040E6D6
:0040EAE8 85C0                    test eax, eax
:0040EAEA 0F8507000000            jne 0040EAF7
:0040EAF0 33C0                    xor eax, eax
:0040EAF2 E949000000              jmp 0040EB40

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040EAEA(C)
|
:0040EAF7 6862E24000              push 0040E262
:0040EAFC E8C1770300              call 004462C2
:0040EB01 83C404                  add esp, 00000004
:0040EB04 E829740100              call 00425F32
:0040EB09 C745E000000000          mov [ebp-20], 00000000
:0040EB10 E903000000              jmp 0040EB18

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040EB33(U)
|
:0040EB15 FF45E0                  inc [ebp-20]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040EB10(U)
|
:0040EB18 837DE016                cmp dword ptr [ebp-20], 00000016
:0040EB1C 0F8D16000000            jnl 0040EB38
:0040EB22 8B45E0                  mov eax, dword ptr [ebp-20]
:0040EB25 8B0485A0D44500          mov eax, dword ptr [4*eax+0045D4A0]
:0040EB2C 50                      push eax

* Reference To: USER32.DestroyCursor, Ord:0083h
                                  |
:0040EB2D FF1588744700            Call dword ptr [00477488]
:0040EB33 E9DDFFFFFF              jmp 0040EB15

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040EB1C(C)
|
:0040EB38 8B45EC                  mov eax, dword ptr [ebp-14]
:0040EB3B E900000000              jmp 0040EB40

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040EAF2(U), :0040EB3B(U)
|
:0040EB40 5F                      pop edi
:0040EB41 5E                      pop esi
:0040EB42 5B                      pop ebx
:0040EB43 C9                      leave
:0040EB44 C21000                  ret 0010


:0040EB47 CC                      int 03
:0040EB48 CC                      int 03
:0040EB49 CC                      int 03
:0040EB4A CC                      int 03
:0040EB4B CC                      int 03
:0040EB4C CC                      int 03
:0040EB4D CC                      int 03
:0040EB4E CC                      int 03
:0040EB4F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040EC6C   , :0040FC75   
|
:0040EB50 55                      push ebp
:0040EB51 8BEC                    mov ebp, esp
:0040EB53 83EC04                  sub esp, 00000004
:0040EB56 53                      push ebx
:0040EB57 56                      push esi
:0040EB58 57                      push edi
:0040EB59 C745FC00AA4600          mov [ebp-04], 0046AA00
:0040EB60 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040EB63 E8E82CFFFF              call 00401850
:0040EB68 50                      push eax
:0040EB69 8D0D0AAA4600            lea ecx, dword ptr [0046AA0A]
:0040EB6F E8AC2CFFFF              call 00401820
:0040EB74 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040EB77 E804120000              call 0040FD80
:0040EB7C 50                      push eax
:0040EB7D 8D0D0AAA4600            lea ecx, dword ptr [0046AA0A]
:0040EB83 E8582EFFFF              call 004019E0
:0040EB88 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040EB8B E840120000              call 0040FDD0
:0040EB90 50                      push eax
:0040EB91 8D0D0AAA4600            lea ecx, dword ptr [0046AA0A]
:0040EB97 E804120000              call 0040FDA0
:0040EB9C E900000000              jmp 0040EBA1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040EB9C(U)
|
:0040EBA1 5F                      pop edi
:0040EBA2 5E                      pop esi
:0040EBA3 5B                      pop ebx
:0040EBA4 C9                      leave
:0040EBA5 C3                      ret



* Referenced by a CALL at Addresses:
|:0040F87A   , :0040FBCA   , :0040FC94   , :0040FD2D   , :00425946   
|
:0040EBA6 55                      push ebp
:0040EBA7 8BEC                    mov ebp, esp
:0040EBA9 83EC10                  sub esp, 00000010
:0040EBAC 53                      push ebx
:0040EBAD 56                      push esi
:0040EBAE 57                      push edi
:0040EBAF C745FCFFFF0000          mov [ebp-04], 0000FFFF
:0040EBB6 833D7853450002          cmp dword ptr [00455378], 00000002
:0040EBBD 0F840E010000            je 0040ECD1
:0040EBC3 8B4508                  mov eax, dword ptr [ebp+08]
:0040EBC6 8945F4                  mov dword ptr [ebp-0C], eax
:0040EBC9 E952000000              jmp 0040EC20

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040EC24(C)
|
:0040EBCE B9B0C44600              mov ecx, 0046C4B0
:0040EBD3 E8A1040200              call 0042F079
:0040EBD8 8945FC                  mov dword ptr [ebp-04], eax
:0040EBDB E963000000              jmp 0040EC43

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040EC2E(C)
|
:0040EBE0 8B450C                  mov eax, dword ptr [ebp+0C]
:0040EBE3 50                      push eax
:0040EBE4 B9B0C44600              mov ecx, 0046C4B0
:0040EBE9 E85B050200              call 0042F149
:0040EBEE 8945FC                  mov dword ptr [ebp-04], eax
:0040EBF1 E94D000000              jmp 0040EC43

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040EC38(C)
|
:0040EBF6 8B450C                  mov eax, dword ptr [ebp+0C]
:0040EBF9 50                      push eax
:0040EBFA B900AA4600              mov ecx, 0046AA00
:0040EBFF E82C2DFFFF              call 00401930
:0040EC04 33C9                    xor ecx, ecx
:0040EC06 8AC8                    mov cl, al
:0040EC08 51                      push ecx
:0040EC09 B9B0C44600              mov ecx, 0046C4B0
:0040EC0E E8E6060200              call 0042F2F9
:0040EC13 8945FC                  mov dword ptr [ebp-04], eax
:0040EC16 E928000000              jmp 0040EC43
:0040EC1B E923000000              jmp 0040EC43

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040EBC9(U)
|
:0040EC20 837DF400                cmp dword ptr [ebp-0C], 00000000
:0040EC24 0F84A4FFFFFF            je 0040EBCE
:0040EC2A 837DF401                cmp dword ptr [ebp-0C], 00000001
:0040EC2E 0F84ACFFFFFF            je 0040EBE0
:0040EC34 837DF402                cmp dword ptr [ebp-0C], 00000002
:0040EC38 0F84B8FFFFFF            je 0040EBF6
:0040EC3E E900000000              jmp 0040EC43

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040EBDB(U), :0040EBF1(U), :0040EC16(U), :0040EC1B(U), :0040EC3E(U)
|
:0040EC43 817DFCFFFF0000          cmp dword ptr [ebp-04], 0000FFFF
:0040EC4A 0F8481000000            je 0040ECD1
:0040EC50 8B45FC                  mov eax, dword ptr [ebp-04]
:0040EC53 50                      push eax
:0040EC54 B9B0C44600              mov ecx, 0046C4B0
:0040EC59 E82A0F0200              call 0042FB88
:0040EC5E 8945F8                  mov dword ptr [ebp-08], eax
:0040EC61 8B45F8                  mov eax, dword ptr [ebp-08]
:0040EC64 8945F0                  mov dword ptr [ebp-10], eax
:0040EC67 E931000000              jmp 0040EC9D
:0040EC6C E8DFFEFFFF              call 0040EB50
:0040EC71 E87428FFFF              call 004014EA
:0040EC76 E956000000              jmp 0040ECD1
:0040EC7B 830D7853450020          or dword ptr [00455378], 00000020
:0040EC82 E94A000000              jmp 0040ECD1
:0040EC87 830D7853450004          or dword ptr [00455378], 00000004
:0040EC8E E93E000000              jmp 0040ECD1
:0040EC93 E939000000              jmp 0040ECD1
:0040EC98 E934000000              jmp 0040ECD1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040EC67(U)
|
:0040EC9D 836DF002                sub dword ptr [ebp-10], 00000002
:0040ECA1 837DF006                cmp dword ptr [ebp-10], 00000006
:0040ECA5 0F8726000000            ja 0040ECD1
:0040ECAB 8B45F0                  mov eax, dword ptr [ebp-10]
:0040ECAE FF2485B5EC4000          jmp dword ptr [4*eax+0040ECB5]

:0040ECB5 6CEC4000                DWORD 0040EC6C
:0040ECB9 93EC4000                DWORD 0040EC93
:0040ECBD 93EC4000                DWORD 0040EC93
:0040ECC1 93EC4000                DWORD 0040EC93
:0040ECC5 93EC4000                DWORD 0040EC93
:0040ECC9 7BEC4000                DWORD 0040EC7B
:0040ECCD 87EC4000                DWORD 0040EC87



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040EBBD(C), :0040EC4A(C), :0040EC76(U), :0040EC82(U), :0040EC8E(U)
|:0040EC93(U), :0040EC98(U), :0040ECA5(C)
|
:0040ECD1 8B45FC                  mov eax, dword ptr [ebp-04]
:0040ECD4 E900000000              jmp 0040ECD9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040ECD4(U)
|
:0040ECD9 5F                      pop edi
:0040ECDA 5E                      pop esi
:0040ECDB 5B                      pop ebx
:0040ECDC C9                      leave
:0040ECDD C3                      ret



* Referenced by a CALL at Address:
|:00431CC1   
|
:0040ECDE 55                      push ebp
:0040ECDF 8BEC                    mov ebp, esp
:0040ECE1 81ECDC000000            sub esp, 000000DC
:0040ECE7 53                      push ebx
:0040ECE8 56                      push esi
:0040ECE9 57                      push edi
:0040ECEA 8D4DAC                  lea ecx, dword ptr [ebp-54]
:0040ECED E87E2BFFFF              call 00401870
:0040ECF2 8D4DA4                  lea ecx, dword ptr [ebp-5C]
:0040ECF5 E8762BFFFF              call 00401870
:0040ECFA 8B4508                  mov eax, dword ptr [ebp+08]
:0040ECFD 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040ED00 8D0C8500A74600          lea ecx, dword ptr [4*eax+0046A700]
:0040ED07 E8C42BFFFF              call 004018D0
:0040ED0C 50                      push eax
:0040ED0D 8D4DAC                  lea ecx, dword ptr [ebp-54]
:0040ED10 E87B2BFFFF              call 00401890
:0040ED15 8B450C                  mov eax, dword ptr [ebp+0C]
:0040ED18 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040ED1B 8D0C8500A74600          lea ecx, dword ptr [4*eax+0046A700]
:0040ED22 E8A92BFFFF              call 004018D0
:0040ED27 50                      push eax
:0040ED28 8D4DA4                  lea ecx, dword ptr [ebp-5C]
:0040ED2B E8602BFFFF              call 00401890
:0040ED30 8B4508                  mov eax, dword ptr [ebp+08]
:0040ED33 39450C                  cmp dword ptr [ebp+0C], eax
:0040ED36 0F8541000000            jne 0040ED7D
:0040ED3C 8B4510                  mov eax, dword ptr [ebp+10]
:0040ED3F 50                      push eax
:0040ED40 33C0                    xor eax, eax
:0040ED42 8A45AD                  mov al, byte ptr [ebp-53]
:0040ED45 C1E003                  shl eax, 03
:0040ED48 83C018                  add eax, 00000018
:0040ED4B 50                      push eax
:0040ED4C 33C0                    xor eax, eax
:0040ED4E 8A45AC                  mov al, byte ptr [ebp-54]
:0040ED51 C1E003                  shl eax, 03
:0040ED54 83C008                  add eax, 00000008
:0040ED57 50                      push eax
:0040ED58 E879020000              call 0040EFD6
:0040ED5D 83C40C                  add esp, 0000000C
:0040ED60 B9D0A64600              mov ecx, 0046A6D0
:0040ED65 E866CCFFFF              call 0040B9D0
:0040ED6A 33C9                    xor ecx, ecx
:0040ED6C 8AC8                    mov cl, al
:0040ED6E 41                      inc ecx
:0040ED6F 51                      push ecx
:0040ED70 E8B3860200              call 00437428
:0040ED75 83C404                  add esp, 00000004
:0040ED78 E954020000              jmp 0040EFD1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040ED36(C)
|
:0040ED7D 33C0                    xor eax, eax
:0040ED7F 8A45AC                  mov al, byte ptr [ebp-54]
:0040ED82 C1E003                  shl eax, 03
:0040ED85 8945B8                  mov dword ptr [ebp-48], eax
:0040ED88 33C0                    xor eax, eax
:0040ED8A 8A45AD                  mov al, byte ptr [ebp-53]
:0040ED8D C1E003                  shl eax, 03
:0040ED90 8945BC                  mov dword ptr [ebp-44], eax
:0040ED93 33C0                    xor eax, eax
:0040ED95 8A45A4                  mov al, byte ptr [ebp-5C]
:0040ED98 C1E003                  shl eax, 03
:0040ED9B 8945F8                  mov dword ptr [ebp-08], eax
:0040ED9E 33C0                    xor eax, eax
:0040EDA0 8A45A5                  mov al, byte ptr [ebp-5B]
:0040EDA3 C1E003                  shl eax, 03
:0040EDA6 8945FC                  mov dword ptr [ebp-04], eax
:0040EDA9 33C0                    xor eax, eax
:0040EDAB 8A45AC                  mov al, byte ptr [ebp-54]
:0040EDAE C1E003                  shl eax, 03
:0040EDB1 50                      push eax
:0040EDB2 33C0                    xor eax, eax
:0040EDB4 8A45A4                  mov al, byte ptr [ebp-5C]
:0040EDB7 C1E003                  shl eax, 03
:0040EDBA 50                      push eax
:0040EDBB E872020000              call 0040F032
:0040EDC0 83C408                  add esp, 00000008
:0040EDC3 8945D8                  mov dword ptr [ebp-28], eax
:0040EDC6 33C0                    xor eax, eax
:0040EDC8 8A45AD                  mov al, byte ptr [ebp-53]
:0040EDCB C1E003                  shl eax, 03
:0040EDCE 50                      push eax
:0040EDCF 33C0                    xor eax, eax
:0040EDD1 8A45A5                  mov al, byte ptr [ebp-5B]
:0040EDD4 C1E003                  shl eax, 03
:0040EDD7 50                      push eax
:0040EDD8 E855020000              call 0040F032
:0040EDDD 83C408                  add esp, 00000008
:0040EDE0 8945DC                  mov dword ptr [ebp-24], eax
:0040EDE3 33C0                    xor eax, eax
:0040EDE5 8A45AC                  mov al, byte ptr [ebp-54]
:0040EDE8 C1E003                  shl eax, 03
:0040EDEB 50                      push eax
:0040EDEC 8B45D8                  mov eax, dword ptr [ebp-28]
:0040EDEF 50                      push eax
:0040EDF0 E83D020000              call 0040F032
:0040EDF5 83C408                  add esp, 00000008
:0040EDF8 8945C8                  mov dword ptr [ebp-38], eax
:0040EDFB 33C0                    xor eax, eax
:0040EDFD 8A45AD                  mov al, byte ptr [ebp-53]
:0040EE00 C1E003                  shl eax, 03
:0040EE03 50                      push eax
:0040EE04 8B45DC                  mov eax, dword ptr [ebp-24]
:0040EE07 50                      push eax
:0040EE08 E825020000              call 0040F032
:0040EE0D 83C408                  add esp, 00000008
:0040EE10 8945CC                  mov dword ptr [ebp-34], eax
:0040EE13 33C0                    xor eax, eax
:0040EE15 8A45AC                  mov al, byte ptr [ebp-54]
:0040EE18 C1E003                  shl eax, 03
:0040EE1B 50                      push eax
:0040EE1C 8B45C8                  mov eax, dword ptr [ebp-38]
:0040EE1F 50                      push eax
:0040EE20 E80D020000              call 0040F032
:0040EE25 83C408                  add esp, 00000008
:0040EE28 8945C0                  mov dword ptr [ebp-40], eax
:0040EE2B 33C0                    xor eax, eax
:0040EE2D 8A45AD                  mov al, byte ptr [ebp-53]
:0040EE30 C1E003                  shl eax, 03
:0040EE33 50                      push eax
:0040EE34 8B45CC                  mov eax, dword ptr [ebp-34]
:0040EE37 50                      push eax
:0040EE38 E8F5010000              call 0040F032
:0040EE3D 83C408                  add esp, 00000008
:0040EE40 8945C4                  mov dword ptr [ebp-3C], eax
:0040EE43 8B45D8                  mov eax, dword ptr [ebp-28]
:0040EE46 50                      push eax
:0040EE47 8B45C8                  mov eax, dword ptr [ebp-38]
:0040EE4A 50                      push eax
:0040EE4B E8E2010000              call 0040F032
:0040EE50 83C408                  add esp, 00000008
:0040EE53 8945D0                  mov dword ptr [ebp-30], eax
:0040EE56 8B45DC                  mov eax, dword ptr [ebp-24]
:0040EE59 50                      push eax
:0040EE5A 8B45CC                  mov eax, dword ptr [ebp-34]
:0040EE5D 50                      push eax
:0040EE5E E8CF010000              call 0040F032
:0040EE63 83C408                  add esp, 00000008
:0040EE66 8945D4                  mov dword ptr [ebp-2C], eax
:0040EE69 8B45F8                  mov eax, dword ptr [ebp-08]
:0040EE6C 50                      push eax
:0040EE6D 8B45D8                  mov eax, dword ptr [ebp-28]
:0040EE70 50                      push eax
:0040EE71 E8BC010000              call 0040F032
:0040EE76 83C408                  add esp, 00000008
:0040EE79 8945E8                  mov dword ptr [ebp-18], eax
:0040EE7C 8B45FC                  mov eax, dword ptr [ebp-04]
:0040EE7F 50                      push eax
:0040EE80 8B45DC                  mov eax, dword ptr [ebp-24]
:0040EE83 50                      push eax
:0040EE84 E8A9010000              call 0040F032
:0040EE89 83C408                  add esp, 00000008
:0040EE8C 8945EC                  mov dword ptr [ebp-14], eax
:0040EE8F 8B45E8                  mov eax, dword ptr [ebp-18]
:0040EE92 50                      push eax
:0040EE93 8B45D8                  mov eax, dword ptr [ebp-28]
:0040EE96 50                      push eax
:0040EE97 E896010000              call 0040F032
:0040EE9C 83C408                  add esp, 00000008
:0040EE9F 8945E0                  mov dword ptr [ebp-20], eax
:0040EEA2 8B45EC                  mov eax, dword ptr [ebp-14]
:0040EEA5 50                      push eax
:0040EEA6 8B45DC                  mov eax, dword ptr [ebp-24]
:0040EEA9 50                      push eax
:0040EEAA E883010000              call 0040F032
:0040EEAF 83C408                  add esp, 00000008
:0040EEB2 8945E4                  mov dword ptr [ebp-1C], eax
:0040EEB5 8B45F8                  mov eax, dword ptr [ebp-08]
:0040EEB8 50                      push eax
:0040EEB9 8B45E8                  mov eax, dword ptr [ebp-18]
:0040EEBC 50                      push eax
:0040EEBD E870010000              call 0040F032
:0040EEC2 83C408                  add esp, 00000008
:0040EEC5 8945F0                  mov dword ptr [ebp-10], eax
:0040EEC8 8B45FC                  mov eax, dword ptr [ebp-04]
:0040EECB 50                      push eax
:0040EECC 8B45EC                  mov eax, dword ptr [ebp-14]
:0040EECF 50                      push eax
:0040EED0 E85D010000              call 0040F032
:0040EED5 83C408                  add esp, 00000008
:0040EED8 8945F4                  mov dword ptr [ebp-0C], eax
:0040EEDB C745B000000000          mov [ebp-50], 00000000
:0040EEE2 E903000000              jmp 0040EEEA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040EF89(U)
|
:0040EEE7 FF45B0                  inc [ebp-50]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040EEE2(U)
|
:0040EEEA 837DB008                cmp dword ptr [ebp-50], 00000008
:0040EEEE 0F879A000000            ja 0040EF8E
:0040EEF4 E89E800100              call 00426F97
:0040EEF9 8B45B0                  mov eax, dword ptr [ebp-50]
:0040EEFC 8B44C5B8                mov eax, dword ptr [ebp+8*eax-48]
:0040EF00 8945B4                  mov dword ptr [ebp-4C], eax
:0040EF03 8B45B0                  mov eax, dword ptr [ebp-50]
:0040EF06 8B44C5BC                mov eax, dword ptr [ebp+8*eax-44]
:0040EF0A 83C028                  add eax, 00000028
:0040EF0D 8945A8                  mov dword ptr [ebp-58], eax
:0040EF10 8D8524FFFFFF            lea eax, dword ptr [ebp+FFFFFF24]
:0040EF16 50                      push eax
:0040EF17 6A10                    push 00000010
:0040EF19 6A08                    push 00000008
:0040EF1B 8B45A8                  mov eax, dword ptr [ebp-58]
:0040EF1E 83E810                  sub eax, 00000010
:0040EF21 50                      push eax
:0040EF22 8B45B4                  mov eax, dword ptr [ebp-4C]
:0040EF25 83C008                  add eax, 00000008
:0040EF28 50                      push eax
:0040EF29 E82D6A0300              call 0044595B
:0040EF2E 83C414                  add esp, 00000014
:0040EF31 8B4510                  mov eax, dword ptr [ebp+10]
:0040EF34 50                      push eax
:0040EF35 8B45A8                  mov eax, dword ptr [ebp-58]
:0040EF38 83E810                  sub eax, 00000010
:0040EF3B 50                      push eax
:0040EF3C 8B45B4                  mov eax, dword ptr [ebp-4C]
:0040EF3F 83C008                  add eax, 00000008
:0040EF42 50                      push eax
:0040EF43 E88E000000              call 0040EFD6
:0040EF48 83C40C                  add esp, 0000000C
:0040EF4B E867800100              call 00426FB7
:0040EF50 B9D0A64600              mov ecx, 0046A6D0
:0040EF55 E876CAFFFF              call 0040B9D0
:0040EF5A 33C9                    xor ecx, ecx
:0040EF5C 8AC8                    mov cl, al
:0040EF5E 41                      inc ecx
:0040EF5F 51                      push ecx
:0040EF60 E8C3840200              call 00437428
:0040EF65 83C404                  add esp, 00000004
:0040EF68 8D8524FFFFFF            lea eax, dword ptr [ebp+FFFFFF24]
:0040EF6E 50                      push eax
:0040EF6F 6A10                    push 00000010
:0040EF71 6A08                    push 00000008
:0040EF73 8B45A8                  mov eax, dword ptr [ebp-58]
:0040EF76 83E810                  sub eax, 00000010
:0040EF79 50                      push eax
:0040EF7A 8B45B4                  mov eax, dword ptr [ebp-4C]
:0040EF7D 83C008                  add eax, 00000008
:0040EF80 50                      push eax
:0040EF81 E819680300              call 0044579F
:0040EF86 83C414                  add esp, 00000014
:0040EF89 E959FFFFFF              jmp 0040EEE7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040EEEE(C)
|
:0040EF8E 837D1400                cmp dword ptr [ebp+14], 00000000
:0040EF92 0F8434000000            je 0040EFCC
:0040EF98 8B4510                  mov eax, dword ptr [ebp+10]
:0040EF9B 50                      push eax
:0040EF9C 8B45A8                  mov eax, dword ptr [ebp-58]
:0040EF9F 83E810                  sub eax, 00000010
:0040EFA2 50                      push eax
:0040EFA3 8B45B4                  mov eax, dword ptr [ebp-4C]
:0040EFA6 83C008                  add eax, 00000008
:0040EFA9 50                      push eax
:0040EFAA E827000000              call 0040EFD6
:0040EFAF 83C40C                  add esp, 0000000C
:0040EFB2 B9D0A64600              mov ecx, 0046A6D0
:0040EFB7 E814CAFFFF              call 0040B9D0
:0040EFBC 33C9                    xor ecx, ecx
:0040EFBE 8AC8                    mov cl, al
:0040EFC0 83C102                  add ecx, 00000002
:0040EFC3 51                      push ecx
:0040EFC4 E85F840200              call 00437428
:0040EFC9 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040EF92(C)
|
:0040EFCC E900000000              jmp 0040EFD1

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040ED78(U), :0040EFCC(U)
|
:0040EFD1 5F                      pop edi
:0040EFD2 5E                      pop esi
:0040EFD3 5B                      pop ebx
:0040EFD4 C9                      leave
:0040EFD5 C3                      ret



* Referenced by a CALL at Addresses:
|:0040ED58   , :0040EF43   , :0040EFAA   
|
:0040EFD6 55                      push ebp
:0040EFD7 8BEC                    mov ebp, esp
:0040EFD9 53                      push ebx
:0040EFDA 56                      push esi
:0040EFDB 57                      push edi
:0040EFDC B906000000              mov ecx, 00000006
:0040EFE1 8B4510                  mov eax, dword ptr [ebp+10]
:0040EFE4 2BD2                    sub edx, edx
:0040EFE6 F7F1                    div ecx
:0040EFE8 895510                  mov dword ptr [ebp+10], edx
:0040EFEB 6A00                    push 00000000
:0040EFED 6A00                    push 00000000
:0040EFEF 6A04                    push 00000004
:0040EFF1 E8095D0300              call 00444CFF
:0040EFF6 83C40C                  add esp, 0000000C
:0040EFF9 6A04                    push 00000004
:0040EFFB 6A00                    push 00000000
:0040EFFD 8B4510                  mov eax, dword ptr [ebp+10]
:0040F000 C1E007                  shl eax, 07
:0040F003 05C0A50000              add eax, 0000A5C0
:0040F008 50                      push eax
:0040F009 B940CF4600              mov ecx, 0046CF40
:0040F00E E80D870300              call 00447720
:0040F013 50                      push eax
:0040F014 6A10                    push 00000010
:0040F016 6A08                    push 00000008
:0040F018 8B450C                  mov eax, dword ptr [ebp+0C]
:0040F01B 50                      push eax
:0040F01C 8B4508                  mov eax, dword ptr [ebp+08]
:0040F01F 50                      push eax
:0040F020 E87A670300              call 0044579F
:0040F025 83C414                  add esp, 00000014
:0040F028 E900000000              jmp 0040F02D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F028(U)
|
:0040F02D 5F                      pop edi
:0040F02E 5E                      pop esi
:0040F02F 5B                      pop ebx
:0040F030 C9                      leave
:0040F031 C3                      ret



* Referenced by a CALL at Addresses:
|:0040EDBB   , :0040EDD8   , :0040EDF0   , :0040EE08   , :0040EE20   
|:0040EE38   , :0040EE4B   , :0040EE5E   , :0040EE71   , :0040EE84   
|:0040EE97   , :0040EEAA   , :0040EEBD   , :0040EED0   
|
:0040F032 55                      push ebp
:0040F033 8BEC                    mov ebp, esp
:0040F035 53                      push ebx
:0040F036 56                      push esi
:0040F037 57                      push edi
:0040F038 8B450C                  mov eax, dword ptr [ebp+0C]
:0040F03B 034508                  add eax, dword ptr [ebp+08]
:0040F03E C1E801                  shr eax, 01
:0040F041 E900000000              jmp 0040F046

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F041(U)
|
:0040F046 5F                      pop edi
:0040F047 5E                      pop esi
:0040F048 5B                      pop ebx
:0040F049 C9                      leave
:0040F04A C3                      ret



* Referenced by a CALL at Addresses:
|:0040F6FE   , :0040FBA7   
|
:0040F04B 55                      push ebp
:0040F04C 8BEC                    mov ebp, esp
:0040F04E 53                      push ebx
:0040F04F 56                      push esi
:0040F050 57                      push edi
:0040F051 813D64F94600419C0000    cmp dword ptr [0046F964], 00009C41
:0040F05B 0F8C2E000000            jl 0040F08F
:0040F061 813D64F946009D9C0000    cmp dword ptr [0046F964], 00009C9D
:0040F06B 0F8F1E000000            jg 0040F08F
:0040F071 E8831B0000              call 00410BF9
:0040F076 C70564F94600FFFFFFFF    mov dword ptr [0046F964], FFFFFFFF
:0040F080 E8226C0100              call 00425CA7
:0040F085 6A01                    push 00000001
:0040F087 E83F6A0100              call 00425ACB
:0040F08C 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040F05B(C), :0040F06B(C)
|
:0040F08F E900000000              jmp 0040F094

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F08F(U)
|
:0040F094 5F                      pop edi
:0040F095 5E                      pop esi
:0040F096 5B                      pop ebx
:0040F097 C9                      leave
:0040F098 C3                      ret



* Referenced by a CALL at Address:
|:0042567A   
|
:0040F099 55                      push ebp
:0040F09A 8BEC                    mov ebp, esp
:0040F09C 53                      push ebx
:0040F09D 56                      push esi
:0040F09E 57                      push edi
:0040F09F 6A01                    push 00000001
:0040F0A1 E838000000              call 0040F0DE
:0040F0A6 83C404                  add esp, 00000004
:0040F0A9 F605785345006E          test byte ptr [00455378], 6E
:0040F0B0 0F840A000000            je 0040F0C0
:0040F0B6 A178534500              mov eax, dword ptr [00455378]
:0040F0BB E919000000              jmp 0040F0D9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F0B0(C)
|
:0040F0C0 E86C050000              call 0040F631
:0040F0C5 6A00                    push 00000000
:0040F0C7 E8FF690100              call 00425ACB
:0040F0CC 83C404                  add esp, 00000004
:0040F0CF A178534500              mov eax, dword ptr [00455378]
:0040F0D4 E900000000              jmp 0040F0D9

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040F0BB(U), :0040F0D4(U)
|
:0040F0D9 5F                      pop edi
:0040F0DA 5E                      pop esi
:0040F0DB 5B                      pop ebx
:0040F0DC C9                      leave
:0040F0DD C3                      ret



* Referenced by a CALL at Addresses:
|:0040F0A1   , :0040FA82   
|
:0040F0DE 55                      push ebp
:0040F0DF 8BEC                    mov ebp, esp
:0040F0E1 83EC08                  sub esp, 00000008
:0040F0E4 53                      push ebx
:0040F0E5 56                      push esi
:0040F0E6 57                      push edi
:0040F0E7 837D0800                cmp dword ptr [ebp+08], 00000000
:0040F0EB 0F851F000000            jne 0040F110
:0040F0F1 B9D0A64600              mov ecx, 0046A6D0
:0040F0F6 E8F527FFFF              call 004018F0
:0040F0FB 33C9                    xor ecx, ecx
:0040F0FD 8AC8                    mov cl, al
:0040F0FF 83C102                  add ecx, 00000002
:0040F102 51                      push ecx
:0040F103 E8B4000000              call 0040F1BC
:0040F108 83C404                  add esp, 00000004
:0040F10B E90A000000              jmp 0040F11A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F0EB(C)
|
:0040F110 6A01                    push 00000001
:0040F112 E8A5000000              call 0040F1BC
:0040F117 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F10B(U)
|
:0040F11A C7056852450000000000    mov dword ptr [00455268], 00000000
:0040F124 C7058053450000000000    mov dword ptr [00455380], 00000000
:0040F12E C6054CF9460000          mov byte ptr [0046F94C], 00
:0040F135 C7057853450000000000    mov dword ptr [00455378], 00000000
:0040F13F C6057C534500FF          mov byte ptr [0045537C], FF
:0040F146 C745FC00AA4600          mov [ebp-04], 0046AA00
:0040F14D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040F150 E8FB26FFFF              call 00401850
:0040F155 33C9                    xor ecx, ecx
:0040F157 8AC8                    mov cl, al
:0040F159 80E10F                  and cl, 0F
:0040F15C 884DF8                  mov byte ptr [ebp-08], cl
:0040F15F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040F162 E8190C0000              call 0040FD80
:0040F167 33C9                    xor ecx, ecx
:0040F169 8AC8                    mov cl, al
:0040F16B 33C0                    xor eax, eax
:0040F16D 8A45F8                  mov al, byte ptr [ebp-08]
:0040F170 C1E00C                  shl eax, 0C
:0040F173 0BC8                    or ecx, eax
:0040F175 51                      push ecx
:0040F176 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040F179 E8B227FFFF              call 00401930
:0040F17E 33C9                    xor ecx, ecx
:0040F180 8AC8                    mov cl, al
:0040F182 51                      push ecx
:0040F183 B9B0C44600              mov ecx, 0046C4B0
:0040F188 E8B0080200              call 0042FA3D
:0040F18D 8B4508                  mov eax, dword ptr [ebp+08]
:0040F190 50                      push eax
:0040F191 E88E010000              call 0040F324
:0040F196 83C404                  add esp, 00000004
:0040F199 6A00                    push 00000000
:0040F19B E8B9680100              call 00425A59
:0040F1A0 83C404                  add esp, 00000004
:0040F1A3 E8FF6A0100              call 00425CA7
:0040F1A8 6A01                    push 00000001
:0040F1AA E81C690100              call 00425ACB
:0040F1AF 83C404                  add esp, 00000004
:0040F1B2 E900000000              jmp 0040F1B7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F1B2(U)
|
:0040F1B7 5F                      pop edi
:0040F1B8 5E                      pop esi
:0040F1B9 5B                      pop ebx
:0040F1BA C9                      leave
:0040F1BB C3                      ret



* Referenced by a CALL at Addresses:
|:0040F103   , :0040F112   
|
:0040F1BC 55                      push ebp
:0040F1BD 8BEC                    mov ebp, esp
:0040F1BF 83EC08                  sub esp, 00000008
:0040F1C2 53                      push ebx
:0040F1C3 56                      push esi
:0040F1C4 57                      push edi
:0040F1C5 6A04                    push 00000004
:0040F1C7 6A00                    push 00000000
:0040F1C9 6A00                    push 00000000
:0040F1CB B980E34600              mov ecx, 0046E380
:0040F1D0 E84B850300              call 00447720
:0040F1D5 8945FC                  mov dword ptr [ebp-04], eax
:0040F1D8 8B4508                  mov eax, dword ptr [ebp+08]
:0040F1DB 8945F8                  mov dword ptr [ebp-08], eax
:0040F1DE E9CD000000              jmp 0040F2B0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F2BE(C)
|
:0040F1E3 6A04                    push 00000004
:0040F1E5 6A00                    push 00000000
:0040F1E7 6A00                    push 00000000
:0040F1E9 B998F94600              mov ecx, 0046F998
:0040F1EE E82D850300              call 00447720
:0040F1F3 8945FC                  mov dword ptr [ebp-04], eax
:0040F1F6 E88CFE0000              call 0041F087
:0040F1FB 894508                  mov dword ptr [ebp+08], eax
:0040F1FE 813D9C2B4500FF000000    cmp dword ptr [00452B9C], 000000FF
:0040F208 0F8534000000            jne 0040F242
:0040F20E 6A72                    push 00000072
:0040F210 E8736C0100              call 00425E88
:0040F215 83C404                  add esp, 00000004
:0040F218 6A04                    push 00000004
:0040F21A 6A00                    push 00000000
:0040F21C 6A00                    push 00000000
:0040F21E B918E54600              mov ecx, 0046E518
:0040F223 E8F8840300              call 00447720
:0040F228 8945FC                  mov dword ptr [ebp-04], eax
:0040F22B 8B45FC                  mov eax, dword ptr [ebp-04]
:0040F22E 50                      push eax
:0040F22F 8B4508                  mov eax, dword ptr [ebp+08]
:0040F232 50                      push eax
:0040F233 B998E34600              mov ecx, 0046E398
:0040F238 E844840100              call 00427681
:0040F23D E932000000              jmp 0040F274

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F208(C)
|
:0040F242 A19C2B4500              mov eax, dword ptr [00452B9C]
:0040F247 394508                  cmp dword ptr [ebp+08], eax
:0040F24A 0F8424000000            je 0040F274
:0040F250 6A72                    push 00000072
:0040F252 E8316C0100              call 00425E88
:0040F257 83C404                  add esp, 00000004
:0040F25A 8B45FC                  mov eax, dword ptr [ebp-04]
:0040F25D 50                      push eax
:0040F25E 8B4508                  mov eax, dword ptr [ebp+08]
:0040F261 50                      push eax
:0040F262 B998E34600              mov ecx, 0046E398
:0040F267 E815840100              call 00427681
:0040F26C 8B4508                  mov eax, dword ptr [ebp+08]
:0040F26F A39C2B4500              mov dword ptr [00452B9C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040F23D(U), :0040F24A(C)
|
:0040F274 E950000000              jmp 0040F2C9

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040F2B4(C), :0040F2C4(U)
|
:0040F279 A1982B4500              mov eax, dword ptr [00452B98]
:0040F27E 394508                  cmp dword ptr [ebp+08], eax
:0040F281 0F8424000000            je 0040F2AB
:0040F287 6A72                    push 00000072
:0040F289 E8FA6B0100              call 00425E88
:0040F28E 83C404                  add esp, 00000004
:0040F291 8B45FC                  mov eax, dword ptr [ebp-04]
:0040F294 50                      push eax
:0040F295 8B4508                  mov eax, dword ptr [ebp+08]
:0040F298 50                      push eax
:0040F299 B998E34600              mov ecx, 0046E398
:0040F29E E8DE830100              call 00427681
:0040F2A3 8B4508                  mov eax, dword ptr [ebp+08]
:0040F2A6 A3982B4500              mov dword ptr [00452B98], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F281(C)
|
:0040F2AB E919000000              jmp 0040F2C9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F1DE(U)
|
:0040F2B0 837DF800                cmp dword ptr [ebp-08], 00000000
:0040F2B4 0F82BFFFFFFF            jb 0040F279
:0040F2BA 837DF801                cmp dword ptr [ebp-08], 00000001
:0040F2BE 0F861FFFFFFF            jbe 0040F1E3
:0040F2C4 E9B0FFFFFF              jmp 0040F279

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040F274(U), :0040F2AB(U)
|
:0040F2C9 E8307A0100              call 00426CFE
:0040F2CE E8C47C0100              call 00426F97
:0040F2D3 6A07                    push 00000007
:0040F2D5 E8FB590300              call 00444CD5
:0040F2DA 83C404                  add esp, 00000004
:0040F2DD 8B45FC                  mov eax, dword ptr [ebp-04]
:0040F2E0 50                      push eax
:0040F2E1 6890010000              push 00000190
:0040F2E6 6880020000              push 00000280
:0040F2EB 6A28                    push 00000028
:0040F2ED 6A00                    push 00000000
:0040F2EF E8AB640300              call 0044579F
:0040F2F4 83C414                  add esp, 00000014
:0040F2F7 6A01                    push 00000001
:0040F2F9 E81E790100              call 00426C1C
:0040F2FE 83C404                  add esp, 00000004
:0040F301 E8111FFFFF              call 00401217
:0040F306 E8AC7C0100              call 00426FB7
:0040F30B E86D7C0100              call 00426F7D
:0040F310 6A00                    push 00000000
:0040F312 E8716B0100              call 00425E88
:0040F317 83C404                  add esp, 00000004
:0040F31A E900000000              jmp 0040F31F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F31A(U)
|
:0040F31F 5F                      pop edi
:0040F320 5E                      pop esi
:0040F321 5B                      pop ebx
:0040F322 C9                      leave
:0040F323 C3                      ret



* Referenced by a CALL at Address:
|:0040F191   
|
:0040F324 55                      push ebp
:0040F325 8BEC                    mov ebp, esp
:0040F327 83EC1C                  sub esp, 0000001C
:0040F32A 53                      push ebx
:0040F32B 56                      push esi
:0040F32C 57                      push edi
:0040F32D B900AA4600              mov ecx, 0046AA00
:0040F332 E8F925FFFF              call 00401930
:0040F337 33C9                    xor ecx, ecx
:0040F339 8AC8                    mov cl, al
:0040F33B 894DF4                  mov dword ptr [ebp-0C], ecx
:0040F33E 68FF000000              push 000000FF
:0040F343 B988534500              mov ecx, 00455388
:0040F348 E8BB2AFFFF              call 00401E08
:0040F34D 68FE000000              push 000000FE
:0040F352 6A02                    push 00000002
:0040F354 6A0A                    push 0000000A
:0040F356 6A00                    push 00000000
:0040F358 6A45                    push 00000045
:0040F35A B988534500              mov ecx, 00455388
:0040F35F E8E12AFFFF              call 00401E45
:0040F364 C745EC00000000          mov [ebp-14], 00000000
:0040F36B E903000000              jmp 0040F373

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F3A4(U)
|
:0040F370 FF45EC                  inc [ebp-14]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F36B(U)
|
:0040F373 837DEC0B                cmp dword ptr [ebp-14], 0000000B
:0040F377 0F832C000000            jnb 0040F3A9
:0040F37D 8B45EC                  mov eax, dword ptr [ebp-14]
:0040F380 83C040                  add eax, 00000040
:0040F383 50                      push eax
:0040F384 6A02                    push 00000002
:0040F386 6A03                    push 00000003
:0040F388 6A00                    push 00000000
:0040F38A 8B45EC                  mov eax, dword ptr [ebp-14]
:0040F38D 8D0440                  lea eax, dword ptr [eax+2*eax]
:0040F390 C1E003                  shl eax, 03
:0040F393 83C008                  add eax, 00000008
:0040F396 C1E803                  shr eax, 03
:0040F399 50                      push eax
:0040F39A B988534500              mov ecx, 00455388
:0040F39F E8A12AFFFF              call 00401E45
:0040F3A4 E9C7FFFFFF              jmp 0040F370

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F377(C)
|
:0040F3A9 837D0800                cmp dword ptr [ebp+08], 00000000
:0040F3AD 0F85A2000000            jne 0040F455
:0040F3B3 C745EC00000000          mov [ebp-14], 00000000
:0040F3BA E903000000              jmp 0040F3C2

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040F3EE(U), :0040F450(U)
|
:0040F3BF FF45EC                  inc [ebp-14]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F3BA(U)
|
:0040F3C2 837DEC0A                cmp dword ptr [ebp-14], 0000000A
:0040F3C6 0F8389000000            jnb 0040F455
:0040F3CC 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040F3CF 8D0480                  lea eax, dword ptr [eax+4*eax]
:0040F3D2 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040F3D5 33D2                    xor edx, edx
:0040F3D7 8A9441402E4500          mov dl, byte ptr [ecx+2*eax+00452E40]
:0040F3DE 8955E8                  mov dword ptr [ebp-18], edx
:0040F3E1 817DE8FF000000          cmp dword ptr [ebp-18], 000000FF
:0040F3E8 0F8505000000            jne 0040F3F3
:0040F3EE E9CCFFFFFF              jmp 0040F3BF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F3E8(C)
|
:0040F3F3 B914000000              mov ecx, 00000014
:0040F3F8 8B45E8                  mov eax, dword ptr [ebp-18]
:0040F3FB 2BD2                    sub edx, edx
:0040F3FD F7F1                    div ecx
:0040F3FF 8BC2                    mov eax, edx
:0040F401 C1E005                  shl eax, 05
:0040F404 8945FC                  mov dword ptr [ebp-04], eax
:0040F407 B914000000              mov ecx, 00000014
:0040F40C 8B45E8                  mov eax, dword ptr [ebp-18]
:0040F40F 2BD2                    sub edx, edx
:0040F411 F7F1                    div ecx
:0040F413 C1E005                  shl eax, 05
:0040F416 83C030                  add eax, 00000030
:0040F419 8945F8                  mov dword ptr [ebp-08], eax
:0040F41C 8B45EC                  mov eax, dword ptr [ebp-14]
:0040F41F 50                      push eax
:0040F420 6A02                    push 00000002
:0040F422 6A08                    push 00000008
:0040F424 8B45F8                  mov eax, dword ptr [ebp-08]
:0040F427 C1E804                  shr eax, 04
:0040F42A 50                      push eax
:0040F42B 8B45FC                  mov eax, dword ptr [ebp-04]
:0040F42E C1E803                  shr eax, 03
:0040F431 50                      push eax
:0040F432 B988534500              mov ecx, 00455388
:0040F437 E8092AFFFF              call 00401E45
:0040F43C 8B45EC                  mov eax, dword ptr [ebp-14]
:0040F43F 50                      push eax
:0040F440 8B45F8                  mov eax, dword ptr [ebp-08]
:0040F443 50                      push eax
:0040F444 8B45FC                  mov eax, dword ptr [ebp-04]
:0040F447 50                      push eax
:0040F448 E808010000              call 0040F555
:0040F44D 83C40C                  add esp, 0000000C
:0040F450 E96AFFFFFF              jmp 0040F3BF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040F3AD(C), :0040F3C6(C)
|
:0040F455 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0040F458 E81324FFFF              call 00401870
:0040F45D 837D0801                cmp dword ptr [ebp+08], 00000001
:0040F461 0F85E4000000            jne 0040F54B
:0040F467 6A01                    push 00000001
:0040F469 B910BC4600              mov ecx, 0046BC10
:0040F46E E8ED090100              call 0041FE60
:0040F473 6A04                    push 00000004
:0040F475 B910BC4600              mov ecx, 0046BC10
:0040F47A E8020A0100              call 0041FE81
:0040F47F 6A00                    push 00000000
:0040F481 B910BC4600              mov ecx, 0046BC10
:0040F486 E8A7090100              call 0041FE32
:0040F48B C745E400A74600          mov [ebp-1C], 0046A700
:0040F492 C745EC00000000          mov [ebp-14], 00000000
:0040F499 E907000000              jmp 0040F4A5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040F4D0(U), :0040F528(U)
|
:0040F49E FF45EC                  inc [ebp-14]
:0040F4A1 8345E40C                add dword ptr [ebp-1C], 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F499(U)
|
:0040F4A5 837DEC40                cmp dword ptr [ebp-14], 00000040
:0040F4A9 0F837E000000            jnb 0040F52D
:0040F4AF 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0040F4B2 E81924FFFF              call 004018D0
:0040F4B7 50                      push eax
:0040F4B8 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0040F4BB E8D023FFFF              call 00401890
:0040F4C0 33C0                    xor eax, eax
:0040F4C2 8A45F0                  mov al, byte ptr [ebp-10]
:0040F4C5 3DFF000000              cmp eax, 000000FF
:0040F4CA 0F8505000000            jne 0040F4D5
:0040F4D0 E9C9FFFFFF              jmp 0040F49E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F4CA(C)
|
:0040F4D5 33C0                    xor eax, eax
:0040F4D7 8A45F0                  mov al, byte ptr [ebp-10]
:0040F4DA C1E003                  shl eax, 03
:0040F4DD 8945FC                  mov dword ptr [ebp-04], eax
:0040F4E0 33C0                    xor eax, eax
:0040F4E2 8A45F1                  mov al, byte ptr [ebp-0F]
:0040F4E5 C1E003                  shl eax, 03
:0040F4E8 83C028                  add eax, 00000028
:0040F4EB 8945F8                  mov dword ptr [ebp-08], eax
:0040F4EE 8B45EC                  mov eax, dword ptr [ebp-14]
:0040F4F1 50                      push eax
:0040F4F2 6A02                    push 00000002
:0040F4F4 6A05                    push 00000005
:0040F4F6 8B45F8                  mov eax, dword ptr [ebp-08]
:0040F4F9 83E810                  sub eax, 00000010
:0040F4FC C1E804                  shr eax, 04
:0040F4FF 50                      push eax
:0040F500 8B45FC                  mov eax, dword ptr [ebp-04]
:0040F503 83E820                  sub eax, 00000020
:0040F506 C1E803                  shr eax, 03
:0040F509 50                      push eax
:0040F50A B988534500              mov ecx, 00455388
:0040F50F E83129FFFF              call 00401E45
:0040F514 8B45EC                  mov eax, dword ptr [ebp-14]
:0040F517 50                      push eax
:0040F518 8B45F8                  mov eax, dword ptr [ebp-08]
:0040F51B 50                      push eax
:0040F51C 8B45FC                  mov eax, dword ptr [ebp-04]
:0040F51F 50                      push eax
:0040F520 E876000000              call 0040F59B
:0040F525 83C40C                  add esp, 0000000C
:0040F528 E971FFFFFF              jmp 0040F49E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F4A9(C)
|

* Possible StringData Ref from Data Obj ->"M0"
                                  |
:0040F52D 6804EF4400              push 0044EF04
:0040F532 6810BC4600              push 0046BC10
:0040F537 E84B150100              call 00420A87
:0040F53C 83C408                  add esp, 00000008
:0040F53F 6A00                    push 00000000
:0040F541 B910BC4600              mov ecx, 0046BC10
:0040F546 E815090100              call 0041FE60

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F461(C)
|
:0040F54B E900000000              jmp 0040F550

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F54B(U)
|
:0040F550 5F                      pop edi
:0040F551 5E                      pop esi
:0040F552 5B                      pop ebx
:0040F553 C9                      leave
:0040F554 C3                      ret



* Referenced by a CALL at Address:
|:0040F448   
|
:0040F555 55                      push ebp
:0040F556 8BEC                    mov ebp, esp
:0040F558 53                      push ebx
:0040F559 56                      push esi
:0040F55A 57                      push edi
:0040F55B 8B450C                  mov eax, dword ptr [ebp+0C]
:0040F55E 83C008                  add eax, 00000008
:0040F561 50                      push eax
:0040F562 8B4508                  mov eax, dword ptr [ebp+08]
:0040F565 C1E803                  shr eax, 03
:0040F568 40                      inc eax
:0040F569 50                      push eax
:0040F56A B910BC4600              mov ecx, 0046BC10
:0040F56F E893060100              call 0041FC07
:0040F574 8B4510                  mov eax, dword ptr [ebp+10]
:0040F577 8B0485182E4500          mov eax, dword ptr [4*eax+00452E18]
:0040F57E 50                      push eax

* Possible StringData Ref from Data Obj ->"M4C7%s"
                                  |
:0040F57F 6808EF4400              push 0044EF08
:0040F584 6810BC4600              push 0046BC10
:0040F589 E895150100              call 00420B23
:0040F58E 83C40C                  add esp, 0000000C
:0040F591 E900000000              jmp 0040F596

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F591(U)
|
:0040F596 5F                      pop edi
:0040F597 5E                      pop esi
:0040F598 5B                      pop ebx
:0040F599 C9                      leave
:0040F59A C3                      ret



* Referenced by a CALL at Address:
|:0040F520   
|
:0040F59B 55                      push ebp
:0040F59C 8BEC                    mov ebp, esp
:0040F59E 83EC04                  sub esp, 00000004
:0040F5A1 53                      push ebx
:0040F5A2 56                      push esi
:0040F5A3 57                      push edi
:0040F5A4 6A00                    push 00000000
:0040F5A6 8B4510                  mov eax, dword ptr [ebp+10]
:0040F5A9 50                      push eax
:0040F5AA E87620FFFF              call 00401625
:0040F5AF 83C408                  add esp, 00000008
:0040F5B2 85C0                    test eax, eax
:0040F5B4 0F846D000000            je 0040F627
:0040F5BA 8B4510                  mov eax, dword ptr [ebp+10]
:0040F5BD 50                      push eax
:0040F5BE E8C3F80000              call 0041EE86
:0040F5C3 83C404                  add esp, 00000004
:0040F5C6 8945FC                  mov dword ptr [ebp-04], eax
:0040F5C9 B9D0A64600              mov ecx, 0046A6D0
:0040F5CE E81D23FFFF              call 004018F0
:0040F5D3 33C9                    xor ecx, ecx
:0040F5D5 8AC8                    mov cl, al
:0040F5D7 2B4D10                  sub ecx, dword ptr [ebp+10]
:0040F5DA 83F901                  cmp ecx, 00000001
:0040F5DD 1BC0                    sbb eax, eax
:0040F5DF 83E0FB                  and eax, FFFFFFFB
:0040F5E2 83C007                  add eax, 00000007
:0040F5E5 50                      push eax
:0040F5E6 B910BC4600              mov ecx, 0046BC10
:0040F5EB E8E3060100              call 0041FCD3
:0040F5F0 8B450C                  mov eax, dword ptr [ebp+0C]
:0040F5F3 83E810                  sub eax, 00000010
:0040F5F6 50                      push eax
:0040F5F7 8B5D08                  mov ebx, dword ptr [ebp+08]
:0040F5FA C1EB03                  shr ebx, 03
:0040F5FD 8B45FC                  mov eax, dword ptr [ebp-04]
:0040F600 50                      push eax
:0040F601 E8A47D0300              call 004473AA
:0040F606 83C404                  add esp, 00000004
:0040F609 2BD8                    sub ebx, eax
:0040F60B 53                      push ebx
:0040F60C B910BC4600              mov ecx, 0046BC10
:0040F611 E8F1050100              call 0041FC07
:0040F616 8B45FC                  mov eax, dword ptr [ebp-04]
:0040F619 50                      push eax
:0040F61A 6810BC4600              push 0046BC10
:0040F61F E863140100              call 00420A87
:0040F624 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F5B4(C)
|
:0040F627 E900000000              jmp 0040F62C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F627(U)
|
:0040F62C 5F                      pop edi
:0040F62D 5E                      pop esi
:0040F62E 5B                      pop ebx
:0040F62F C9                      leave
:0040F630 C3                      ret



* Referenced by a CALL at Address:
|:0040F0C0   
|
:0040F631 55                      push ebp
:0040F632 8BEC                    mov ebp, esp
:0040F634 53                      push ebx
:0040F635 56                      push esi
:0040F636 57                      push edi
:0040F637 C605F8D44500FF          mov byte ptr [0045D4F8], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040F675(U), :0040F740(U)
|
:0040F63E E86D800200              call 004376B0
:0040F643 83F801                  cmp eax, 00000001
:0040F646 0F85B7000000            jne 0040F703
:0040F64C E852020000              call 0040F8A3
:0040F651 85C0                    test eax, eax
:0040F653 0F84A5000000            je 0040F6FE
:0040F659 33C0                    xor eax, eax
:0040F65B A07C534500              mov al, byte ptr [0045537C]
:0040F660 3DFE000000              cmp eax, 000000FE
:0040F665 0F8514000000            jne 0040F67F
:0040F66B C70500EF440001000000    mov dword ptr [0044EF00], 00000001
:0040F675 E9C4FFFFFF              jmp 0040F63E
:0040F67A E97F000000              jmp 0040F6FE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F665(C)
|
:0040F67F 33C0                    xor eax, eax
:0040F681 A07C534500              mov al, byte ptr [0045537C]
:0040F686 83F840                  cmp eax, 00000040
:0040F689 0F8C18000000            jl 0040F6A7
:0040F68F 33C0                    xor eax, eax
:0040F691 A07C534500              mov al, byte ptr [0045537C]
:0040F696 8B0485A82C4500          mov eax, dword ptr [4*eax+00452CA8]
:0040F69D A364F94600              mov dword ptr [0046F964], eax
:0040F6A2 E957000000              jmp 0040F6FE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F689(C)
|
:0040F6A7 6A00                    push 00000000
:0040F6A9 33C0                    xor eax, eax
:0040F6AB A07C534500              mov al, byte ptr [0045537C]
:0040F6B0 50                      push eax
:0040F6B1 E86F1FFFFF              call 00401625
:0040F6B6 83C408                  add esp, 00000008
:0040F6B9 85C0                    test eax, eax
:0040F6BB 0F8410000000            je 0040F6D1
:0040F6C1 33C0                    xor eax, eax
:0040F6C3 A07C534500              mov al, byte ptr [0045537C]
:0040F6C8 83F81A                  cmp eax, 0000001A
:0040F6CB 0F8C11000000            jl 0040F6E2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F6BB(C)
|
:0040F6D1 6A0A                    push 0000000A
:0040F6D3 B994A64600              mov ecx, 0046A694
:0040F6D8 E847990000              call 00419024
:0040F6DD E91C000000              jmp 0040F6FE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F6CB(C)
|
:0040F6E2 6A00                    push 00000000
:0040F6E4 B994A64600              mov ecx, 0046A694
:0040F6E9 E836990000              call 00419024
:0040F6EE 33C0                    xor eax, eax
:0040F6F0 A07C534500              mov al, byte ptr [0045537C]
:0040F6F5 50                      push eax
:0040F6F6 E84F000000              call 0040F74A
:0040F6FB 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040F653(C), :0040F67A(U), :0040F6A2(U), :0040F6DD(U)
|
:0040F6FE E848F9FFFF              call 0040F04B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F646(C)
|
:0040F703 F605785345006E          test byte ptr [00455378], 6E
:0040F70A 0F840A000000            je 0040F71A
:0040F710 A178534500              mov eax, dword ptr [00455378]
:0040F715 E92B000000              jmp 0040F745

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F70A(C)
|
:0040F71A 68FF000000              push 000000FF
:0040F71F 6A00                    push 00000000
:0040F721 E8621BFFFF              call 00401288
:0040F726 83C408                  add esp, 00000008
:0040F729 F605785345006E          test byte ptr [00455378], 6E
:0040F730 0F840A000000            je 0040F740
:0040F736 A178534500              mov eax, dword ptr [00455378]
:0040F73B E905000000              jmp 0040F745

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F730(C)
|
:0040F740 E9F9FEFFFF              jmp 0040F63E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040F715(U), :0040F73B(U)
|
:0040F745 5F                      pop edi
:0040F746 5E                      pop esi
:0040F747 5B                      pop ebx
:0040F748 C9                      leave
:0040F749 C3                      ret



* Referenced by a CALL at Address:
|:0040F6F6   
|
:0040F74A 55                      push ebp
:0040F74B 8BEC                    mov ebp, esp
:0040F74D 83EC0C                  sub esp, 0000000C
:0040F750 53                      push ebx
:0040F751 56                      push esi
:0040F752 57                      push edi
:0040F753 6A00                    push 00000000
:0040F755 E82E670100              call 00425E88
:0040F75A 83C404                  add esp, 00000004
:0040F75D C745FC00AA4600          mov [ebp-04], 0046AA00
:0040F764 8B4508                  mov eax, dword ptr [ebp+08]
:0040F767 50                      push eax
:0040F768 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040F76B E84022FFFF              call 004019B0
:0040F770 B9D0A64600              mov ecx, 0046A6D0
:0040F775 E87621FFFF              call 004018F0
:0040F77A 33C9                    xor ecx, ecx
:0040F77C 8AC8                    mov cl, al
:0040F77E 894DF8                  mov dword ptr [ebp-08], ecx
:0040F781 E8911AFFFF              call 00401217
:0040F786 68FF000000              push 000000FF
:0040F78B 6A02                    push 00000002
:0040F78D E8F61AFFFF              call 00401288
:0040F792 83C408                  add esp, 00000008
:0040F795 85C0                    test eax, eax
:0040F797 0F8505000000            jne 0040F7A2
:0040F79D E9FC000000              jmp 0040F89E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F797(C)
|
:0040F7A2 F605785345006E          test byte ptr [00455378], 6E
:0040F7A9 0F8405000000            je 0040F7B4
:0040F7AF E9EA000000              jmp 0040F89E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F7A9(C)
|
:0040F7B4 E8F77E0200              call 004376B0
:0040F7B9 85C0                    test eax, eax
:0040F7BB 0F84D8000000            je 0040F899
:0040F7C1 8B4508                  mov eax, dword ptr [ebp+08]
:0040F7C4 50                      push eax
:0040F7C5 E8BCF60000              call 0041EE86
:0040F7CA 83C404                  add esp, 00000004
:0040F7CD 50                      push eax

* Possible StringData Ref from Data Obj ->"%s𣿡"
                                  |
:0040F7CE 6814EF4400              push 0044EF14
:0040F7D3 6A02                    push 00000002
:0040F7D5 E85B970200              call 00438F35
:0040F7DA 83C40C                  add esp, 0000000C
:0040F7DD 85C0                    test eax, eax
:0040F7DF 0F84B4000000            je 0040F899
:0040F7E5 8B4508                  mov eax, dword ptr [ebp+08]
:0040F7E8 50                      push eax
:0040F7E9 B9D0A64600              mov ecx, 0046A6D0
:0040F7EE E8DD23FFFF              call 00401BD0
:0040F7F3 830D7853450002          or dword ptr [00455378], 00000002
:0040F7FA 8B4508                  mov eax, dword ptr [ebp+08]
:0040F7FD 50                      push eax
:0040F7FE E84FF60000              call 0041EE52
:0040F803 83C404                  add esp, 00000004
:0040F806 8BC8                    mov ecx, eax
:0040F808 E8E3050000              call 0040FDF0
:0040F80D 50                      push eax
:0040F80E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040F811 E8CA21FFFF              call 004019E0
:0040F816 6A00                    push 00000000
:0040F818 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040F81B E80020FFFF              call 00401820
:0040F820 6A00                    push 00000000
:0040F822 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040F825 E82621FFFF              call 00401950
:0040F82A 6A01                    push 00000001
:0040F82C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040F82F E8DC21FFFF              call 00401A10
:0040F834 6A0D                    push 0000000D
:0040F836 6A0B                    push 0000000B
:0040F838 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040F83B E84021FFFF              call 00401980
:0040F840 68FF000000              push 000000FF
:0040F845 6A02                    push 00000002
:0040F847 E83C1AFFFF              call 00401288
:0040F84C 83C408                  add esp, 00000008
:0040F84F 8945F4                  mov dword ptr [ebp-0C], eax
:0040F852 837DF404                cmp dword ptr [ebp-0C], 00000004
:0040F856 0F840D000000            je 0040F869
:0040F85C 817DF4FFFF0000          cmp dword ptr [ebp-0C], 0000FFFF
:0040F863 0F850A000000            jne 0040F873

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F856(C)
|
:0040F869 E930000000              jmp 0040F89E
:0040F86E E926000000              jmp 0040F899

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040F863(C), :0040F894(U)
|
:0040F873 68FF000000              push 000000FF
:0040F878 6A00                    push 00000000
:0040F87A E827F3FFFF              call 0040EBA6
:0040F87F 83C408                  add esp, 00000008
:0040F882 F605785345006E          test byte ptr [00455378], 6E
:0040F889 0F8405000000            je 0040F894
:0040F88F E90A000000              jmp 0040F89E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F889(C)
|
:0040F894 E9DAFFFFFF              jmp 0040F873

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040F7BB(C), :0040F7DF(C), :0040F86E(U)
|
:0040F899 E900000000              jmp 0040F89E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040F79D(U), :0040F7AF(U), :0040F869(U), :0040F88F(U), :0040F899(U)
|
:0040F89E 5F                      pop edi
:0040F89F 5E                      pop esi
:0040F8A0 5B                      pop ebx
:0040F8A1 C9                      leave
:0040F8A2 C3                      ret



* Referenced by a CALL at Addresses:
|:0040F64C   , :0040FACE   
|
:0040F8A3 55                      push ebp
:0040F8A4 8BEC                    mov ebp, esp
:0040F8A6 53                      push ebx
:0040F8A7 56                      push esi
:0040F8A8 57                      push edi
:0040F8A9 B988534500              mov ecx, 00455388
:0040F8AE E83F24FFFF              call 00401CF2
:0040F8B3 B988534500              mov ecx, 00455388
:0040F8B8 E81926FFFF              call 00401ED6
:0040F8BD A27C534500              mov byte ptr [0045537C], al
:0040F8C2 33C0                    xor eax, eax
:0040F8C4 A0F8D44500              mov al, byte ptr [0045D4F8]
:0040F8C9 33C9                    xor ecx, ecx
:0040F8CB 8A0D7C534500            mov cl, byte ptr [0045537C]
:0040F8D1 3BC1                    cmp eax, ecx
:0040F8D3 0F8435000000            je 0040F90E
:0040F8D9 33C0                    xor eax, eax
:0040F8DB A07C534500              mov al, byte ptr [0045537C]
:0040F8E0 2DFF000000              sub eax, 000000FF
:0040F8E5 83F801                  cmp eax, 00000001
:0040F8E8 1BC0                    sbb eax, eax
:0040F8EA 40                      inc eax
:0040F8EB 50                      push eax
:0040F8EC E897650100              call 00425E88
:0040F8F1 83C404                  add esp, 00000004
:0040F8F4 33C0                    xor eax, eax
:0040F8F6 A07C534500              mov al, byte ptr [0045537C]
:0040F8FB 50                      push eax
:0040F8FC E86C000000              call 0040F96D
:0040F901 83C404                  add esp, 00000004
:0040F904 A07C534500              mov al, byte ptr [0045537C]
:0040F909 A2F8D44500              mov byte ptr [0045D4F8], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F8D3(C)
|
:0040F90E B988534500              mov ecx, 00455388
:0040F913 E8A424FFFF              call 00401DBC
:0040F918 A380534500              mov dword ptr [00455380], eax
:0040F91D A180534500              mov eax, dword ptr [00455380]
:0040F922 390568524500            cmp dword ptr [00455268], eax
:0040F928 0F8433000000            je 0040F961
:0040F92E A180534500              mov eax, dword ptr [00455380]
:0040F933 A368524500              mov dword ptr [00455268], eax
:0040F938 833D8053450001          cmp dword ptr [00455380], 00000001
:0040F93F 0F851C000000            jne 0040F961
:0040F945 33C0                    xor eax, eax
:0040F947 A07C534500              mov al, byte ptr [0045537C]
:0040F94C 3DFF000000              cmp eax, 000000FF
:0040F951 0F840A000000            je 0040F961
:0040F957 B801000000              mov eax, 00000001
:0040F95C E907000000              jmp 0040F968

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040F928(C), :0040F93F(C), :0040F951(C)
|
:0040F961 33C0                    xor eax, eax
:0040F963 E900000000              jmp 0040F968

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040F95C(U), :0040F963(U)
|
:0040F968 5F                      pop edi
:0040F969 5E                      pop esi
:0040F96A 5B                      pop ebx
:0040F96B C9                      leave
:0040F96C C3                      ret



* Referenced by a CALL at Address:
|:0040F8FC   
|
:0040F96D 55                      push ebp
:0040F96E 8BEC                    mov ebp, esp
:0040F970 83EC04                  sub esp, 00000004
:0040F973 53                      push ebx
:0040F974 56                      push esi
:0040F975 57                      push edi
:0040F976 E8D41DFFFF              call 0040174F
:0040F97B 6A07                    push 00000007
:0040F97D B910BC4600              mov ecx, 0046BC10
:0040F982 E84C030100              call 0041FCD3
:0040F987 817D08FF000000          cmp dword ptr [ebp+08], 000000FF
:0040F98E 0F850C000000            jne 0040F9A0
:0040F994 C745FC24EF4400          mov [ebp-04], 0044EF24
:0040F99B E994000000              jmp 0040FA34

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F98E(C)
|
:0040F9A0 817D08FE000000          cmp dword ptr [ebp+08], 000000FE
:0040F9A7 0F850C000000            jne 0040F9B9
:0040F9AD C745FC28EF4400          mov [ebp-04], 0044EF28
:0040F9B4 E97B000000              jmp 0040FA34

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F9A7(C)
|
:0040F9B9 837D0840                cmp dword ptr [ebp+08], 00000040
:0040F9BD 0F8212000000            jb 0040F9D5
:0040F9C3 8B4508                  mov eax, dword ptr [ebp+08]
:0040F9C6 8B0485E02C4500          mov eax, dword ptr [4*eax+00452CE0]
:0040F9CD 8945FC                  mov dword ptr [ebp-04], eax
:0040F9D0 E95F000000              jmp 0040FA34

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F9BD(C)
|
:0040F9D5 E84416FFFF              call 0040101E
:0040F9DA 33C9                    xor ecx, ecx
:0040F9DC 8AC8                    mov cl, al
:0040F9DE 83F901                  cmp ecx, 00000001
:0040F9E1 0F852A000000            jne 0040FA11
:0040F9E7 837D0840                cmp dword ptr [ebp+08], 00000040
:0040F9EB 0F820C000000            jb 0040F9FD
:0040F9F1 C745FC2CEF4400          mov [ebp-04], 0044EF2C
:0040F9F8 E90F000000              jmp 0040FA0C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F9EB(C)
|
:0040F9FD 8B4508                  mov eax, dword ptr [ebp+08]
:0040FA00 50                      push eax
:0040FA01 E880F40000              call 0041EE86
:0040FA06 83C404                  add esp, 00000004
:0040FA09 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F9F8(U)
|
:0040FA0C E923000000              jmp 0040FA34

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F9E1(C)
|
:0040FA11 837D080A                cmp dword ptr [ebp+08], 0000000A
:0040FA15 0F820C000000            jb 0040FA27
:0040FA1B C745FC30EF4400          mov [ebp-04], 0044EF30
:0040FA22 E90D000000              jmp 0040FA34

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FA15(C)
|
:0040FA27 8B4508                  mov eax, dword ptr [ebp+08]
:0040FA2A 8B0485182E4500          mov eax, dword ptr [4*eax+00452E18]
:0040FA31 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040F99B(U), :0040F9B4(U), :0040F9D0(U), :0040FA0C(U), :0040FA22(U)
|
:0040FA34 6A0C                    push 0000000C
:0040FA36 BB08000000              mov ebx, 00000008
:0040FA3B 8B45FC                  mov eax, dword ptr [ebp-04]
:0040FA3E 50                      push eax
:0040FA3F E866790300              call 004473AA
:0040FA44 83C404                  add esp, 00000004
:0040FA47 2BD8                    sub ebx, eax
:0040FA49 C1EB01                  shr ebx, 01
:0040FA4C 83C346                  add ebx, 00000046
:0040FA4F 53                      push ebx
:0040FA50 B910BC4600              mov ecx, 0046BC10
:0040FA55 E8AD010100              call 0041FC07
:0040FA5A 8B45FC                  mov eax, dword ptr [ebp-04]
:0040FA5D 50                      push eax

* Possible StringData Ref from Data Obj ->"M4C7%s"
                                  |
:0040FA5E 6834EF4400              push 0044EF34
:0040FA63 6810BC4600              push 0046BC10
:0040FA68 E8B6100100              call 00420B23
:0040FA6D 83C40C                  add esp, 0000000C
:0040FA70 E900000000              jmp 0040FA75

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FA70(U)
|
:0040FA75 5F                      pop edi
:0040FA76 5E                      pop esi
:0040FA77 5B                      pop ebx
:0040FA78 C9                      leave
:0040FA79 C3                      ret



* Referenced by a CALL at Address:
|:00425660   
|
:0040FA7A 55                      push ebp
:0040FA7B 8BEC                    mov ebp, esp
:0040FA7D 53                      push ebx
:0040FA7E 56                      push esi
:0040FA7F 57                      push edi
:0040FA80 6A00                    push 00000000
:0040FA82 E857F6FFFF              call 0040F0DE
:0040FA87 83C404                  add esp, 00000004
:0040FA8A F605785345006E          test byte ptr [00455378], 6E
:0040FA91 0F840A000000            je 0040FAA1
:0040FA97 A178534500              mov eax, dword ptr [00455378]
:0040FA9C E90A000000              jmp 0040FAAB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FA91(C)
|
:0040FAA1 E80A000000              call 0040FAB0
:0040FAA6 E900000000              jmp 0040FAAB

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040FA9C(U), :0040FAA6(U)
|
:0040FAAB 5F                      pop edi
:0040FAAC 5E                      pop esi
:0040FAAD 5B                      pop ebx
:0040FAAE C9                      leave
:0040FAAF C3                      ret



* Referenced by a CALL at Address:
|:0040FAA1   
|
:0040FAB0 55                      push ebp
:0040FAB1 8BEC                    mov ebp, esp
:0040FAB3 83EC04                  sub esp, 00000004
:0040FAB6 53                      push ebx
:0040FAB7 56                      push esi
:0040FAB8 57                      push edi
:0040FAB9 C605F8D44500FF          mov byte ptr [0045D4F8], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FBE9(U)
|
:0040FAC0 E8EB7B0200              call 004376B0
:0040FAC5 83F801                  cmp eax, 00000001
:0040FAC8 0F85DE000000            jne 0040FBAC
:0040FACE E8D0FDFFFF              call 0040F8A3
:0040FAD3 85C0                    test eax, eax
:0040FAD5 0F84CC000000            je 0040FBA7
:0040FADB 6A00                    push 00000000
:0040FADD B994A64600              mov ecx, 0046A694
:0040FAE2 E83D950000              call 00419024
:0040FAE7 33C0                    xor eax, eax
:0040FAE9 A07C534500              mov al, byte ptr [0045537C]
:0040FAEE 3DFE000000              cmp eax, 000000FE
:0040FAF3 0F854F000000            jne 0040FB48
:0040FAF9 833D00EF440001          cmp dword ptr [0044EF00], 00000001
:0040FB00 0F853D000000            jne 0040FB43

* Possible StringData Ref from Data Obj ->"ͻȻﴢ"
                                  |
:0040FB06 6840EF4400              push 0044EF40
:0040FB0B 6A02                    push 00000002
:0040FB0D E823940200              call 00438F35
:0040FB12 83C408                  add esp, 00000008
:0040FB15 85C0                    test eax, eax
:0040FB17 0F840A000000            je 0040FB27
:0040FB1D E815A4FFFF              call 00409F37
:0040FB22 E91C000000              jmp 0040FB43

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FB17(C)
|

* Possible StringData Ref from Data Obj ->"ôȡ"
                                  |
:0040FB27 6860EF4400              push 0044EF60
:0040FB2C 6A02                    push 00000002
:0040FB2E E802940200              call 00438F35
:0040FB33 83C408                  add esp, 00000008
:0040FB36 85C0                    test eax, eax
:0040FB38 0F8405000000            je 0040FB43
:0040FB3E E878A6FFFF              call 0040A1BB

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040FB00(C), :0040FB22(U), :0040FB38(C)
|
:0040FB43 E95F000000              jmp 0040FBA7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FAF3(C)
|
:0040FB48 33C0                    xor eax, eax
:0040FB4A A07C534500              mov al, byte ptr [0045537C]
:0040FB4F 83F840                  cmp eax, 00000040
:0040FB52 0F8C18000000            jl 0040FB70
:0040FB58 33C0                    xor eax, eax
:0040FB5A A07C534500              mov al, byte ptr [0045537C]
:0040FB5F 8B0485A82C4500          mov eax, dword ptr [4*eax+00452CA8]
:0040FB66 A364F94600              mov dword ptr [0046F964], eax
:0040FB6B E937000000              jmp 0040FBA7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FB52(C)
|
:0040FB70 33C0                    xor eax, eax
:0040FB72 A07C534500              mov al, byte ptr [0045537C]
:0040FB77 83F809                  cmp eax, 00000009
:0040FB7A 0F850C000000            jne 0040FB8C
:0040FB80 C745FC01000000          mov [ebp-04], 00000001
:0040FB87 E907000000              jmp 0040FB93

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FB7A(C)
|
:0040FB8C C745FC02000000          mov [ebp-04], 00000002

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FB87(U)
|
:0040FB93 33C0                    xor eax, eax
:0040FB95 A07C534500              mov al, byte ptr [0045537C]
:0040FB9A 50                      push eax
:0040FB9B 8B45FC                  mov eax, dword ptr [ebp-04]
:0040FB9E 50                      push eax
:0040FB9F E859000000              call 0040FBFD
:0040FBA4 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040FAD5(C), :0040FB43(U), :0040FB6B(U)
|
:0040FBA7 E89FF4FFFF              call 0040F04B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FAC8(C)
|
:0040FBAC F605785345006E          test byte ptr [00455378], 6E
:0040FBB3 0F840A000000            je 0040FBC3
:0040FBB9 A178534500              mov eax, dword ptr [00455378]
:0040FBBE E935000000              jmp 0040FBF8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FBB3(C)
|
:0040FBC3 68FF000000              push 000000FF
:0040FBC8 6A00                    push 00000000
:0040FBCA E8D7EFFFFF              call 0040EBA6
:0040FBCF 83C408                  add esp, 00000008
:0040FBD2 F605785345006E          test byte ptr [00455378], 6E
:0040FBD9 0F840A000000            je 0040FBE9
:0040FBDF A178534500              mov eax, dword ptr [00455378]
:0040FBE4 E90F000000              jmp 0040FBF8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FBD9(C)
|
:0040FBE9 E9D2FEFFFF              jmp 0040FAC0
:0040FBEE A178534500              mov eax, dword ptr [00455378]
:0040FBF3 E900000000              jmp 0040FBF8

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040FBBE(U), :0040FBE4(U), :0040FBF3(U)
|
:0040FBF8 5F                      pop edi
:0040FBF9 5E                      pop esi
:0040FBFA 5B                      pop ebx
:0040FBFB C9                      leave
:0040FBFC C3                      ret



* Referenced by a CALL at Address:
|:0040FB9F   
|
:0040FBFD 55                      push ebp
:0040FBFE 8BEC                    mov ebp, esp
:0040FC00 83EC10                  sub esp, 00000010
:0040FC03 53                      push ebx
:0040FC04 56                      push esi
:0040FC05 57                      push edi
:0040FC06 C745FC00AA4600          mov [ebp-04], 0046AA00
:0040FC0D C745F800000000          mov [ebp-08], 00000000
:0040FC14 8B4508                  mov eax, dword ptr [ebp+08]
:0040FC17 8945F0                  mov dword ptr [ebp-10], eax
:0040FC1A E932010000              jmp 0040FD51

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FD55(C)
|
:0040FC1F 830D7853450002          or dword ptr [00455378], 00000002
:0040FC26 6A00                    push 00000000
:0040FC28 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040FC2B E8B01EFFFF              call 00401AE0
:0040FC30 6A01                    push 00000001
:0040FC32 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040FC35 E8161DFFFF              call 00401950
:0040FC3A 6A01                    push 00000001
:0040FC3C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040FC3F E8CC1DFFFF              call 00401A10
:0040FC44 8B4508                  mov eax, dword ptr [ebp+08]
:0040FC47 50                      push eax
:0040FC48 E8B313FFFF              call 00401000
:0040FC4D 83C404                  add esp, 00000004
:0040FC50 B9D0A64600              mov ecx, 0046A6D0
:0040FC55 E8961CFFFF              call 004018F0
:0040FC5A 50                      push eax
:0040FC5B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040FC5E E84D1DFFFF              call 004019B0
:0040FC63 68FF000000              push 000000FF
:0040FC68 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040FC6B E8701DFFFF              call 004019E0
:0040FC70 E9F5000000              jmp 0040FD6A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FD5F(C)
|
:0040FC75 E8D6EEFFFF              call 0040EB50
:0040FC7A 6A00                    push 00000000
:0040FC7C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040FC7F E88C1DFFFF              call 00401A10
:0040FC84 6A00                    push 00000000
:0040FC86 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040FC89 E8C21CFFFF              call 00401950
:0040FC8E 8B450C                  mov eax, dword ptr [ebp+0C]
:0040FC91 50                      push eax
:0040FC92 6A02                    push 00000002
:0040FC94 E80DEFFFFF              call 0040EBA6
:0040FC99 83C408                  add esp, 00000008
:0040FC9C 8945F4                  mov dword ptr [ebp-0C], eax
:0040FC9F 837DF404                cmp dword ptr [ebp-0C], 00000004
:0040FCA3 0F840D000000            je 0040FCB6
:0040FCA9 817DF4FFFF0000          cmp dword ptr [ebp-0C], 0000FFFF
:0040FCB0 0F8570000000            jne 0040FD26

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FCA3(C)
|
:0040FCB6 6A00                    push 00000000
:0040FCB8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040FCBB E8201EFFFF              call 00401AE0
:0040FCC0 6A00                    push 00000000
:0040FCC2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040FCC5 E8861CFFFF              call 00401950
:0040FCCA 6A01                    push 00000001
:0040FCCC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040FCCF E83C1DFFFF              call 00401A10
:0040FCD4 8B4508                  mov eax, dword ptr [ebp+08]
:0040FCD7 50                      push eax
:0040FCD8 E82313FFFF              call 00401000
:0040FCDD 83C404                  add esp, 00000004
:0040FCE0 B9D0A64600              mov ecx, 0046A6D0
:0040FCE5 E8061CFFFF              call 004018F0
:0040FCEA 50                      push eax
:0040FCEB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040FCEE E8BD1CFFFF              call 004019B0
:0040FCF3 6A0F                    push 0000000F
:0040FCF5 6A08                    push 00000008
:0040FCF7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040FCFA E8811CFFFF              call 00401980
:0040FCFF 6A01                    push 00000001
:0040FD01 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040FD04 E8471CFFFF              call 00401950
:0040FD09 8B450C                  mov eax, dword ptr [ebp+0C]
:0040FD0C 50                      push eax
:0040FD0D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040FD10 E8CB1CFFFF              call 004019E0
:0040FD15 830D7853450002          or dword ptr [00455378], 00000002
:0040FD1C E94E000000              jmp 0040FD6F
:0040FD21 E926000000              jmp 0040FD4C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040FCB0(C), :0040FD47(U)
|
:0040FD26 68FF000000              push 000000FF
:0040FD2B 6A00                    push 00000000
:0040FD2D E874EEFFFF              call 0040EBA6
:0040FD32 83C408                  add esp, 00000008
:0040FD35 F605785345006E          test byte ptr [00455378], 6E
:0040FD3C 0F8405000000            je 0040FD47
:0040FD42 E928000000              jmp 0040FD6F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FD3C(C)
|
:0040FD47 E9DAFFFFFF              jmp 0040FD26

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FD21(U)
|
:0040FD4C E919000000              jmp 0040FD6A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FC1A(U)
|
:0040FD51 837DF001                cmp dword ptr [ebp-10], 00000001
:0040FD55 0F84C4FEFFFF            je 0040FC1F
:0040FD5B 837DF002                cmp dword ptr [ebp-10], 00000002
:0040FD5F 0F8410FFFFFF            je 0040FC75
:0040FD65 E900000000              jmp 0040FD6A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040FC70(U), :0040FD4C(U), :0040FD65(U)
|
:0040FD6A E900000000              jmp 0040FD6F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040FD1C(U), :0040FD42(U), :0040FD6A(U)
|
:0040FD6F 5F                      pop edi
:0040FD70 5E                      pop esi
:0040FD71 5B                      pop ebx
:0040FD72 C9                      leave
:0040FD73 C3                      ret


:0040FD74 CC                      int 03
:0040FD75 CC                      int 03
:0040FD76 CC                      int 03
:0040FD77 CC                      int 03
:0040FD78 CC                      int 03
:0040FD79 CC                      int 03
:0040FD7A CC                      int 03
:0040FD7B CC                      int 03
:0040FD7C CC                      int 03
:0040FD7D CC                      int 03
:0040FD7E CC                      int 03
:0040FD7F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040EB77   , :0040F162   , :00412521   , :00414A88   , :004156FE   
|:00415955   , :004177A1   , :0042559B   , :00436F2B   , :00443B39   
|
:0040FD80 55                      push ebp
:0040FD81 8BEC                    mov ebp, esp
:0040FD83 83EC04                  sub esp, 00000004
:0040FD86 53                      push ebx
:0040FD87 56                      push esi
:0040FD88 57                      push edi
:0040FD89 894DFC                  mov dword ptr [ebp-04], ecx
:0040FD8C 8B45FC                  mov eax, dword ptr [ebp-04]
:0040FD8F 8A4006                  mov al, byte ptr [eax+06]
:0040FD92 E900000000              jmp 0040FD97

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FD92(U)
|
:0040FD97 5F                      pop edi
:0040FD98 5E                      pop esi
:0040FD99 5B                      pop ebx
:0040FD9A C9                      leave
:0040FD9B C3                      ret


:0040FD9C CC                      int 03
:0040FD9D CC                      int 03
:0040FD9E CC                      int 03
:0040FD9F CC                      int 03

* Referenced by a CALL at Address:
|:0040EB97   
|
:0040FDA0 55                      push ebp
:0040FDA1 8BEC                    mov ebp, esp
:0040FDA3 83EC04                  sub esp, 00000004
:0040FDA6 53                      push ebx
:0040FDA7 56                      push esi
:0040FDA8 57                      push edi
:0040FDA9 894DFC                  mov dword ptr [ebp-04], ecx
:0040FDAC 8B4508                  mov eax, dword ptr [ebp+08]
:0040FDAF 8A4001                  mov al, byte ptr [eax+01]
:0040FDB2 50                      push eax
:0040FDB3 8B4508                  mov eax, dword ptr [ebp+08]
:0040FDB6 8A00                    mov al, byte ptr [eax]
:0040FDB8 50                      push eax
:0040FDB9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040FDBC E8BF1BFFFF              call 00401980
:0040FDC1 E900000000              jmp 0040FDC6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FDC1(U)
|
:0040FDC6 5F                      pop edi
:0040FDC7 5E                      pop esi
:0040FDC8 5B                      pop ebx
:0040FDC9 C9                      leave
:0040FDCA C20400                  ret 0004


:0040FDCD CC                      int 03
:0040FDCE CC                      int 03
:0040FDCF CC                      int 03

* Referenced by a CALL at Address:
|:0040EB8B   
|
:0040FDD0 55                      push ebp
:0040FDD1 8BEC                    mov ebp, esp
:0040FDD3 83EC04                  sub esp, 00000004
:0040FDD6 53                      push ebx
:0040FDD7 56                      push esi
:0040FDD8 57                      push edi
:0040FDD9 894DFC                  mov dword ptr [ebp-04], ecx
:0040FDDC 8B45FC                  mov eax, dword ptr [ebp-04]
:0040FDDF E900000000              jmp 0040FDE4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FDDF(U)
|
:0040FDE4 5F                      pop edi
:0040FDE5 5E                      pop esi
:0040FDE6 5B                      pop ebx
:0040FDE7 C9                      leave
:0040FDE8 C3                      ret


:0040FDE9 CC                      int 03
:0040FDEA CC                      int 03
:0040FDEB CC                      int 03
:0040FDEC CC                      int 03
:0040FDED CC                      int 03
:0040FDEE CC                      int 03
:0040FDEF CC                      int 03

* Referenced by a CALL at Address:
|:0040F808   
|
:0040FDF0 55                      push ebp
:0040FDF1 8BEC                    mov ebp, esp
:0040FDF3 83EC04                  sub esp, 00000004
:0040FDF6 53                      push ebx
:0040FDF7 56                      push esi
:0040FDF8 57                      push edi
:0040FDF9 894DFC                  mov dword ptr [ebp-04], ecx
:0040FDFC 8B45FC                  mov eax, dword ptr [ebp-04]
:0040FDFF 8A400B                  mov al, byte ptr [eax+0B]
:0040FE02 E900000000              jmp 0040FE07

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FE02(U)
|
:0040FE07 5F                      pop edi
:0040FE08 5E                      pop esi
:0040FE09 5B                      pop ebx
:0040FE0A C9                      leave
:0040FE0B C3                      ret


:0040FE0C CC                      int 03
:0040FE0D CC                      int 03
:0040FE0E CC                      int 03
:0040FE0F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040AC82   , :0040FEB6   , :00410CB7   
|
:0040FE10 55                      push ebp
:0040FE11 8BEC                    mov ebp, esp
:0040FE13 83EC04                  sub esp, 00000004
:0040FE16 53                      push ebx
:0040FE17 56                      push esi
:0040FE18 57                      push edi
:0040FE19 837D0808                cmp dword ptr [ebp+08], 00000008
:0040FE1D 0F8322000000            jnb 0040FE45
:0040FE23 B9D0A64600              mov ecx, 0046A6D0
:0040FE28 E8F3BBFFFF              call 0040BA20
:0040FE2D 8945FC                  mov dword ptr [ebp-04], eax
:0040FE30 8365FCF0                and dword ptr [ebp-04], FFFFFFF0
:0040FE34 8B4508                  mov eax, dword ptr [ebp+08]
:0040FE37 0B45FC                  or eax, dword ptr [ebp-04]
:0040FE3A 50                      push eax
:0040FE3B B9D0A64600              mov ecx, 0046A6D0
:0040FE40 E80BBCFFFF              call 0040BA50

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FE1D(C)
|
:0040FE45 E900000000              jmp 0040FE4A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FE45(U)
|
:0040FE4A 5F                      pop edi
:0040FE4B 5E                      pop esi
:0040FE4C 5B                      pop ebx
:0040FE4D C9                      leave
:0040FE4E C3                      ret



* Referenced by a CALL at Address:
|:00410D4F   
|
:0040FE4F 55                      push ebp
:0040FE50 8BEC                    mov ebp, esp
:0040FE52 83EC10                  sub esp, 00000010
:0040FE55 53                      push ebx
:0040FE56 56                      push esi
:0040FE57 57                      push edi
:0040FE58 6A00                    push 00000000
:0040FE5A 6A08                    push 00000008
:0040FE5C 8D45F4                  lea eax, dword ptr [ebp-0C]
:0040FE5F 50                      push eax
:0040FE60 E8FE750300              call 00447463
:0040FE65 83C40C                  add esp, 0000000C
:0040FE68 B9D0A64600              mov ecx, 0046A6D0
:0040FE6D E88EBDFFFF              call 0040BC00
:0040FE72 8945F0                  mov dword ptr [ebp-10], eax
:0040FE75 8B45F0                  mov eax, dword ptr [ebp-10]
:0040FE78 C64405F401              mov [ebp+eax-0C], 01
:0040FE7D 6A00                    push 00000000
:0040FE7F 6A00                    push 00000000
:0040FE81 8D45F4                  lea eax, dword ptr [ebp-0C]
:0040FE84 50                      push eax
:0040FE85 6A00                    push 00000000
:0040FE87 6A08                    push 00000008

* Possible Indirect StringData Ref from Data Obj ->"û"
                                  |
:0040FE89 6878EF4400              push 0044EF78
:0040FE8E 6A28                    push 00000028
:0040FE90 68E0000000              push 000000E0
:0040FE95 E85A7F0200              call 00437DF4
:0040FE9A 83C420                  add esp, 00000020
:0040FE9D 8845FC                  mov byte ptr [ebp-04], al
:0040FEA0 33C0                    xor eax, eax
:0040FEA2 8A45FC                  mov al, byte ptr [ebp-04]
:0040FEA5 3DFF000000              cmp eax, 000000FF
:0040FEAA 0F840E000000            je 0040FEBE
:0040FEB0 33C0                    xor eax, eax
:0040FEB2 8A45FC                  mov al, byte ptr [ebp-04]
:0040FEB5 50                      push eax
:0040FEB6 E855FFFFFF              call 0040FE10
:0040FEBB 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FEAA(C)
|
:0040FEBE E900000000              jmp 0040FEC3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FEBE(U)
|
:0040FEC3 5F                      pop edi
:0040FEC4 5E                      pop esi
:0040FEC5 5B                      pop ebx
:0040FEC6 C9                      leave
:0040FEC7 C3                      ret



* Referenced by a CALL at Addresses:
|:0040AC2E   , :0040FFD1   , :00410C49   
|
:0040FEC8 55                      push ebp
:0040FEC9 8BEC                    mov ebp, esp
:0040FECB 83EC04                  sub esp, 00000004
:0040FECE 53                      push ebx
:0040FECF 56                      push esi
:0040FED0 57                      push edi
:0040FED1 B9D0A64600              mov ecx, 0046A6D0
:0040FED6 E845BBFFFF              call 0040BA20
:0040FEDB 8945FC                  mov dword ptr [ebp-04], eax
:0040FEDE F645FD08                test [ebp-03], 08
:0040FEE2 0F8422000000            je 0040FF0A
:0040FEE8 837D0800                cmp dword ptr [ebp+08], 00000000
:0040FEEC 0F8518000000            jne 0040FF0A
:0040FEF2 8B45FC                  mov eax, dword ptr [ebp-04]
:0040FEF5 25FFF7FFFF              and eax, FFFFF7FF
:0040FEFA 50                      push eax
:0040FEFB B9D0A64600              mov ecx, 0046A6D0
:0040FF00 E84BBBFFFF              call 0040BA50
:0040FF05 E927000000              jmp 0040FF31

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040FEE2(C), :0040FEEC(C)
|
:0040FF0A F645FD08                test [ebp-03], 08
:0040FF0E 0F851D000000            jne 0040FF31
:0040FF14 837D0800                cmp dword ptr [ebp+08], 00000000
:0040FF18 0F8413000000            je 0040FF31
:0040FF1E 8B45FC                  mov eax, dword ptr [ebp-04]
:0040FF21 0D00080000              or eax, 00000800
:0040FF26 50                      push eax
:0040FF27 B9D0A64600              mov ecx, 0046A6D0
:0040FF2C E81FBBFFFF              call 0040BA50

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040FF05(U), :0040FF0E(C), :0040FF18(C)
|
:0040FF31 E900000000              jmp 0040FF36

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FF31(U)
|
:0040FF36 5F                      pop edi
:0040FF37 5E                      pop esi
:0040FF38 5B                      pop ebx
:0040FF39 C9                      leave
:0040FF3A C3                      ret



* Referenced by a CALL at Addresses:
|:0040B73C   , :00410D59   
|
:0040FF3B 55                      push ebp
:0040FF3C 8BEC                    mov ebp, esp
:0040FF3E 83EC0C                  sub esp, 0000000C
:0040FF41 53                      push ebx
:0040FF42 56                      push esi
:0040FF43 57                      push edi
:0040FF44 6A00                    push 00000000
:0040FF46 6A04                    push 00000004
:0040FF48 8D45F4                  lea eax, dword ptr [ebp-0C]
:0040FF4B 50                      push eax
:0040FF4C E812750300              call 00447463
:0040FF51 83C40C                  add esp, 0000000C
:0040FF54 B9D0A64600              mov ecx, 0046A6D0
:0040FF59 E8C2BAFFFF              call 0040BA20
:0040FF5E 8945FC                  mov dword ptr [ebp-04], eax
:0040FF61 8B45FC                  mov eax, dword ptr [ebp-04]
:0040FF64 2500080000              and eax, 00000800
:0040FF69 C1E80B                  shr eax, 0B
:0040FF6C C64405F401              mov [ebp+eax-0C], 01
:0040FF71 6A00                    push 00000000
:0040FF73 6A00                    push 00000000
:0040FF75 8D45F4                  lea eax, dword ptr [ebp-0C]
:0040FF78 50                      push eax
:0040FF79 6A00                    push 00000000
:0040FF7B 8B45FC                  mov eax, dword ptr [ebp-04]
:0040FF7E 2500020000              and eax, 00000200
:0040FF83 83F801                  cmp eax, 00000001
:0040FF86 1BC0                    sbb eax, eax
:0040FF88 83C003                  add eax, 00000003
:0040FF8B 50                      push eax

* Possible Indirect StringData Ref from Data Obj ->"320x240"
                                  |
:0040FF8C 68A0EF4400              push 0044EFA0
:0040FF91 6A28                    push 00000028
:0040FF93 6810010000              push 00000110
:0040FF98 E8577E0200              call 00437DF4
:0040FF9D 83C420                  add esp, 00000020
:0040FFA0 8845F8                  mov byte ptr [ebp-08], al
:0040FFA3 33C0                    xor eax, eax
:0040FFA5 8A45F8                  mov al, byte ptr [ebp-08]
:0040FFA8 83F802                  cmp eax, 00000002
:0040FFAB 0F850A000000            jne 0040FFBB
:0040FFB1 E8C6B6FFFF              call 0040B67C
:0040FFB6 E91E000000              jmp 0040FFD9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FFAB(C)
|
:0040FFBB 33C0                    xor eax, eax
:0040FFBD 8A45F8                  mov al, byte ptr [ebp-08]
:0040FFC0 3DFF000000              cmp eax, 000000FF
:0040FFC5 0F840E000000            je 0040FFD9
:0040FFCB 33C0                    xor eax, eax
:0040FFCD 8A45F8                  mov al, byte ptr [ebp-08]
:0040FFD0 50                      push eax
:0040FFD1 E8F2FEFFFF              call 0040FEC8
:0040FFD6 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040FFB6(U), :0040FFC5(C)
|
:0040FFD9 E900000000              jmp 0040FFDE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FFD9(U)
|
:0040FFDE 5F                      pop edi
:0040FFDF 5E                      pop esi
:0040FFE0 5B                      pop ebx
:0040FFE1 C9                      leave
:0040FFE2 C3                      ret



* Referenced by a CALL at Addresses:
|:0040AC66   , :00410074   , :00410C2A   
|
:0040FFE3 55                      push ebp
:0040FFE4 8BEC                    mov ebp, esp
:0040FFE6 53                      push ebx
:0040FFE7 56                      push esi
:0040FFE8 57                      push edi
:0040FFE9 837D0804                cmp dword ptr [ebp+08], 00000004
:0040FFED 0F830E000000            jnb 00410001
:0040FFF3 8B4508                  mov eax, dword ptr [ebp+08]
:0040FFF6 50                      push eax
:0040FFF7 B9D0A64600              mov ecx, 0046A6D0
:0040FFFC E8EFB9FFFF              call 0040B9F0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FFED(C)
|
:00410001 E900000000              jmp 00410006

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410001(U)
|
:00410006 5F                      pop edi
:00410007 5E                      pop esi
:00410008 5B                      pop ebx
:00410009 C9                      leave
:0041000A C3                      ret



* Referenced by a CALL at Address:
|:00410D27   
|
:0041000B 55                      push ebp
:0041000C 8BEC                    mov ebp, esp
:0041000E 83EC08                  sub esp, 00000008
:00410011 53                      push ebx
:00410012 56                      push esi
:00410013 57                      push edi
:00410014 6A00                    push 00000000
:00410016 6A04                    push 00000004
:00410018 8D45F8                  lea eax, dword ptr [ebp-08]
:0041001B 50                      push eax
:0041001C E842740300              call 00447463
:00410021 83C40C                  add esp, 0000000C
:00410024 B9D0A64600              mov ecx, 0046A6D0
:00410029 E8A2B9FFFF              call 0040B9D0
:0041002E 8845FC                  mov byte ptr [ebp-04], al
:00410031 33C0                    xor eax, eax
:00410033 8A45FC                  mov al, byte ptr [ebp-04]
:00410036 C64405F801              mov [ebp+eax-08], 01
:0041003B 6A00                    push 00000000
:0041003D 6A00                    push 00000000
:0041003F 8D45F8                  lea eax, dword ptr [ebp-08]
:00410042 50                      push eax
:00410043 6A00                    push 00000000
:00410045 6A04                    push 00000004

* Possible Indirect StringData Ref from Data Obj ->""
                                  |
:00410047 68B0EF4400              push 0044EFB0
:0041004C 6A28                    push 00000028
:0041004E 68A0000000              push 000000A0
:00410053 E89C7D0200              call 00437DF4
:00410058 83C420                  add esp, 00000020
:0041005B 8845FC                  mov byte ptr [ebp-04], al
:0041005E 33C0                    xor eax, eax
:00410060 8A45FC                  mov al, byte ptr [ebp-04]
:00410063 3DFF000000              cmp eax, 000000FF
:00410068 0F840E000000            je 0041007C
:0041006E 33C0                    xor eax, eax
:00410070 8A45FC                  mov al, byte ptr [ebp-04]
:00410073 50                      push eax
:00410074 E86AFFFFFF              call 0040FFE3
:00410079 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410068(C)
|
:0041007C E900000000              jmp 00410081

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041007C(U)
|
:00410081 5F                      pop edi
:00410082 5E                      pop esi
:00410083 5B                      pop ebx
:00410084 C9                      leave
:00410085 C3                      ret



* Referenced by a CALL at Addresses:
|:0040AC4A   , :00410119   , :00410C9F   
|
:00410086 55                      push ebp
:00410087 8BEC                    mov ebp, esp
:00410089 53                      push ebx
:0041008A 56                      push esi
:0041008B 57                      push edi
:0041008C 837D0804                cmp dword ptr [ebp+08], 00000004
:00410090 0F8310000000            jnb 004100A6
:00410096 33C0                    xor eax, eax
:00410098 8A4508                  mov al, byte ptr [ebp+08]
:0041009B 50                      push eax
:0041009C B9D0A64600              mov ecx, 0046A6D0
:004100A1 E83ABAFFFF              call 0040BAE0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410090(C)
|
:004100A6 E900000000              jmp 004100AB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004100A6(U)
|
:004100AB 5F                      pop edi
:004100AC 5E                      pop esi
:004100AD 5B                      pop ebx
:004100AE C9                      leave
:004100AF C3                      ret



* Referenced by a CALL at Address:
|:00410D45   
|
:004100B0 55                      push ebp
:004100B1 8BEC                    mov ebp, esp
:004100B3 83EC08                  sub esp, 00000008
:004100B6 53                      push ebx
:004100B7 56                      push esi
:004100B8 57                      push edi
:004100B9 6A00                    push 00000000
:004100BB 6A04                    push 00000004
:004100BD 8D45F8                  lea eax, dword ptr [ebp-08]
:004100C0 50                      push eax
:004100C1 E89D730300              call 00447463
:004100C6 83C40C                  add esp, 0000000C
:004100C9 B9D0A64600              mov ecx, 0046A6D0
:004100CE E8DDB9FFFF              call 0040BAB0
:004100D3 8845FC                  mov byte ptr [ebp-04], al
:004100D6 33C0                    xor eax, eax
:004100D8 8A45FC                  mov al, byte ptr [ebp-04]
:004100DB C64405F801              mov [ebp+eax-08], 01
:004100E0 6A00                    push 00000000
:004100E2 6A00                    push 00000000
:004100E4 8D45F8                  lea eax, dword ptr [ebp-08]
:004100E7 50                      push eax
:004100E8 6A00                    push 00000000
:004100EA 6A04                    push 00000004

* Possible Indirect StringData Ref from Data Obj ->""
                                  |
:004100EC 68C8EF4400              push 0044EFC8
:004100F1 6A28                    push 00000028
:004100F3 68F0000000              push 000000F0
:004100F8 E8F77C0200              call 00437DF4
:004100FD 83C420                  add esp, 00000020
:00410100 8845FC                  mov byte ptr [ebp-04], al
:00410103 33C0                    xor eax, eax
:00410105 8A45FC                  mov al, byte ptr [ebp-04]
:00410108 3DFF000000              cmp eax, 000000FF
:0041010D 0F840E000000            je 00410121
:00410113 33C0                    xor eax, eax
:00410115 8A45FC                  mov al, byte ptr [ebp-04]
:00410118 50                      push eax
:00410119 E868FFFFFF              call 00410086
:0041011E 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041010D(C)
|
:00410121 E900000000              jmp 00410126

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410121(U)
|
:00410126 5F                      pop edi
:00410127 5E                      pop esi
:00410128 5B                      pop ebx
:00410129 C9                      leave
:0041012A C3                      ret



* Referenced by a CALL at Address:
|:00410457   
|
:0041012B 55                      push ebp
:0041012C 8BEC                    mov ebp, esp
:0041012E 83EC20                  sub esp, 00000020
:00410131 53                      push ebx
:00410132 56                      push esi
:00410133 57                      push edi
:00410134 B9D0A64600              mov ecx, 0046A6D0
:00410139 E882BAFFFF              call 0040BBC0
:0041013E 33C9                    xor ecx, ecx
:00410140 8AC8                    mov cl, al
:00410142 894DFC                  mov dword ptr [ebp-04], ecx
:00410145 8B45FC                  mov eax, dword ptr [ebp-04]
:00410148 8945F8                  mov dword ptr [ebp-08], eax
:0041014B C645F400                mov [ebp-0C], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004101CB(U)
|
:0041014F 6A00                    push 00000000
:00410151 6A14                    push 00000014
:00410153 8D45E0                  lea eax, dword ptr [ebp-20]
:00410156 50                      push eax
:00410157 E807730300              call 00447463
:0041015C 83C40C                  add esp, 0000000C
:0041015F 837DF813                cmp dword ptr [ebp-08], 00000013
:00410163 0F8308000000            jnb 00410171
:00410169 8B45F8                  mov eax, dword ptr [ebp-08]
:0041016C C64405E001              mov [ebp+eax-20], 01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410163(C)
|
:00410171 8D45F4                  lea eax, dword ptr [ebp-0C]
:00410174 50                      push eax
:00410175 6A00                    push 00000000
:00410177 8D45E0                  lea eax, dword ptr [ebp-20]
:0041017A 50                      push eax
:0041017B 68A0000000              push 000000A0
:00410180 6A08                    push 00000008

* Possible Indirect StringData Ref from Data Obj ->"ƶ"
                                  |
:00410182 68D8EF4400              push 0044EFD8
:00410187 6A28                    push 00000028
:00410189 68F0000000              push 000000F0
:0041018E E8617C0200              call 00437DF4
:00410193 83C420                  add esp, 00000020
:00410196 33C9                    xor ecx, ecx
:00410198 8AC8                    mov cl, al
:0041019A 894DF8                  mov dword ptr [ebp-08], ecx
:0041019D 817DF8FF000000          cmp dword ptr [ebp-08], 000000FF
:004101A4 0F8513000000            jne 004101BD
:004101AA 8B45FC                  mov eax, dword ptr [ebp-04]
:004101AD 50                      push eax
:004101AE B990A64600              mov ecx, 0046A690
:004101B3 E8128D0000              call 00418ECA
:004101B8 E913000000              jmp 004101D0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004101A4(C)
|
:004101BD 8B45F8                  mov eax, dword ptr [ebp-08]
:004101C0 50                      push eax
:004101C1 B990A64600              mov ecx, 0046A690
:004101C6 E8FF8C0000              call 00418ECA
:004101CB E97FFFFFFF              jmp 0041014F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004101B8(U)
|
:004101D0 33C0                    xor eax, eax
:004101D2 E900000000              jmp 004101D7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004101D2(U)
|
:004101D7 5F                      pop edi
:004101D8 5E                      pop esi
:004101D9 5B                      pop ebx
:004101DA C9                      leave
:004101DB C3                      ret



* Referenced by a CALL at Address:
|:00410461   
|
:004101DC 55                      push ebp
:004101DD 8BEC                    mov ebp, esp
:004101DF 83EC0C                  sub esp, 0000000C
:004101E2 53                      push ebx
:004101E3 56                      push esi
:004101E4 57                      push edi
:004101E5 C645F400                mov [ebp-0C], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041024E(U)
|
:004101E9 B9D0A64600              mov ecx, 0046A6D0
:004101EE E820E80000              call 0041EA13
:004101F3 8945FC                  mov dword ptr [ebp-04], eax
:004101F6 8D45F4                  lea eax, dword ptr [ebp-0C]
:004101F9 50                      push eax
:004101FA 6A00                    push 00000000
:004101FC 6A00                    push 00000000
:004101FE 68A0000000              push 000000A0
:00410203 6A0F                    push 0000000F

* Possible Indirect StringData Ref from Data Obj ->""
                                  |
:00410205 6828F04400              push 0044F028
:0041020A 6A28                    push 00000028
:0041020C 6800010000              push 00000100
:00410211 E8DE7B0200              call 00437DF4
:00410216 83C420                  add esp, 00000020
:00410219 33C9                    xor ecx, ecx
:0041021B 8AC8                    mov cl, al
:0041021D 894DF8                  mov dword ptr [ebp-08], ecx
:00410220 8B45FC                  mov eax, dword ptr [ebp-04]
:00410223 50                      push eax
:00410224 B9D0A64600              mov ecx, 0046A6D0
:00410229 E822B8FFFF              call 0040BA50
:0041022E 817DF8FF000000          cmp dword ptr [ebp-08], 000000FF
:00410235 0F8505000000            jne 00410240
:0041023B E913000000              jmp 00410253

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410235(C)
|
:00410240 8B45F8                  mov eax, dword ptr [ebp-08]
:00410243 50                      push eax
:00410244 B994A64600              mov ecx, 0046A694
:00410249 E8D68D0000              call 00419024
:0041024E E996FFFFFF              jmp 004101E9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041023B(U)
|
:00410253 33C0                    xor eax, eax
:00410255 E900000000              jmp 0041025A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410255(U)
|
:0041025A 5F                      pop edi
:0041025B 5E                      pop esi
:0041025C 5B                      pop ebx
:0041025D C9                      leave
:0041025E C3                      ret



* Referenced by a CALL at Addresses:
|:0040ABE8   , :0041039B   , :00410C87   
|
:0041025F 55                      push ebp
:00410260 8BEC                    mov ebp, esp
:00410262 83EC08                  sub esp, 00000008
:00410265 53                      push ebx
:00410266 56                      push esi
:00410267 57                      push edi
:00410268 C745FC00100000          mov [ebp-04], 00001000
:0041026F B9D0A64600              mov ecx, 0046A6D0
:00410274 E8A7B7FFFF              call 0040BA20
:00410279 8945F8                  mov dword ptr [ebp-08], eax
:0041027C 8B45F8                  mov eax, dword ptr [ebp-08]
:0041027F 8545FC                  test dword ptr [ebp-04], eax
:00410282 0F8422000000            je 004102AA
:00410288 837D0800                cmp dword ptr [ebp+08], 00000000
:0041028C 0F8513000000            jne 004102A5
:00410292 8B45FC                  mov eax, dword ptr [ebp-04]
:00410295 F7D0                    not eax
:00410297 2345F8                  and eax, dword ptr [ebp-08]
:0041029A 50                      push eax
:0041029B B9D0A64600              mov ecx, 0046A6D0
:004102A0 E8ABB7FFFF              call 0040BA50

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041028C(C)
|
:004102A5 E91B000000              jmp 004102C5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410282(C)
|
:004102AA 837D0800                cmp dword ptr [ebp+08], 00000000
:004102AE 0F8411000000            je 004102C5
:004102B4 8B45F8                  mov eax, dword ptr [ebp-08]
:004102B7 0B45FC                  or eax, dword ptr [ebp-04]
:004102BA 50                      push eax
:004102BB B9D0A64600              mov ecx, 0046A6D0
:004102C0 E88BB7FFFF              call 0040BA50

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004102A5(U), :004102AE(C)
|
:004102C5 E900000000              jmp 004102CA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004102C5(U)
|
:004102CA 5F                      pop edi
:004102CB 5E                      pop esi
:004102CC 5B                      pop ebx
:004102CD C9                      leave
:004102CE C3                      ret



* Referenced by a CALL at Addresses:
|:0040ABC5   , :0041038A   , :00410C68   
|
:004102CF 55                      push ebp
:004102D0 8BEC                    mov ebp, esp
:004102D2 83EC08                  sub esp, 00000008
:004102D5 53                      push ebx
:004102D6 56                      push esi
:004102D7 57                      push edi
:004102D8 C745FC00200000          mov [ebp-04], 00002000
:004102DF B9D0A64600              mov ecx, 0046A6D0
:004102E4 E837B7FFFF              call 0040BA20
:004102E9 8945F8                  mov dword ptr [ebp-08], eax
:004102EC 6A72                    push 00000072
:004102EE E8955B0100              call 00425E88
:004102F3 83C404                  add esp, 00000004
:004102F6 8B45FC                  mov eax, dword ptr [ebp-04]
:004102F9 8545F8                  test dword ptr [ebp-08], eax
:004102FC 0F842C000000            je 0041032E
:00410302 837D0800                cmp dword ptr [ebp+08], 00000000
:00410306 0F851D000000            jne 00410329
:0041030C 8B45FC                  mov eax, dword ptr [ebp-04]
:0041030F F7D0                    not eax
:00410311 2345F8                  and eax, dword ptr [ebp-08]
:00410314 50                      push eax
:00410315 B9D0A64600              mov ecx, 0046A6D0
:0041031A E831B7FFFF              call 0040BA50
:0041031F B990A64600              mov ecx, 0046A690
:00410324 E8C78B0000              call 00418EF0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410306(C)
|
:00410329 E934000000              jmp 00410362

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004102FC(C)
|
:0041032E 837D0800                cmp dword ptr [ebp+08], 00000000
:00410332 0F842A000000            je 00410362
:00410338 8B45FC                  mov eax, dword ptr [ebp-04]
:0041033B 0B45F8                  or eax, dword ptr [ebp-08]
:0041033E 50                      push eax
:0041033F B9D0A64600              mov ecx, 0046A6D0
:00410344 E807B7FFFF              call 0040BA50
:00410349 B9D0A64600              mov ecx, 0046A6D0
:0041034E E86DB8FFFF              call 0040BBC0
:00410353 33C9                    xor ecx, ecx
:00410355 8AC8                    mov cl, al
:00410357 51                      push ecx
:00410358 B990A64600              mov ecx, 0046A690
:0041035D E8688B0000              call 00418ECA

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00410329(U), :00410332(C)
|
:00410362 6A00                    push 00000000
:00410364 E81F5B0100              call 00425E88
:00410369 83C404                  add esp, 00000004
:0041036C E900000000              jmp 00410371

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041036C(U)
|
:00410371 5F                      pop edi
:00410372 5E                      pop esi
:00410373 5B                      pop ebx
:00410374 C9                      leave
:00410375 C3                      ret



* Referenced by a CALL at Address:
|:00410440   
|
:00410376 55                      push ebp
:00410377 8BEC                    mov ebp, esp
:00410379 53                      push ebx
:0041037A 56                      push esi
:0041037B 57                      push edi
:0041037C 837D0800                cmp dword ptr [ebp+08], 00000000
:00410380 0F8411000000            je 00410397
:00410386 8B450C                  mov eax, dword ptr [ebp+0C]
:00410389 50                      push eax
:0041038A E840FFFFFF              call 004102CF
:0041038F 83C404                  add esp, 00000004
:00410392 E90C000000              jmp 004103A3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410380(C)
|
:00410397 8B450C                  mov eax, dword ptr [ebp+0C]
:0041039A 50                      push eax
:0041039B E8BFFEFFFF              call 0041025F
:004103A0 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410392(U)
|
:004103A3 E900000000              jmp 004103A8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004103A3(U)
|
:004103A8 5F                      pop edi
:004103A9 5E                      pop esi
:004103AA 5B                      pop ebx
:004103AB C9                      leave
:004103AC C3                      ret



* Referenced by a CALL at Addresses:
|:004104AA   , :004104C4   
|
:004103AD 55                      push ebp
:004103AE 8BEC                    mov ebp, esp
:004103B0 83EC14                  sub esp, 00000014
:004103B3 53                      push ebx
:004103B4 56                      push esi
:004103B5 57                      push edi
:004103B6 8B4508                  mov eax, dword ptr [ebp+08]
:004103B9 8B0485F8F04400          mov eax, dword ptr [4*eax+0044F0F8]
:004103C0 8945FC                  mov dword ptr [ebp-04], eax
:004103C3 6A00                    push 00000000
:004103C5 6A03                    push 00000003
:004103C7 8D45F0                  lea eax, dword ptr [ebp-10]
:004103CA 50                      push eax
:004103CB E893700300              call 00447463
:004103D0 83C40C                  add esp, 0000000C
:004103D3 B9D0A64600              mov ecx, 0046A6D0
:004103D8 E843B6FFFF              call 0040BA20
:004103DD 8945F8                  mov dword ptr [ebp-08], eax
:004103E0 8B45F8                  mov eax, dword ptr [ebp-08]
:004103E3 2345FC                  and eax, dword ptr [ebp-04]
:004103E6 83F801                  cmp eax, 00000001
:004103E9 1BC0                    sbb eax, eax
:004103EB F7D8                    neg eax
:004103ED C64405F001              mov [ebp+eax-10], 01
:004103F2 6A00                    push 00000000
:004103F4 6A00                    push 00000000
:004103F6 8D45F0                  lea eax, dword ptr [ebp-10]
:004103F9 50                      push eax
:004103FA 6A00                    push 00000000
:004103FC 8B45F8                  mov eax, dword ptr [ebp-08]
:004103FF 2500020000              and eax, 00000200
:00410404 83F801                  cmp eax, 00000001
:00410407 1BC0                    sbb eax, eax
:00410409 83C003                  add eax, 00000003
:0041040C 50                      push eax

* Possible Indirect StringData Ref from Data Obj ->""
                                  |
:0041040D 68E8F04400              push 0044F0E8
:00410412 6A28                    push 00000028
:00410414 68B0000000              push 000000B0
:00410419 E8D6790200              call 00437DF4
:0041041E 83C420                  add esp, 00000020
:00410421 33C9                    xor ecx, ecx
:00410423 8AC8                    mov cl, al
:00410425 894DF4                  mov dword ptr [ebp-0C], ecx
:00410428 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041042B 8945EC                  mov dword ptr [ebp-14], eax
:0041042E E942000000              jmp 00410475

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410483(C)
|
:00410433 837DF401                cmp dword ptr [ebp-0C], 00000001
:00410437 1BC0                    sbb eax, eax
:00410439 F7D8                    neg eax
:0041043B 50                      push eax
:0041043C 8B4508                  mov eax, dword ptr [ebp+08]
:0041043F 50                      push eax
:00410440 E831FFFFFF              call 00410376
:00410445 83C408                  add esp, 00000008
:00410448 E94B000000              jmp 00410498

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041048D(C)
|
:0041044D 837D0800                cmp dword ptr [ebp+08], 00000000
:00410451 0F840A000000            je 00410461
:00410457 E8CFFCFFFF              call 0041012B
:0041045C E905000000              jmp 00410466

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410451(C)
|
:00410461 E876FDFFFF              call 004101DC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041045C(U)
|
:00410466 E92D000000              jmp 00410498
:0041046B E92D000000              jmp 0041049D
:00410470 E923000000              jmp 00410498

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041042E(U)
|
:00410475 837DEC00                cmp dword ptr [ebp-14], 00000000
:00410479 0F821E000000            jb 0041049D
:0041047F 837DEC01                cmp dword ptr [ebp-14], 00000001
:00410483 0F86AAFFFFFF            jbe 00410433
:00410489 837DEC02                cmp dword ptr [ebp-14], 00000002
:0041048D 0F84BAFFFFFF            je 0041044D
:00410493 E905000000              jmp 0041049D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00410448(U), :00410466(U), :00410470(U)
|
:00410498 E900000000              jmp 0041049D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041046B(U), :00410479(C), :00410493(U), :00410498(U)
|
:0041049D 5F                      pop edi
:0041049E 5E                      pop esi
:0041049F 5B                      pop ebx
:004104A0 C9                      leave
:004104A1 C3                      ret



* Referenced by a CALL at Address:
|:00410D3B   
|
:004104A2 55                      push ebp
:004104A3 8BEC                    mov ebp, esp
:004104A5 53                      push ebx
:004104A6 56                      push esi
:004104A7 57                      push edi
:004104A8 6A00                    push 00000000
:004104AA E8FEFEFFFF              call 004103AD
:004104AF 83C404                  add esp, 00000004
:004104B2 E900000000              jmp 004104B7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004104B2(U)
|
:004104B7 5F                      pop edi
:004104B8 5E                      pop esi
:004104B9 5B                      pop ebx
:004104BA C9                      leave
:004104BB C3                      ret



* Referenced by a CALL at Address:
|:00410D31   
|
:004104BC 55                      push ebp
:004104BD 8BEC                    mov ebp, esp
:004104BF 53                      push ebx
:004104C0 56                      push esi
:004104C1 57                      push edi
:004104C2 6A01                    push 00000001
:004104C4 E8E4FEFFFF              call 004103AD
:004104C9 83C404                  add esp, 00000004
:004104CC E900000000              jmp 004104D1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004104CC(U)
|
:004104D1 5F                      pop edi
:004104D2 5E                      pop esi
:004104D3 5B                      pop ebx
:004104D4 C9                      leave
:004104D5 C3                      ret



* Referenced by a CALL at Addresses:
|:0040AC0B   , :004105C3   , :00410CD6   , :00441E36   
|
:004104D6 55                      push ebp
:004104D7 8BEC                    mov ebp, esp
:004104D9 83EC04                  sub esp, 00000004
:004104DC 53                      push ebx
:004104DD 56                      push esi
:004104DE 57                      push edi
:004104DF B9D0A64600              mov ecx, 0046A6D0
:004104E4 E837B5FFFF              call 0040BA20
:004104E9 8945FC                  mov dword ptr [ebp-04], eax
:004104EC F645FD40                test [ebp-03], 40
:004104F0 0F8422000000            je 00410518
:004104F6 837D0800                cmp dword ptr [ebp+08], 00000000
:004104FA 0F8518000000            jne 00410518
:00410500 8B45FC                  mov eax, dword ptr [ebp-04]
:00410503 25FFBFFFFF              and eax, FFFFBFFF
:00410508 50                      push eax
:00410509 B9D0A64600              mov ecx, 0046A6D0
:0041050E E83DB5FFFF              call 0040BA50
:00410513 E927000000              jmp 0041053F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004104F0(C), :004104FA(C)
|
:00410518 F645FD40                test [ebp-03], 40
:0041051C 0F851D000000            jne 0041053F
:00410522 837D0800                cmp dword ptr [ebp+08], 00000000
:00410526 0F8413000000            je 0041053F
:0041052C 8B45FC                  mov eax, dword ptr [ebp-04]
:0041052F 0D00400000              or eax, 00004000
:00410534 50                      push eax
:00410535 B9D0A64600              mov ecx, 0046A6D0
:0041053A E811B5FFFF              call 0040BA50

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00410513(U), :0041051C(C), :00410526(C)
|
:0041053F E900000000              jmp 00410544

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041053F(U)
|
:00410544 5F                      pop edi
:00410545 5E                      pop esi
:00410546 5B                      pop ebx
:00410547 C9                      leave
:00410548 C3                      ret



* Referenced by a CALL at Address:
|:00410D63   
|
:00410549 55                      push ebp
:0041054A 8BEC                    mov ebp, esp
:0041054C 83EC0C                  sub esp, 0000000C
:0041054F 53                      push ebx
:00410550 56                      push esi
:00410551 57                      push edi
:00410552 6A00                    push 00000000
:00410554 6A02                    push 00000002
:00410556 8D45F4                  lea eax, dword ptr [ebp-0C]
:00410559 50                      push eax
:0041055A E8046F0300              call 00447463
:0041055F 83C40C                  add esp, 0000000C
:00410562 B9D0A64600              mov ecx, 0046A6D0
:00410567 E8B4B4FFFF              call 0040BA20
:0041056C 8945FC                  mov dword ptr [ebp-04], eax
:0041056F 8B45FC                  mov eax, dword ptr [ebp-04]
:00410572 2500400000              and eax, 00004000
:00410577 83F801                  cmp eax, 00000001
:0041057A 1BC0                    sbb eax, eax
:0041057C F7D8                    neg eax
:0041057E C64405F401              mov [ebp+eax-0C], 01
:00410583 6A00                    push 00000000
:00410585 6A00                    push 00000000
:00410587 8D45F4                  lea eax, dword ptr [ebp-0C]
:0041058A 50                      push eax
:0041058B 6A00                    push 00000000
:0041058D 6A02                    push 00000002

* Possible Indirect StringData Ref from Data Obj ->""
                                  |
:0041058F 68E8F04400              push 0044F0E8
:00410594 6A28                    push 00000028
:00410596 6810010000              push 00000110
:0041059B E854780200              call 00437DF4
:004105A0 83C420                  add esp, 00000020
:004105A3 8845F8                  mov byte ptr [ebp-08], al
:004105A6 33C0                    xor eax, eax
:004105A8 8A45F8                  mov al, byte ptr [ebp-08]
:004105AB 3DFF000000              cmp eax, 000000FF
:004105B0 0F8415000000            je 004105CB
:004105B6 33C0                    xor eax, eax
:004105B8 8A45F8                  mov al, byte ptr [ebp-08]
:004105BB 83F801                  cmp eax, 00000001
:004105BE 1BC0                    sbb eax, eax
:004105C0 F7D8                    neg eax
:004105C2 50                      push eax
:004105C3 E80EFFFFFF              call 004104D6
:004105C8 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004105B0(C)
|
:004105CB E900000000              jmp 004105D0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004105CB(U)
|
:004105D0 5F                      pop edi
:004105D1 5E                      pop esi
:004105D2 5B                      pop ebx
:004105D3 C9                      leave
:004105D4 C3                      ret



* Referenced by a CALL at Addresses:
|:00410624   , :00410D09   
|
:004105D5 55                      push ebp
:004105D6 8BEC                    mov ebp, esp
:004105D8 53                      push ebx
:004105D9 56                      push esi
:004105DA 57                      push edi
:004105DB E8C0ADFFFF              call 0040B3A0
:004105E0 3DFFFF0000              cmp eax, 0000FFFF
:004105E5 0F850A000000            jne 004105F5
:004105EB B8FEFF0000              mov eax, 0000FFFE
:004105F0 E90A000000              jmp 004105FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004105E5(C)
|
:004105F5 B8FFFF0000              mov eax, 0000FFFF
:004105FA E900000000              jmp 004105FF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004105F0(U), :004105FA(U)
|
:004105FF 5F                      pop edi
:00410600 5E                      pop esi
:00410601 5B                      pop ebx
:00410602 C9                      leave
:00410603 C3                      ret



* Referenced by a CALL at Addresses:
|:00431EE8   , :00431EF4   
|
:00410604 55                      push ebp
:00410605 8BEC                    mov ebp, esp
:00410607 83EC04                  sub esp, 00000004
:0041060A 53                      push ebx
:0041060B 56                      push esi
:0041060C 57                      push edi

* Possible StringData Ref from Data Obj ->"ڴ"
                                  |
:0041060D 6868F44400              push 0044F468
:00410612 6A06                    push 00000006
:00410614 E81C890200              call 00438F35
:00410619 83C408                  add esp, 00000008
:0041061C 85C0                    test eax, eax
:0041061E 0F8457000000            je 0041067B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410676(U)
|
:00410624 E8ACFFFFFF              call 004105D5
:00410629 8945FC                  mov dword ptr [ebp-04], eax
:0041062C 837DFC00                cmp dword ptr [ebp-04], 00000000
:00410630 0F840D000000            je 00410643
:00410636 817DFCFEFF0000          cmp dword ptr [ebp-04], 0000FFFE
:0041063D 0F8521000000            jne 00410664

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410630(C)
|

* Possible StringData Ref from Data Obj ->""
                                  |
:00410643 6878F44400              push 0044F478
:00410648 6A06                    push 00000006
:0041064A E8E6880200              call 00438F35
:0041064F 83C408                  add esp, 00000008
:00410652 85C0                    test eax, eax
:00410654 0F8405000000            je 0041065F
:0041065A E91C000000              jmp 0041067B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410654(C)
|
:0041065F E912000000              jmp 00410676

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041063D(C)
|
:00410664 817DFCFFFF0000          cmp dword ptr [ebp-04], 0000FFFF
:0041066B 0F8505000000            jne 00410676
:00410671 E905000000              jmp 0041067B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041065F(U), :0041066B(C)
|
:00410676 E9A9FFFFFF              jmp 00410624

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041061E(C), :0041065A(U), :00410671(U)
|
:0041067B 33C0                    xor eax, eax
:0041067D E900000000              jmp 00410682

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041067D(U)
|
:00410682 5F                      pop edi
:00410683 5E                      pop esi
:00410684 5B                      pop ebx
:00410685 C9                      leave
:00410686 C3                      ret



* Referenced by a CALL at Addresses:
|:00410CFC   , :00442169   
|
:00410687 55                      push ebp
:00410688 8BEC                    mov ebp, esp
:0041068A 53                      push ebx
:0041068B 56                      push esi
:0041068C 57                      push edi
:0041068D 8B4508                  mov eax, dword ptr [ebp+08]
:00410690 50                      push eax
:00410691 E8AEA7FFFF              call 0040AE44
:00410696 83C404                  add esp, 00000004
:00410699 3DFFFF0000              cmp eax, 0000FFFF
:0041069E 0F8421000000            je 004106C5
:004106A4 830D7853450008          or dword ptr [00455378], 00000008
:004106AB 813D64F94600469C0000    cmp dword ptr [0046F964], 00009C46
:004106B5 0F850A000000            jne 004106C5
:004106BB C70564F94600FEFFFFFF    mov dword ptr [0046F964], FFFFFFFE

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041069E(C), :004106B5(C)
|
:004106C5 B8FFFF0000              mov eax, 0000FFFF
:004106CA E900000000              jmp 004106CF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004106CA(U)
|
:004106CF 5F                      pop edi
:004106D0 5E                      pop esi
:004106D1 5B                      pop ebx
:004106D2 C9                      leave
:004106D3 C3                      ret



* Referenced by a CALL at Addresses:
|:0041085C   , :004108B9   , :00410A18   
|
:004106D4 55                      push ebp
:004106D5 8BEC                    mov ebp, esp
:004106D7 83EC14                  sub esp, 00000014
:004106DA 53                      push ebx
:004106DB 56                      push esi
:004106DC 57                      push edi
:004106DD 8B4514                  mov eax, dword ptr [ebp+14]
:004106E0 8945FC                  mov dword ptr [ebp-04], eax
:004106E3 8B450C                  mov eax, dword ptr [ebp+0C]
:004106E6 8945F0                  mov dword ptr [ebp-10], eax
:004106E9 E957000000              jmp 00410745

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410749(C)
|
:004106EE 8B4514                  mov eax, dword ptr [ebp+14]
:004106F1 8945F8                  mov dword ptr [ebp-08], eax
:004106F4 8B4D08                  mov ecx, dword ptr [ebp+08]
:004106F7 E89490FFFF              call 00409790
:004106FC 8945FC                  mov dword ptr [ebp-04], eax
:004106FF E95A000000              jmp 0041075E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410753(C)
|
:00410704 8B4514                  mov eax, dword ptr [ebp+14]
:00410707 8945F8                  mov dword ptr [ebp-08], eax
:0041070A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041070D E8CE8AFFFF              call 004091E0
:00410712 33C9                    xor ecx, ecx
:00410714 8AC8                    mov cl, al
:00410716 894DFC                  mov dword ptr [ebp-04], ecx
:00410719 E940000000              jmp 0041075E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410759(U)
|
:0041071E 8B4508                  mov eax, dword ptr [ebp+08]
:00410721 50                      push eax
:00410722 E8E5E70000              call 0041EF0C
:00410727 83C404                  add esp, 00000004
:0041072A 8945F4                  mov dword ptr [ebp-0C], eax
:0041072D 8B450C                  mov eax, dword ptr [ebp+0C]
:00410730 50                      push eax
:00410731 8B45F4                  mov eax, dword ptr [ebp-0C]
:00410734 50                      push eax
:00410735 E8E6B6FFFF              call 0040BE20
:0041073A 83C408                  add esp, 00000008
:0041073D 8945F8                  mov dword ptr [ebp-08], eax
:00410740 E919000000              jmp 0041075E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004106E9(U)
|
:00410745 837DF00B                cmp dword ptr [ebp-10], 0000000B
:00410749 0F849FFFFFFF            je 004106EE
:0041074F 837DF00C                cmp dword ptr [ebp-10], 0000000C
:00410753 0F84ABFFFFFF            je 00410704
:00410759 E9C0FFFFFF              jmp 0041071E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004106FF(U), :00410719(U), :00410740(U)
|
:0041075E 837D1002                cmp dword ptr [ebp+10], 00000002
:00410762 0F8433000000            je 0041079B
:00410768 817DFCFF000000          cmp dword ptr [ebp-04], 000000FF
:0041076F 0F8426000000            je 0041079B
:00410775 837DFC00                cmp dword ptr [ebp-04], 00000000
:00410779 0F841C000000            je 0041079B
:0041077F 837DF800                cmp dword ptr [ebp-08], 00000000
:00410783 0F8412000000            je 0041079B
:00410789 8B45F8                  mov eax, dword ptr [ebp-08]
:0041078C 8BC8                    mov ecx, eax
:0041078E C1E008                  shl eax, 08
:00410791 2BC1                    sub eax, ecx
:00410793 2BD2                    sub edx, edx
:00410795 F775FC                  div [ebp-04]
:00410798 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00410762(C), :0041076F(C), :00410779(C), :00410783(C)
|
:0041079B 8B4510                  mov eax, dword ptr [ebp+10]
:0041079E 8945EC                  mov dword ptr [ebp-14], eax
:004107A1 E960000000              jmp 00410806

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041080A(C)
|
:004107A6 817DF8A1000000          cmp dword ptr [ebp-08], 000000A1
:004107AD 0F820C000000            jb 004107BF
:004107B3 33C0                    xor eax, eax
:004107B5 E96D000000              jmp 00410827
:004107BA E923000000              jmp 004107E2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004107AD(C)
|
:004107BF 837DF851                cmp dword ptr [ebp-08], 00000051
:004107C3 0F820F000000            jb 004107D8
:004107C9 B801000000              mov eax, 00000001
:004107CE E954000000              jmp 00410827
:004107D3 E90A000000              jmp 004107E2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004107C3(C)
|
:004107D8 B802000000              mov eax, 00000002
:004107DD E945000000              jmp 00410827

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004107BA(U), :004107D3(U)
|
:004107E2 E938000000              jmp 0041081F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410814(C)
|
:004107E7 8B45F8                  mov eax, dword ptr [ebp-08]
:004107EA 0FAF4518                imul eax, dword ptr [ebp+18]
:004107EE B9FF000000              mov ecx, 000000FF
:004107F3 2BD2                    sub edx, edx
:004107F5 F7F1                    div ecx
:004107F7 E92B000000              jmp 00410827
:004107FC E91E000000              jmp 0041081F
:00410801 E919000000              jmp 0041081F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004107A1(U)
|
:00410806 837DEC00                cmp dword ptr [ebp-14], 00000000
:0041080A 0F8496FFFFFF            je 004107A6
:00410810 837DEC01                cmp dword ptr [ebp-14], 00000001
:00410814 0F84CDFFFFFF            je 004107E7
:0041081A E900000000              jmp 0041081F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004107E2(U), :004107FC(U), :00410801(U), :0041081A(U)
|
:0041081F 8B45F8                  mov eax, dword ptr [ebp-08]
:00410822 E900000000              jmp 00410827

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004107B5(U), :004107CE(U), :004107DD(U), :004107F7(U), :00410822(U)
|
:00410827 5F                      pop edi
:00410828 5E                      pop esi
:00410829 5B                      pop ebx
:0041082A C9                      leave
:0041082B C3                      ret



* Referenced by a CALL at Addresses:
|:0042AAE9   , :0042AB61   , :0043A0AB   , :0043A0EF   , :0043A452   
|:0043A47B   , :0043CA51   , :0043F737   , :0043F780   , :0043F7A6   
|:0043F7F2   , :0043F818   , :0043F83A   
|
:0041082C 55                      push ebp
:0041082D 8BEC                    mov ebp, esp
:0041082F 83EC10                  sub esp, 00000010
:00410832 53                      push ebx
:00410833 56                      push esi
:00410834 57                      push edi
:00410835 8B4510                  mov eax, dword ptr [ebp+10]
:00410838 8D04C540000000          lea eax, dword ptr [8*eax+00000040]
:0041083F C1E803                  shr eax, 03
:00410842 8945F8                  mov dword ptr [ebp-08], eax
:00410845 E84D670100              call 00426F97
:0041084A 8B451C                  mov eax, dword ptr [ebp+1C]
:0041084D 50                      push eax
:0041084E 8B4518                  mov eax, dword ptr [ebp+18]
:00410851 50                      push eax
:00410852 6A00                    push 00000000
:00410854 8B4508                  mov eax, dword ptr [ebp+08]
:00410857 50                      push eax
:00410858 8B4514                  mov eax, dword ptr [ebp+14]
:0041085B 50                      push eax
:0041085C E873FEFFFF              call 004106D4
:00410861 83C414                  add esp, 00000014
:00410864 8B048500F14400          mov eax, dword ptr [4*eax+0044F100]
:0041086B 8945F4                  mov dword ptr [ebp-0C], eax
:0041086E 6A0A                    push 0000000A
:00410870 6A00                    push 00000000
:00410872 6A0A                    push 0000000A
:00410874 8B451C                  mov eax, dword ptr [ebp+1C]
:00410877 50                      push eax
:00410878 8B45F8                  mov eax, dword ptr [ebp-08]
:0041087B 50                      push eax
:0041087C 8B450C                  mov eax, dword ptr [ebp+0C]
:0041087F 50                      push eax
:00410880 E8F2670100              call 00427077
:00410885 83C418                  add esp, 00000018
:00410888 6A04                    push 00000004
:0041088A 6A00                    push 00000000
:0041088C 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041088F 50                      push eax
:00410890 B940CF4600              mov ecx, 0046CF40
:00410895 E8866E0300              call 00447720
:0041089A 50                      push eax
:0041089B 6A08                    push 00000008
:0041089D 6A01                    push 00000001
:0041089F E806460300              call 00444EAA
:004108A4 83C40C                  add esp, 0000000C
:004108A7 8B451C                  mov eax, dword ptr [ebp+1C]
:004108AA 50                      push eax
:004108AB 8B4518                  mov eax, dword ptr [ebp+18]
:004108AE 50                      push eax
:004108AF 6A01                    push 00000001
:004108B1 8B4508                  mov eax, dword ptr [ebp+08]
:004108B4 50                      push eax
:004108B5 8B4514                  mov eax, dword ptr [ebp+14]
:004108B8 50                      push eax
:004108B9 E816FEFFFF              call 004106D4
:004108BE 83C414                  add esp, 00000014
:004108C1 8945FC                  mov dword ptr [ebp-04], eax
:004108C4 837DFC00                cmp dword ptr [ebp-04], 00000000
:004108C8 0F8420000000            je 004108EE
:004108CE 6A02                    push 00000002
:004108D0 8B45F8                  mov eax, dword ptr [ebp-08]
:004108D3 83C008                  add eax, 00000008
:004108D6 50                      push eax
:004108D7 8B450C                  mov eax, dword ptr [ebp+0C]
:004108DA 0345FC                  add eax, dword ptr [ebp-04]
:004108DD 50                      push eax
:004108DE 8B45F8                  mov eax, dword ptr [ebp-08]
:004108E1 50                      push eax
:004108E2 8B450C                  mov eax, dword ptr [ebp+0C]
:004108E5 50                      push eax
:004108E6 E8A6490300              call 00445291
:004108EB 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004108C8(C)
|
:004108EE E8C4660100              call 00426FB7
:004108F3 6A00                    push 00000000
:004108F5 B910BC4600              mov ecx, 0046BC10
:004108FA E8D1F40000              call 0041FDD0
:004108FF 6A04                    push 00000004
:00410901 B910BC4600              mov ecx, 0046BC10
:00410906 E876F50000              call 0041FE81
:0041090B 6A01                    push 00000001
:0041090D B910BC4600              mov ecx, 0046BC10
:00410912 E849F50000              call 0041FE60
:00410917 6A00                    push 00000000
:00410919 B910BC4600              mov ecx, 0046BC10
:0041091E E80FF50000              call 0041FE32
:00410923 6A07                    push 00000007
:00410925 B910BC4600              mov ecx, 0046BC10
:0041092A E8A4F30000              call 0041FCD3
:0041092F 8B4508                  mov eax, dword ptr [ebp+08]
:00410932 8945F0                  mov dword ptr [ebp-10], eax
:00410935 E903010000              jmp 00410A3D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410A4B(C)
|
:0041093A 8B4510                  mov eax, dword ptr [ebp+10]
:0041093D 50                      push eax
:0041093E 8B450C                  mov eax, dword ptr [ebp+0C]
:00410941 C1E803                  shr eax, 03
:00410944 83C003                  add eax, 00000003
:00410947 50                      push eax
:00410948 B910BC4600              mov ecx, 0046BC10
:0041094D E8B5F20000              call 0041FC07
:00410952 8B4D14                  mov ecx, dword ptr [ebp+14]
:00410955 E8368EFFFF              call 00409790
:0041095A 50                      push eax
:0041095B 8B4518                  mov eax, dword ptr [ebp+18]
:0041095E 50                      push eax

* Possible StringData Ref from Data Obj ->"%4u /%4u"
                                  |
:0041095F 6888F44400              push 0044F488
:00410964 6810BC4600              push 0046BC10
:00410969 E8B5010100              call 00420B23
:0041096E 83C410                  add esp, 00000010
:00410971 E9EA000000              jmp 00410A60

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410A55(C)
|
:00410976 8B4510                  mov eax, dword ptr [ebp+10]
:00410979 50                      push eax
:0041097A 8B450C                  mov eax, dword ptr [ebp+0C]
:0041097D C1E803                  shr eax, 03
:00410980 83C003                  add eax, 00000003
:00410983 50                      push eax
:00410984 B910BC4600              mov ecx, 0046BC10
:00410989 E879F20000              call 0041FC07
:0041098E 8B4D14                  mov ecx, dword ptr [ebp+14]
:00410991 E84A88FFFF              call 004091E0
:00410996 33C9                    xor ecx, ecx
:00410998 8AC8                    mov cl, al
:0041099A 51                      push ecx
:0041099B 8B4518                  mov eax, dword ptr [ebp+18]
:0041099E 50                      push eax

* Possible StringData Ref from Data Obj ->"%4u /%4u"
                                  |
:0041099F 6894F44400              push 0044F494
:004109A4 6810BC4600              push 0046BC10
:004109A9 E875010100              call 00420B23
:004109AE 83C410                  add esp, 00000010
:004109B1 E9AA000000              jmp 00410A60

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410A41(C)
|
:004109B6 8B4510                  mov eax, dword ptr [ebp+10]
:004109B9 50                      push eax
:004109BA 8B450C                  mov eax, dword ptr [ebp+0C]
:004109BD C1E803                  shr eax, 03
:004109C0 83C005                  add eax, 00000005
:004109C3 50                      push eax
:004109C4 B910BC4600              mov ecx, 0046BC10
:004109C9 E839F20000              call 0041FC07
:004109CE 8B4D14                  mov ecx, dword ptr [ebp+14]
:004109D1 E8BA8DFFFF              call 00409790
:004109D6 50                      push eax

* Possible StringData Ref from Data Obj ->"%3u"
                                  |
:004109D7 68A0F44400              push 0044F4A0
:004109DC 6810BC4600              push 0046BC10
:004109E1 E83D010100              call 00420B23
:004109E6 83C40C                  add esp, 0000000C
:004109E9 E972000000              jmp 00410A60

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410A5B(U)
|
:004109EE 8B4510                  mov eax, dword ptr [ebp+10]
:004109F1 50                      push eax
:004109F2 8B450C                  mov eax, dword ptr [ebp+0C]
:004109F5 C1E803                  shr eax, 03
:004109F8 83C005                  add eax, 00000005
:004109FB 50                      push eax
:004109FC B910BC4600              mov ecx, 0046BC10
:00410A01 E801F20000              call 0041FC07
:00410A06 8B451C                  mov eax, dword ptr [ebp+1C]
:00410A09 50                      push eax
:00410A0A 8B4518                  mov eax, dword ptr [ebp+18]
:00410A0D 50                      push eax
:00410A0E 6A02                    push 00000002
:00410A10 8B4508                  mov eax, dword ptr [ebp+08]
:00410A13 50                      push eax
:00410A14 8B4514                  mov eax, dword ptr [ebp+14]
:00410A17 50                      push eax
:00410A18 E8B7FCFFFF              call 004106D4
:00410A1D 83C414                  add esp, 00000014
:00410A20 50                      push eax

* Possible StringData Ref from Data Obj ->"%3u"
                                  |
:00410A21 68A4F44400              push 0044F4A4
:00410A26 6810BC4600              push 0046BC10
:00410A2B E8F3000100              call 00420B23
:00410A30 83C40C                  add esp, 0000000C
:00410A33 E928000000              jmp 00410A60
:00410A38 E923000000              jmp 00410A60

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410935(U)
|
:00410A3D 837DF003                cmp dword ptr [ebp-10], 00000003
:00410A41 0F846FFFFFFF            je 004109B6
:00410A47 837DF00B                cmp dword ptr [ebp-10], 0000000B
:00410A4B 0F84E9FEFFFF            je 0041093A
:00410A51 837DF00C                cmp dword ptr [ebp-10], 0000000C
:00410A55 0F841BFFFFFF            je 00410976
:00410A5B E98EFFFFFF              jmp 004109EE

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00410971(U), :004109B1(U), :004109E9(U), :00410A33(U), :00410A38(U)
|
:00410A60 6A00                    push 00000000
:00410A62 B910BC4600              mov ecx, 0046BC10
:00410A67 E8F4F30000              call 0041FE60
:00410A6C E900000000              jmp 00410A71

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410A6C(U)
|
:00410A71 5F                      pop edi
:00410A72 5E                      pop esi
:00410A73 5B                      pop ebx
:00410A74 C9                      leave
:00410A75 C3                      ret



* Referenced by a CALL at Addresses:
|:00410D13   , :004252F3   
|
:00410A76 55                      push ebp
:00410A77 8BEC                    mov ebp, esp
:00410A79 83EC20                  sub esp, 00000020
:00410A7C 53                      push ebx
:00410A7D 56                      push esi
:00410A7E 57                      push edi
:00410A7F C745F0E8564500          mov [ebp-10], 004556E8
:00410A86 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00410A89 E8C2030000              call 00410E50
:00410A8E 8845F8                  mov byte ptr [ebp-08], al
:00410A91 C745E400000000          mov [ebp-1C], 00000000
:00410A98 C745FC00D54500          mov [ebp-04], 0045D500
:00410A9F C745EC00000000          mov [ebp-14], 00000000
:00410AA6 E907000000              jmp 00410AB2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410B0A(U)
|
:00410AAB FF45EC                  inc [ebp-14]
:00410AAE 8345F036                add dword ptr [ebp-10], 00000036

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410AA6(U)
|
:00410AB2 817DEC00020000          cmp dword ptr [ebp-14], 00000200
:00410AB9 0F8350000000            jnb 00410B0F
:00410ABF 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00410AC2 E889030000              call 00410E50
:00410AC7 33C9                    xor ecx, ecx
:00410AC9 8AC8                    mov cl, al
:00410ACB 85C9                    test ecx, ecx
:00410ACD 0F8415000000            je 00410AE8
:00410AD3 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00410AD6 E875030000              call 00410E50
:00410ADB 33C9                    xor ecx, ecx
:00410ADD 8AC8                    mov cl, al
:00410ADF 83F906                  cmp ecx, 00000006
:00410AE2 0F8522000000            jne 00410B0A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410ACD(C)
|
:00410AE8 8B45EC                  mov eax, dword ptr [ebp-14]
:00410AEB 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00410AEE 6689044D70524500        mov word ptr [2*ecx+00455270], ax
:00410AF6 FF45E4                  inc [ebp-1C]
:00410AF9 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00410AFC E8DF89FFFF              call 004094E0
:00410B01 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00410B04 8901                    mov dword ptr [ecx], eax
:00410B06 8345FC04                add dword ptr [ebp-04], 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410AE2(C)
|
:00410B0A E99CFFFFFF              jmp 00410AAB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410AB9(C)
|
:00410B0F 8B45FC                  mov eax, dword ptr [ebp-04]
:00410B12 C70000000000            mov dword ptr [eax], 00000000
:00410B18 C745F470000000          mov [ebp-0C], 00000070
:00410B1F 837DE406                cmp dword ptr [ebp-1C], 00000006
:00410B23 0F8604000000            jbe 00410B2D
:00410B29 8345F410                add dword ptr [ebp-0C], 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410B23(C)
|
:00410B2D C645E000                mov [ebp-20], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410B9B(U)
|
:00410B31 B988534500              mov ecx, 00455388
:00410B36 E8B711FFFF              call 00401CF2
:00410B3B 8D45E0                  lea eax, dword ptr [ebp-20]
:00410B3E 50                      push eax
:00410B3F 6A06                    push 00000006
:00410B41 6A00                    push 00000000
:00410B43 68A0000000              push 000000A0
:00410B48 6A0A                    push 0000000A
:00410B4A 6800D54500              push 0045D500
:00410B4F 6A28                    push 00000028
:00410B51 6A50                    push 00000050
:00410B53 E89C720200              call 00437DF4
:00410B58 83C420                  add esp, 00000020
:00410B5B 8845E8                  mov byte ptr [ebp-18], al
:00410B5E 33C0                    xor eax, eax
:00410B60 8A45E8                  mov al, byte ptr [ebp-18]
:00410B63 3DFF000000              cmp eax, 000000FF
:00410B68 0F850A000000            jne 00410B78
:00410B6E E92D000000              jmp 00410BA0
:00410B73 E923000000              jmp 00410B9B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410B68(C)
|
:00410B78 6A01                    push 00000001
:00410B7A 33C0                    xor eax, eax
:00410B7C 8A45E8                  mov al, byte ptr [ebp-18]
:00410B7F 33C9                    xor ecx, ecx
:00410B81 668B0C4570524500        mov cx, word ptr [2*eax+00455270]
:00410B89 51                      push ecx
:00410B8A E84AE30000              call 0041EED9
:00410B8F 83C404                  add esp, 00000004
:00410B92 50                      push eax
:00410B93 E8CCE30200              call 0043EF64
:00410B98 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410B73(U)
|
:00410B9B E991FFFFFF              jmp 00410B31

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410B6E(U)
|
:00410BA0 E900000000              jmp 00410BA5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410BA0(U)
|
:00410BA5 5F                      pop edi
:00410BA6 5E                      pop esi
:00410BA7 5B                      pop ebx
:00410BA8 C9                      leave
:00410BA9 C3                      ret



* Referenced by a CALL at Addresses:
|:00410D1D   , :0042527C   
|
:00410BAA 55                      push ebp
:00410BAB 8BEC                    mov ebp, esp
:00410BAD 83EC08                  sub esp, 00000008
:00410BB0 53                      push ebx
:00410BB1 56                      push esi
:00410BB2 57                      push edi
:00410BB3 B9B0C44600              mov ecx, 0046C4B0
:00410BB8 E8C3020000              call 00410E80
:00410BBD 8945FC                  mov dword ptr [ebp-04], eax
:00410BC0 8B45FC                  mov eax, dword ptr [ebp-04]
:00410BC3 33C9                    xor ecx, ecx
:00410BC5 8A08                    mov cl, byte ptr [eax]
:00410BC7 85C9                    test ecx, ecx
:00410BC9 0F840B000000            je 00410BDA
:00410BCF 8B45FC                  mov eax, dword ptr [ebp-04]
:00410BD2 8945F8                  mov dword ptr [ebp-08], eax
:00410BD5 E907000000              jmp 00410BE1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410BC9(C)
|

* Possible StringData Ref from Data Obj ->"ڲʾ"
                                  |
:00410BDA C745F8A8F44400          mov [ebp-08], 0044F4A8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410BD5(U)
|
:00410BE1 8B45F8                  mov eax, dword ptr [ebp-08]
:00410BE4 50                      push eax
:00410BE5 6A00                    push 00000000
:00410BE7 E849830200              call 00438F35
:00410BEC 83C408                  add esp, 00000008
:00410BEF E900000000              jmp 00410BF4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410BEF(U)
|
:00410BF4 5F                      pop edi
:00410BF5 5E                      pop esi
:00410BF6 5B                      pop ebx
:00410BF7 C9                      leave
:00410BF8 C3                      ret



* Referenced by a CALL at Addresses:
|:0040F071   , :00413A03   
|
:00410BF9 55                      push ebp
:00410BFA 8BEC                    mov ebp, esp
:00410BFC 83EC04                  sub esp, 00000004
:00410BFF 53                      push ebx
:00410C00 56                      push esi
:00410C01 57                      push edi
:00410C02 813D64F94600419C0000    cmp dword ptr [0046F964], 00009C41
:00410C0C 0F8C33020000            jl 00410E45
:00410C12 A164F94600              mov eax, dword ptr [0046F964]
:00410C17 8945FC                  mov dword ptr [ebp-04], eax
:00410C1A E958010000              jmp 00410D77
:00410C1F A164F94600              mov eax, dword ptr [0046F964]
:00410C24 2D4C9C0000              sub eax, 00009C4C
:00410C29 50                      push eax
:00410C2A E8B4F3FFFF              call 0040FFE3
:00410C2F 83C404                  add esp, 00000004
:00410C32 E90E020000              jmp 00410E45
:00410C37 A164F94600              mov eax, dword ptr [0046F964]
:00410C3C 2D509C0000              sub eax, 00009C50
:00410C41 83F801                  cmp eax, 00000001
:00410C44 1BC0                    sbb eax, eax
:00410C46 F7D8                    neg eax
:00410C48 50                      push eax
:00410C49 E87AF2FFFF              call 0040FEC8
:00410C4E 83C404                  add esp, 00000004
:00410C51 E9EF010000              jmp 00410E45
:00410C56 A164F94600              mov eax, dword ptr [0046F964]
:00410C5B 2D529C0000              sub eax, 00009C52
:00410C60 83F801                  cmp eax, 00000001
:00410C63 1BC0                    sbb eax, eax
:00410C65 F7D8                    neg eax
:00410C67 50                      push eax
:00410C68 E862F6FFFF              call 004102CF
:00410C6D 83C404                  add esp, 00000004
:00410C70 E9D0010000              jmp 00410E45
:00410C75 A164F94600              mov eax, dword ptr [0046F964]
:00410C7A 2D549C0000              sub eax, 00009C54
:00410C7F 83F801                  cmp eax, 00000001
:00410C82 1BC0                    sbb eax, eax
:00410C84 F7D8                    neg eax
:00410C86 50                      push eax
:00410C87 E8D3F5FFFF              call 0041025F
:00410C8C 83C404                  add esp, 00000004
:00410C8F E9B1010000              jmp 00410E45
:00410C94 A164F94600              mov eax, dword ptr [0046F964]
:00410C99 2D999C0000              sub eax, 00009C99
:00410C9E 50                      push eax
:00410C9F E8E2F3FFFF              call 00410086
:00410CA4 83C404                  add esp, 00000004
:00410CA7 E999010000              jmp 00410E45
:00410CAC A164F94600              mov eax, dword ptr [0046F964]
:00410CB1 2D919C0000              sub eax, 00009C91
:00410CB6 50                      push eax
:00410CB7 E854F1FFFF              call 0040FE10
:00410CBC 83C404                  add esp, 00000004
:00410CBF E981010000              jmp 00410E45
:00410CC4 A164F94600              mov eax, dword ptr [0046F964]
:00410CC9 2D839C0000              sub eax, 00009C83
:00410CCE 83F801                  cmp eax, 00000001
:00410CD1 1BC0                    sbb eax, eax
:00410CD3 F7D8                    neg eax
:00410CD5 50                      push eax
:00410CD6 E8FBF7FFFF              call 004104D6
:00410CDB 83C404                  add esp, 00000004
:00410CDE E962010000              jmp 00410E45
:00410CE3 6A00                    push 00000000
:00410CE5 6A00                    push 00000000
:00410CE7 6A10                    push 00000010
:00410CE9 A198D44500              mov eax, dword ptr [0045D498]
:00410CEE 50                      push eax

* Reference To: USER32.PostMessageA, Ord:01A3h
                                  |
:00410CEF FF1524744700            Call dword ptr [00477424]
:00410CF5 E94B010000              jmp 00410E45
:00410CFA 6A00                    push 00000000
:00410CFC E886F9FFFF              call 00410687
:00410D01 83C404                  add esp, 00000004
:00410D04 E93C010000              jmp 00410E45
:00410D09 E8C7F8FFFF              call 004105D5
:00410D0E E932010000              jmp 00410E45
:00410D13 E85EFDFFFF              call 00410A76
:00410D18 E928010000              jmp 00410E45
:00410D1D E888FEFFFF              call 00410BAA
:00410D22 E91E010000              jmp 00410E45
:00410D27 E8DFF2FFFF              call 0041000B
:00410D2C E914010000              jmp 00410E45
:00410D31 E886F7FFFF              call 004104BC
:00410D36 E90A010000              jmp 00410E45
:00410D3B E862F7FFFF              call 004104A2
:00410D40 E900010000              jmp 00410E45
:00410D45 E866F3FFFF              call 004100B0
:00410D4A E9F6000000              jmp 00410E45
:00410D4F E8FBF0FFFF              call 0040FE4F
:00410D54 E9EC000000              jmp 00410E45
:00410D59 E8DDF1FFFF              call 0040FF3B
:00410D5E E9E2000000              jmp 00410E45
:00410D63 E8E1F7FFFF              call 00410549
:00410D68 E9D8000000              jmp 00410E45
:00410D6D E9D3000000              jmp 00410E45
:00410D72 E9CE000000              jmp 00410E45

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410C1A(U)
|
:00410D77 816DFC419C0000          sub dword ptr [ebp-04], 00009C41
:00410D7E 837DFC5A                cmp dword ptr [ebp-04], 0000005A
:00410D82 0F87BD000000            ja 00410E45
:00410D88 8B45FC                  mov eax, dword ptr [ebp-04]
:00410D8B 33C9                    xor ecx, ecx
:00410D8D 8A88EA0D4100            mov cl, byte ptr [eax+00410DEA]
:00410D93 FF248D9A0D4100          jmp dword ptr [4*ecx+00410D9A]

:00410D9A E30C4100                DWORD 00410CE3
:00410D9E 130D4100                DWORD 00410D13
:00410DA2 1D0D4100                DWORD 00410D1D
:00410DA6 FA0C4100                DWORD 00410CFA
:00410DAA 090D4100                DWORD 00410D09
:00410DAE 1F0C4100                DWORD 00410C1F
:00410DB2 370C4100                DWORD 00410C37
:00410DB6 560C4100                DWORD 00410C56
:00410DBA 750C4100                DWORD 00410C75
:00410DBE 270D4100                DWORD 00410D27
:00410DC2 310D4100                DWORD 00410D31
:00410DC6 3B0D4100                DWORD 00410D3B
:00410DCA 450D4100                DWORD 00410D45
:00410DCE 4F0D4100                DWORD 00410D4F
:00410DD2 590D4100                DWORD 00410D59
:00410DD6 630D4100                DWORD 00410D63
:00410DDA C40C4100                DWORD 00410CC4
:00410DDE AC0C4100                DWORD 00410CAC
:00410DE2 940C4100                DWORD 00410C94
:00410DE6 6D0D4100                DWORD 00410D6D


:00410DEA 0001                    add byte ptr [ecx], al
:00410DEC 1313                    adc edx, dword ptr [ebx]
:00410DEE 0203                    add al, byte ptr [ebx]
:00410DF0 0413                    add al, 13
:00410DF2 1313                    adc edx, dword ptr [ebx]
:00410DF4 130505050506            adc eax, dword ptr [06050505]
:00410DFA 06                      push es
:00410DFB 07                      pop es
:00410DFC 07                      pop es
:00410DFD 0808                    or byte ptr [eax], cl
:00410DFF 090A                    or dword ptr [edx], ecx
:00410E01 0B0C0D0E130F13          or ecx, dword ptr [ecx+130F130E]
:00410E08 1313                    adc edx, dword ptr [ebx]
:00410E0A 1313                    adc edx, dword ptr [ebx]
:00410E0C 1313                    adc edx, dword ptr [ebx]
:00410E0E 1313                    adc edx, dword ptr [ebx]
:00410E10 1313                    adc edx, dword ptr [ebx]
:00410E12 1313                    adc edx, dword ptr [ebx]
:00410E14 1313                    adc edx, dword ptr [ebx]
:00410E16 1313                    adc edx, dword ptr [ebx]
:00410E18 1313                    adc edx, dword ptr [ebx]
:00410E1A 1313                    adc edx, dword ptr [ebx]
:00410E1C 1313                    adc edx, dword ptr [ebx]
:00410E1E 1313                    adc edx, dword ptr [ebx]
:00410E20 1313                    adc edx, dword ptr [ebx]
:00410E22 1313                    adc edx, dword ptr [ebx]
:00410E24 1313                    adc edx, dword ptr [ebx]
:00410E26 1313                    adc edx, dword ptr [ebx]
:00410E28 1313                    adc edx, dword ptr [ebx]
:00410E2A 1313                    adc edx, dword ptr [ebx]
:00410E2C 1010                    adc byte ptr [eax], dl
:00410E2E 1313                    adc edx, dword ptr [ebx]
:00410E30 1313                    adc edx, dword ptr [ebx]
:00410E32 1313                    adc edx, dword ptr [ebx]
:00410E34 1313                    adc edx, dword ptr [ebx]
:00410E36 1313                    adc edx, dword ptr [ebx]
:00410E38 1313                    adc edx, dword ptr [ebx]
:00410E3A 1111                    adc dword ptr [ecx], edx
:00410E3C 1111                    adc dword ptr [ecx], edx
:00410E3E 1111                    adc dword ptr [ecx], edx
:00410E40 1111                    adc dword ptr [ecx], edx
:00410E42 1212                    adc dl, byte ptr [edx]
:00410E44 12E9                    adc ch, cl
:00410E46 00000000                BYTE  4 DUP(0)


:00410E4A 5F                      pop edi
:00410E4B 5E                      pop esi
:00410E4C 5B                      pop ebx
:00410E4D C9                      leave
:00410E4E C3                      ret


:00410E4F CC                      int 03

* Referenced by a CALL at Addresses:
|:00410A89   , :00410AC2   , :00410AD6   , :00416141   , :00416250   
|:0041634A   , :00416409   , :00427E84   , :00427EA4   , :00428E8A   
|:0042CA7F   , :0042CAC6   , :0042CB0D   , :00433DA6   , :00433F0D   
|:00433F21   , :00435E5C   , :00435E71   , :0044096F   , :00440994   
|
:00410E50 55                      push ebp
:00410E51 8BEC                    mov ebp, esp
:00410E53 83EC04                  sub esp, 00000004
:00410E56 53                      push ebx
:00410E57 56                      push esi
:00410E58 57                      push edi
:00410E59 894DFC                  mov dword ptr [ebp-04], ecx
:00410E5C 8B45FC                  mov eax, dword ptr [ebp-04]
:00410E5F 33C9                    xor ecx, ecx
:00410E61 8A481A                  mov cl, byte ptr [eax+1A]
:00410E64 80E11F                  and cl, 1F
:00410E67 8AC1                    mov al, cl
:00410E69 E900000000              jmp 00410E6E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410E69(U)
|
:00410E6E 5F                      pop edi
:00410E6F 5E                      pop esi
:00410E70 5B                      pop ebx
:00410E71 C9                      leave
:00410E72 C3                      ret


:00410E73 CC                      int 03
:00410E74 CC                      int 03
:00410E75 CC                      int 03
:00410E76 CC                      int 03
:00410E77 CC                      int 03
:00410E78 CC                      int 03
:00410E79 CC                      int 03
:00410E7A CC                      int 03
:00410E7B CC                      int 03
:00410E7C CC                      int 03
:00410E7D CC                      int 03
:00410E7E CC                      int 03
:00410E7F CC                      int 03

* Referenced by a CALL at Addresses:
|:00410BB8   , :00443DEB   
|
:00410E80 55                      push ebp
:00410E81 8BEC                    mov ebp, esp
:00410E83 83EC04                  sub esp, 00000004
:00410E86 53                      push ebx
:00410E87 56                      push esi
:00410E88 57                      push edi
:00410E89 894DFC                  mov dword ptr [ebp-04], ecx
:00410E8C 8B45FC                  mov eax, dword ptr [ebp-04]
:00410E8F 0598070000              add eax, 00000798
:00410E94 E900000000              jmp 00410E99

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410E94(U)
|
:00410E99 5F                      pop edi
:00410E9A 5E                      pop esi
:00410E9B 5B                      pop ebx
:00410E9C C9                      leave
:00410E9D C3                      ret


:00410E9E CC                      int 03
:00410E9F CC                      int 03
:00410EA0 55                      push ebp
:00410EA1 8BEC                    mov ebp, esp
:00410EA3 53                      push ebx
:00410EA4 56                      push esi
:00410EA5 57                      push edi
:00410EA6 E80F000000              call 00410EBA
:00410EAB E832000000              call 00410EE2
:00410EB0 E900000000              jmp 00410EB5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410EB0(U)
|
:00410EB5 5F                      pop edi
:00410EB6 5E                      pop esi
:00410EB7 5B                      pop ebx
:00410EB8 C9                      leave
:00410EB9 C3                      ret



* Referenced by a CALL at Address:
|:00410EA6   
|
:00410EBA 55                      push ebp
:00410EBB 8BEC                    mov ebp, esp
:00410EBD 53                      push ebx
:00410EBE 56                      push esi
:00410EBF 57                      push edi
:00410EC0 68F0784100              push 004178F0
:00410EC5 68C0784100              push 004178C0
:00410ECA 6A08                    push 00000008
:00410ECC 6A0E                    push 0000000E
:00410ECE 6808A64600              push 0046A608
:00410ED3 E8686E0300              call 00447D40
:00410ED8 E900000000              jmp 00410EDD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410ED8(U)
|
:00410EDD 5F                      pop edi
:00410EDE 5E                      pop esi
:00410EDF 5B                      pop ebx
:00410EE0 C9                      leave
:00410EE1 C3                      ret



* Referenced by a CALL at Address:
|:00410EAB   
|
:00410EE2 55                      push ebp
:00410EE3 8BEC                    mov ebp, esp
:00410EE5 53                      push ebx
:00410EE6 56                      push esi
:00410EE7 57                      push edi
:00410EE8 68FF0E4100              push 00410EFF
:00410EED E8EE6D0300              call 00447CE0
:00410EF2 83C404                  add esp, 00000004
:00410EF5 E900000000              jmp 00410EFA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410EF5(U)
|
:00410EFA 5F                      pop edi
:00410EFB 5E                      pop esi
:00410EFC 5B                      pop ebx
:00410EFD C9                      leave
:00410EFE C3                      ret


:00410EFF 55                      push ebp
:00410F00 8BEC                    mov ebp, esp
:00410F02 53                      push ebx
:00410F03 56                      push esi
:00410F04 57                      push edi
:00410F05 68F0784100              push 004178F0
:00410F0A 6A08                    push 00000008
:00410F0C 6A0E                    push 0000000E
:00410F0E 6808A64600              push 0046A608
:00410F13 E8B86E0300              call 00447DD0
:00410F18 E900000000              jmp 00410F1D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410F18(U)
|
:00410F1D 5F                      pop edi
:00410F1E 5E                      pop esi
:00410F1F 5B                      pop ebx
:00410F20 C9                      leave
:00410F21 C3                      ret


:00410F22 55                      push ebp
:00410F23 8BEC                    mov ebp, esp
:00410F25 53                      push ebx
:00410F26 56                      push esi
:00410F27 57                      push edi
:00410F28 E80F000000              call 00410F3C
:00410F2D E824000000              call 00410F56
:00410F32 E900000000              jmp 00410F37

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410F32(U)
|
:00410F37 5F                      pop edi
:00410F38 5E                      pop esi
:00410F39 5B                      pop ebx
:00410F3A C9                      leave
:00410F3B C3                      ret



* Referenced by a CALL at Address:
|:00410F28   
|
:00410F3C 55                      push ebp
:00410F3D 8BEC                    mov ebp, esp
:00410F3F 53                      push ebx
:00410F40 56                      push esi
:00410F41 57                      push edi
:00410F42 B960F74500              mov ecx, 0045F760
:00410F47 E8C4690000              call 00417910
:00410F4C E900000000              jmp 00410F51

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410F4C(U)
|
:00410F51 5F                      pop edi
:00410F52 5E                      pop esi
:00410F53 5B                      pop ebx
:00410F54 C9                      leave
:00410F55 C3                      ret



* Referenced by a CALL at Address:
|:00410F2D   
|
:00410F56 55                      push ebp
:00410F57 8BEC                    mov ebp, esp
:00410F59 53                      push ebx
:00410F5A 56                      push esi
:00410F5B 57                      push edi
:00410F5C 68730F4100              push 00410F73
:00410F61 E87A6D0300              call 00447CE0
:00410F66 83C404                  add esp, 00000004
:00410F69 E900000000              jmp 00410F6E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410F69(U)
|
:00410F6E 5F                      pop edi
:00410F6F 5E                      pop esi
:00410F70 5B                      pop ebx
:00410F71 C9                      leave
:00410F72 C3                      ret


:00410F73 55                      push ebp
:00410F74 8BEC                    mov ebp, esp
:00410F76 53                      push ebx
:00410F77 56                      push esi
:00410F78 57                      push edi
:00410F79 B960F74500              mov ecx, 0045F760
:00410F7E E80D6A0000              call 00417990
:00410F83 E900000000              jmp 00410F88

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410F83(U)
|
:00410F88 5F                      pop edi
:00410F89 5E                      pop esi
:00410F8A 5B                      pop ebx
:00410F8B C9                      leave
:00410F8C C3                      ret


:00410F8D 55                      push ebp
:00410F8E 8BEC                    mov ebp, esp
:00410F90 53                      push ebx
:00410F91 56                      push esi
:00410F92 57                      push edi
:00410F93 E80F000000              call 00410FA7
:00410F98 E835000000              call 00410FD2
:00410F9D E900000000              jmp 00410FA2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410F9D(U)
|
:00410FA2 5F                      pop edi
:00410FA3 5E                      pop esi
:00410FA4 5B                      pop ebx
:00410FA5 C9                      leave
:00410FA6 C3                      ret



* Referenced by a CALL at Address:
|:00410F93   
|
:00410FA7 55                      push ebp
:00410FA8 8BEC                    mov ebp, esp
:00410FAA 53                      push ebx
:00410FAB 56                      push esi
:00410FAC 57                      push edi
:00410FAD 68007B4100              push 00417B00
:00410FB2 68F0794100              push 004179F0
:00410FB7 6881000000              push 00000081
:00410FBC 6A3E                    push 0000003E
:00410FBE 68D8D54500              push 0045D5D8
:00410FC3 E8786D0300              call 00447D40
:00410FC8 E900000000              jmp 00410FCD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410FC8(U)
|
:00410FCD 5F                      pop edi
:00410FCE 5E                      pop esi
:00410FCF 5B                      pop ebx
:00410FD0 C9                      leave
:00410FD1 C3                      ret



* Referenced by a CALL at Address:
|:00410F98   
|
:00410FD2 55                      push ebp
:00410FD3 8BEC                    mov ebp, esp
:00410FD5 53                      push ebx
:00410FD6 56                      push esi
:00410FD7 57                      push edi
:00410FD8 68EF0F4100              push 00410FEF
:00410FDD E8FE6C0300              call 00447CE0
:00410FE2 83C404                  add esp, 00000004
:00410FE5 E900000000              jmp 00410FEA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410FE5(U)
|
:00410FEA 5F                      pop edi
:00410FEB 5E                      pop esi
:00410FEC 5B                      pop ebx
:00410FED C9                      leave
:00410FEE C3                      ret


:00410FEF 55                      push ebp
:00410FF0 8BEC                    mov ebp, esp
:00410FF2 53                      push ebx
:00410FF3 56                      push esi
:00410FF4 57                      push edi
:00410FF5 68007B4100              push 00417B00
:00410FFA 6881000000              push 00000081
:00410FFF 6A3E                    push 0000003E
:00411001 68D8D54500              push 0045D5D8
:00411006 E8C56D0300              call 00447DD0
:0041100B E900000000              jmp 00411010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041100B(U)
|
:00411010 5F                      pop edi
:00411011 5E                      pop esi
:00411012 5B                      pop ebx
:00411013 C9                      leave
:00411014 C3                      ret



* Referenced by a CALL at Addresses:
|:00411050   , :00417093   , :00417A7F   
|
:00411015 55                      push ebp
:00411016 8BEC                    mov ebp, esp
:00411018 53                      push ebx
:00411019 56                      push esi
:0041101A 57                      push edi
:0041101B 8B4508                  mov eax, dword ptr [ebp+08]
:0041101E 25FFFF0000              and eax, 0000FFFF
:00411023 8B0485F0144500          mov eax, dword ptr [4*eax+004514F0]
:0041102A 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0041102D 81E1FFFF0000            and ecx, 0000FFFF
:00411033 8D0CC9                  lea ecx, dword ptr [ecx+8*ecx]
:00411036 03C1                    add eax, ecx
:00411038 E900000000              jmp 0041103D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411038(U)
|
:0041103D 5F                      pop edi
:0041103E 5E                      pop esi
:0041103F 5B                      pop ebx
:00411040 C9                      leave
:00411041 C3                      ret


:00411042 55                      push ebp
:00411043 8BEC                    mov ebp, esp
:00411045 53                      push ebx
:00411046 56                      push esi
:00411047 57                      push edi
:00411048 8B450C                  mov eax, dword ptr [ebp+0C]
:0041104B 50                      push eax
:0041104C 8B4508                  mov eax, dword ptr [ebp+08]
:0041104F 50                      push eax
:00411050 E8C0FFFFFF              call 00411015
:00411055 83C408                  add esp, 00000008
:00411058 8A00                    mov al, byte ptr [eax]
:0041105A E900000000              jmp 0041105F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041105A(U)
|
:0041105F 5F                      pop edi
:00411060 5E                      pop esi
:00411061 5B                      pop ebx
:00411062 C9                      leave
:00411063 C3                      ret



* Referenced by a CALL at Addresses:
|:00414E46   , :00414F9A   
|
:00411064 55                      push ebp
:00411065 8BEC                    mov ebp, esp
:00411067 53                      push ebx
:00411068 56                      push esi
:00411069 57                      push edi
:0041106A 8B4508                  mov eax, dword ptr [ebp+08]
:0041106D 2DD8D54500              sub eax, 0045D5D8
:00411072 B93E000000              mov ecx, 0000003E
:00411077 99                      cdq
:00411078 F7F9                    idiv ecx
:0041107A E900000000              jmp 0041107F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041107A(U)
|
:0041107F 5F                      pop edi
:00411080 5E                      pop esi
:00411081 5B                      pop ebx
:00411082 C9                      leave
:00411083 C3                      ret



* Referenced by a CALL at Addresses:
|:00415699   , :00415935   , :00415C93   , :0041657C   , :00416943   
|:00417635   
|
:00411084 55                      push ebp
:00411085 8BEC                    mov ebp, esp
:00411087 53                      push ebx
:00411088 56                      push esi
:00411089 57                      push edi
:0041108A 8B4508                  mov eax, dword ptr [ebp+08]
:0041108D 2500FE0000              and eax, 0000FE00
:00411092 E900000000              jmp 00411097

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411092(U)
|
:00411097 5F                      pop edi
:00411098 5E                      pop esi
:00411099 5B                      pop ebx
:0041109A C9                      leave
:0041109B C3                      ret



* Referenced by a CALL at Addresses:
|:0041591D   , :00415C83   
|
:0041109C 55                      push ebp
:0041109D 8BEC                    mov ebp, esp
:0041109F 53                      push ebx
:004110A0 56                      push esi
:004110A1 57                      push edi
:004110A2 8B4508                  mov eax, dword ptr [ebp+08]
:004110A5 25FF010000              and eax, 000001FF
:004110AA E900000000              jmp 004110AF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004110AA(U)
|
:004110AF 5F                      pop edi
:004110B0 5E                      pop esi
:004110B1 5B                      pop ebx
:004110B2 C9                      leave
:004110B3 C3                      ret



* Referenced by a CALL at Addresses:
|:00414DCE   , :0041510A   , :00415A66   
|
:004110B4 55                      push ebp
:004110B5 8BEC                    mov ebp, esp
:004110B7 83EC0C                  sub esp, 0000000C
:004110BA 53                      push ebx
:004110BB 56                      push esi
:004110BC 57                      push edi
:004110BD 8B4508                  mov eax, dword ptr [ebp+08]
:004110C0 2500FE0000              and eax, 0000FE00
:004110C5 668945F8                mov word ptr [ebp-08], ax
:004110C9 8B4508                  mov eax, dword ptr [ebp+08]
:004110CC 25FF010000              and eax, 000001FF
:004110D1 66894508                mov word ptr [ebp+08], ax
:004110D5 C745FC60F74500          mov [ebp-04], 0045F760
:004110DC 8B45F8                  mov eax, dword ptr [ebp-08]
:004110DF 25FFFF0000              and eax, 0000FFFF
:004110E4 8945F4                  mov dword ptr [ebp-0C], eax
:004110E7 E937000000              jmp 00411123

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041112A(C)
|
:004110EC 8B4508                  mov eax, dword ptr [ebp+08]
:004110EF 25FFFF0000              and eax, 0000FFFF
:004110F4 50                      push eax
:004110F5 E8DFDD0000              call 0041EED9
:004110FA 83C404                  add esp, 00000004
:004110FD 8945FC                  mov dword ptr [ebp-04], eax
:00411100 E93D000000              jmp 00411142

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411137(C)
|
:00411105 8B4508                  mov eax, dword ptr [ebp+08]
:00411108 25FFFF0000              and eax, 0000FFFF
:0041110D 50                      push eax
:0041110E E819DE0000              call 0041EF2C
:00411113 83C404                  add esp, 00000004
:00411116 8945FC                  mov dword ptr [ebp-04], eax
:00411119 E924000000              jmp 00411142
:0041111E E91F000000              jmp 00411142

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004110E7(U)
|
:00411123 817DF400020000          cmp dword ptr [ebp-0C], 00000200
:0041112A 0F84BCFFFFFF            je 004110EC
:00411130 817DF400040000          cmp dword ptr [ebp-0C], 00000400
:00411137 0F84C8FFFFFF            je 00411105
:0041113D E900000000              jmp 00411142

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00411100(U), :00411119(U), :0041111E(U), :0041113D(U)
|
:00411142 8B45FC                  mov eax, dword ptr [ebp-04]
:00411145 E900000000              jmp 0041114A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411145(U)
|
:0041114A 5F                      pop edi
:0041114B 5E                      pop esi
:0041114C 5B                      pop ebx
:0041114D C9                      leave
:0041114E C3                      ret



* Referenced by a CALL at Address:
|:00416A50   
|
:0041114F 55                      push ebp
:00411150 8BEC                    mov ebp, esp
:00411152 83EC08                  sub esp, 00000008
:00411155 53                      push ebx
:00411156 56                      push esi
:00411157 57                      push edi
:00411158 8B4508                  mov eax, dword ptr [ebp+08]
:0041115B 2500FE0000              and eax, 0000FE00
:00411160 668945FC                mov word ptr [ebp-04], ax
:00411164 8B4508                  mov eax, dword ptr [ebp+08]
:00411167 25FF010000              and eax, 000001FF
:0041116C 66894508                mov word ptr [ebp+08], ax
:00411170 8B45FC                  mov eax, dword ptr [ebp-04]
:00411173 25FFFF0000              and eax, 0000FFFF
:00411178 8945F8                  mov dword ptr [ebp-08], eax
:0041117B E93F000000              jmp 004111BF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004111C6(C)
|
:00411180 8B4508                  mov eax, dword ptr [ebp+08]
:00411183 25FFFF0000              and eax, 0000FFFF
:00411188 50                      push eax
:00411189 E84BDD0000              call 0041EED9
:0041118E 83C404                  add esp, 00000004
:00411191 8BC8                    mov ecx, eax
:00411193 E84883FFFF              call 004094E0
:00411198 E950000000              jmp 004111ED

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004111D3(C)
|
:0041119D 8B4508                  mov eax, dword ptr [ebp+08]
:004111A0 25FFFF0000              and eax, 0000FFFF
:004111A5 50                      push eax
:004111A6 E881DD0000              call 0041EF2C
:004111AB 83C404                  add esp, 00000004
:004111AE 8BC8                    mov ecx, eax
:004111B0 E86B690000              call 00417B20
:004111B5 E933000000              jmp 004111ED
:004111BA E91F000000              jmp 004111DE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041117B(U)
|
:004111BF 817DF800020000          cmp dword ptr [ebp-08], 00000200
:004111C6 0F84B4FFFFFF            je 00411180
:004111CC 817DF800040000          cmp dword ptr [ebp-08], 00000400
:004111D3 0F84C4FFFFFF            je 0041119D
:004111D9 E900000000              jmp 004111DE

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004111BA(U), :004111D9(U)
|
:004111DE B960F74500              mov ecx, 0045F760
:004111E3 E858690000              call 00417B40
:004111E8 E900000000              jmp 004111ED

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00411198(U), :004111B5(U), :004111E8(U)
|
:004111ED 5F                      pop edi
:004111EE 5E                      pop esi
:004111EF 5B                      pop ebx
:004111F0 C9                      leave
:004111F1 C3                      ret



* Referenced by a CALL at Address:
|:00411A80   
|
:004111F2 55                      push ebp
:004111F3 8BEC                    mov ebp, esp
:004111F5 53                      push ebx
:004111F6 56                      push esi
:004111F7 57                      push edi
:004111F8 8B450C                  mov eax, dword ptr [ebp+0C]
:004111FB 2BD2                    sub edx, edx
:004111FD F77508                  div [ebp+08]
:00411200 85D2                    test edx, edx
:00411202 0F8412000000            je 0041121A
:00411208 33C9                    xor ecx, ecx
:0041120A 8B450C                  mov eax, dword ptr [ebp+0C]
:0041120D 2BD2                    sub edx, edx
:0041120F F77508                  div [ebp+08]
:00411212 2BCA                    sub ecx, edx
:00411214 034D08                  add ecx, dword ptr [ebp+08]
:00411217 014D0C                  add dword ptr [ebp+0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411202(C)
|
:0041121A 8B450C                  mov eax, dword ptr [ebp+0C]
:0041121D E900000000              jmp 00411222

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041121D(U)
|
:00411222 5F                      pop edi
:00411223 5E                      pop esi
:00411224 5B                      pop ebx
:00411225 C9                      leave
:00411226 C3                      ret


:00411227 55                      push ebp
:00411228 8BEC                    mov ebp, esp
:0041122A 53                      push ebx
:0041122B 56                      push esi
:0041122C 57                      push edi
:0041122D 8B450C                  mov eax, dword ptr [ebp+0C]
:00411230 25FFFF0000              and eax, 0000FFFF
:00411235 8B4D08                  mov ecx, dword ptr [ebp+08]
:00411238 81E1FFFF0000            and ecx, 0000FFFF
:0041123E 99                      cdq
:0041123F F7F9                    idiv ecx
:00411241 85D2                    test edx, edx
:00411243 0F842D000000            je 00411276
:00411249 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0041124C 81E1FFFF0000            and ecx, 0000FFFF
:00411252 8B450C                  mov eax, dword ptr [ebp+0C]
:00411255 25FFFF0000              and eax, 0000FFFF
:0041125A 8B5D08                  mov ebx, dword ptr [ebp+08]
:0041125D 81E3FFFF0000            and ebx, 0000FFFF
:00411263 99                      cdq
:00411264 F7FB                    idiv ebx
:00411266 2BCA                    sub ecx, edx
:00411268 8B4508                  mov eax, dword ptr [ebp+08]
:0041126B 25FFFF0000              and eax, 0000FFFF
:00411270 03C8                    add ecx, eax
:00411272 66894D0C                mov word ptr [ebp+0C], cx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411243(C)
|
:00411276 668B450C                mov ax, word ptr [ebp+0C]
:0041127A E900000000              jmp 0041127F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041127A(U)
|
:0041127F 5F                      pop edi
:00411280 5E                      pop esi
:00411281 5B                      pop ebx
:00411282 C9                      leave
:00411283 C3                      ret


:00411284 55                      push ebp
:00411285 8BEC                    mov ebp, esp
:00411287 53                      push ebx
:00411288 56                      push esi
:00411289 57                      push edi
:0041128A 8B450C                  mov eax, dword ptr [ebp+0C]
:0041128D 25FFFF0000              and eax, 0000FFFF
:00411292 8B4D08                  mov ecx, dword ptr [ebp+08]
:00411295 81E1FFFF0000            and ecx, 0000FFFF
:0041129B 99                      cdq
:0041129C F7F9                    idiv ecx
:0041129E 85D2                    test edx, edx
:004112A0 0F8423000000            je 004112C9
:004112A6 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004112A9 81E1FFFF0000            and ecx, 0000FFFF
:004112AF 8B450C                  mov eax, dword ptr [ebp+0C]
:004112B2 25FFFF0000              and eax, 0000FFFF
:004112B7 8B5D08                  mov ebx, dword ptr [ebp+08]
:004112BA 81E3FFFF0000            and ebx, 0000FFFF
:004112C0 99                      cdq
:004112C1 F7FB                    idiv ebx
:004112C3 2BCA                    sub ecx, edx
:004112C5 66894D0C                mov word ptr [ebp+0C], cx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004112A0(C)
|
:004112C9 668B450C                mov ax, word ptr [ebp+0C]
:004112CD E900000000              jmp 004112D2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004112CD(U)
|
:004112D2 5F                      pop edi
:004112D3 5E                      pop esi
:004112D4 5B                      pop ebx
:004112D5 C9                      leave
:004112D6 C3                      ret


:004112D7 55                      push ebp
:004112D8 8BEC                    mov ebp, esp
:004112DA 83EC04                  sub esp, 00000004
:004112DD 53                      push ebx
:004112DE 56                      push esi
:004112DF 57                      push edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411349(U)
|
:004112E0 817D10FFFF0000          cmp dword ptr [ebp+10], 0000FFFF
:004112E7 0F821D000000            jb 0041130A
:004112ED 66C745FCFFFF            mov [ebp-04], FFFF
:004112F3 33C0                    xor eax, eax
:004112F5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004112F8 81E1FFFF0000            and ecx, 0000FFFF
:004112FE 2BC1                    sub eax, ecx
:00411300 F7D8                    neg eax
:00411302 294510                  sub dword ptr [ebp+10], eax
:00411305 E90E000000              jmp 00411318

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004112E7(C)
|
:0041130A 8B4510                  mov eax, dword ptr [ebp+10]
:0041130D 668945FC                mov word ptr [ebp-04], ax
:00411311 C7451000000000          mov [ebp+10], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411305(U)
|
:00411318 8B45FC                  mov eax, dword ptr [ebp-04]
:0041131B 25FFFF0000              and eax, 0000FFFF
:00411320 50                      push eax
:00411321 8B450C                  mov eax, dword ptr [ebp+0C]
:00411324 50                      push eax
:00411325 8B4508                  mov eax, dword ptr [ebp+08]
:00411328 50                      push eax

* Reference To: KERNEL32._lread, Ord:0263h
                                  |
:00411329 FF15AC734700            Call dword ptr [004773AC]
:0041132F 837D1000                cmp dword ptr [ebp+10], 00000000
:00411333 0F8505000000            jne 0041133E
:00411339 E915000000              jmp 00411353

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411333(C)
|
:0041133E 8B45FC                  mov eax, dword ptr [ebp-04]
:00411341 25FFFF0000              and eax, 0000FFFF
:00411346 01450C                  add dword ptr [ebp+0C], eax
:00411349 E992FFFFFF              jmp 004112E0
:0041134E E900000000              jmp 00411353

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00411339(U), :0041134E(U)
|
:00411353 5F                      pop edi
:00411354 5E                      pop esi
:00411355 5B                      pop ebx
:00411356 C9                      leave
:00411357 C3                      ret


:00411358 55                      push ebp
:00411359 8BEC                    mov ebp, esp
:0041135B 83EC04                  sub esp, 00000004
:0041135E 53                      push ebx
:0041135F 56                      push esi
:00411360 57                      push edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004113CA(U)
|
:00411361 817D10FFFF0000          cmp dword ptr [ebp+10], 0000FFFF
:00411368 0F821D000000            jb 0041138B
:0041136E 66C745FCFFFF            mov [ebp-04], FFFF
:00411374 33C0                    xor eax, eax
:00411376 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00411379 81E1FFFF0000            and ecx, 0000FFFF
:0041137F 2BC1                    sub eax, ecx
:00411381 F7D8                    neg eax
:00411383 294510                  sub dword ptr [ebp+10], eax
:00411386 E90E000000              jmp 00411399

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411368(C)
|
:0041138B 8B4510                  mov eax, dword ptr [ebp+10]
:0041138E 668945FC                mov word ptr [ebp-04], ax
:00411392 C7451000000000          mov [ebp+10], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411386(U)
|
:00411399 8B45FC                  mov eax, dword ptr [ebp-04]
:0041139C 25FFFF0000              and eax, 0000FFFF
:004113A1 50                      push eax
:004113A2 8B450C                  mov eax, dword ptr [ebp+0C]
:004113A5 50                      push eax
:004113A6 8B4508                  mov eax, dword ptr [ebp+08]
:004113A9 50                      push eax

* Reference To: KERNEL32._lwrite, Ord:0264h
                                  |
:004113AA FF1518734700            Call dword ptr [00477318]
:004113B0 837D1000                cmp dword ptr [ebp+10], 00000000
:004113B4 0F8505000000            jne 004113BF
:004113BA E915000000              jmp 004113D4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004113B4(C)
|
:004113BF 8B45FC                  mov eax, dword ptr [ebp-04]
:004113C2 25FFFF0000              and eax, 0000FFFF
:004113C7 01450C                  add dword ptr [ebp+0C], eax
:004113CA E992FFFFFF              jmp 00411361
:004113CF E900000000              jmp 004113D4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004113BA(U), :004113CF(U)
|
:004113D4 5F                      pop edi
:004113D5 5E                      pop esi
:004113D6 5B                      pop ebx
:004113D7 C9                      leave
:004113D8 C3                      ret



* Referenced by a CALL at Addresses:
|:00412224   , :0041495A   , :00414A4C   
|
:004113D9 55                      push ebp
:004113DA 8BEC                    mov ebp, esp
:004113DC 83EC04                  sub esp, 00000004
:004113DF 53                      push ebx
:004113E0 56                      push esi
:004113E1 57                      push edi
:004113E2 C745FC00000000          mov [ebp-04], 00000000
:004113E9 E903000000              jmp 004113F1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411408(U)
|
:004113EE FF45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004113E9(U)
|
:004113F1 8B450C                  mov eax, dword ptr [ebp+0C]
:004113F4 3945FC                  cmp dword ptr [ebp-04], eax
:004113F7 0F8310000000            jnb 0041140D
:004113FD 8A4510                  mov al, byte ptr [ebp+10]
:00411400 8B4D08                  mov ecx, dword ptr [ebp+08]
:00411403 8801                    mov byte ptr [ecx], al
:00411405 FF4508                  inc [ebp+08]
:00411408 E9E1FFFFFF              jmp 004113EE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004113F7(C)
|
:0041140D E900000000              jmp 00411412

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041140D(U)
|
:00411412 5F                      pop edi
:00411413 5E                      pop esi
:00411414 5B                      pop ebx
:00411415 C9                      leave
:00411416 C3                      ret



* Referenced by a CALL at Addresses:
|:00413DA7   , :004149C1   
|
:00411417 55                      push ebp
:00411418 8BEC                    mov ebp, esp
:0041141A 83EC04                  sub esp, 00000004
:0041141D 53                      push ebx
:0041141E 56                      push esi
:0041141F 57                      push edi
:00411420 C745FC00000000          mov [ebp-04], 00000000
:00411427 E903000000              jmp 0041142F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411449(U)
|
:0041142C FF45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411427(U)
|
:0041142F 8B45FC                  mov eax, dword ptr [ebp-04]
:00411432 39450C                  cmp dword ptr [ebp+0C], eax
:00411435 0F8613000000            jbe 0041144E
:0041143B 668B4510                mov ax, word ptr [ebp+10]
:0041143F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00411442 668901                  mov word ptr [ecx], ax
:00411445 83450802                add dword ptr [ebp+08], 00000002
:00411449 E9DEFFFFFF              jmp 0041142C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411435(C)
|
:0041144E E900000000              jmp 00411453

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041144E(U)
|
:00411453 5F                      pop edi
:00411454 5E                      pop esi
:00411455 5B                      pop ebx
:00411456 C9                      leave
:00411457 C3                      ret


:00411458 55                      push ebp
:00411459 8BEC                    mov ebp, esp
:0041145B 83EC0C                  sub esp, 0000000C
:0041145E 53                      push ebx
:0041145F 56                      push esi
:00411460 57                      push edi
:00411461 C745FC00000000          mov [ebp-04], 00000000
:00411468 E903000000              jmp 00411470

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004114AE(U)
|
:0041146D FF45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411468(U)
|
:00411470 8B4510                  mov eax, dword ptr [ebp+10]
:00411473 3945FC                  cmp dword ptr [ebp-04], eax
:00411476 0F8337000000            jnb 004114B3
:0041147C 8B450C                  mov eax, dword ptr [ebp+0C]
:0041147F 8945F8                  mov dword ptr [ebp-08], eax
:00411482 FF450C                  inc [ebp+0C]
:00411485 8B4508                  mov eax, dword ptr [ebp+08]
:00411488 8945F4                  mov dword ptr [ebp-0C], eax
:0041148B FF4508                  inc [ebp+08]
:0041148E 8B45F8                  mov eax, dword ptr [ebp-08]
:00411491 33C9                    xor ecx, ecx
:00411493 8A08                    mov cl, byte ptr [eax]
:00411495 8B45F4                  mov eax, dword ptr [ebp-0C]
:00411498 33D2                    xor edx, edx
:0041149A 8A10                    mov dl, byte ptr [eax]
:0041149C 3BCA                    cmp ecx, edx
:0041149E 0F840A000000            je 004114AE
:004114A4 B801000000              mov eax, 00000001
:004114A9 E90C000000              jmp 004114BA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041149E(C)
|
:004114AE E9BAFFFFFF              jmp 0041146D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411476(C)
|
:004114B3 33C0                    xor eax, eax
:004114B5 E900000000              jmp 004114BA

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004114A9(U), :004114B5(U)
|
:004114BA 5F                      pop edi
:004114BB 5E                      pop esi
:004114BC 5B                      pop ebx
:004114BD C9                      leave
:004114BE C3                      ret



* Referenced by a CALL at Addresses:
|:00411516   , :00411DBE   , :00412304   , :0041467C   , :00414C8F   
|:00414D29   , :00415177   , :004152F7   , :0041537D   , :0041564B   
|:00415AB0   , :00415BE7   , :00415D25   , :00415ECF   , :0041602D   
|:004160C0   , :00416631   , :00416B70   , :00417577   , :004175D2   
|:004176FA   
|
:004114BF 55                      push ebp
:004114C0 8BEC                    mov ebp, esp
:004114C2 53                      push ebx
:004114C3 56                      push esi
:004114C4 57                      push edi
:004114C5 8B4508                  mov eax, dword ptr [ebp+08]
:004114C8 25FFFF0000              and eax, 0000FFFF
:004114CD 8BC8                    mov ecx, eax
:004114CF C1E006                  shl eax, 06
:004114D2 2BC1                    sub eax, ecx
:004114D4 2BC1                    sub eax, ecx
:004114D6 8D80D8D54500            lea eax, dword ptr [eax+0045D5D8]
:004114DC E900000000              jmp 004114E1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004114DC(U)
|
:004114E1 5F                      pop edi
:004114E2 5E                      pop esi
:004114E3 5B                      pop ebx
:004114E4 C9                      leave
:004114E5 C3                      ret



* Referenced by a CALL at Addresses:
|:0041449A   , :004144E2   , :00414522   , :00414687   , :004148AF   
|:00415B36   , :00417459   
|
:004114E6 55                      push ebp
:004114E7 8BEC                    mov ebp, esp
:004114E9 83EC04                  sub esp, 00000004
:004114EC 53                      push ebx
:004114ED 56                      push esi
:004114EE 57                      push edi
:004114EF 66A158F74500            mov ax, word ptr [0045F758]
:004114F5 668945FC                mov word ptr [ebp-04], ax
:004114F9 8B45FC                  mov eax, dword ptr [ebp-04]
:004114FC 25FFFF0000              and eax, 0000FFFF
:00411501 3DFFFF0000              cmp eax, 0000FFFF
:00411506 0F8506000000            jne 00411512
:0041150C 66C745FC8000            mov [ebp-04], 0080

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411506(C)
|
:00411512 8B45FC                  mov eax, dword ptr [ebp-04]
:00411515 50                      push eax
:00411516 E8A4FFFFFF              call 004114BF
:0041151B 83C404                  add esp, 00000004
:0041151E E900000000              jmp 00411523

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041151E(U)
|
:00411523 5F                      pop edi
:00411524 5E                      pop esi
:00411525 5B                      pop ebx
:00411526 C9                      leave
:00411527 C3                      ret



* Referenced by a CALL at Addresses:
|:004139FB   , :00414851   , :0041488C   , :00415507   , :0041589D   
|
:00411528 55                      push ebp
:00411529 8BEC                    mov ebp, esp
:0041152B 53                      push ebx
:0041152C 56                      push esi
:0041152D 57                      push edi
:0041152E 6800040000              push 00000400
:00411533 6A00                    push 00000000
:00411535 A198D44500              mov eax, dword ptr [0045D498]
:0041153A 50                      push eax

* Reference To: USER32.GetMenu, Ord:0101h
                                  |
:0041153B FF1580744700            Call dword ptr [00477480]
:00411541 50                      push eax

* Reference To: USER32.GetMenuState, Ord:010Ah
                                  |
:00411542 FF1584744700            Call dword ptr [00477484]
:00411548 A801                    test al, 01
:0041154A 0F8414000000            je 00411564
:00411550 837D0800                cmp dword ptr [ebp+08], 00000000
:00411554 0F8505000000            jne 0041155F
:0041155A E925000000              jmp 00411584

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411554(C)
|
:0041155F E90F000000              jmp 00411573

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041154A(C)
|
:00411564 837D0801                cmp dword ptr [ebp+08], 00000001
:00411568 0F8505000000            jne 00411573
:0041156E E911000000              jmp 00411584

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041155F(U), :00411568(C)
|
:00411573 8B4508                  mov eax, dword ptr [ebp+08]
:00411576 50                      push eax
:00411577 E84F450100              call 00425ACB
:0041157C 83C404                  add esp, 00000004
:0041157F E900000000              jmp 00411584

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041155A(U), :0041156E(U), :0041157F(U)
|
:00411584 5F                      pop edi
:00411585 5E                      pop esi
:00411586 5B                      pop ebx
:00411587 C9                      leave
:00411588 C3                      ret


:00411589 55                      push ebp
:0041158A 8BEC                    mov ebp, esp
:0041158C 53                      push ebx
:0041158D 56                      push esi
:0041158E 57                      push edi
:0041158F 8B450C                  mov eax, dword ptr [ebp+0C]
:00411592 25FFFF0000              and eax, 0000FFFF
:00411597 C1E002                  shl eax, 02
:0041159A 034508                  add eax, dword ptr [ebp+08]
:0041159D E900000000              jmp 004115A2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041159D(U)
|
:004115A2 5F                      pop edi
:004115A3 5E                      pop esi
:004115A4 5B                      pop ebx
:004115A5 C9                      leave
:004115A6 C3                      ret


:004115A7 55                      push ebp
:004115A8 8BEC                    mov ebp, esp
:004115AA 83EC0C                  sub esp, 0000000C
:004115AD 53                      push ebx
:004115AE 56                      push esi
:004115AF 57                      push edi
:004115B0 66C745F40000            mov [ebp-0C], 0000
:004115B6 8B4508                  mov eax, dword ptr [ebp+08]
:004115B9 25FFFFFF3F              and eax, 3FFFFFFF
:004115BE 668945FC                mov word ptr [ebp-04], ax
:004115C2 8B450C                  mov eax, dword ptr [ebp+0C]
:004115C5 25FFFFFF3F              and eax, 3FFFFFFF
:004115CA 668945F8                mov word ptr [ebp-08], ax
:004115CE 8B45F8                  mov eax, dword ptr [ebp-08]
:004115D1 25FFFF0000              and eax, 0000FFFF
:004115D6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004115D9 81E1FFFF0000            and ecx, 0000FFFF
:004115DF 3BC1                    cmp eax, ecx
:004115E1 0F850F000000            jne 004115F6
:004115E7 8B45F4                  mov eax, dword ptr [ebp-0C]
:004115EA 25FFFF0000              and eax, 0000FFFF
:004115EF 83C801                  or eax, 00000001
:004115F2 668945F4                mov word ptr [ebp-0C], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004115E1(C)
|
:004115F6 8B45F8                  mov eax, dword ptr [ebp-08]
:004115F9 25FFFF0000              and eax, 0000FFFF
:004115FE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00411601 81E1FFFF0000            and ecx, 0000FFFF
:00411607 3BC1                    cmp eax, ecx
:00411609 0F8E0F000000            jle 0041161E
:0041160F 8B45F4                  mov eax, dword ptr [ebp-0C]
:00411612 25FFFF0000              and eax, 0000FFFF
:00411617 83C802                  or eax, 00000002
:0041161A 668945F4                mov word ptr [ebp-0C], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411609(C)
|
:0041161E 668B45F4                mov ax, word ptr [ebp-0C]
:00411622 E900000000              jmp 00411627

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411622(U)
|
:00411627 5F                      pop edi
:00411628 5E                      pop esi
:00411629 5B                      pop ebx
:0041162A C9                      leave
:0041162B C3                      ret



* Referenced by a CALL at Addresses:
|:0041164A   , :0041168B   , :004116D8   , :004116EF   , :0041179F   
|:004117AD   , :004117C1   , :0041193F   , :0041198C   , :004119B9   
|:004119F5   , :00411AD0   , :00411B7B   , :00411BC6   , :00411C0F   
|
:0041162C 55                      push ebp
:0041162D 8BEC                    mov ebp, esp
:0041162F 53                      push ebx
:00411630 56                      push esi
:00411631 57                      push edi
:00411632 8B4508                  mov eax, dword ptr [ebp+08]
:00411635 40                      inc eax
:00411636 E900000000              jmp 0041163B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411636(U)
|
:0041163B 5F                      pop edi
:0041163C 5E                      pop esi
:0041163D 5B                      pop ebx
:0041163E C9                      leave
:0041163F C3                      ret



* Referenced by a CALL at Addresses:
|:004116B9   , :00411775   , :00411956   , :004119DE   , :00411A34   
|:00411B05   , :00411BAF   , :00411C27   
|
:00411640 55                      push ebp
:00411641 8BEC                    mov ebp, esp
:00411643 53                      push ebx
:00411644 56                      push esi
:00411645 57                      push edi
:00411646 8B4508                  mov eax, dword ptr [ebp+08]
:00411649 50                      push eax
:0041164A E8DDFFFFFF              call 0041162C
:0041164F 83C404                  add esp, 00000004
:00411652 8B00                    mov eax, dword ptr [eax]
:00411654 8B4D08                  mov ecx, dword ptr [ebp+08]
:00411657 8D440810                lea eax, dword ptr [eax+ecx+10]
:0041165B E900000000              jmp 00411660

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041165B(U)
|
:00411660 5F                      pop edi
:00411661 5E                      pop esi
:00411662 5B                      pop ebx
:00411663 C9                      leave
:00411664 C3                      ret



* Referenced by a CALL at Address:
|:00411A0F   
|
:00411665 55                      push ebp
:00411666 8BEC                    mov ebp, esp
:00411668 83EC20                  sub esp, 00000020
:0041166B 53                      push ebx
:0041166C 56                      push esi
:0041166D 57                      push edi
:0041166E 836D0810                sub dword ptr [ebp+08], 00000010
:00411672 8B4508                  mov eax, dword ptr [ebp+08]
:00411675 8945F8                  mov dword ptr [ebp-08], eax
:00411678 8B4508                  mov eax, dword ptr [ebp+08]
:0041167B 33C9                    xor ecx, ecx
:0041167D 8A08                    mov cl, byte ptr [eax]
:0041167F 80E1FE                  and cl, FE
:00411682 8B4508                  mov eax, dword ptr [ebp+08]
:00411685 8808                    mov byte ptr [eax], cl
:00411687 8B4508                  mov eax, dword ptr [ebp+08]
:0041168A 50                      push eax
:0041168B E89CFFFFFF              call 0041162C
:00411690 83C404                  add esp, 00000004
:00411693 8B00                    mov eax, dword ptr [eax]
:00411695 8945F4                  mov dword ptr [ebp-0C], eax
:00411698 C745E800000000          mov [ebp-18], 00000000
:0041169F 8B4508                  mov eax, dword ptr [ebp+08]
:004116A2 33C9                    xor ecx, ecx
:004116A4 8A08                    mov cl, byte ptr [eax]
:004116A6 F6C102                  test cl, 02
:004116A9 0F844A010000            je 004117F9
:004116AF 8B45F4                  mov eax, dword ptr [ebp-0C]
:004116B2 8945E8                  mov dword ptr [ebp-18], eax
:004116B5 8B4508                  mov eax, dword ptr [ebp+08]
:004116B8 50                      push eax
:004116B9 E882FFFFFF              call 00411640
:004116BE 83C404                  add esp, 00000004
:004116C1 894508                  mov dword ptr [ebp+08], eax
:004116C4 8B4508                  mov eax, dword ptr [ebp+08]
:004116C7 33C9                    xor ecx, ecx
:004116C9 8A08                    mov cl, byte ptr [eax]
:004116CB F6C101                  test cl, 01
:004116CE 0F8553000000            jne 00411727
:004116D4 8B4508                  mov eax, dword ptr [ebp+08]
:004116D7 50                      push eax
:004116D8 E84FFFFFFF              call 0041162C
:004116DD 83C404                  add esp, 00000004
:004116E0 8B00                    mov eax, dword ptr [eax]
:004116E2 0345F4                  add eax, dword ptr [ebp-0C]
:004116E5 83C010                  add eax, 00000010
:004116E8 8945FC                  mov dword ptr [ebp-04], eax
:004116EB 8B45F8                  mov eax, dword ptr [ebp-08]
:004116EE 50                      push eax
:004116EF E838FFFFFF              call 0041162C
:004116F4 83C404                  add esp, 00000004
:004116F7 8945E4                  mov dword ptr [ebp-1C], eax
:004116FA 8B45FC                  mov eax, dword ptr [ebp-04]
:004116FD 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00411700 8901                    mov dword ptr [ecx], eax
:00411702 8B4508                  mov eax, dword ptr [ebp+08]
:00411705 33C9                    xor ecx, ecx
:00411707 8A08                    mov cl, byte ptr [eax]
:00411709 F6C102                  test cl, 02
:0041170C 0F8515000000            jne 00411727
:00411712 8B45F8                  mov eax, dword ptr [ebp-08]
:00411715 33C9                    xor ecx, ecx
:00411717 8A08                    mov cl, byte ptr [eax]
:00411719 80E1FD                  and cl, FD
:0041171C 8B45F8                  mov eax, dword ptr [ebp-08]
:0041171F 8808                    mov byte ptr [eax], cl
:00411721 8B45FC                  mov eax, dword ptr [ebp-04]
:00411724 8945E8                  mov dword ptr [ebp-18], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004116CE(C), :0041170C(C)
|
:00411727 6A04                    push 00000004
:00411729 6A00                    push 00000000
:0041172B 6A00                    push 00000000
:0041172D B9D0E44600              mov ecx, 0046E4D0
:00411732 E8E95F0300              call 00447720
:00411737 894508                  mov dword ptr [ebp+08], eax
:0041173A C745F000000000          mov [ebp-10], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411780(U)
|
:00411741 8B4508                  mov eax, dword ptr [ebp+08]
:00411744 33C9                    xor ecx, ecx
:00411746 8A08                    mov cl, byte ptr [eax]
:00411748 894DEC                  mov dword ptr [ebp-14], ecx
:0041174B F645EC02                test [ebp-14], 02
:0041174F 0F8505000000            jne 0041175A
:00411755 E92B000000              jmp 00411785

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041174F(C)
|
:0041175A 8B4508                  mov eax, dword ptr [ebp+08]
:0041175D 3945F8                  cmp dword ptr [ebp-08], eax
:00411760 0F8505000000            jne 0041176B
:00411766 E91A000000              jmp 00411785

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411760(C)
|
:0041176B 8B4508                  mov eax, dword ptr [ebp+08]
:0041176E 8945F0                  mov dword ptr [ebp-10], eax
:00411771 8B4508                  mov eax, dword ptr [ebp+08]
:00411774 50                      push eax
:00411775 E8C6FEFFFF              call 00411640
:0041177A 83C404                  add esp, 00000004
:0041177D 894508                  mov dword ptr [ebp+08], eax
:00411780 E9BCFFFFFF              jmp 00411741

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00411755(U), :00411766(U)
|
:00411785 837DF000                cmp dword ptr [ebp-10], 00000000
:00411789 0F846A000000            je 004117F9
:0041178F 8B45F0                  mov eax, dword ptr [ebp-10]
:00411792 F60001                  test byte ptr [eax], 01
:00411795 0F855E000000            jne 004117F9
:0041179B 8B45F0                  mov eax, dword ptr [ebp-10]
:0041179E 50                      push eax
:0041179F E888FEFFFF              call 0041162C
:004117A4 83C404                  add esp, 00000004
:004117A7 8B18                    mov ebx, dword ptr [eax]
:004117A9 8B45F8                  mov eax, dword ptr [ebp-08]
:004117AC 50                      push eax
:004117AD E87AFEFFFF              call 0041162C
:004117B2 83C404                  add esp, 00000004
:004117B5 0318                    add ebx, dword ptr [eax]
:004117B7 83C310                  add ebx, 00000010
:004117BA 895DFC                  mov dword ptr [ebp-04], ebx
:004117BD 8B45F0                  mov eax, dword ptr [ebp-10]
:004117C0 50                      push eax
:004117C1 E866FEFFFF              call 0041162C
:004117C6 83C404                  add esp, 00000004
:004117C9 8945E0                  mov dword ptr [ebp-20], eax
:004117CC 8B45FC                  mov eax, dword ptr [ebp-04]
:004117CF 8B4DE0                  mov ecx, dword ptr [ebp-20]
:004117D2 8901                    mov dword ptr [ecx], eax
:004117D4 8B45F8                  mov eax, dword ptr [ebp-08]
:004117D7 33C9                    xor ecx, ecx
:004117D9 8A08                    mov cl, byte ptr [eax]
:004117DB F6C102                  test cl, 02
:004117DE 0F8515000000            jne 004117F9
:004117E4 8B45F0                  mov eax, dword ptr [ebp-10]
:004117E7 33C9                    xor ecx, ecx
:004117E9 8A08                    mov cl, byte ptr [eax]
:004117EB 80E1FD                  and cl, FD
:004117EE 8B45F0                  mov eax, dword ptr [ebp-10]
:004117F1 8808                    mov byte ptr [eax], cl
:004117F3 8B45FC                  mov eax, dword ptr [ebp-04]
:004117F6 8945E8                  mov dword ptr [ebp-18], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004116A9(C), :00411789(C), :00411795(C), :004117DE(C)
|
:004117F9 8B45E8                  mov eax, dword ptr [ebp-18]
:004117FC E900000000              jmp 00411801

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004117FC(U)
|
:00411801 5F                      pop edi
:00411802 5E                      pop esi
:00411803 5B                      pop ebx
:00411804 C9                      leave
:00411805 C3                      ret



* Referenced by a CALL at Address:
|:004119AD   
|
:00411806 55                      push ebp
:00411807 8BEC                    mov ebp, esp
:00411809 83EC0C                  sub esp, 0000000C
:0041180C 53                      push ebx
:0041180D 56                      push esi
:0041180E 57                      push edi
:0041180F C745F4D8D54500          mov [ebp-0C], 0045D5D8
:00411816 66C745FC0000            mov [ebp-04], 0000
:0041181C E908000000              jmp 00411829

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411873(U)
|
:00411821 66FF45FC                inc [ebp-04]
:00411825 8345F43E                add dword ptr [ebp-0C], 0000003E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041181C(U)
|
:00411829 8B45FC                  mov eax, dword ptr [ebp-04]
:0041182C 25FFFF0000              and eax, 0000FFFF
:00411831 3D80000000              cmp eax, 00000080
:00411836 0F8D3C000000            jnl 00411878
:0041183C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041183F E81C630000              call 00417B60
:00411844 0FB7C0                  movzx eax, ax
:00411847 F6C480                  test ah, 80
:0041184A 0F8423000000            je 00411873
:00411850 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00411853 E858630000              call 00417BB0
:00411858 8945F8                  mov dword ptr [ebp-08], eax
:0041185B 8B4508                  mov eax, dword ptr [ebp+08]
:0041185E 3945F8                  cmp dword ptr [ebp-08], eax
:00411861 0F850C000000            jne 00411873
:00411867 8B450C                  mov eax, dword ptr [ebp+0C]
:0041186A 50                      push eax
:0041186B 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041186E E80D630000              call 00417B80

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041184A(C), :00411861(C)
|
:00411873 E9A9FFFFFF              jmp 00411821

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411836(C)
|
:00411878 66C745FC0000            mov [ebp-04], 0000
:0041187E E904000000              jmp 00411887

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004118D5(U)
|
:00411883 66FF45FC                inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041187E(U)
|
:00411887 8B45FC                  mov eax, dword ptr [ebp-04]
:0041188A 25FFFF0000              and eax, 0000FFFF
:0041188F 3D80000000              cmp eax, 00000080
:00411894 0F8D40000000            jnl 004118DA
:0041189A 8B45FC                  mov eax, dword ptr [ebp-04]
:0041189D 25FFFF0000              and eax, 0000FFFF
:004118A2 8B0485C0164600          mov eax, dword ptr [4*eax+004616C0]
:004118A9 8945F8                  mov dword ptr [ebp-08], eax
:004118AC 837DF800                cmp dword ptr [ebp-08], 00000000
:004118B0 0F841F000000            je 004118D5
:004118B6 8B4508                  mov eax, dword ptr [ebp+08]
:004118B9 3945F8                  cmp dword ptr [ebp-08], eax
:004118BC 0F8513000000            jne 004118D5
:004118C2 8B450C                  mov eax, dword ptr [ebp+0C]
:004118C5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004118C8 81E1FFFF0000            and ecx, 0000FFFF
:004118CE 89048DC0164600          mov dword ptr [4*ecx+004616C0], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004118B0(C), :004118BC(C)
|
:004118D5 E9A9FFFFFF              jmp 00411883

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411894(C)
|
:004118DA E900000000              jmp 004118DF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004118DA(U)
|
:004118DF 5F                      pop edi
:004118E0 5E                      pop esi
:004118E1 5B                      pop ebx
:004118E2 C9                      leave
:004118E3 C3                      ret



* Referenced by a CALL at Address:
|:00411B23   
|
:004118E4 55                      push ebp
:004118E5 8BEC                    mov ebp, esp
:004118E7 83EC24                  sub esp, 00000024
:004118EA 53                      push ebx
:004118EB 56                      push esi
:004118EC 57                      push edi
:004118ED 6A04                    push 00000004
:004118EF 6A00                    push 00000000
:004118F1 6A00                    push 00000000
:004118F3 B9D0E44600              mov ecx, 0046E4D0
:004118F8 E8235E0300              call 00447720
:004118FD 8945FC                  mov dword ptr [ebp-04], eax
:00411900 C745E800000000          mov [ebp-18], 00000000
:00411907 C745E000000000          mov [ebp-20], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411A3F(U)
|
:0041190E 8B45FC                  mov eax, dword ptr [ebp-04]
:00411911 8A00                    mov al, byte ptr [eax]
:00411913 8845E4                  mov byte ptr [ebp-1C], al
:00411916 33C0                    xor eax, eax
:00411918 8A45E4                  mov al, byte ptr [ebp-1C]
:0041191B A802                    test al, 02
:0041191D 0F8505000000            jne 00411928
:00411923 E91C010000              jmp 00411A44

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041191D(C)
|
:00411928 33C0                    xor eax, eax
:0041192A 8A45E4                  mov al, byte ptr [ebp-1C]
:0041192D A801                    test al, 01
:0041192F 0F85F4000000            jne 00411A29
:00411935 8B45FC                  mov eax, dword ptr [ebp-04]
:00411938 8945E8                  mov dword ptr [ebp-18], eax
:0041193B 8B45FC                  mov eax, dword ptr [ebp-04]
:0041193E 50                      push eax
:0041193F E8E8FCFFFF              call 0041162C
:00411944 83C404                  add esp, 00000004
:00411947 8B00                    mov eax, dword ptr [eax]
:00411949 8945E0                  mov dword ptr [ebp-20], eax
:0041194C 8A45E4                  mov al, byte ptr [ebp-1C]
:0041194F 8845EC                  mov byte ptr [ebp-14], al
:00411952 8B45FC                  mov eax, dword ptr [ebp-04]
:00411955 50                      push eax
:00411956 E8E5FCFFFF              call 00411640
:0041195B 83C404                  add esp, 00000004
:0041195E 8945F0                  mov dword ptr [ebp-10], eax
:00411961 8B45F0                  mov eax, dword ptr [ebp-10]
:00411964 8A00                    mov al, byte ptr [eax]
:00411966 8845E4                  mov byte ptr [ebp-1C], al
:00411969 33C0                    xor eax, eax
:0041196B 8A45E4                  mov al, byte ptr [ebp-1C]
:0041196E A802                    test al, 02
:00411970 0F8505000000            jne 0041197B
:00411976 E9C9000000              jmp 00411A44

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411970(C)
|
:0041197B 33C0                    xor eax, eax
:0041197D 8A45E4                  mov al, byte ptr [ebp-1C]
:00411980 A801                    test al, 01
:00411982 0F8497000000            je 00411A1F
:00411988 8B45F0                  mov eax, dword ptr [ebp-10]
:0041198B 50                      push eax
:0041198C E89BFCFFFF              call 0041162C
:00411991 83C404                  add esp, 00000004
:00411994 8B00                    mov eax, dword ptr [eax]
:00411996 8945F8                  mov dword ptr [ebp-08], eax
:00411999 8B45F0                  mov eax, dword ptr [ebp-10]
:0041199C 83C010                  add eax, 00000010
:0041199F 8945F4                  mov dword ptr [ebp-0C], eax
:004119A2 8B45FC                  mov eax, dword ptr [ebp-04]
:004119A5 83C010                  add eax, 00000010
:004119A8 50                      push eax
:004119A9 8B45F4                  mov eax, dword ptr [ebp-0C]
:004119AC 50                      push eax
:004119AD E854FEFFFF              call 00411806
:004119B2 83C408                  add esp, 00000008
:004119B5 8B45F0                  mov eax, dword ptr [ebp-10]
:004119B8 50                      push eax
:004119B9 E86EFCFFFF              call 0041162C
:004119BE 83C404                  add esp, 00000004
:004119C1 8B00                    mov eax, dword ptr [eax]
:004119C3 83C010                  add eax, 00000010
:004119C6 0FB7C0                  movzx eax, ax
:004119C9 50                      push eax
:004119CA 8B45FC                  mov eax, dword ptr [ebp-04]
:004119CD 50                      push eax
:004119CE 8B45F0                  mov eax, dword ptr [ebp-10]
:004119D1 50                      push eax
:004119D2 E819690300              call 004482F0
:004119D7 83C40C                  add esp, 0000000C
:004119DA 8B45FC                  mov eax, dword ptr [ebp-04]
:004119DD 50                      push eax
:004119DE E85DFCFFFF              call 00411640
:004119E3 83C404                  add esp, 00000004
:004119E6 8945F4                  mov dword ptr [ebp-0C], eax
:004119E9 8A45EC                  mov al, byte ptr [ebp-14]
:004119EC 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004119EF 8801                    mov byte ptr [ecx], al
:004119F1 8B45F4                  mov eax, dword ptr [ebp-0C]
:004119F4 50                      push eax
:004119F5 E832FCFFFF              call 0041162C
:004119FA 83C404                  add esp, 00000004
:004119FD 8945DC                  mov dword ptr [ebp-24], eax
:00411A00 8B45E0                  mov eax, dword ptr [ebp-20]
:00411A03 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00411A06 8901                    mov dword ptr [ecx], eax
:00411A08 8B45F4                  mov eax, dword ptr [ebp-0C]
:00411A0B 83C010                  add eax, 00000010
:00411A0E 50                      push eax
:00411A0F E851FCFFFF              call 00411665
:00411A14 83C404                  add esp, 00000004
:00411A17 8945E0                  mov dword ptr [ebp-20], eax
:00411A1A E905000000              jmp 00411A24

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411982(C)
|
:00411A1F E920000000              jmp 00411A44

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411A1A(U)
|
:00411A24 E907000000              jmp 00411A30

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041192F(C)
|
:00411A29 C745E000000000          mov [ebp-20], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411A24(U)
|
:00411A30 8B45FC                  mov eax, dword ptr [ebp-04]
:00411A33 50                      push eax
:00411A34 E807FCFFFF              call 00411640
:00411A39 83C404                  add esp, 00000004
:00411A3C 8945FC                  mov dword ptr [ebp-04], eax
:00411A3F E9CAFEFFFF              jmp 0041190E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00411923(U), :00411976(U), :00411A1F(U)
|
:00411A44 8B45E0                  mov eax, dword ptr [ebp-20]
:00411A47 8B4D08                  mov ecx, dword ptr [ebp+08]
:00411A4A 8901                    mov dword ptr [ecx], eax
:00411A4C 8B45E8                  mov eax, dword ptr [ebp-18]
:00411A4F E900000000              jmp 00411A54

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411A4F(U)
|
:00411A54 5F                      pop edi
:00411A55 5E                      pop esi
:00411A56 5B                      pop ebx
:00411A57 C9                      leave
:00411A58 C3                      ret



* Referenced by a CALL at Address:
|:00411D02   
|
:00411A59 55                      push ebp
:00411A5A 8BEC                    mov ebp, esp
:00411A5C 83EC20                  sub esp, 00000020
:00411A5F 53                      push ebx
:00411A60 56                      push esi
:00411A61 57                      push edi
:00411A62 837D0800                cmp dword ptr [ebp+08], 00000000
:00411A66 0F8507000000            jne 00411A73
:00411A6C 33C0                    xor eax, eax
:00411A6E E971010000              jmp 00411BE4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411A66(C)
|
:00411A73 C745F000000000          mov [ebp-10], 00000000
:00411A7A 8B4508                  mov eax, dword ptr [ebp+08]
:00411A7D 50                      push eax
:00411A7E 6A10                    push 00000010
:00411A80 E86DF7FFFF              call 004111F2
:00411A85 83C408                  add esp, 00000008
:00411A88 894508                  mov dword ptr [ebp+08], eax
:00411A8B 6A04                    push 00000004
:00411A8D 6A00                    push 00000000
:00411A8F 6A00                    push 00000000
:00411A91 B9D0E44600              mov ecx, 0046E4D0
:00411A96 E8855C0300              call 00447720
:00411A9B 8945FC                  mov dword ptr [ebp-04], eax
:00411A9E C745F4FFFFFFFF          mov [ebp-0C], FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411B10(U)
|
:00411AA5 8B45FC                  mov eax, dword ptr [ebp-04]
:00411AA8 8A00                    mov al, byte ptr [eax]
:00411AAA 8845EC                  mov byte ptr [ebp-14], al
:00411AAD 33C0                    xor eax, eax
:00411AAF 8A45EC                  mov al, byte ptr [ebp-14]
:00411AB2 A802                    test al, 02
:00411AB4 0F8505000000            jne 00411ABF
:00411ABA E956000000              jmp 00411B15

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411AB4(C)
|
:00411ABF 33C0                    xor eax, eax
:00411AC1 8A45EC                  mov al, byte ptr [ebp-14]
:00411AC4 A801                    test al, 01
:00411AC6 0F8535000000            jne 00411B01
:00411ACC 8B45FC                  mov eax, dword ptr [ebp-04]
:00411ACF 50                      push eax
:00411AD0 E857FBFFFF              call 0041162C
:00411AD5 83C404                  add esp, 00000004
:00411AD8 8B00                    mov eax, dword ptr [eax]
:00411ADA 8945F8                  mov dword ptr [ebp-08], eax
:00411ADD 8B4508                  mov eax, dword ptr [ebp+08]
:00411AE0 3945F8                  cmp dword ptr [ebp-08], eax
:00411AE3 0F8218000000            jb 00411B01
:00411AE9 8B45F4                  mov eax, dword ptr [ebp-0C]
:00411AEC 3945F8                  cmp dword ptr [ebp-08], eax
:00411AEF 0F830C000000            jnb 00411B01
:00411AF5 8B45F8                  mov eax, dword ptr [ebp-08]
:00411AF8 8945F4                  mov dword ptr [ebp-0C], eax
:00411AFB 8B45FC                  mov eax, dword ptr [ebp-04]
:00411AFE 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00411AC6(C), :00411AE3(C), :00411AEF(C)
|
:00411B01 8B45FC                  mov eax, dword ptr [ebp-04]
:00411B04 50                      push eax
:00411B05 E836FBFFFF              call 00411640
:00411B0A 83C404                  add esp, 00000004
:00411B0D 8945FC                  mov dword ptr [ebp-04], eax
:00411B10 E990FFFFFF              jmp 00411AA5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411ABA(U)
|
:00411B15 837DF4FF                cmp dword ptr [ebp-0C], FFFFFFFF
:00411B19 0F8522000000            jne 00411B41
:00411B1F 8D45F4                  lea eax, dword ptr [ebp-0C]
:00411B22 50                      push eax
:00411B23 E8BCFDFFFF              call 004118E4
:00411B28 83C404                  add esp, 00000004
:00411B2B 8945F0                  mov dword ptr [ebp-10], eax
:00411B2E 8B4508                  mov eax, dword ptr [ebp+08]
:00411B31 3945F4                  cmp dword ptr [ebp-0C], eax
:00411B34 0F8307000000            jnb 00411B41
:00411B3A 33C0                    xor eax, eax
:00411B3C E9A3000000              jmp 00411BE4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00411B19(C), :00411B34(C)
|
:00411B41 8B45F0                  mov eax, dword ptr [ebp-10]
:00411B44 8A00                    mov al, byte ptr [eax]
:00411B46 8845EC                  mov byte ptr [ebp-14], al
:00411B49 8B45F0                  mov eax, dword ptr [ebp-10]
:00411B4C 33C9                    xor ecx, ecx
:00411B4E 8A08                    mov cl, byte ptr [eax]
:00411B50 80C903                  or cl, 03
:00411B53 8B45F0                  mov eax, dword ptr [ebp-10]
:00411B56 8808                    mov byte ptr [eax], cl
:00411B58 8B4508                  mov eax, dword ptr [ebp+08]
:00411B5B 8945F8                  mov dword ptr [ebp-08], eax
:00411B5E 8B45F4                  mov eax, dword ptr [ebp-0C]
:00411B61 2B45F8                  sub eax, dword ptr [ebp-08]
:00411B64 8945E8                  mov dword ptr [ebp-18], eax
:00411B67 837DE810                cmp dword ptr [ebp-18], 00000010
:00411B6B 0F8306000000            jnb 00411B77
:00411B71 8B45F4                  mov eax, dword ptr [ebp-0C]
:00411B74 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411B6B(C)
|
:00411B77 8B45F0                  mov eax, dword ptr [ebp-10]
:00411B7A 50                      push eax
:00411B7B E8ACFAFFFF              call 0041162C
:00411B80 83C404                  add esp, 00000004
:00411B83 8945E4                  mov dword ptr [ebp-1C], eax
:00411B86 8B45F8                  mov eax, dword ptr [ebp-08]
:00411B89 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00411B8C 8901                    mov dword ptr [ecx], eax
:00411B8E 8B45F0                  mov eax, dword ptr [ebp-10]
:00411B91 83C010                  add eax, 00000010
:00411B94 8945FC                  mov dword ptr [ebp-04], eax
:00411B97 8B45F4                  mov eax, dword ptr [ebp-0C]
:00411B9A 3945F8                  cmp dword ptr [ebp-08], eax
:00411B9D 0F8508000000            jne 00411BAB
:00411BA3 8B45FC                  mov eax, dword ptr [ebp-04]
:00411BA6 E939000000              jmp 00411BE4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411B9D(C)
|
:00411BAB 8B45F0                  mov eax, dword ptr [ebp-10]
:00411BAE 50                      push eax
:00411BAF E88CFAFFFF              call 00411640
:00411BB4 83C404                  add esp, 00000004
:00411BB7 8945F0                  mov dword ptr [ebp-10], eax
:00411BBA 8A45EC                  mov al, byte ptr [ebp-14]
:00411BBD 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00411BC0 8801                    mov byte ptr [ecx], al
:00411BC2 8B45F0                  mov eax, dword ptr [ebp-10]
:00411BC5 50                      push eax
:00411BC6 E861FAFFFF              call 0041162C
:00411BCB 83C404                  add esp, 00000004
:00411BCE 8945E0                  mov dword ptr [ebp-20], eax
:00411BD1 8B45E8                  mov eax, dword ptr [ebp-18]
:00411BD4 83E810                  sub eax, 00000010
:00411BD7 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00411BDA 8901                    mov dword ptr [ecx], eax
:00411BDC 8B45FC                  mov eax, dword ptr [ebp-04]
:00411BDF E900000000              jmp 00411BE4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00411A6E(U), :00411B3C(U), :00411BA6(U), :00411BDF(U)
|
:00411BE4 5F                      pop edi
:00411BE5 5E                      pop esi
:00411BE6 5B                      pop ebx
:00411BE7 C9                      leave
:00411BE8 C3                      ret



* Referenced by a CALL at Address:
|:0041783B   
|
:00411BE9 55                      push ebp
:00411BEA 8BEC                    mov ebp, esp
:00411BEC 83EC08                  sub esp, 00000008
:00411BEF 53                      push ebx
:00411BF0 56                      push esi
:00411BF1 57                      push edi
:00411BF2 6A04                    push 00000004
:00411BF4 6A00                    push 00000000
:00411BF6 6A00                    push 00000000
:00411BF8 B9D0E44600              mov ecx, 0046E4D0
:00411BFD E81E5B0300              call 00447720
:00411C02 8945FC                  mov dword ptr [ebp-04], eax
:00411C05 8B45FC                  mov eax, dword ptr [ebp-04]
:00411C08 C60002                  mov byte ptr [eax], 02
:00411C0B 8B45FC                  mov eax, dword ptr [ebp-04]
:00411C0E 50                      push eax
:00411C0F E818FAFFFF              call 0041162C
:00411C14 83C404                  add esp, 00000004
:00411C17 8945F8                  mov dword ptr [ebp-08], eax
:00411C1A 8B45F8                  mov eax, dword ptr [ebp-08]
:00411C1D C700E07D0900            mov dword ptr [eax], 00097DE0
:00411C23 8B45FC                  mov eax, dword ptr [ebp-04]
:00411C26 50                      push eax
:00411C27 E814FAFFFF              call 00411640
:00411C2C 83C404                  add esp, 00000004
:00411C2F 8945FC                  mov dword ptr [ebp-04], eax
:00411C32 8B45FC                  mov eax, dword ptr [ebp-04]
:00411C35 C60000                  mov byte ptr [eax], 00
:00411C38 E900000000              jmp 00411C3D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411C38(U)
|
:00411C3D 5F                      pop edi
:00411C3E 5E                      pop esi
:00411C3F 5B                      pop ebx
:00411C40 C9                      leave
:00411C41 C3                      ret



* Referenced by a CALL at Addresses:
|:00411F41   , :00411F5F   , :00411F7D   , :00411F9B   , :00411FA8   
|:00411FC6   , :00412184   , :0041223D   , :0041226A   , :00412297   
|:00413AAC   , :00413AD1   , :00413AF6   , :00413B1B   , :00413C05   
|:00413DCB   , :00414B4F   
|
:00411C42 55                      push ebp
:00411C43 8BEC                    mov ebp, esp
:00411C45 53                      push ebx
:00411C46 56                      push esi
:00411C47 57                      push edi
:00411C48 6A04                    push 00000004
:00411C4A 6A00                    push 00000000
:00411C4C 8B4508                  mov eax, dword ptr [ebp+08]
:00411C4F 25FFFF0000              and eax, 0000FFFF
:00411C54 50                      push eax
:00411C55 B950F94600              mov ecx, 0046F950
:00411C5A E8C15A0300              call 00447720
:00411C5F 668B00                  mov ax, word ptr [eax]
:00411C62 E900000000              jmp 00411C67

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411C62(U)
|
:00411C67 5F                      pop edi
:00411C68 5E                      pop esi
:00411C69 5B                      pop ebx
:00411C6A C9                      leave
:00411C6B C3                      ret


:00411C6C 55                      push ebp
:00411C6D 8BEC                    mov ebp, esp
:00411C6F 83EC04                  sub esp, 00000004
:00411C72 53                      push ebx
:00411C73 56                      push esi
:00411C74 57                      push edi
:00411C75 6A04                    push 00000004
:00411C77 6A00                    push 00000000
:00411C79 6A10                    push 00000010
:00411C7B B950F94600              mov ecx, 0046F950
:00411C80 E89B5A0300              call 00447720
:00411C85 8945FC                  mov dword ptr [ebp-04], eax
:00411C88 8B4518                  mov eax, dword ptr [ebp+18]
:00411C8B 25FFFF0000              and eax, 0000FFFF
:00411C90 8B4D14                  mov ecx, dword ptr [ebp+14]
:00411C93 81E1FFFF0000            and ecx, 0000FFFF
:00411C99 0FAFC1                  imul eax, ecx
:00411C9C 8B4D10                  mov ecx, dword ptr [ebp+10]
:00411C9F 81E1FFFF0000            and ecx, 0000FFFF
:00411CA5 0FAFC1                  imul eax, ecx
:00411CA8 8B4D10                  mov ecx, dword ptr [ebp+10]
:00411CAB 81E1FFFF0000            and ecx, 0000FFFF
:00411CB1 8B550C                  mov edx, dword ptr [ebp+0C]
:00411CB4 81E2FFFF0000            and edx, 0000FFFF
:00411CBA 0FAFCA                  imul ecx, edx
:00411CBD 03C1                    add eax, ecx
:00411CBF 8B4D08                  mov ecx, dword ptr [ebp+08]
:00411CC2 81E1FFFF0000            and ecx, 0000FFFF
:00411CC8 03C1                    add eax, ecx
:00411CCA 03C0                    add eax, eax
:00411CCC 0145FC                  add dword ptr [ebp-04], eax
:00411CCF 8B45FC                  mov eax, dword ptr [ebp-04]
:00411CD2 E900000000              jmp 00411CD7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411CD2(U)
|
:00411CD7 5F                      pop edi
:00411CD8 5E                      pop esi
:00411CD9 5B                      pop ebx
:00411CDA C9                      leave
:00411CDB C3                      ret



* Referenced by a CALL at Address:
|:00411E4C   
|
:00411CDC 55                      push ebp
:00411CDD 8BEC                    mov ebp, esp
:00411CDF 83EC08                  sub esp, 00000008
:00411CE2 53                      push ebx
:00411CE3 56                      push esi
:00411CE4 57                      push edi
:00411CE5 6A00                    push 00000000
:00411CE7 8B850C010000            mov eax, dword ptr [ebp+0000010C]
:00411CED 25FFFF0000              and eax, 0000FFFF
:00411CF2 50                      push eax
:00411CF3 8D4D08                  lea ecx, dword ptr [ebp+08]
:00411CF6 E886590100              call 00427681
:00411CFB 8945F8                  mov dword ptr [ebp-08], eax
:00411CFE 8B45F8                  mov eax, dword ptr [ebp-08]
:00411D01 50                      push eax
:00411D02 E852FDFFFF              call 00411A59
:00411D07 83C404                  add esp, 00000004
:00411D0A 8945FC                  mov dword ptr [ebp-04], eax
:00411D0D 837DFC00                cmp dword ptr [ebp-04], 00000000
:00411D11 0F8508000000            jne 00411D1F
:00411D17 8B45FC                  mov eax, dword ptr [ebp-04]
:00411D1A E920000000              jmp 00411D3F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411D11(C)
|
:00411D1F 8B45FC                  mov eax, dword ptr [ebp-04]
:00411D22 50                      push eax
:00411D23 8B850C010000            mov eax, dword ptr [ebp+0000010C]
:00411D29 25FFFF0000              and eax, 0000FFFF
:00411D2E 50                      push eax
:00411D2F 8D4D08                  lea ecx, dword ptr [ebp+08]
:00411D32 E84A590100              call 00427681
:00411D37 8B45FC                  mov eax, dword ptr [ebp-04]
:00411D3A E900000000              jmp 00411D3F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00411D1A(U), :00411D3A(U)
|
:00411D3F 5F                      pop edi
:00411D40 5E                      pop esi
:00411D41 5B                      pop ebx
:00411D42 C9                      leave
:00411D43 C3                      ret



* Referenced by a CALL at Addresses:
|:004122F4   , :00415167   
|
:00411D44 55                      push ebp
:00411D45 8BEC                    mov ebp, esp
:00411D47 81EC14010000            sub esp, 00000114
:00411D4D 53                      push ebx
:00411D4E 56                      push esi
:00411D4F 57                      push edi
:00411D50 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00411D56 E81579FFFF              call 00409670
:00411D5B C745F8D8D54500          mov [ebp-08], 0045D5D8
:00411D62 66C745F00000            mov [ebp-10], 0000
:00411D68 E908000000              jmp 00411D75

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411DA1(U)
|
:00411D6D 66FF45F0                inc [ebp-10]
:00411D71 8345F83E                add dword ptr [ebp-08], 0000003E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411D68(U)
|
:00411D75 8B45F0                  mov eax, dword ptr [ebp-10]
:00411D78 25FFFF0000              and eax, 0000FFFF
:00411D7D 3D80000000              cmp eax, 00000080
:00411D82 0F8D1E000000            jnl 00411DA6
:00411D88 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00411D8B E8D05D0000              call 00417B60
:00411D90 0FB7C0                  movzx eax, ax
:00411D93 F6C480                  test ah, 80
:00411D96 0F8505000000            jne 00411DA1
:00411D9C E905000000              jmp 00411DA6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411D96(C)
|
:00411DA1 E9C7FFFFFF              jmp 00411D6D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00411D82(C), :00411D9C(U)
|
:00411DA6 8B45F0                  mov eax, dword ptr [ebp-10]
:00411DA9 25FFFF0000              and eax, 0000FFFF
:00411DAE 3D80000000              cmp eax, 00000080
:00411DB3 0F8512000000            jne 00411DCB
:00411DB9 6880000000              push 00000080
:00411DBE E8FCF6FFFF              call 004114BF
:00411DC3 83C404                  add esp, 00000004
:00411DC6 E9DC000000              jmp 00411EA7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411DB3(C)
|
:00411DCB 8B4508                  mov eax, dword ptr [ebp+08]
:00411DCE 50                      push eax
:00411DCF 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00411DD2 E8195E0000              call 00417BF0
:00411DD7 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00411DDA E8F15D0000              call 00417BD0
:00411DDF 6800800000              push 00008000
:00411DE4 6800800000              push 00008000
:00411DE9 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00411DEC E85F5E0000              call 00417C50
:00411DF1 6A00                    push 00000000
:00411DF3 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00411DF6 E8255E0000              call 00417C20
:00411DFB 8B450C                  mov eax, dword ptr [ebp+0C]
:00411DFE 50                      push eax
:00411DFF 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00411E02 E8A95E0000              call 00417CB0
:00411E07 8B450C                  mov eax, dword ptr [ebp+0C]
:00411E0A 25FFFF0000              and eax, 0000FFFF
:00411E0F 8B0485C0164600          mov eax, dword ptr [4*eax+004616C0]
:00411E16 8945F4                  mov dword ptr [ebp-0C], eax
:00411E19 837DF400                cmp dword ptr [ebp-0C], 00000000
:00411E1D 0F8570000000            jne 00411E93

* Possible StringData Ref from Data Obj ->"A:PMAPOBJ.E2"
                                  |
:00411E23 6850144500              push 00451450
:00411E28 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00411E2E E8DC560100              call 0042750F
:00411E33 8B450C                  mov eax, dword ptr [ebp+0C]
:00411E36 50                      push eax
:00411E37 81EC04010000            sub esp, 00000104
:00411E3D 8DB5ECFEFFFF            lea esi, dword ptr [ebp+FFFFFEEC]
:00411E43 8BFC                    mov edi, esp
:00411E45 B941000000              mov ecx, 00000041
:00411E4A F3                      repz
:00411E4B A5                      movsd
:00411E4C E88BFEFFFF              call 00411CDC
:00411E51 81C408010000            add esp, 00000108
:00411E57 8945FC                  mov dword ptr [ebp-04], eax
:00411E5A 837DFC00                cmp dword ptr [ebp-04], 00000000
:00411E5E 0F841F000000            je 00411E83
:00411E64 8B45FC                  mov eax, dword ptr [ebp-04]
:00411E67 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00411E6A 81E1FFFF0000            and ecx, 0000FFFF
:00411E70 89048DC0164600          mov dword ptr [4*ecx+004616C0], eax
:00411E77 8B45FC                  mov eax, dword ptr [ebp-04]
:00411E7A 50                      push eax
:00411E7B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00411E7E E8FD5C0000              call 00417B80

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411E5E(C)
|
:00411E83 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00411E89 E89275FFFF              call 00409420
:00411E8E E90C000000              jmp 00411E9F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411E1D(C)
|
:00411E93 8B45F4                  mov eax, dword ptr [ebp-0C]
:00411E96 50                      push eax
:00411E97 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00411E9A E8E15C0000              call 00417B80

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411E8E(U)
|
:00411E9F 8B45F8                  mov eax, dword ptr [ebp-08]
:00411EA2 E900000000              jmp 00411EA7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00411DC6(U), :00411EA2(U)
|
:00411EA7 5F                      pop edi
:00411EA8 5E                      pop esi
:00411EA9 5B                      pop ebx
:00411EAA C9                      leave
:00411EAB C3                      ret



* Referenced by a CALL at Address:
|:00414B58   
|
:00411EAC 55                      push ebp
:00411EAD 8BEC                    mov ebp, esp
:00411EAF 81EC0C010000            sub esp, 0000010C
:00411EB5 53                      push ebx
:00411EB6 56                      push esi
:00411EB7 57                      push edi
:00411EB8 8D8DFCFEFFFF            lea ecx, dword ptr [ebp+FFFFFEFC]
:00411EBE E8AD77FFFF              call 00409670

* Possible StringData Ref from Data Obj ->"A:PMAPCHIP.E2"
                                  |
:00411EC3 6840144500              push 00451440
:00411EC8 8D8DFCFEFFFF            lea ecx, dword ptr [ebp+FFFFFEFC]
:00411ECE E83C560100              call 0042750F
:00411ED3 B9E8E44600              mov ecx, 0046E4E8
:00411ED8 E80372FFFF              call 004090E0
:00411EDD 50                      push eax
:00411EDE 8B4508                  mov eax, dword ptr [ebp+08]
:00411EE1 25FFFF0000              and eax, 0000FFFF
:00411EE6 50                      push eax
:00411EE7 8D8DFCFEFFFF            lea ecx, dword ptr [ebp+FFFFFEFC]
:00411EED E88F570100              call 00427681
:00411EF2 8985F8FEFFFF            mov dword ptr [ebp+FFFFFEF8], eax
:00411EF8 6A04                    push 00000004
:00411EFA 6A00                    push 00000000
:00411EFC 6A00                    push 00000000
:00411EFE B950F94600              mov ecx, 0046F950
:00411F03 E818580300              call 00447720
:00411F08 8985F4FEFFFF            mov dword ptr [ebp+FFFFFEF4], eax
:00411F0E 668B4508                mov ax, word ptr [ebp+08]
:00411F12 8B8DF4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEF4]
:00411F18 668901                  mov word ptr [ecx], ax
:00411F1B 8D8DFCFEFFFF            lea ecx, dword ptr [ebp+FFFFFEFC]
:00411F21 E8FA74FFFF              call 00409420
:00411F26 8B85F8FEFFFF            mov eax, dword ptr [ebp+FFFFFEF8]
:00411F2C E900000000              jmp 00411F31

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411F2C(U)
|
:00411F31 5F                      pop edi
:00411F32 5E                      pop esi
:00411F33 5B                      pop ebx
:00411F34 C9                      leave
:00411F35 C3                      ret



* Referenced by a CALL at Addresses:
|:004120D4   , :004122BF   
|
:00411F36 55                      push ebp
:00411F37 8BEC                    mov ebp, esp
:00411F39 83EC04                  sub esp, 00000004
:00411F3C 53                      push ebx
:00411F3D 56                      push esi
:00411F3E 57                      push edi
:00411F3F 6A06                    push 00000006
:00411F41 E8FCFCFFFF              call 00411C42
:00411F46 83C404                  add esp, 00000004
:00411F49 0FB7C0                  movzx eax, ax
:00411F4C 8B4D10                  mov ecx, dword ptr [ebp+10]
:00411F4F 81E1FFFF0000            and ecx, 0000FFFF
:00411F55 3BC1                    cmp eax, ecx
:00411F57 0F8EAF000000            jle 0041200C
:00411F5D 6A04                    push 00000004
:00411F5F E8DEFCFFFF              call 00411C42
:00411F64 83C404                  add esp, 00000004
:00411F67 0FB7C0                  movzx eax, ax
:00411F6A 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00411F6D 81E1FFFF0000            and ecx, 0000FFFF
:00411F73 3BC1                    cmp eax, ecx
:00411F75 0F8E91000000            jle 0041200C
:00411F7B 6A02                    push 00000002
:00411F7D E8C0FCFFFF              call 00411C42
:00411F82 83C404                  add esp, 00000004
:00411F85 0FB7C0                  movzx eax, ax
:00411F88 8B4D08                  mov ecx, dword ptr [ebp+08]
:00411F8B 81E1FFFF0000            and ecx, 0000FFFF
:00411F91 3BC1                    cmp eax, ecx
:00411F93 0F8E73000000            jle 0041200C
:00411F99 6A02                    push 00000002
:00411F9B E8A2FCFFFF              call 00411C42
:00411FA0 83C404                  add esp, 00000004
:00411FA3 0FB7D8                  movzx ebx, ax
:00411FA6 6A04                    push 00000004
:00411FA8 E895FCFFFF              call 00411C42
:00411FAD 83C404                  add esp, 00000004
:00411FB0 0FB7C0                  movzx eax, ax
:00411FB3 0FAFD8                  imul ebx, eax
:00411FB6 8B4510                  mov eax, dword ptr [ebp+10]
:00411FB9 25FFFF0000              and eax, 0000FFFF
:00411FBE 0FAFD8                  imul ebx, eax
:00411FC1 895DFC                  mov dword ptr [ebp-04], ebx
:00411FC4 6A02                    push 00000002
:00411FC6 E877FCFFFF              call 00411C42
:00411FCB 83C404                  add esp, 00000004
:00411FCE 0FB7C0                  movzx eax, ax
:00411FD1 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00411FD4 81E1FFFF0000            and ecx, 0000FFFF
:00411FDA 0FAFC1                  imul eax, ecx
:00411FDD 0145FC                  add dword ptr [ebp-04], eax
:00411FE0 8B4508                  mov eax, dword ptr [ebp+08]
:00411FE3 25FFFF0000              and eax, 0000FFFF
:00411FE8 0145FC                  add dword ptr [ebp-04], eax
:00411FEB C165FC01                shl dword ptr [ebp-04], 01
:00411FEF 6A04                    push 00000004
:00411FF1 6A00                    push 00000000
:00411FF3 8B45FC                  mov eax, dword ptr [ebp-04]
:00411FF6 83C010                  add eax, 00000010
:00411FF9 50                      push eax
:00411FFA B950F94600              mov ecx, 0046F950
:00411FFF E81C570300              call 00447720
:00412004 668B00                  mov ax, word ptr [eax]
:00412007 E909000000              jmp 00412015

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00411F57(C), :00411F75(C), :00411F93(C)
|
:0041200C 66B800F0                mov ax, F000
:00412010 E900000000              jmp 00412015

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00412007(U), :00412010(U)
|
:00412015 5F                      pop edi
:00412016 5E                      pop esi
:00412017 5B                      pop ebx
:00412018 C9                      leave
:00412019 C3                      ret



* Referenced by a CALL at Addresses:
|:00413BB8   , :00413D4D   
|
:0041201A 55                      push ebp
:0041201B 8BEC                    mov ebp, esp
:0041201D 83EC10                  sub esp, 00000010
:00412020 53                      push ebx
:00412021 56                      push esi
:00412022 57                      push edi
:00412023 668B4510                mov ax, word ptr [ebp+10]
:00412027 668945FC                mov word ptr [ebp-04], ax
:0041202B E904000000              jmp 00412034

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004120FD(U)
|
:00412030 66FF45FC                inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041202B(U)
|
:00412034 8B451C                  mov eax, dword ptr [ebp+1C]
:00412037 25FFFF0000              and eax, 0000FFFF
:0041203C 8B4D10                  mov ecx, dword ptr [ebp+10]
:0041203F 81E1FFFF0000            and ecx, 0000FFFF
:00412045 03C1                    add eax, ecx
:00412047 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041204A 81E1FFFF0000            and ecx, 0000FFFF
:00412050 3BC1                    cmp eax, ecx
:00412052 0F8EAA000000            jle 00412102
:00412058 8B450C                  mov eax, dword ptr [ebp+0C]
:0041205B 25FFFF0000              and eax, 0000FFFF
:00412060 8B4D18                  mov ecx, dword ptr [ebp+18]
:00412063 81E1FFFF0000            and ecx, 0000FFFF
:00412069 2BC1                    sub eax, ecx
:0041206B 40                      inc eax
:0041206C 668945F4                mov word ptr [ebp-0C], ax
:00412070 E904000000              jmp 00412079

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004120F8(U)
|
:00412075 66FF45F4                inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412070(U)
|
:00412079 8B450C                  mov eax, dword ptr [ebp+0C]
:0041207C 25FFFF0000              and eax, 0000FFFF
:00412081 40                      inc eax
:00412082 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00412085 81E1FFFF0000            and ecx, 0000FFFF
:0041208B 3BC1                    cmp eax, ecx
:0041208D 0F8E6A000000            jle 004120FD
:00412093 668B4508                mov ax, word ptr [ebp+08]
:00412097 668945F8                mov word ptr [ebp-08], ax
:0041209B E904000000              jmp 004120A4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004120F3(U)
|
:004120A0 66FF45F8                inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041209B(U)
|
:004120A4 8B4514                  mov eax, dword ptr [ebp+14]
:004120A7 25FFFF0000              and eax, 0000FFFF
:004120AC 8B4D08                  mov ecx, dword ptr [ebp+08]
:004120AF 81E1FFFF0000            and ecx, 0000FFFF
:004120B5 03C1                    add eax, ecx
:004120B7 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004120BA 81E1FFFF0000            and ecx, 0000FFFF
:004120C0 3BC1                    cmp eax, ecx
:004120C2 0F8E30000000            jle 004120F8
:004120C8 8B45FC                  mov eax, dword ptr [ebp-04]
:004120CB 50                      push eax
:004120CC 8B45F4                  mov eax, dword ptr [ebp-0C]
:004120CF 50                      push eax
:004120D0 8B45F8                  mov eax, dword ptr [ebp-08]
:004120D3 50                      push eax
:004120D4 E85DFEFFFF              call 00411F36
:004120D9 83C40C                  add esp, 0000000C
:004120DC 668945F0                mov word ptr [ebp-10], ax
:004120E0 807DF1F0                cmp byte ptr [ebp-0F], F0
:004120E4 0F8509000000            jne 004120F3
:004120EA 66B8FFFF                mov ax, FFFF
:004120EE E917000000              jmp 0041210A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004120E4(C)
|
:004120F3 E9A8FFFFFF              jmp 004120A0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004120C2(C)
|
:004120F8 E978FFFFFF              jmp 00412075

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041208D(C)
|
:004120FD E92EFFFFFF              jmp 00412030

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412052(C)
|
:00412102 6633C0                  xor ax, ax
:00412105 E900000000              jmp 0041210A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004120EE(U), :00412105(U)
|
:0041210A 5F                      pop edi
:0041210B 5E                      pop esi
:0041210C 5B                      pop ebx
:0041210D C9                      leave
:0041210E C3                      ret



* Referenced by a CALL at Addresses:
|:004123FA   , :00412EC1   
|
:0041210F 55                      push ebp
:00412110 8BEC                    mov ebp, esp
:00412112 83EC10                  sub esp, 00000010
:00412115 53                      push ebx
:00412116 56                      push esi
:00412117 57                      push edi
:00412118 8B4508                  mov eax, dword ptr [ebp+08]
:0041211B 33C9                    xor ecx, ecx
:0041211D 668B08                  mov cx, word ptr [eax]
:00412120 8D04CD00000000          lea eax, dword ptr [8*ecx+00000000]
:00412127 668945F8                mov word ptr [ebp-08], ax
:0041212B 8B450C                  mov eax, dword ptr [ebp+0C]
:0041212E 33C9                    xor ecx, ecx
:00412130 668B08                  mov cx, word ptr [eax]
:00412133 8D04CD00000000          lea eax, dword ptr [8*ecx+00000000]
:0041213A F7D8                    neg eax
:0041213C 668945F0                mov word ptr [ebp-10], ax
:00412140 8B45F0                  mov eax, dword ptr [ebp-10]
:00412143 25FFFF0000              and eax, 0000FFFF
:00412148 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041214B 81E1FFFF0000            and ecx, 0000FFFF
:00412151 03C1                    add eax, ecx
:00412153 668945FC                mov word ptr [ebp-04], ax
:00412157 8B450C                  mov eax, dword ptr [ebp+0C]
:0041215A 33C9                    xor ecx, ecx
:0041215C 668B08                  mov cx, word ptr [eax]
:0041215F 8B4508                  mov eax, dword ptr [ebp+08]
:00412162 33D2                    xor edx, edx
:00412164 668B10                  mov dx, word ptr [eax]
:00412167 03CA                    add ecx, edx
:00412169 8D048D00000000          lea eax, dword ptr [4*ecx+00000000]
:00412170 8B4D10                  mov ecx, dword ptr [ebp+10]
:00412173 81E1FFFF0000            and ecx, 0000FFFF
:00412179 C1E103                  shl ecx, 03
:0041217C 2BC1                    sub eax, ecx
:0041217E 668945F4                mov word ptr [ebp-0C], ax
:00412182 6A08                    push 00000008
:00412184 E8B9FAFFFF              call 00411C42
:00412189 83C404                  add esp, 00000004
:0041218C 0FB7C0                  movzx eax, ax
:0041218F C1E003                  shl eax, 03
:00412192 99                      cdq
:00412193 2BC2                    sub eax, edx
:00412195 C1F801                  sar eax, 01
:00412198 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041219B 81E1FFFF0000            and ecx, 0000FFFF
:004121A1 03C1                    add eax, ecx
:004121A3 83E808                  sub eax, 00000008
:004121A6 668945FC                mov word ptr [ebp-04], ax
:004121AA 8B45FC                  mov eax, dword ptr [ebp-04]
:004121AD 25FFFF0000              and eax, 0000FFFF
:004121B2 33C9                    xor ecx, ecx
:004121B4 668B0D34F74500          mov cx, word ptr [0045F734]
:004121BB C1E103                  shl ecx, 03
:004121BE 2BC1                    sub eax, ecx
:004121C0 668945FC                mov word ptr [ebp-04], ax
:004121C4 8B45F4                  mov eax, dword ptr [ebp-0C]
:004121C7 25FFFF0000              and eax, 0000FFFF
:004121CC 33C9                    xor ecx, ecx
:004121CE 668B0D36F74500          mov cx, word ptr [0045F736]
:004121D5 8D0CCDF8FFFFFF          lea ecx, dword ptr [8*ecx+FFFFFFF8]
:004121DC 2BC1                    sub eax, ecx
:004121DE 668945F4                mov word ptr [ebp-0C], ax
:004121E2 668B45FC                mov ax, word ptr [ebp-04]
:004121E6 8B4D08                  mov ecx, dword ptr [ebp+08]
:004121E9 668901                  mov word ptr [ecx], ax
:004121EC 668B45F4                mov ax, word ptr [ebp-0C]
:004121F0 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004121F3 668901                  mov word ptr [ecx], ax
:004121F6 E900000000              jmp 004121FB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004121F6(U)
|
:004121FB 5F                      pop edi
:004121FC 5E                      pop esi
:004121FD 5B                      pop ebx
:004121FE C9                      leave
:004121FF C3                      ret



* Referenced by a CALL at Addresses:
|:00417743   , :00417765   
|
:00412200 55                      push ebp
:00412201 8BEC                    mov ebp, esp
:00412203 83EC34                  sub esp, 00000034
:00412206 53                      push ebx
:00412207 56                      push esi
:00412208 57                      push edi
:00412209 66C745F0FFFF            mov [ebp-10], FFFF
:0041220F 66C745ECFFFF            mov [ebp-14], FFFF
:00412215 66C745F4FFFF            mov [ebp-0C], FFFF
:0041221B 6A00                    push 00000000
:0041221D 6A70                    push 00000070
:0041221F 6808A64600              push 0046A608
:00412224 E8B0F1FFFF              call 004113D9
:00412229 83C40C                  add esp, 0000000C
:0041222C 66C745E00000            mov [ebp-20], 0000
:00412232 E904000000              jmp 0041223B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412511(U)
|
:00412237 66FF45E0                inc [ebp-20]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412232(U)
|
:0041223B 6A06                    push 00000006
:0041223D E800FAFFFF              call 00411C42
:00412242 83C404                  add esp, 00000004
:00412245 0FB7C0                  movzx eax, ax
:00412248 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0041224B 81E1FFFF0000            and ecx, 0000FFFF
:00412251 3BC1                    cmp eax, ecx
:00412253 0F8EBD020000            jle 00412516
:00412259 66C745DC0000            mov [ebp-24], 0000
:0041225F E904000000              jmp 00412268

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041250C(U)
|
:00412264 66FF45DC                inc [ebp-24]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041225F(U)
|
:00412268 6A04                    push 00000004
:0041226A E8D3F9FFFF              call 00411C42
:0041226F 83C404                  add esp, 00000004
:00412272 0FB7C0                  movzx eax, ax
:00412275 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00412278 81E1FFFF0000            and ecx, 0000FFFF
:0041227E 3BC1                    cmp eax, ecx
:00412280 0F8E8B020000            jle 00412511
:00412286 66C745E40000            mov [ebp-1C], 0000
:0041228C E904000000              jmp 00412295

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412507(U)
|
:00412291 66FF45E4                inc [ebp-1C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041228C(U)
|
:00412295 6A02                    push 00000002
:00412297 E8A6F9FFFF              call 00411C42
:0041229C 83C404                  add esp, 00000004
:0041229F 0FB7C0                  movzx eax, ax
:004122A2 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004122A5 81E1FFFF0000            and ecx, 0000FFFF
:004122AB 3BC1                    cmp eax, ecx
:004122AD 0F8E59020000            jle 0041250C
:004122B3 8B45E0                  mov eax, dword ptr [ebp-20]
:004122B6 50                      push eax
:004122B7 8B45DC                  mov eax, dword ptr [ebp-24]
:004122BA 50                      push eax
:004122BB 8B45E4                  mov eax, dword ptr [ebp-1C]
:004122BE 50                      push eax
:004122BF E872FCFFFF              call 00411F36
:004122C4 83C40C                  add esp, 0000000C
:004122C7 668945E8                mov word ptr [ebp-18], ax
:004122CB 8B4508                  mov eax, dword ptr [ebp+08]
:004122CE 25FFFF0000              and eax, 0000FFFF
:004122D3 83F801                  cmp eax, 00000001
:004122D6 0F8565000000            jne 00412341
:004122DC 807DE8FF                cmp byte ptr [ebp-18], FF
:004122E0 0F845B000000            je 00412341
:004122E6 8B45E8                  mov eax, dword ptr [ebp-18]
:004122E9 25FF000000              and eax, 000000FF
:004122EE 50                      push eax
:004122EF 6800060000              push 00000600
:004122F4 E84BFAFFFF              call 00411D44
:004122F9 83C408                  add esp, 00000008
:004122FC 8945F8                  mov dword ptr [ebp-08], eax
:004122FF 6880000000              push 00000080
:00412304 E8B6F1FFFF              call 004114BF
:00412309 83C404                  add esp, 00000004
:0041230C 3B45F8                  cmp eax, dword ptr [ebp-08]
:0041230F 0F8505000000            jne 0041231A
:00412315 E9D3020000              jmp 004125ED

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041230F(C)
|
:0041231A 8B45F8                  mov eax, dword ptr [ebp-08]
:0041231D 50                      push eax
:0041231E 6A00                    push 00000000
:00412320 6A00                    push 00000000
:00412322 6A00                    push 00000000
:00412324 6A00                    push 00000000
:00412326 6A00                    push 00000000
:00412328 8B45E0                  mov eax, dword ptr [ebp-20]
:0041232B 50                      push eax
:0041232C 8B45DC                  mov eax, dword ptr [ebp-24]
:0041232F 50                      push eax
:00412330 8B45E4                  mov eax, dword ptr [ebp-1C]
:00412333 50                      push eax
:00412334 6800060000              push 00000600
:00412339 E8832A0000              call 00414DC1
:0041233E 83C428                  add esp, 00000028

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004122D6(C), :004122E0(C)
|
:00412341 8B45E8                  mov eax, dword ptr [ebp-18]
:00412344 2500FF0000              and eax, 0000FF00
:00412349 668945E8                mov word ptr [ebp-18], ax
:0041234D 8B45E8                  mov eax, dword ptr [ebp-18]
:00412350 25FFFF0000              and eax, 0000FFFF
:00412355 8945D0                  mov dword ptr [ebp-30], eax
:00412358 E90F010000              jmp 0041246C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00412479(C), :00412486(C), :0041249E(C), :004124AB(C), :004124C3(C)
|:004124D0(C), :004124E2(C), :004124EF(C)
|
:0041235D 8B45E8                  mov eax, dword ptr [ebp-18]
:00412360 25FFFF0000              and eax, 0000FFFF
:00412365 2D00F10000              sub eax, 0000F100
:0041236A 668945E8                mov word ptr [ebp-18], ax
:0041236E 8B45E8                  mov eax, dword ptr [ebp-18]
:00412371 25FFFF0000              and eax, 0000FFFF
:00412376 C1E808                  shr eax, 08
:00412379 8BC8                    mov ecx, eax
:0041237B C1E003                  shl eax, 03
:0041237E 2BC1                    sub eax, ecx
:00412380 8D044508A64600          lea eax, dword ptr [2*eax+0046A608]
:00412387 8945FC                  mov dword ptr [ebp-04], eax
:0041238A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041238D E84E590000              call 00417CE0
:00412392 0FB7C0                  movzx eax, ax
:00412395 F6C480                  test ah, 80
:00412398 0F8400000000            je 0041239E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412398(C)
|
:0041239E 6800800000              push 00008000
:004123A3 6800800000              push 00008000
:004123A8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004123AB E850590000              call 00417D00
:004123B0 8B45E4                  mov eax, dword ptr [ebp-1C]
:004123B3 50                      push eax
:004123B4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004123B7 E8A4590000              call 00417D60
:004123BC 8B45DC                  mov eax, dword ptr [ebp-24]
:004123BF 50                      push eax
:004123C0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004123C3 E8C8590000              call 00417D90
:004123C8 8B45E4                  mov eax, dword ptr [ebp-1C]
:004123CB 25FFFF0000              and eax, 0000FFFF
:004123D0 83C004                  add eax, 00000004
:004123D3 668945D8                mov word ptr [ebp-28], ax
:004123D7 8B45DC                  mov eax, dword ptr [ebp-24]
:004123DA 25FFFF0000              and eax, 0000FFFF
:004123DF 83C004                  add eax, 00000004
:004123E2 668945D4                mov word ptr [ebp-2C], ax
:004123E6 8B45E0                  mov eax, dword ptr [ebp-20]
:004123E9 25FFFF0000              and eax, 0000FFFF
:004123EE 83C009                  add eax, 00000009
:004123F1 50                      push eax
:004123F2 8D45D4                  lea eax, dword ptr [ebp-2C]
:004123F5 50                      push eax
:004123F6 8D45D8                  lea eax, dword ptr [ebp-28]
:004123F9 50                      push eax
:004123FA E810FDFFFF              call 0041210F
:004123FF 83C40C                  add esp, 0000000C
:00412402 8B45D4                  mov eax, dword ptr [ebp-2C]
:00412405 25FFFF0000              and eax, 0000FFFF
:0041240A 83C028                  add eax, 00000028
:0041240D 668945D4                mov word ptr [ebp-2C], ax
:00412411 8B45D8                  mov eax, dword ptr [ebp-28]
:00412414 25FFFF0000              and eax, 0000FFFF
:00412419 83E818                  sub eax, 00000018
:0041241C 50                      push eax
:0041241D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00412420 E89B590000              call 00417DC0
:00412425 8B45D4                  mov eax, dword ptr [ebp-2C]
:00412428 50                      push eax
:00412429 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041242C E8BF590000              call 00417DF0
:00412431 6A50                    push 00000050
:00412433 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00412436 E8E5590000              call 00417E20
:0041243B 6A48                    push 00000048
:0041243D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00412440 E80B5A0000              call 00417E50
:00412445 E9BD000000              jmp 00412507

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004124FC(C)
|
:0041244A 668B45E4                mov ax, word ptr [ebp-1C]
:0041244E 668945F0                mov word ptr [ebp-10], ax
:00412452 668B45DC                mov ax, word ptr [ebp-24]
:00412456 668945EC                mov word ptr [ebp-14], ax
:0041245A 668B45E0                mov ax, word ptr [ebp-20]
:0041245E 668945F4                mov word ptr [ebp-0C], ax
:00412462 E9A0000000              jmp 00412507
:00412467 E99B000000              jmp 00412507

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412358(U)
|
:0041246C 817DD000F20000          cmp dword ptr [ebp-30], 0000F200
:00412473 0F8F18000000            jg 00412491
:00412479 0F84DEFEFFFF            je 0041235D
:0041247F 817DD000F10000          cmp dword ptr [ebp-30], 0000F100
:00412486 0F84D1FEFFFF            je 0041235D
:0041248C E976000000              jmp 00412507

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412473(C)
|
:00412491 817DD000F40000          cmp dword ptr [ebp-30], 0000F400
:00412498 0F8F18000000            jg 004124B6
:0041249E 0F84B9FEFFFF            je 0041235D
:004124A4 817DD000F30000          cmp dword ptr [ebp-30], 0000F300
:004124AB 0F84ACFEFFFF            je 0041235D
:004124B1 E951000000              jmp 00412507

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412498(C)
|
:004124B6 817DD000F60000          cmp dword ptr [ebp-30], 0000F600
:004124BD 0F8F18000000            jg 004124DB
:004124C3 0F8494FEFFFF            je 0041235D
:004124C9 817DD000F50000          cmp dword ptr [ebp-30], 0000F500
:004124D0 0F8487FEFFFF            je 0041235D
:004124D6 E92C000000              jmp 00412507

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004124BD(C)
|
:004124DB 817DD000F70000          cmp dword ptr [ebp-30], 0000F700
:004124E2 0F8475FEFFFF            je 0041235D
:004124E8 817DD000F80000          cmp dword ptr [ebp-30], 0000F800
:004124EF 0F8468FEFFFF            je 0041235D
:004124F5 817DD000F90000          cmp dword ptr [ebp-30], 0000F900
:004124FC 0F8448FFFFFF            je 0041244A
:00412502 E900000000              jmp 00412507

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00412445(U), :00412462(U), :00412467(U), :0041248C(U), :004124B1(U)
|:004124D6(U), :00412502(U)
|
:00412507 E985FDFFFF              jmp 00412291

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004122AD(C)
|
:0041250C E953FDFFFF              jmp 00412264

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412280(C)
|
:00412511 E921FDFFFF              jmp 00412237

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412253(C)
|
:00412516 66C745D8FE03            mov [ebp-28], 03FE
:0041251C B900AA4600              mov ecx, 0046AA00
:00412521 E85AD8FFFF              call 0040FD80
:00412526 33C9                    xor ecx, ecx
:00412528 8AC8                    mov cl, al
:0041252A 894DCC                  mov dword ptr [ebp-34], ecx
:0041252D E99D000000              jmp 004125CF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004125D3(C)
|
:00412532 66C745D8FD03            mov [ebp-28], 03FD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004125DD(C)
|
:00412538 C745FC08A64600          mov [ebp-04], 0046A608
:0041253F 66C745E80000            mov [ebp-18], 0000
:00412545 E908000000              jmp 00412552

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041257C(U)
|
:0041254A 66FF45E8                inc [ebp-18]
:0041254E 8345FC0E                add dword ptr [ebp-04], 0000000E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412545(U)
|
:00412552 8B45E8                  mov eax, dword ptr [ebp-18]
:00412555 25FFFF0000              and eax, 0000FFFF
:0041255A 83F804                  cmp eax, 00000004
:0041255D 0F8D1E000000            jnl 00412581
:00412563 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00412566 E875570000              call 00417CE0
:0041256B 0FB7C0                  movzx eax, ax
:0041256E F6C480                  test ah, 80
:00412571 0F8405000000            je 0041257C
:00412577 E905000000              jmp 00412581

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412571(C)
|
:0041257C E9C9FFFFFF              jmp 0041254A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041255D(C), :00412577(U)
|
:00412581 8B45E8                  mov eax, dword ptr [ebp-18]
:00412584 83E003                  and eax, 00000003
:00412587 668945E8                mov word ptr [ebp-18], ax
:0041258B 8B45F0                  mov eax, dword ptr [ebp-10]
:0041258E 25FFFF0000              and eax, 0000FFFF
:00412593 3DFFFF0000              cmp eax, 0000FFFF
:00412598 0F8505000000            jne 004125A3
:0041259E E94A000000              jmp 004125ED

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412598(C)
|
:004125A3 6A00                    push 00000000
:004125A5 8B45E8                  mov eax, dword ptr [ebp-18]
:004125A8 50                      push eax
:004125A9 6A01                    push 00000001
:004125AB 6A02                    push 00000002
:004125AD 6A02                    push 00000002
:004125AF 6A00                    push 00000000
:004125B1 8B45EC                  mov eax, dword ptr [ebp-14]
:004125B4 50                      push eax
:004125B5 8B45F0                  mov eax, dword ptr [ebp-10]
:004125B8 50                      push eax
:004125B9 8B45D8                  mov eax, dword ptr [ebp-28]
:004125BC 50                      push eax
:004125BD E8022B0000              call 004150C4
:004125C2 83C424                  add esp, 00000024
:004125C5 E91E000000              jmp 004125E8
:004125CA E919000000              jmp 004125E8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041252D(U)
|
:004125CF 837DCC03                cmp dword ptr [ebp-34], 00000003
:004125D3 0F8459FFFFFF            je 00412532
:004125D9 837DCC04                cmp dword ptr [ebp-34], 00000004
:004125DD 0F8455FFFFFF            je 00412538
:004125E3 E900000000              jmp 004125E8

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004125C5(U), :004125CA(U), :004125E3(U)
|
:004125E8 E900000000              jmp 004125ED

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00412315(U), :0041259E(U), :004125E8(U)
|
:004125ED 5F                      pop edi
:004125EE 5E                      pop esi
:004125EF 5B                      pop ebx
:004125F0 C9                      leave
:004125F1 C3                      ret



* Referenced by a CALL at Address:
|:00414B60   
|
:004125F2 55                      push ebp
:004125F3 8BEC                    mov ebp, esp
:004125F5 83EC14                  sub esp, 00000014
:004125F8 53                      push ebx
:004125F9 56                      push esi
:004125FA 57                      push edi
:004125FB A124F74500              mov eax, dword ptr [0045F724]
:00412600 8945FC                  mov dword ptr [ebp-04], eax
:00412603 66C745EC0000            mov [ebp-14], 0000
:00412609 66C745F00000            mov [ebp-10], 0000
:0041260F E904000000              jmp 00412618

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412673(U)
|
:00412614 66FF45F0                inc [ebp-10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041260F(U)
|
:00412618 8B45F0                  mov eax, dword ptr [ebp-10]
:0041261B 25FFFF0000              and eax, 0000FFFF
:00412620 83F832                  cmp eax, 00000032
:00412623 0F8D4F000000            jnl 00412678
:00412629 8B45FC                  mov eax, dword ptr [ebp-04]
:0041262C 8945F8                  mov dword ptr [ebp-08], eax
:0041262F 66C745F40000            mov [ebp-0C], 0000
:00412635 E908000000              jmp 00412642

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412661(U)
|
:0041263A 66FF45F4                inc [ebp-0C]
:0041263E 66FF45EC                inc [ebp-14]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412635(U)
|
:00412642 8B45F4                  mov eax, dword ptr [ebp-0C]
:00412645 25FFFF0000              and eax, 0000FFFF
:0041264A 83F850                  cmp eax, 00000050
:0041264D 0F8D13000000            jnl 00412666
:00412653 668B45EC                mov ax, word ptr [ebp-14]
:00412657 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041265A 668901                  mov word ptr [ecx], ax
:0041265D 8345FC02                add dword ptr [ebp-04], 00000002
:00412661 E9D4FFFFFF              jmp 0041263A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041264D(C)
|
:00412666 8B45F8                  mov eax, dword ptr [ebp-08]
:00412669 8945FC                  mov dword ptr [ebp-04], eax
:0041266C 8145FC90010000          add dword ptr [ebp-04], 00000190
:00412673 E99CFFFFFF              jmp 00412614

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412623(C)
|
:00412678 E900000000              jmp 0041267D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412678(U)
|
:0041267D 5F                      pop edi
:0041267E 5E                      pop esi
:0041267F 5B                      pop ebx
:00412680 C9                      leave
:00412681 C3                      ret



* Referenced by a CALL at Address:
|:00414A54   
|
:00412682 55                      push ebp
:00412683 8BEC                    mov ebp, esp
:00412685 83EC08                  sub esp, 00000008
:00412688 53                      push ebx
:00412689 56                      push esi
:0041268A 57                      push edi
:0041268B C745FCD8D54500          mov [ebp-04], 0045D5D8
:00412692 66C745F80000            mov [ebp-08], 0000
:00412698 E908000000              jmp 004126A5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004126D4(U)
|
:0041269D 66FF45F8                inc [ebp-08]
:004126A1 8345FC3E                add dword ptr [ebp-04], 0000003E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412698(U)
|
:004126A5 8B45F8                  mov eax, dword ptr [ebp-08]
:004126A8 25FFFF0000              and eax, 0000FFFF
:004126AD 3D80000000              cmp eax, 00000080
:004126B2 0F8D21000000            jnl 004126D9
:004126B8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004126BB E810550000              call 00417BD0
:004126C0 6A00                    push 00000000
:004126C2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004126C5 E8B6570000              call 00417E80
:004126CA 6A00                    push 00000000
:004126CC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004126CF E8AC540000              call 00417B80
:004126D4 E9C4FFFFFF              jmp 0041269D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004126B2(C)
|
:004126D9 E900000000              jmp 004126DE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004126D9(U)
|
:004126DE 5F                      pop edi
:004126DF 5E                      pop esi
:004126E0 5B                      pop ebx
:004126E1 C9                      leave
:004126E2 C3                      ret



* Referenced by a CALL at Address:
|:00412A2F   
|
:004126E3 55                      push ebp
:004126E4 8BEC                    mov ebp, esp
:004126E6 83EC0C                  sub esp, 0000000C
:004126E9 53                      push ebx
:004126EA 56                      push esi
:004126EB 57                      push edi
:004126EC 66C745FC0000            mov [ebp-04], 0000
:004126F2 E904000000              jmp 004126FB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412793(U)
|
:004126F7 66FF45FC                inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004126F2(U)
|
:004126FB 8B4514                  mov eax, dword ptr [ebp+14]
:004126FE 25FFFF0000              and eax, 0000FFFF
:00412703 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00412706 81E1FFFF0000            and ecx, 0000FFFF
:0041270C 3BC1                    cmp eax, ecx
:0041270E 0F8E84000000            jle 00412798
:00412714 C745F878F74500          mov [ebp-08], 0045F778
:0041271B 8B450C                  mov eax, dword ptr [ebp+0C]
:0041271E 25FFFF0000              and eax, 0000FFFF
:00412723 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00412726 81E1FFFF0000            and ecx, 0000FFFF
:0041272C 03C1                    add eax, ecx
:0041272E 33C9                    xor ecx, ecx
:00412730 668B0DD0D54500          mov cx, word ptr [0045D5D0]
:00412737 0FAFC1                  imul eax, ecx
:0041273A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041273D 81E1FFFF0000            and ecx, 0000FFFF
:00412743 03C1                    add eax, ecx
:00412745 03C0                    add eax, eax
:00412747 0145F8                  add dword ptr [ebp-08], eax
:0041274A 66C745F40000            mov [ebp-0C], 0000
:00412750 E908000000              jmp 0041275D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041278E(U)
|
:00412755 66FF45F4                inc [ebp-0C]
:00412759 8345F802                add dword ptr [ebp-08], 00000002

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412750(U)
|
:0041275D 8B4510                  mov eax, dword ptr [ebp+10]
:00412760 25FFFF0000              and eax, 0000FFFF
:00412765 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00412768 81E1FFFF0000            and ecx, 0000FFFF
:0041276E 3BC1                    cmp eax, ecx
:00412770 0F8E1D000000            jle 00412793
:00412776 8B45F8                  mov eax, dword ptr [ebp-08]
:00412779 33C9                    xor ecx, ecx
:0041277B 668B08                  mov cx, word ptr [eax]
:0041277E 8B4518                  mov eax, dword ptr [ebp+18]
:00412781 25FFFF0000              and eax, 0000FFFF
:00412786 0BC8                    or ecx, eax
:00412788 8B45F8                  mov eax, dword ptr [ebp-08]
:0041278B 668908                  mov word ptr [eax], cx
:0041278E E9C2FFFFFF              jmp 00412755

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412770(C)
|
:00412793 E95FFFFFFF              jmp 004126F7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041270E(C)
|
:00412798 E900000000              jmp 0041279D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412798(U)
|
:0041279D 5F                      pop edi
:0041279E 5E                      pop esi
:0041279F 5B                      pop ebx
:004127A0 C9                      leave
:004127A1 C3                      ret



* Referenced by a CALL at Addresses:
|:004129E5   , :00412A10   
|
:004127A2 55                      push ebp
:004127A3 8BEC                    mov ebp, esp
:004127A5 83EC04                  sub esp, 00000004
:004127A8 53                      push ebx
:004127A9 56                      push esi
:004127AA 57                      push edi
:004127AB 8B4508                  mov eax, dword ptr [ebp+08]
:004127AE 25FFFF0000              and eax, 0000FFFF
:004127B3 C1E803                  shr eax, 03
:004127B6 668945FC                mov word ptr [ebp-04], ax
:004127BA 8B4508                  mov eax, dword ptr [ebp+08]
:004127BD 25FFFF0000              and eax, 0000FFFF
:004127C2 99                      cdq
:004127C3 33C2                    xor eax, edx
:004127C5 2BC2                    sub eax, edx
:004127C7 83E007                  and eax, 00000007
:004127CA 33C2                    xor eax, edx
:004127CC 2BC2                    sub eax, edx
:004127CE 0F8404000000            je 004127D8
:004127D4 66FF45FC                inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004127CE(C)
|
:004127D8 668B45FC                mov ax, word ptr [ebp-04]
:004127DC E900000000              jmp 004127E1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004127DC(U)
|
:004127E1 5F                      pop edi
:004127E2 5E                      pop esi
:004127E3 5B                      pop ebx
:004127E4 C9                      leave
:004127E5 C3                      ret


:004127E6 55                      push ebp
:004127E7 8BEC                    mov ebp, esp
:004127E9 83EC04                  sub esp, 00000004
:004127EC 53                      push ebx
:004127ED 56                      push esi
:004127EE 57                      push edi
:004127EF 8B4508                  mov eax, dword ptr [ebp+08]
:004127F2 25FFFF0000              and eax, 0000FFFF
:004127F7 C1E803                  shr eax, 03
:004127FA 668945FC                mov word ptr [ebp-04], ax
:004127FE 668B45FC                mov ax, word ptr [ebp-04]
:00412802 E900000000              jmp 00412807

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412802(U)
|
:00412807 5F                      pop edi
:00412808 5E                      pop esi
:00412809 5B                      pop ebx
:0041280A C9                      leave
:0041280B C3                      ret



* Referenced by a CALL at Addresses:
|:00412BDA   , :00412E35   
|
:0041280C 55                      push ebp
:0041280D 8BEC                    mov ebp, esp
:0041280F 83EC20                  sub esp, 00000020
:00412812 53                      push ebx
:00412813 56                      push esi
:00412814 57                      push edi
:00412815 8B4508                  mov eax, dword ptr [ebp+08]
:00412818 25FFFF0000              and eax, 0000FFFF
:0041281D 668945EC                mov word ptr [ebp-14], ax
:00412821 8B450C                  mov eax, dword ptr [ebp+0C]
:00412824 25FFFF0000              and eax, 0000FFFF
:00412829 83E828                  sub eax, 00000028
:0041282C 25FFFF0000              and eax, 0000FFFF
:00412831 668945E4                mov word ptr [ebp-1C], ax
:00412835 668B45EC                mov ax, word ptr [ebp-14]
:00412839 668945FC                mov word ptr [ebp-04], ax
:0041283D 668B45E4                mov ax, word ptr [ebp-1C]
:00412841 668945F8                mov word ptr [ebp-08], ax
:00412845 0FBF45EC                movsx eax, word ptr [ebp-14]
:00412849 85C0                    test eax, eax
:0041284B 0F8D43000000            jnl 00412894
:00412851 8B4510                  mov eax, dword ptr [ebp+10]
:00412854 25FFFF0000              and eax, 0000FFFF
:00412859 0FBF4DEC                movsx ecx, word ptr [ebp-14]
:0041285D 03C1                    add eax, ecx
:0041285F 668945EC                mov word ptr [ebp-14], ax
:00412863 0FBF45EC                movsx eax, word ptr [ebp-14]
:00412867 85C0                    test eax, eax
:00412869 0F8F08000000            jg 00412877
:0041286F 6633C0                  xor ax, ax
:00412872 E9C9010000              jmp 00412A40

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412869(C)
|
:00412877 66C745FC0000            mov [ebp-04], 0000
:0041287D 8B4510                  mov eax, dword ptr [ebp+10]
:00412880 25FFFF0000              and eax, 0000FFFF
:00412885 0FBF4DEC                movsx ecx, word ptr [ebp-14]
:00412889 2BC1                    sub eax, ecx
:0041288B 668945F0                mov word ptr [ebp-10], ax
:0041288F E950000000              jmp 004128E4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041284B(C)
|
:00412894 0FBF45EC                movsx eax, word ptr [ebp-14]
:00412898 3D80020000              cmp eax, 00000280
:0041289D 0F8C08000000            jl 004128AB
:004128A3 6633C0                  xor ax, ax
:004128A6 E995010000              jmp 00412A40

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041289D(C)
|
:004128AB 8B4510                  mov eax, dword ptr [ebp+10]
:004128AE 25FFFF0000              and eax, 0000FFFF
:004128B3 0FBF4DEC                movsx ecx, word ptr [ebp-14]
:004128B7 03C1                    add eax, ecx
:004128B9 668945EC                mov word ptr [ebp-14], ax
:004128BD 0FBF45EC                movsx eax, word ptr [ebp-14]
:004128C1 2D80020000              sub eax, 00000280
:004128C6 668945EC                mov word ptr [ebp-14], ax
:004128CA 0FBF45EC                movsx eax, word ptr [ebp-14]
:004128CE 85C0                    test eax, eax
:004128D0 0F8D06000000            jnl 004128DC
:004128D6 66C745EC0000            mov [ebp-14], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004128D0(C)
|
:004128DC 668B45EC                mov ax, word ptr [ebp-14]
:004128E0 668945F0                mov word ptr [ebp-10], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041288F(U)
|
:004128E4 0FBF45E4                movsx eax, word ptr [ebp-1C]
:004128E8 85C0                    test eax, eax
:004128EA 0F8D43000000            jnl 00412933
:004128F0 8B4514                  mov eax, dword ptr [ebp+14]
:004128F3 25FFFF0000              and eax, 0000FFFF
:004128F8 0FBF4DE4                movsx ecx, word ptr [ebp-1C]
:004128FC 03C1                    add eax, ecx
:004128FE 668945E4                mov word ptr [ebp-1C], ax
:00412902 0FBF45E4                movsx eax, word ptr [ebp-1C]
:00412906 85C0                    test eax, eax
:00412908 0F8F08000000            jg 00412916
:0041290E 6633C0                  xor ax, ax
:00412911 E92A010000              jmp 00412A40

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412908(C)
|
:00412916 66C745F80000            mov [ebp-08], 0000
:0041291C 8B4514                  mov eax, dword ptr [ebp+14]
:0041291F 25FFFF0000              and eax, 0000FFFF
:00412924 0FBF4DE4                movsx ecx, word ptr [ebp-1C]
:00412928 2BC1                    sub eax, ecx
:0041292A 668945F4                mov word ptr [ebp-0C], ax
:0041292E E950000000              jmp 00412983

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004128EA(C)
|
:00412933 0FBF45E4                movsx eax, word ptr [ebp-1C]
:00412937 3D90010000              cmp eax, 00000190
:0041293C 0F8C08000000            jl 0041294A
:00412942 6633C0                  xor ax, ax
:00412945 E9F6000000              jmp 00412A40

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041293C(C)
|
:0041294A 8B4514                  mov eax, dword ptr [ebp+14]
:0041294D 25FFFF0000              and eax, 0000FFFF
:00412952 0FBF4DE4                movsx ecx, word ptr [ebp-1C]
:00412956 03C1                    add eax, ecx
:00412958 668945E4                mov word ptr [ebp-1C], ax
:0041295C 0FBF45E4                movsx eax, word ptr [ebp-1C]
:00412960 2D90010000              sub eax, 00000190
:00412965 668945E4                mov word ptr [ebp-1C], ax
:00412969 0FBF45E4                movsx eax, word ptr [ebp-1C]
:0041296D 85C0                    test eax, eax
:0041296F 0F8D06000000            jnl 0041297B
:00412975 66C745E40000            mov [ebp-1C], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041296F(C)
|
:0041297B 668B45E4                mov ax, word ptr [ebp-1C]
:0041297F 668945F4                mov word ptr [ebp-0C], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041292E(U)
|
:00412983 8B4510                  mov eax, dword ptr [ebp+10]
:00412986 25FFFF0000              and eax, 0000FFFF
:0041298B 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0041298E 81E1FFFF0000            and ecx, 0000FFFF
:00412994 2BC1                    sub eax, ecx
:00412996 66894510                mov word ptr [ebp+10], ax
:0041299A 8B4514                  mov eax, dword ptr [ebp+14]
:0041299D 25FFFF0000              and eax, 0000FFFF
:004129A2 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004129A5 81E1FFFF0000            and ecx, 0000FFFF
:004129AB 2BC1                    sub eax, ecx
:004129AD 66894514                mov word ptr [ebp+14], ax
:004129B1 8B45FC                  mov eax, dword ptr [ebp-04]
:004129B4 25FFFF0000              and eax, 0000FFFF
:004129B9 C1E803                  shr eax, 03
:004129BC 668945E8                mov word ptr [ebp-18], ax
:004129C0 8B45F8                  mov eax, dword ptr [ebp-08]
:004129C3 25FFFF0000              and eax, 0000FFFF
:004129C8 C1E803                  shr eax, 03
:004129CB 668945E0                mov word ptr [ebp-20], ax
:004129CF 6A02                    push 00000002
:004129D1 8B4514                  mov eax, dword ptr [ebp+14]
:004129D4 25FFFF0000              and eax, 0000FFFF
:004129D9 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004129DC 81E1FFFF0000            and ecx, 0000FFFF
:004129E2 03C1                    add eax, ecx
:004129E4 50                      push eax
:004129E5 E8B8FDFFFF              call 004127A2
:004129EA 83C404                  add esp, 00000004
:004129ED 0FB7C0                  movzx eax, ax
:004129F0 8B4DE0                  mov ecx, dword ptr [ebp-20]
:004129F3 81E1FFFF0000            and ecx, 0000FFFF
:004129F9 2BC1                    sub eax, ecx
:004129FB 50                      push eax
:004129FC 8B45FC                  mov eax, dword ptr [ebp-04]
:004129FF 25FFFF0000              and eax, 0000FFFF
:00412A04 8B4D10                  mov ecx, dword ptr [ebp+10]
:00412A07 81E1FFFF0000            and ecx, 0000FFFF
:00412A0D 03C1                    add eax, ecx
:00412A0F 50                      push eax
:00412A10 E88DFDFFFF              call 004127A2
:00412A15 83C404                  add esp, 00000004
:00412A18 0FB7C0                  movzx eax, ax
:00412A1B 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00412A1E 81E1FFFF0000            and ecx, 0000FFFF
:00412A24 2BC1                    sub eax, ecx
:00412A26 50                      push eax
:00412A27 8B45E0                  mov eax, dword ptr [ebp-20]
:00412A2A 50                      push eax
:00412A2B 8B45E8                  mov eax, dword ptr [ebp-18]
:00412A2E 50                      push eax
:00412A2F E8AFFCFFFF              call 004126E3
:00412A34 83C414                  add esp, 00000014
:00412A37 66B80100                mov ax, 0001
:00412A3B E900000000              jmp 00412A40

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00412872(U), :004128A6(U), :00412911(U), :00412945(U), :00412A3B(U)
|
:00412A40 5F                      pop edi
:00412A41 5E                      pop esi
:00412A42 5B                      pop ebx
:00412A43 C9                      leave
:00412A44 C3                      ret



* Referenced by a CALL at Address:
|:00412EFC   
|
:00412A45 55                      push ebp
:00412A46 8BEC                    mov ebp, esp
:00412A48 83EC20                  sub esp, 00000020
:00412A4B 53                      push ebx
:00412A4C 56                      push esi
:00412A4D 57                      push edi
:00412A4E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00412A51 E8CA540000              call 00417F20
:00412A56 8945FC                  mov dword ptr [ebp-04], eax
:00412A59 8B45FC                  mov eax, dword ptr [ebp-04]
:00412A5C 668B00                  mov ax, word ptr [eax]
:00412A5F 668945F4                mov word ptr [ebp-0C], ax
:00412A63 8345FC02                add dword ptr [ebp-04], 00000002
:00412A67 8B45FC                  mov eax, dword ptr [ebp-04]
:00412A6A 668B00                  mov ax, word ptr [eax]
:00412A6D 668945F0                mov word ptr [ebp-10], ax
:00412A71 8345FC02                add dword ptr [ebp-04], 00000002
:00412A75 8B4510                  mov eax, dword ptr [ebp+10]
:00412A78 25FFFF0000              and eax, 0000FFFF
:00412A7D 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00412A80 81E1FFFF0000            and ecx, 0000FFFF
:00412A86 2BC1                    sub eax, ecx
:00412A88 66894510                mov word ptr [ebp+10], ax
:00412A8C 8B4D08                  mov ecx, dword ptr [ebp+08]
:00412A8F E83C550000              call 00417FD0
:00412A94 8B4510                  mov eax, dword ptr [ebp+10]
:00412A97 50                      push eax
:00412A98 8B450C                  mov eax, dword ptr [ebp+0C]
:00412A9B 50                      push eax
:00412A9C 8B4D08                  mov ecx, dword ptr [ebp+08]
:00412A9F E86C550000              call 00418010
:00412AA4 8B4D08                  mov ecx, dword ptr [ebp+08]
:00412AA7 E804540000              call 00417EB0
:00412AAC 8945E4                  mov dword ptr [ebp-1C], eax
:00412AAF F645E780                test [ebp-19], 80
:00412AB3 0F8429010000            je 00412BE2
:00412AB9 F645E740                test [ebp-19], 40
:00412ABD 0F84A9000000            je 00412B6C
:00412AC3 8B45F4                  mov eax, dword ptr [ebp-0C]
:00412AC6 25FFFF0000              and eax, 0000FFFF
:00412ACB 48                      dec eax
:00412ACC 0145FC                  add dword ptr [ebp-04], eax
:00412ACF 6A04                    push 00000004
:00412AD1 6A00                    push 00000000
:00412AD3 6A00                    push 00000000
:00412AD5 B918E54600              mov ecx, 0046E518
:00412ADA E8414C0300              call 00447720
:00412ADF 8945F8                  mov dword ptr [ebp-08], eax
:00412AE2 66C745E80000            mov [ebp-18], 0000
:00412AE8 E904000000              jmp 00412AF1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412B54(U)
|
:00412AED 66FF45E8                inc [ebp-18]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412AE8(U)
|
:00412AF1 8B45E8                  mov eax, dword ptr [ebp-18]
:00412AF4 25FFFF0000              and eax, 0000FFFF
:00412AF9 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00412AFC 81E1FFFF0000            and ecx, 0000FFFF
:00412B02 3BC1                    cmp eax, ecx
:00412B04 0F8D4F000000            jnl 00412B59
:00412B0A 66C745EC0000            mov [ebp-14], 0000
:00412B10 E904000000              jmp 00412B19

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412B42(U)
|
:00412B15 66FF45EC                inc [ebp-14]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412B10(U)
|
:00412B19 8B45EC                  mov eax, dword ptr [ebp-14]
:00412B1C 25FFFF0000              and eax, 0000FFFF
:00412B21 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00412B24 81E1FFFF0000            and ecx, 0000FFFF
:00412B2A 3BC1                    cmp eax, ecx
:00412B2C 0F8D15000000            jnl 00412B47
:00412B32 8B45FC                  mov eax, dword ptr [ebp-04]
:00412B35 8A00                    mov al, byte ptr [eax]
:00412B37 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00412B3A 8801                    mov byte ptr [ecx], al
:00412B3C FF4DFC                  dec [ebp-04]
:00412B3F FF45F8                  inc [ebp-08]
:00412B42 E9CEFFFFFF              jmp 00412B15

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412B2C(C)
|
:00412B47 8B45F4                  mov eax, dword ptr [ebp-0C]
:00412B4A 25FFFF0000              and eax, 0000FFFF
:00412B4F 03C0                    add eax, eax
:00412B51 0145FC                  add dword ptr [ebp-04], eax
:00412B54 E994FFFFFF              jmp 00412AED

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412B04(C)
|
:00412B59 6A04                    push 00000004
:00412B5B 6A00                    push 00000000
:00412B5D 6A00                    push 00000000
:00412B5F B918E54600              mov ecx, 0046E518
:00412B64 E8B74B0300              call 00447720
:00412B69 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412ABD(C)
|
:00412B6C 6A00                    push 00000000
:00412B6E 6A00                    push 00000000
:00412B70 6A04                    push 00000004
:00412B72 E888210300              call 00444CFF
:00412B77 83C40C                  add esp, 0000000C
:00412B7A 8B450C                  mov eax, dword ptr [ebp+0C]
:00412B7D 25FFFF0000              and eax, 0000FFFF
:00412B82 8945E0                  mov dword ptr [ebp-20], eax
:00412B85 F6450D80                test [ebp+0D], 80
:00412B89 0F8410000000            je 00412B9F
:00412B8F 8B450C                  mov eax, dword ptr [ebp+0C]
:00412B92 25FFFF0000              and eax, 0000FFFF
:00412B97 2DFFFF0000              sub eax, 0000FFFF
:00412B9C 8945E0                  mov dword ptr [ebp-20], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412B89(C)
|
:00412B9F 8B45FC                  mov eax, dword ptr [ebp-04]
:00412BA2 50                      push eax
:00412BA3 8B45F0                  mov eax, dword ptr [ebp-10]
:00412BA6 25FFFF0000              and eax, 0000FFFF
:00412BAB 50                      push eax
:00412BAC 8B45F4                  mov eax, dword ptr [ebp-0C]
:00412BAF 25FFFF0000              and eax, 0000FFFF
:00412BB4 50                      push eax
:00412BB5 8B4510                  mov eax, dword ptr [ebp+10]
:00412BB8 25FFFF0000              and eax, 0000FFFF
:00412BBD 50                      push eax
:00412BBE 8B45E0                  mov eax, dword ptr [ebp-20]
:00412BC1 50                      push eax
:00412BC2 E8D82B0300              call 0044579F
:00412BC7 83C414                  add esp, 00000014
:00412BCA 8B45F0                  mov eax, dword ptr [ebp-10]
:00412BCD 50                      push eax
:00412BCE 8B45F4                  mov eax, dword ptr [ebp-0C]
:00412BD1 50                      push eax
:00412BD2 8B4510                  mov eax, dword ptr [ebp+10]
:00412BD5 50                      push eax
:00412BD6 8B450C                  mov eax, dword ptr [ebp+0C]
:00412BD9 50                      push eax
:00412BDA E82DFCFFFF              call 0041280C
:00412BDF 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412AB3(C)
|
:00412BE2 E900000000              jmp 00412BE7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412BE2(U)
|
:00412BE7 5F                      pop edi
:00412BE8 5E                      pop esi
:00412BE9 5B                      pop ebx
:00412BEA C9                      leave
:00412BEB C3                      ret



* Referenced by a CALL at Address:
|:00412F19   
|
:00412BEC 55                      push ebp
:00412BED 8BEC                    mov ebp, esp
:00412BEF 83EC24                  sub esp, 00000024
:00412BF2 53                      push ebx
:00412BF3 56                      push esi
:00412BF4 57                      push edi
:00412BF5 8B4D08                  mov ecx, dword ptr [ebp+08]
:00412BF8 E823530000              call 00417F20
:00412BFD 8945FC                  mov dword ptr [ebp-04], eax
:00412C00 8B45FC                  mov eax, dword ptr [ebp-04]
:00412C03 668B00                  mov ax, word ptr [eax]
:00412C06 668945F4                mov word ptr [ebp-0C], ax
:00412C0A 8345FC02                add dword ptr [ebp-04], 00000002
:00412C0E 8B45FC                  mov eax, dword ptr [ebp-04]
:00412C11 668B00                  mov ax, word ptr [eax]
:00412C14 668945F0                mov word ptr [ebp-10], ax
:00412C18 8345FC02                add dword ptr [ebp-04], 00000002
:00412C1C 8B4510                  mov eax, dword ptr [ebp+10]
:00412C1F 25FFFF0000              and eax, 0000FFFF
:00412C24 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00412C27 81E1FFFF0000            and ecx, 0000FFFF
:00412C2D 2BC1                    sub eax, ecx
:00412C2F 66894510                mov word ptr [ebp+10], ax
:00412C33 8B4D08                  mov ecx, dword ptr [ebp+08]
:00412C36 E895530000              call 00417FD0
:00412C3B 8B4510                  mov eax, dword ptr [ebp+10]
:00412C3E 50                      push eax
:00412C3F 8B450C                  mov eax, dword ptr [ebp+0C]
:00412C42 50                      push eax
:00412C43 8B4D08                  mov ecx, dword ptr [ebp+08]
:00412C46 E8C5530000              call 00418010
:00412C4B 8B4D08                  mov ecx, dword ptr [ebp+08]
:00412C4E E85D520000              call 00417EB0
:00412C53 8945E0                  mov dword ptr [ebp-20], eax
:00412C56 F645E380                test [ebp-1D], 80
:00412C5A 0F84DD010000            je 00412E3D
:00412C60 F645E340                test [ebp-1D], 40
:00412C64 0F84B4000000            je 00412D1E
:00412C6A 8B45F4                  mov eax, dword ptr [ebp-0C]
:00412C6D 25FFFF0000              and eax, 0000FFFF
:00412C72 48                      dec eax
:00412C73 0145FC                  add dword ptr [ebp-04], eax
:00412C76 6A04                    push 00000004
:00412C78 6A00                    push 00000000
:00412C7A 6A00                    push 00000000
:00412C7C B918E54600              mov ecx, 0046E518
:00412C81 E89A4A0300              call 00447720
:00412C86 8945F8                  mov dword ptr [ebp-08], eax
:00412C89 66C745E80000            mov [ebp-18], 0000
:00412C8F E904000000              jmp 00412C98

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412D14(U)
|
:00412C94 66FF45E8                inc [ebp-18]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412C8F(U)
|
:00412C98 8B45E8                  mov eax, dword ptr [ebp-18]
:00412C9B 25FFFF0000              and eax, 0000FFFF
:00412CA0 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00412CA3 81E1FFFF0000            and ecx, 0000FFFF
:00412CA9 3BC1                    cmp eax, ecx
:00412CAB 0F8D68000000            jnl 00412D19
:00412CB1 66C745EC0000            mov [ebp-14], 0000
:00412CB7 E904000000              jmp 00412CC0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412D02(U)
|
:00412CBC 66FF45EC                inc [ebp-14]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412CB7(U)
|
:00412CC0 8B45EC                  mov eax, dword ptr [ebp-14]
:00412CC3 25FFFF0000              and eax, 0000FFFF
:00412CC8 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00412CCB 81E1FFFF0000            and ecx, 0000FFFF
:00412CD1 3BC1                    cmp eax, ecx
:00412CD3 0F8D2E000000            jnl 00412D07
:00412CD9 8B45FC                  mov eax, dword ptr [ebp-04]
:00412CDC 8A00                    mov al, byte ptr [eax]
:00412CDE 8845E4                  mov byte ptr [ebp-1C], al
:00412CE1 FF4DFC                  dec [ebp-04]
:00412CE4 33C0                    xor eax, eax
:00412CE6 8A45E4                  mov al, byte ptr [ebp-1C]
:00412CE9 85C0                    test eax, eax
:00412CEB 0F8406000000            je 00412CF7
:00412CF1 8A4514                  mov al, byte ptr [ebp+14]
:00412CF4 8845E4                  mov byte ptr [ebp-1C], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412CEB(C)
|
:00412CF7 8A45E4                  mov al, byte ptr [ebp-1C]
:00412CFA 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00412CFD 8801                    mov byte ptr [ecx], al
:00412CFF FF45F8                  inc [ebp-08]
:00412D02 E9B5FFFFFF              jmp 00412CBC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412CD3(C)
|
:00412D07 8B45F4                  mov eax, dword ptr [ebp-0C]
:00412D0A 25FFFF0000              and eax, 0000FFFF
:00412D0F 03C0                    add eax, eax
:00412D11 0145FC                  add dword ptr [ebp-04], eax
:00412D14 E97BFFFFFF              jmp 00412C94

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412CAB(C)
|
:00412D19 E996000000              jmp 00412DB4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412C64(C)
|
:00412D1E 6A04                    push 00000004
:00412D20 6A00                    push 00000000
:00412D22 6A00                    push 00000000
:00412D24 B918E54600              mov ecx, 0046E518
:00412D29 E8F2490300              call 00447720
:00412D2E 8945F8                  mov dword ptr [ebp-08], eax
:00412D31 66C745E80000            mov [ebp-18], 0000
:00412D37 E904000000              jmp 00412D40

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412DAF(U)
|
:00412D3C 66FF45E8                inc [ebp-18]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412D37(U)
|
:00412D40 8B45E8                  mov eax, dword ptr [ebp-18]
:00412D43 25FFFF0000              and eax, 0000FFFF
:00412D48 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00412D4B 81E1FFFF0000            and ecx, 0000FFFF
:00412D51 3BC1                    cmp eax, ecx
:00412D53 0F8D5B000000            jnl 00412DB4
:00412D59 66C745EC0000            mov [ebp-14], 0000
:00412D5F E904000000              jmp 00412D68

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412DAA(U)
|
:00412D64 66FF45EC                inc [ebp-14]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412D5F(U)
|
:00412D68 8B45EC                  mov eax, dword ptr [ebp-14]
:00412D6B 25FFFF0000              and eax, 0000FFFF
:00412D70 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00412D73 81E1FFFF0000            and ecx, 0000FFFF
:00412D79 3BC1                    cmp eax, ecx
:00412D7B 0F8D2E000000            jnl 00412DAF
:00412D81 8B45FC                  mov eax, dword ptr [ebp-04]
:00412D84 8A00                    mov al, byte ptr [eax]
:00412D86 8845E4                  mov byte ptr [ebp-1C], al
:00412D89 FF45FC                  inc [ebp-04]
:00412D8C 33C0                    xor eax, eax
:00412D8E 8A45E4                  mov al, byte ptr [ebp-1C]
:00412D91 85C0                    test eax, eax
:00412D93 0F8406000000            je 00412D9F
:00412D99 8A4514                  mov al, byte ptr [ebp+14]
:00412D9C 8845E4                  mov byte ptr [ebp-1C], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412D93(C)
|
:00412D9F 8A45E4                  mov al, byte ptr [ebp-1C]
:00412DA2 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00412DA5 8801                    mov byte ptr [ecx], al
:00412DA7 FF45F8                  inc [ebp-08]
:00412DAA E9B5FFFFFF              jmp 00412D64

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412D7B(C)
|
:00412DAF E988FFFFFF              jmp 00412D3C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00412D19(U), :00412D53(C)
|
:00412DB4 6A04                    push 00000004
:00412DB6 6A00                    push 00000000
:00412DB8 6A00                    push 00000000
:00412DBA B918E54600              mov ecx, 0046E518
:00412DBF E85C490300              call 00447720
:00412DC4 8945FC                  mov dword ptr [ebp-04], eax
:00412DC7 6A00                    push 00000000
:00412DC9 6A00                    push 00000000
:00412DCB 6A04                    push 00000004
:00412DCD E82D1F0300              call 00444CFF
:00412DD2 83C40C                  add esp, 0000000C
:00412DD5 8B450C                  mov eax, dword ptr [ebp+0C]
:00412DD8 25FFFF0000              and eax, 0000FFFF
:00412DDD 8945DC                  mov dword ptr [ebp-24], eax
:00412DE0 F6450D80                test [ebp+0D], 80
:00412DE4 0F8410000000            je 00412DFA
:00412DEA 8B450C                  mov eax, dword ptr [ebp+0C]
:00412DED 25FFFF0000              and eax, 0000FFFF
:00412DF2 2DFFFF0000              sub eax, 0000FFFF
:00412DF7 8945DC                  mov dword ptr [ebp-24], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412DE4(C)
|
:00412DFA 8B45FC                  mov eax, dword ptr [ebp-04]
:00412DFD 50                      push eax
:00412DFE 8B45F0                  mov eax, dword ptr [ebp-10]
:00412E01 25FFFF0000              and eax, 0000FFFF
:00412E06 50                      push eax
:00412E07 8B45F4                  mov eax, dword ptr [ebp-0C]
:00412E0A 25FFFF0000              and eax, 0000FFFF
:00412E0F 50                      push eax
:00412E10 8B4510                  mov eax, dword ptr [ebp+10]
:00412E13 25FFFF0000              and eax, 0000FFFF
:00412E18 50                      push eax
:00412E19 8B45DC                  mov eax, dword ptr [ebp-24]
:00412E1C 50                      push eax
:00412E1D E87D290300              call 0044579F
:00412E22 83C414                  add esp, 00000014
:00412E25 8B45F0                  mov eax, dword ptr [ebp-10]
:00412E28 50                      push eax
:00412E29 8B45F4                  mov eax, dword ptr [ebp-0C]
:00412E2C 50                      push eax
:00412E2D 8B4510                  mov eax, dword ptr [ebp+10]
:00412E30 50                      push eax
:00412E31 8B450C                  mov eax, dword ptr [ebp+0C]
:00412E34 50                      push eax
:00412E35 E8D2F9FFFF              call 0041280C
:00412E3A 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412C5A(C)
|
:00412E3D E900000000              jmp 00412E42

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412E3D(U)
|
:00412E42 5F                      pop edi
:00412E43 5E                      pop esi
:00412E44 5B                      pop ebx
:00412E45 C9                      leave
:00412E46 C3                      ret



* Referenced by a CALL at Address:
|:004137B7   
|
:00412E47 55                      push ebp
:00412E48 8BEC                    mov ebp, esp
:00412E4A 83EC14                  sub esp, 00000014
:00412E4D 53                      push ebx
:00412E4E 56                      push esi
:00412E4F 57                      push edi
:00412E50 6A00                    push 00000000
:00412E52 6A00                    push 00000000
:00412E54 6A04                    push 00000004
:00412E56 E8A41E0300              call 00444CFF
:00412E5B 83C40C                  add esp, 0000000C
:00412E5E 66C745F80000            mov [ebp-08], 0000
:00412E64 E904000000              jmp 00412E6D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412F21(U)
|
:00412E69 66FF45F8                inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412E64(U)
|
:00412E6D 8B45F8                  mov eax, dword ptr [ebp-08]
:00412E70 25FFFF0000              and eax, 0000FFFF
:00412E75 33C9                    xor ecx, ecx
:00412E77 668B0DC0184600          mov cx, word ptr [004618C0]
:00412E7E 3BC1                    cmp eax, ecx
:00412E80 0F8DA0000000            jnl 00412F26
:00412E86 8B45F8                  mov eax, dword ptr [ebp-08]
:00412E89 25FFFF0000              and eax, 0000FFFF
:00412E8E 8B048520F54500          mov eax, dword ptr [4*eax+0045F520]
:00412E95 8945EC                  mov dword ptr [ebp-14], eax
:00412E98 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00412E9B E8A0510000              call 00418040
:00412EA0 668945F4                mov word ptr [ebp-0C], ax
:00412EA4 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00412EA7 E8B4510000              call 00418060
:00412EAC 668945F0                mov word ptr [ebp-10], ax
:00412EB0 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00412EB3 E8C8510000              call 00418080
:00412EB8 50                      push eax
:00412EB9 8D45F0                  lea eax, dword ptr [ebp-10]
:00412EBC 50                      push eax
:00412EBD 8D45F4                  lea eax, dword ptr [ebp-0C]
:00412EC0 50                      push eax
:00412EC1 E849F2FFFF              call 0041210F
:00412EC6 83C40C                  add esp, 0000000C
:00412EC9 8B45F0                  mov eax, dword ptr [ebp-10]
:00412ECC 25FFFF0000              and eax, 0000FFFF
:00412ED1 83C028                  add eax, 00000028
:00412ED4 668945F0                mov word ptr [ebp-10], ax
:00412ED8 8B45EC                  mov eax, dword ptr [ebp-14]
:00412EDB 668B4036                mov ax, word ptr [eax+36]
:00412EDF 668945FC                mov word ptr [ebp-04], ax
:00412EE3 F745FCFFFF0000          test [ebp-04], 0000FFFF
:00412EEA 0F8519000000            jne 00412F09
:00412EF0 8B45F0                  mov eax, dword ptr [ebp-10]
:00412EF3 50                      push eax
:00412EF4 8B45F4                  mov eax, dword ptr [ebp-0C]
:00412EF7 50                      push eax
:00412EF8 8B45EC                  mov eax, dword ptr [ebp-14]
:00412EFB 50                      push eax
:00412EFC E844FBFFFF              call 00412A45
:00412F01 83C40C                  add esp, 0000000C
:00412F04 E918000000              jmp 00412F21

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412EEA(C)
|
:00412F09 8B45FC                  mov eax, dword ptr [ebp-04]
:00412F0C 50                      push eax
:00412F0D 8B45F0                  mov eax, dword ptr [ebp-10]
:00412F10 50                      push eax
:00412F11 8B45F4                  mov eax, dword ptr [ebp-0C]
:00412F14 50                      push eax
:00412F15 8B45EC                  mov eax, dword ptr [ebp-14]
:00412F18 50                      push eax
:00412F19 E8CEFCFFFF              call 00412BEC
:00412F1E 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412F04(U)
|
:00412F21 E943FFFFFF              jmp 00412E69

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412E80(C)
|
:00412F26 6A00                    push 00000000
:00412F28 6A00                    push 00000000
:00412F2A 6A00                    push 00000000
:00412F2C E8CE1D0300              call 00444CFF
:00412F31 83C40C                  add esp, 0000000C
:00412F34 E900000000              jmp 00412F39

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412F34(U)
|
:00412F39 5F                      pop edi
:00412F3A 5E                      pop esi
:00412F3B 5B                      pop ebx
:00412F3C C9                      leave
:00412F3D C3                      ret



* Referenced by a CALL at Address:
|:00417845   
|
:00412F3E 55                      push ebp
:00412F3F 8BEC                    mov ebp, esp
:00412F41 83EC18                  sub esp, 00000018
:00412F44 53                      push ebx
:00412F45 56                      push esi
:00412F46 57                      push edi
:00412F47 66C745EC0000            mov [ebp-14], 0000
:00412F4D 66C745F00200            mov [ebp-10], 0002
:00412F53 66C745E80000            mov [ebp-18], 0000
:00412F59 66C745FC0000            mov [ebp-04], 0000
:00412F5F 66C745F40000            mov [ebp-0C], 0000
:00412F65 E904000000              jmp 00412F6E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413018(U)
|
:00412F6A 66FF45F4                inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412F65(U)
|
:00412F6E 8B45F4                  mov eax, dword ptr [ebp-0C]
:00412F71 25FFFF0000              and eax, 0000FFFF
:00412F76 83F864                  cmp eax, 00000064
:00412F79 0F8D9E000000            jnl 0041301D
:00412F7F 668B45EC                mov ax, word ptr [ebp-14]
:00412F83 668945E8                mov word ptr [ebp-18], ax
:00412F87 66C745F80000            mov [ebp-08], 0000
:00412F8D E904000000              jmp 00412F96

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412FEB(U)
|
:00412F92 66FF45F8                inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412F8D(U)
|
:00412F96 8B45F8                  mov eax, dword ptr [ebp-08]
:00412F99 25FFFF0000              and eax, 0000FFFF
:00412F9E 83F864                  cmp eax, 00000064
:00412FA1 0F8D49000000            jnl 00412FF0
:00412FA7 668B45E8                mov ax, word ptr [ebp-18]
:00412FAB 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00412FAE 81E1FFFF0000            and ecx, 0000FFFF
:00412FB4 C1E102                  shl ecx, 02
:00412FB7 8D0C89                  lea ecx, dword ptr [ecx+4*ecx]
:00412FBA 8D0C89                  lea ecx, dword ptr [ecx+4*ecx]
:00412FBD 8B55F8                  mov edx, dword ptr [ebp-08]
:00412FC0 81E2FFFF0000            and edx, 0000FFFF
:00412FC6 03CA                    add ecx, edx
:00412FC8 6689044D58194600        mov word ptr [2*ecx+00461958], ax
:00412FD0 66FF45FC                inc [ebp-04]
:00412FD4 8B45FC                  mov eax, dword ptr [ebp-04]
:00412FD7 25FFFF0000              and eax, 0000FFFF
:00412FDC 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00412FDF 81E1FFFF0000            and ecx, 0000FFFF
:00412FE5 03C1                    add eax, ecx
:00412FE7 668945E8                mov word ptr [ebp-18], ax
:00412FEB E9A2FFFFFF              jmp 00412F92

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412FA1(C)
|
:00412FF0 8B45F0                  mov eax, dword ptr [ebp-10]
:00412FF3 25FFFF0000              and eax, 0000FFFF
:00412FF8 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00412FFB 81E1FFFF0000            and ecx, 0000FFFF
:00413001 03C1                    add eax, ecx
:00413003 668945EC                mov word ptr [ebp-14], ax
:00413007 8B45F0                  mov eax, dword ptr [ebp-10]
:0041300A 25FFFF0000              and eax, 0000FFFF
:0041300F 48                      dec eax
:00413010 668945FC                mov word ptr [ebp-04], ax
:00413014 66FF45F0                inc [ebp-10]
:00413018 E94DFFFFFF              jmp 00412F6A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412F79(C)
|
:0041301D E900000000              jmp 00413022

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041301D(U)
|
:00413022 5F                      pop edi
:00413023 5E                      pop esi
:00413024 5B                      pop ebx
:00413025 C9                      leave
:00413026 C3                      ret



* Referenced by a CALL at Address:
|:004136A3   
|
:00413027 55                      push ebp
:00413028 8BEC                    mov ebp, esp
:0041302A 83EC28                  sub esp, 00000028
:0041302D 53                      push ebx
:0041302E 56                      push esi
:0041302F 57                      push edi
:00413030 66C745F40000            mov [ebp-0C], 0000
:00413036 E904000000              jmp 0041303F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004130CF(U)
|
:0041303B 66FF45F4                inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413036(U)
|
:0041303F 33C0                    xor eax, eax
:00413041 66A1C0184600            mov ax, word ptr [004618C0]
:00413047 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041304A 81E1FFFF0000            and ecx, 0000FFFF
:00413050 3BC1                    cmp eax, ecx
:00413052 0F8E7C000000            jle 004130D4
:00413058 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041305B 25FFFF0000              and eax, 0000FFFF
:00413060 8B048520F54500          mov eax, dword ptr [4*eax+0045F520]
:00413067 8945D8                  mov dword ptr [ebp-28], eax
:0041306A 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0041306D E8AE4E0000              call 00417F20
:00413072 8945E4                  mov dword ptr [ebp-1C], eax
:00413075 8345E402                add dword ptr [ebp-1C], 00000002
:00413079 8B45E4                  mov eax, dword ptr [ebp-1C]
:0041307C 668B00                  mov ax, word ptr [eax]
:0041307F 668945F8                mov word ptr [ebp-08], ax
:00413083 8B45F8                  mov eax, dword ptr [ebp-08]
:00413086 25FFFF0000              and eax, 0000FFFF
:0041308B C1E802                  shr eax, 02
:0041308E 668945F0                mov word ptr [ebp-10], ax
:00413092 8B45F8                  mov eax, dword ptr [ebp-08]
:00413095 25FFFF0000              and eax, 0000FFFF
:0041309A 99                      cdq
:0041309B 33C2                    xor eax, edx
:0041309D 2BC2                    sub eax, edx
:0041309F 83E003                  and eax, 00000003
:004130A2 33C2                    xor eax, edx
:004130A4 2BC2                    sub eax, edx
:004130A6 0F8404000000            je 004130B0
:004130AC 66FF45F0                inc [ebp-10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004130A6(C)
|
:004130B0 8B4DD8                  mov ecx, dword ptr [ebp-28]
:004130B3 E8C84F0000              call 00418080
:004130B8 0FB7C0                  movzx eax, ax
:004130BB 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004130BE 81E1FFFF0000            and ecx, 0000FFFF
:004130C4 03C1                    add eax, ecx
:004130C6 50                      push eax
:004130C7 8B4DD8                  mov ecx, dword ptr [ebp-28]
:004130CA E8D14F0000              call 004180A0
:004130CF E967FFFFFF              jmp 0041303B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413052(C)
|
:004130D4 66C745F40000            mov [ebp-0C], 0000
:004130DA E904000000              jmp 004130E3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041325A(U)
|
:004130DF 66FF45F4                inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004130DA(U)
|
:004130E3 33C0                    xor eax, eax
:004130E5 66A1C0184600            mov ax, word ptr [004618C0]
:004130EB 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004130EE 81E1FFFF0000            and ecx, 0000FFFF
:004130F4 3BC1                    cmp eax, ecx
:004130F6 0F8E63010000            jle 0041325F
:004130FC 8B45F4                  mov eax, dword ptr [ebp-0C]
:004130FF 25FFFF0000              and eax, 0000FFFF
:00413104 8B048520F54500          mov eax, dword ptr [4*eax+0045F520]
:0041310B 8945D8                  mov dword ptr [ebp-28], eax
:0041310E 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00413111 E84A4F0000              call 00418060
:00413116 0FB7D8                  movzx ebx, ax
:00413119 C1E302                  shl ebx, 02
:0041311C 8D1C9B                  lea ebx, dword ptr [ebx+4*ebx]
:0041311F 8D1C9B                  lea ebx, dword ptr [ebx+4*ebx]
:00413122 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00413125 E8164F0000              call 00418040
:0041312A 0FB7C0                  movzx eax, ax
:0041312D 03D8                    add ebx, eax
:0041312F 668B045D58194600        mov ax, word ptr [2*ebx+00461958]
:00413137 668945DC                mov word ptr [ebp-24], ax
:0041313B 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041313E 25FFFF0000              and eax, 0000FFFF
:00413143 40                      inc eax
:00413144 668945EC                mov word ptr [ebp-14], ax
:00413148 E904000000              jmp 00413151

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413255(U)
|
:0041314D 66FF45EC                inc [ebp-14]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413148(U)
|
:00413151 33C0                    xor eax, eax
:00413153 66A1C0184600            mov ax, word ptr [004618C0]
:00413159 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041315C 81E1FFFF0000            and ecx, 0000FFFF
:00413162 3BC1                    cmp eax, ecx
:00413164 0F8EF0000000            jle 0041325A
:0041316A 8B45EC                  mov eax, dword ptr [ebp-14]
:0041316D 25FFFF0000              and eax, 0000FFFF
:00413172 8B048520F54500          mov eax, dword ptr [4*eax+0045F520]
:00413179 8945FC                  mov dword ptr [ebp-04], eax
:0041317C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041317F E8DC4E0000              call 00418060
:00413184 0FB7D8                  movzx ebx, ax
:00413187 C1E302                  shl ebx, 02
:0041318A 8D1C9B                  lea ebx, dword ptr [ebx+4*ebx]
:0041318D 8D1C9B                  lea ebx, dword ptr [ebx+4*ebx]
:00413190 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00413193 E8A84E0000              call 00418040
:00413198 0FB7C0                  movzx eax, ax
:0041319B 03D8                    add ebx, eax
:0041319D 668B045D58194600        mov ax, word ptr [2*ebx+00461958]
:004131A5 668945E0                mov word ptr [ebp-20], ax
:004131A9 66C745E80000            mov [ebp-18], 0000
:004131AF 8B45E0                  mov eax, dword ptr [ebp-20]
:004131B2 25FFFF0000              and eax, 0000FFFF
:004131B7 8B4DDC                  mov ecx, dword ptr [ebp-24]
:004131BA 81E1FFFF0000            and ecx, 0000FFFF
:004131C0 3BC1                    cmp eax, ecx
:004131C2 0F8D0B000000            jnl 004131D3
:004131C8 66C745E80100            mov [ebp-18], 0001
:004131CE E93D000000              jmp 00413210

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004131C2(C)
|
:004131D3 8B45E0                  mov eax, dword ptr [ebp-20]
:004131D6 25FFFF0000              and eax, 0000FFFF
:004131DB 8B4DDC                  mov ecx, dword ptr [ebp-24]
:004131DE 81E1FFFF0000            and ecx, 0000FFFF
:004131E4 3BC1                    cmp eax, ecx
:004131E6 0F8524000000            jne 00413210
:004131EC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004131EF E8DC4E0000              call 004180D0
:004131F4 0FB7D8                  movzx ebx, ax
:004131F7 8B4DD8                  mov ecx, dword ptr [ebp-28]
:004131FA E8D14E0000              call 004180D0
:004131FF 0FB7C0                  movzx eax, ax
:00413202 3BD8                    cmp ebx, eax
:00413204 0F8D06000000            jnl 00413210
:0041320A 66C745E80100            mov [ebp-18], 0001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004131CE(U), :004131E6(C), :00413204(C)
|
:00413210 8B45E8                  mov eax, dword ptr [ebp-18]
:00413213 25FFFF0000              and eax, 0000FFFF
:00413218 83F801                  cmp eax, 00000001
:0041321B 0F8534000000            jne 00413255
:00413221 668B45E0                mov ax, word ptr [ebp-20]
:00413225 668945DC                mov word ptr [ebp-24], ax
:00413229 8B45FC                  mov eax, dword ptr [ebp-04]
:0041322C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041322F 81E1FFFF0000            and ecx, 0000FFFF
:00413235 89048D20F54500          mov dword ptr [4*ecx+0045F520], eax
:0041323C 8B45D8                  mov eax, dword ptr [ebp-28]
:0041323F 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00413242 81E1FFFF0000            and ecx, 0000FFFF
:00413248 89048D20F54500          mov dword ptr [4*ecx+0045F520], eax
:0041324F 8B45FC                  mov eax, dword ptr [ebp-04]
:00413252 8945D8                  mov dword ptr [ebp-28], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041321B(C)
|
:00413255 E9F3FEFFFF              jmp 0041314D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413164(C)
|
:0041325A E980FEFFFF              jmp 004130DF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004130F6(C)
|
:0041325F E900000000              jmp 00413264

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041325F(U)
|
:00413264 5F                      pop edi
:00413265 5E                      pop esi
:00413266 5B                      pop ebx
:00413267 C9                      leave
:00413268 C3                      ret



* Referenced by a CALL at Address:
|:0041369E   
|
:00413269 55                      push ebp
:0041326A 8BEC                    mov ebp, esp
:0041326C 83EC0C                  sub esp, 0000000C
:0041326F 53                      push ebx
:00413270 56                      push esi
:00413271 57                      push edi
:00413272 66C705C01846000000      mov word ptr [004618C0], 0000
:0041327B C745F4D8D54500          mov [ebp-0C], 0045D5D8
:00413282 66C745F80000            mov [ebp-08], 0000
:00413288 E908000000              jmp 00413295

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004132E1(U)
|
:0041328D 66FF45F8                inc [ebp-08]
:00413291 8345F43E                add dword ptr [ebp-0C], 0000003E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413288(U)
|
:00413295 8B45F8                  mov eax, dword ptr [ebp-08]
:00413298 25FFFF0000              and eax, 0000FFFF
:0041329D 3D80000000              cmp eax, 00000080
:004132A2 0F8D3E000000            jnl 004132E6
:004132A8 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004132AB E8B0480000              call 00417B60
:004132B0 668945FC                mov word ptr [ebp-04], ax
:004132B4 8B45FC                  mov eax, dword ptr [ebp-04]
:004132B7 2501800000              and eax, 00008001
:004132BC 3D01800000              cmp eax, 00008001
:004132C1 0F851A000000            jne 004132E1
:004132C7 8B45F4                  mov eax, dword ptr [ebp-0C]
:004132CA 33C9                    xor ecx, ecx
:004132CC 668B0DC0184600          mov cx, word ptr [004618C0]
:004132D3 89048D20F54500          mov dword ptr [4*ecx+0045F520], eax
:004132DA 66FF05C0184600          inc word ptr [004618C0]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004132C1(C)
|
:004132E1 E9A7FFFFFF              jmp 0041328D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004132A2(C)
|
:004132E6 E900000000              jmp 004132EB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004132E6(U)
|
:004132EB 5F                      pop edi
:004132EC 5E                      pop esi
:004132ED 5B                      pop ebx
:004132EE C9                      leave
:004132EF C3                      ret



* Referenced by a CALL at Addresses:
|:00413332   , :00416F93   
|
:004132F0 55                      push ebp
:004132F1 8BEC                    mov ebp, esp
:004132F3 83EC04                  sub esp, 00000004
:004132F6 53                      push ebx
:004132F7 56                      push esi
:004132F8 57                      push edi
:004132F9 8B4508                  mov eax, dword ptr [ebp+08]
:004132FC 8A00                    mov al, byte ptr [eax]
:004132FE 8845FC                  mov byte ptr [ebp-04], al
:00413301 33C0                    xor eax, eax
:00413303 8A45FC                  mov al, byte ptr [ebp-04]
:00413306 660FB68020F54400        movzx ax, byte ptr [eax+0044F520]
:0041330E 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00413311 668901                  mov word ptr [ecx], ax
:00413314 8A45FC                  mov al, byte ptr [ebp-04]
:00413317 E900000000              jmp 0041331C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413317(U)
|
:0041331C 5F                      pop edi
:0041331D 5E                      pop esi
:0041331E 5B                      pop ebx
:0041331F C9                      leave
:00413320 C3                      ret



* Referenced by a CALL at Address:
|:00417048   
|
:00413321 55                      push ebp
:00413322 8BEC                    mov ebp, esp
:00413324 83EC04                  sub esp, 00000004
:00413327 53                      push ebx
:00413328 56                      push esi
:00413329 57                      push edi
:0041332A 8D45FC                  lea eax, dword ptr [ebp-04]
:0041332D 50                      push eax
:0041332E 8B4508                  mov eax, dword ptr [ebp+08]
:00413331 50                      push eax
:00413332 E8B9FFFFFF              call 004132F0
:00413337 83C408                  add esp, 00000008
:0041333A 8B45FC                  mov eax, dword ptr [ebp-04]
:0041333D 25FFFF0000              and eax, 0000FFFF
:00413342 034508                  add eax, dword ptr [ebp+08]
:00413345 E900000000              jmp 0041334A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413345(U)
|
:0041334A 5F                      pop edi
:0041334B 5E                      pop esi
:0041334C 5B                      pop ebx
:0041334D C9                      leave
:0041334E C3                      ret



* Referenced by a CALL at Address:
|:00414998   
|
:0041334F 55                      push ebp
:00413350 8BEC                    mov ebp, esp
:00413352 53                      push ebx
:00413353 56                      push esi
:00413354 57                      push edi
:00413355 668B4508                mov ax, word ptr [ebp+08]
:00413359 66A348194600            mov word ptr [00461948], ax
:0041335F 668B450C                mov ax, word ptr [ebp+0C]
:00413363 66A34C194600            mov word ptr [0046194C], ax
:00413369 668B4510                mov ax, word ptr [ebp+10]
:0041336D 66A3D0D54500            mov word ptr [0045D5D0], ax
:00413373 668B4514                mov ax, word ptr [ebp+14]
:00413377 66A3D4D54500            mov word ptr [0045D5D4], ax
:0041337D 8B4514                  mov eax, dword ptr [ebp+14]
:00413380 25FFFF0000              and eax, 0000FFFF
:00413385 8B4D10                  mov ecx, dword ptr [ebp+10]
:00413388 81E1FFFF0000            and ecx, 0000FFFF
:0041338E 0FAFC1                  imul eax, ecx
:00413391 66A354194600            mov word ptr [00461954], ax
:00413397 E900000000              jmp 0041339C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413397(U)
|
:0041339C 5F                      pop edi
:0041339D 5E                      pop esi
:0041339E 5B                      pop ebx
:0041339F C9                      leave
:004133A0 C3                      ret


:004133A1 55                      push ebp
:004133A2 8BEC                    mov ebp, esp
:004133A4 83EC04                  sub esp, 00000004
:004133A7 53                      push ebx
:004133A8 56                      push esi
:004133A9 57                      push edi
:004133AA F7450CFFFF0000          test [ebp+0C], 0000FFFF
:004133B1 0F8515000000            jne 004133CC
:004133B7 B910270000              mov ecx, 00002710
:004133BC 8B4508                  mov eax, dword ptr [ebp+08]
:004133BF 2BD2                    sub edx, edx
:004133C1 F7F1                    div ecx
:004133C3 668945FC                mov word ptr [ebp-04], ax
:004133C7 E910000000              jmp 004133DC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004133B1(C)
|
:004133CC B910270000              mov ecx, 00002710
:004133D1 8B4508                  mov eax, dword ptr [ebp+08]
:004133D4 2BD2                    sub edx, edx
:004133D6 F7F1                    div ecx
:004133D8 668955FC                mov word ptr [ebp-04], dx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004133C7(U)
|
:004133DC 668B45FC                mov ax, word ptr [ebp-04]
:004133E0 E900000000              jmp 004133E5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004133E0(U)
|
:004133E5 5F                      pop edi
:004133E6 5E                      pop esi
:004133E7 5B                      pop ebx
:004133E8 C9                      leave
:004133E9 C3                      ret



* Referenced by a CALL at Address:
|:0041377C   
|
:004133EA 55                      push ebp
:004133EB 8BEC                    mov ebp, esp
:004133ED 53                      push ebx
:004133EE 56                      push esi
:004133EF 57                      push edi
:004133F0 6A00                    push 00000000
:004133F2 6A00                    push 00000000
:004133F4 6A00                    push 00000000
:004133F6 E804190300              call 00444CFF
:004133FB 83C40C                  add esp, 0000000C
:004133FE 8B4510                  mov eax, dword ptr [ebp+10]
:00413401 33C9                    xor ecx, ecx
:00413403 668B08                  mov cx, word ptr [eax]
:00413406 8B048D88674600          mov eax, dword ptr [4*ecx+00466788]
:0041340D 50                      push eax
:0041340E 6A08                    push 00000008
:00413410 6A08                    push 00000008
:00413412 8B450C                  mov eax, dword ptr [ebp+0C]
:00413415 25FFFF0000              and eax, 0000FFFF
:0041341A 50                      push eax
:0041341B 8B4508                  mov eax, dword ptr [ebp+08]
:0041341E 25FFFF0000              and eax, 0000FFFF
:00413423 50                      push eax
:00413424 E876230300              call 0044579F
:00413429 83C414                  add esp, 00000014
:0041342C E900000000              jmp 00413431

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041342C(U)
|
:00413431 5F                      pop edi
:00413432 5E                      pop esi
:00413433 5B                      pop ebx
:00413434 C9                      leave
:00413435 C3                      ret



* Referenced by a CALL at Addresses:
|:004138D7   , :00416DD5   
|
:00413436 55                      push ebp
:00413437 8BEC                    mov ebp, esp
:00413439 53                      push ebx
:0041343A 56                      push esi
:0041343B 57                      push edi
:0041343C E900000000              jmp 00413441

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041343C(U)
|
:00413441 5F                      pop edi
:00413442 5E                      pop esi
:00413443 5B                      pop ebx
:00413444 C9                      leave
:00413445 C3                      ret



* Referenced by a CALL at Address:
|:00414A28   
|
:00413446 55                      push ebp
:00413447 8BEC                    mov ebp, esp
:00413449 83EC04                  sub esp, 00000004
:0041344C 53                      push ebx
:0041344D 56                      push esi
:0041344E 57                      push edi
:0041344F C745FC00000000          mov [ebp-04], 00000000
:00413456 E903000000              jmp 0041345E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041347E(U)
|
:0041345B FF45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413456(U)
|
:0041345E 817DFCA00F0000          cmp dword ptr [ebp-04], 00000FA0
:00413465 0F8318000000            jnb 00413483
:0041346B 8B45FC                  mov eax, dword ptr [ebp-04]
:0041346E C1E006                  shl eax, 06
:00413471 034508                  add eax, dword ptr [ebp+08]
:00413474 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00413477 89048D88674600          mov dword ptr [4*ecx+00466788], eax
:0041347E E9D8FFFFFF              jmp 0041345B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413465(C)
|
:00413483 E900000000              jmp 00413488

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413483(U)
|
:00413488 5F                      pop edi
:00413489 5E                      pop esi
:0041348A 5B                      pop ebx
:0041348B C9                      leave
:0041348C C3                      ret


:0041348D 55                      push ebp
:0041348E 8BEC                    mov ebp, esp
:00413490 83EC10                  sub esp, 00000010
:00413493 53                      push ebx
:00413494 56                      push esi
:00413495 57                      push edi
:00413496 8B4508                  mov eax, dword ptr [ebp+08]
:00413499 25FFFF0000              and eax, 0000FFFF
:0041349E 8D0480                  lea eax, dword ptr [eax+4*eax]
:004134A1 8D0445E0F44400          lea eax, dword ptr [2*eax+0044F4E0]
:004134A8 8945FC                  mov dword ptr [ebp-04], eax
:004134AB 8B45FC                  mov eax, dword ptr [ebp-04]
:004134AE 33C9                    xor ecx, ecx
:004134B0 668B08                  mov cx, word ptr [eax]
:004134B3 83F904                  cmp ecx, 00000004
:004134B6 0F840B000000            je 004134C7
:004134BC 8B45FC                  mov eax, dword ptr [ebp-04]
:004134BF 668B00                  mov ax, word ptr [eax]
:004134C2 E9E0000000              jmp 004135A7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004134B6(C)
|
:004134C7 8B45FC                  mov eax, dword ptr [ebp-04]
:004134CA 66C7000100              mov word ptr [eax], 0001
:004134CF 668B450C                mov ax, word ptr [ebp+0C]
:004134D3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004134D6 66894102                mov word ptr [ecx+02], ax
:004134DA 668B4510                mov ax, word ptr [ebp+10]
:004134DE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004134E1 66894104                mov word ptr [ecx+04], ax
:004134E5 668B4514                mov ax, word ptr [ebp+14]
:004134E9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004134EC 66894106                mov word ptr [ecx+06], ax
:004134F0 668B4518                mov ax, word ptr [ebp+18]
:004134F4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004134F7 66894108                mov word ptr [ecx+08], ax
:004134FB 66C745F80000            mov [ebp-08], 0000
:00413501 E904000000              jmp 0041350A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041359A(U)
|
:00413506 66FF45F8                inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413501(U)
|
:0041350A 8B45F8                  mov eax, dword ptr [ebp-08]
:0041350D 25FFFF0000              and eax, 0000FFFF
:00413512 8B4D18                  mov ecx, dword ptr [ebp+18]
:00413515 81E1FFFF0000            and ecx, 0000FFFF
:0041351B 3BC1                    cmp eax, ecx
:0041351D 0F8D7C000000            jnl 0041359F
:00413523 8B45F8                  mov eax, dword ptr [ebp-08]
:00413526 25FFFF0000              and eax, 0000FFFF
:0041352B 8B4D10                  mov ecx, dword ptr [ebp+10]
:0041352E 81E1FFFF0000            and ecx, 0000FFFF
:00413534 03C1                    add eax, ecx
:00413536 33C9                    xor ecx, ecx
:00413538 668B0DD0D54500          mov cx, word ptr [0045D5D0]
:0041353F 0FAFC1                  imul eax, ecx
:00413542 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00413545 81E1FFFF0000            and ecx, 0000FFFF
:0041354B 03C9                    add ecx, ecx
:0041354D 8D0441                  lea eax, dword ptr [ecx+2*eax]
:00413550 0578F74500              add eax, 0045F778
:00413555 8945F4                  mov dword ptr [ebp-0C], eax
:00413558 66C745F00000            mov [ebp-10], 0000
:0041355E E908000000              jmp 0041356B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413595(U)
|
:00413563 66FF45F0                inc [ebp-10]
:00413567 8345F402                add dword ptr [ebp-0C], 00000002

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041355E(U)
|
:0041356B 8B4514                  mov eax, dword ptr [ebp+14]
:0041356E 25FFFF0000              and eax, 0000FFFF
:00413573 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00413576 81E1FFFF0000            and ecx, 0000FFFF
:0041357C 3BC1                    cmp eax, ecx
:0041357E 0F8E16000000            jle 0041359A
:00413584 8B45F4                  mov eax, dword ptr [ebp-0C]
:00413587 33C9                    xor ecx, ecx
:00413589 668B08                  mov cx, word ptr [eax]
:0041358C 83C940                  or ecx, 00000040
:0041358F 8B45F4                  mov eax, dword ptr [ebp-0C]
:00413592 668908                  mov word ptr [eax], cx
:00413595 E9C9FFFFFF              jmp 00413563

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041357E(C)
|
:0041359A E967FFFFFF              jmp 00413506

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041351D(C)
|
:0041359F 6633C0                  xor ax, ax
:004135A2 E900000000              jmp 004135A7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004134C2(U), :004135A2(U)
|
:004135A7 5F                      pop edi
:004135A8 5E                      pop esi
:004135A9 5B                      pop ebx
:004135AA C9                      leave
:004135AB C3                      ret


:004135AC 55                      push ebp
:004135AD 8BEC                    mov ebp, esp
:004135AF 53                      push ebx
:004135B0 56                      push esi
:004135B1 57                      push edi
:004135B2 8B4508                  mov eax, dword ptr [ebp+08]
:004135B5 25FFFF0000              and eax, 0000FFFF
:004135BA 8D0480                  lea eax, dword ptr [eax+4*eax]
:004135BD 33C9                    xor ecx, ecx
:004135BF 668B0C45E0F44400        mov cx, word ptr [2*eax+0044F4E0]
:004135C7 83F904                  cmp ecx, 00000004
:004135CA 0F8415000000            je 004135E5
:004135D0 8B4508                  mov eax, dword ptr [ebp+08]
:004135D3 25FFFF0000              and eax, 0000FFFF
:004135D8 8D0480                  lea eax, dword ptr [eax+4*eax]
:004135DB 66C70445E0F444000200    mov word ptr [2*eax+0044F4E0], 0002

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004135CA(C)
|
:004135E5 E900000000              jmp 004135EA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004135E5(U)
|
:004135EA 5F                      pop edi
:004135EB 5E                      pop esi
:004135EC 5B                      pop ebx
:004135ED C9                      leave
:004135EE C3                      ret



* Referenced by a CALL at Address:
|:00414A0C   
|
:004135EF 55                      push ebp
:004135F0 8BEC                    mov ebp, esp
:004135F2 53                      push ebx
:004135F3 56                      push esi
:004135F4 57                      push edi
:004135F5 66C7053AF745000100      mov word ptr [0045F73A], 0001
:004135FE A124F74500              mov eax, dword ptr [0045F724]
:00413603 A32CF74500              mov dword ptr [0045F72C], eax
:00413608 A12CF74500              mov eax, dword ptr [0045F72C]
:0041360D A328F74500              mov dword ptr [0045F728], eax
:00413612 E900000000              jmp 00413617

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413612(U)
|
:00413617 5F                      pop edi
:00413618 5E                      pop esi
:00413619 5B                      pop ebx
:0041361A C9                      leave
:0041361B C3                      ret



* Referenced by a CALL at Addresses:
|:00413898   , :00416DD0   
|
:0041361C 55                      push ebp
:0041361D 8BEC                    mov ebp, esp
:0041361F 83EC10                  sub esp, 00000010
:00413622 53                      push ebx
:00413623 56                      push esi
:00413624 57                      push edi
:00413625 C745FC78F74500          mov [ebp-04], 0045F778
:0041362C 66A154194600            mov ax, word ptr [00461954]
:00413632 668945F8                mov word ptr [ebp-08], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413685(C)
|
:00413636 8B45FC                  mov eax, dword ptr [ebp-04]
:00413639 668B00                  mov ax, word ptr [eax]
:0041363C 668945F4                mov word ptr [ebp-0C], ax
:00413640 8B45F4                  mov eax, dword ptr [ebp-0C]
:00413643 83E002                  and eax, 00000002
:00413646 668945F4                mov word ptr [ebp-0C], ax
:0041364A 66C16DF401              shr word ptr [ebp-0C], 01
:0041364F 668B45F4                mov ax, word ptr [ebp-0C]
:00413653 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00413656 668901                  mov word ptr [ecx], ax
:00413659 8345FC02                add dword ptr [ebp-04], 00000002
:0041365D 66FF4DF8                dec [ebp-08]
:00413661 F745F8FFFF0000          test [ebp-08], 0000FFFF
:00413668 0F840C000000            je 0041367A
:0041366E C745F001000000          mov [ebp-10], 00000001
:00413675 E907000000              jmp 00413681

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413668(C)
|
:0041367A C745F000000000          mov [ebp-10], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413675(U)
|
:00413681 837DF000                cmp dword ptr [ebp-10], 00000000
:00413685 0F85ABFFFFFF            jne 00413636
:0041368B E900000000              jmp 00413690

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041368B(U)
|
:00413690 5F                      pop edi
:00413691 5E                      pop esi
:00413692 5B                      pop ebx
:00413693 C9                      leave
:00413694 C3                      ret



* Referenced by a CALL at Addresses:
|:004138DC   , :00416DDF   
|
:00413695 55                      push ebp
:00413696 8BEC                    mov ebp, esp
:00413698 83EC1C                  sub esp, 0000001C
:0041369B 53                      push ebx
:0041369C 56                      push esi
:0041369D 57                      push edi
:0041369E E8C6FBFFFF              call 00413269
:004136A3 E87FF9FFFF              call 00413027
:004136A8 68B8010000              push 000001B8
:004136AD 6880020000              push 00000280
:004136B2 6A28                    push 00000028
:004136B4 6A00                    push 00000000
:004136B6 E8E2160300              call 00444D9D
:004136BB 83C410                  add esp, 00000010
:004136BE A124F74500              mov eax, dword ptr [0045F724]
:004136C3 A388A64600              mov dword ptr [0046A688], eax
:004136C8 66A148194600            mov ax, word ptr [00461948]
:004136CE 668945F0                mov word ptr [ebp-10], ax
:004136D2 66A14C194600            mov ax, word ptr [0046194C]
:004136D8 668945EC                mov word ptr [ebp-14], ax
:004136DC C745FC78F74500          mov [ebp-04], 0045F778
:004136E3 66C745F40000            mov [ebp-0C], 0000
:004136E9 E904000000              jmp 004136F2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004137B2(U)
|
:004136EE 66FF45F4                inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004136E9(U)
|
:004136F2 8B45F4                  mov eax, dword ptr [ebp-0C]
:004136F5 25FFFF0000              and eax, 0000FFFF
:004136FA 33C9                    xor ecx, ecx
:004136FC 668B0DD4D54500          mov cx, word ptr [0045D5D4]
:00413703 3BC1                    cmp eax, ecx
:00413705 0F8DAC000000            jnl 004137B7
:0041370B A188A64600              mov eax, dword ptr [0046A688]
:00413710 8945F8                  mov dword ptr [ebp-08], eax
:00413713 66C745E80000            mov [ebp-18], 0000
:00413719 E917000000              jmp 00413735

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413784(U)
|
:0041371E 8B45F0                  mov eax, dword ptr [ebp-10]
:00413721 25FFFF0000              and eax, 0000FFFF
:00413726 83C008                  add eax, 00000008
:00413729 668945F0                mov word ptr [ebp-10], ax
:0041372D 66FF45E8                inc [ebp-18]
:00413731 8345F802                add dword ptr [ebp-08], 00000002

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413719(U)
|
:00413735 33C0                    xor eax, eax
:00413737 66A1D0D54500            mov ax, word ptr [0045D5D0]
:0041373D 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00413740 81E1FFFF0000            and ecx, 0000FFFF
:00413746 3BC1                    cmp eax, ecx
:00413748 0F8E3B000000            jle 00413789
:0041374E 8B45FC                  mov eax, dword ptr [ebp-04]
:00413751 668B00                  mov ax, word ptr [eax]
:00413754 668945E4                mov word ptr [ebp-1C], ax
:00413758 8345FC02                add dword ptr [ebp-04], 00000002
:0041375C F645E403                test [ebp-1C], 03
:00413760 0F841E000000            je 00413784
:00413766 F645E440                test [ebp-1C], 40
:0041376A 0F8514000000            jne 00413784
:00413770 8B45F8                  mov eax, dword ptr [ebp-08]
:00413773 50                      push eax
:00413774 8B45EC                  mov eax, dword ptr [ebp-14]
:00413777 50                      push eax
:00413778 8B45F0                  mov eax, dword ptr [ebp-10]
:0041377B 50                      push eax
:0041377C E869FCFFFF              call 004133EA
:00413781 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00413760(C), :0041376A(C)
|
:00413784 E995FFFFFF              jmp 0041371E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413748(C)
|
:00413789 66A148194600            mov ax, word ptr [00461948]
:0041378F 668945F0                mov word ptr [ebp-10], ax
:00413793 8B45EC                  mov eax, dword ptr [ebp-14]
:00413796 25FFFF0000              and eax, 0000FFFF
:0041379B 83C008                  add eax, 00000008
:0041379E 668945EC                mov word ptr [ebp-14], ax
:004137A2 33C0                    xor eax, eax
:004137A4 66A130F74500            mov ax, word ptr [0045F730]
:004137AA 03C0                    add eax, eax
:004137AC 010588A64600            add dword ptr [0046A688], eax
:004137B2 E937FFFFFF              jmp 004136EE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413705(C)
|
:004137B7 E88BF6FFFF              call 00412E47
:004137BC 68B8010000              push 000001B8
:004137C1 6880020000              push 00000280
:004137C6 6A00                    push 00000000
:004137C8 6A00                    push 00000000
:004137CA E8CE150300              call 00444D9D
:004137CF 83C410                  add esp, 00000010
:004137D2 E900000000              jmp 004137D7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004137D2(U)
|
:004137D7 5F                      pop edi
:004137D8 5E                      pop esi
:004137D9 5B                      pop ebx
:004137DA C9                      leave
:004137DB C3                      ret



* Referenced by a CALL at Address:
|:00414A04   
|
:004137DC 55                      push ebp
:004137DD 8BEC                    mov ebp, esp
:004137DF 83EC04                  sub esp, 00000004
:004137E2 53                      push ebx
:004137E3 56                      push esi
:004137E4 57                      push edi
:004137E5 8B4508                  mov eax, dword ptr [ebp+08]
:004137E8 25FFFF0000              and eax, 0000FFFF
:004137ED 8BC8                    mov ecx, eax
:004137EF C1E003                  shl eax, 03
:004137F2 2BC1                    sub eax, ecx
:004137F4 8D048520F74500          lea eax, dword ptr [4*eax+0045F720]
:004137FB 8945FC                  mov dword ptr [ebp-04], eax
:004137FE 668B4514                mov ax, word ptr [ebp+14]
:00413802 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00413805 66894110                mov word ptr [ecx+10], ax
:00413809 8B4514                  mov eax, dword ptr [ebp+14]
:0041380C 25FFFF0000              and eax, 0000FFFF
:00413811 33C9                    xor ecx, ecx
:00413813 668B0DD0D54500          mov cx, word ptr [0045D5D0]
:0041381A 2BC1                    sub eax, ecx
:0041381C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041381F 66894112                mov word ptr [ecx+12], ax
:00413823 8B4518                  mov eax, dword ptr [ebp+18]
:00413826 25FFFF0000              and eax, 0000FFFF
:0041382B 33C9                    xor ecx, ecx
:0041382D 668B0DD4D54500          mov cx, word ptr [0045D5D4]
:00413834 2BC1                    sub eax, ecx
:00413836 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00413839 66894118                mov word ptr [ecx+18], ax
:0041383D 668B4510                mov ax, word ptr [ebp+10]
:00413841 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00413844 66894116                mov word ptr [ecx+16], ax
:00413848 668B450C                mov ax, word ptr [ebp+0C]
:0041384C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041384F 66894114                mov word ptr [ecx+14], ax
:00413853 8B451C                  mov eax, dword ptr [ebp+1C]
:00413856 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00413859 8901                    mov dword ptr [ecx], eax
:0041385B 8B4514                  mov eax, dword ptr [ebp+14]
:0041385E 25FFFF0000              and eax, 0000FFFF
:00413863 8B4D10                  mov ecx, dword ptr [ebp+10]
:00413866 81E1FFFF0000            and ecx, 0000FFFF
:0041386C 0FAFC1                  imul eax, ecx
:0041386F 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00413872 81E1FFFF0000            and ecx, 0000FFFF
:00413878 03C1                    add eax, ecx
:0041387A 03C0                    add eax, eax
:0041387C 03451C                  add eax, dword ptr [ebp+1C]
:0041387F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00413882 894104                  mov dword ptr [ecx+04], eax
:00413885 E900000000              jmp 0041388A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413885(U)
|
:0041388A 5F                      pop edi
:0041388B 5E                      pop esi
:0041388C 5B                      pop ebx
:0041388D C9                      leave
:0041388E C3                      ret



* Referenced by a CALL at Addresses:
|:004138F6   , :00414C28   
|
:0041388F 55                      push ebp
:00413890 8BEC                    mov ebp, esp
:00413892 83EC08                  sub esp, 00000008
:00413895 53                      push ebx
:00413896 56                      push esi
:00413897 57                      push edi
:00413898 E87FFDFFFF              call 0041361C
:0041389D C745FC78F74500          mov [ebp-04], 0045F778
:004138A4 66C745F80000            mov [ebp-08], 0000
:004138AA E908000000              jmp 004138B7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004138D2(U)
|
:004138AF 66FF45F8                inc [ebp-08]
:004138B3 8345FC02                add dword ptr [ebp-04], 00000002

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004138AA(U)
|
:004138B7 8B45F8                  mov eax, dword ptr [ebp-08]
:004138BA 25FFFF0000              and eax, 0000FFFF
:004138BF 3DA00F0000              cmp eax, 00000FA0
:004138C4 0F8D0D000000            jnl 004138D7
:004138CA 8B45FC                  mov eax, dword ptr [ebp-04]
:004138CD 66C7000900              mov word ptr [eax], 0009
:004138D2 E9D8FFFFFF              jmp 004138AF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004138C4(C)
|
:004138D7 E85AFBFFFF              call 00413436
:004138DC E8B4FDFFFF              call 00413695
:004138E1 E900000000              jmp 004138E6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004138E1(U)
|
:004138E6 5F                      pop edi
:004138E7 5E                      pop esi
:004138E8 5B                      pop ebx
:004138E9 C9                      leave
:004138EA C3                      ret



* Referenced by a CALL at Addresses:
|:004148D6   , :00414C0C   , :00415C67   , :00415D7D   , :00415DAE   
|:00415E66   , :00416782   , :004167BD   , :0041786D   
|
:004138EB 55                      push ebp
:004138EC 8BEC                    mov ebp, esp
:004138EE 53                      push ebx
:004138EF 56                      push esi
:004138F0 57                      push edi
:004138F1 E8A1360100              call 00426F97
:004138F6 E894FFFFFF              call 0041388F
:004138FB E8B7360100              call 00426FB7
:00413900 E900000000              jmp 00413905

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413900(U)
|
:00413905 5F                      pop edi
:00413906 5E                      pop esi
:00413907 5B                      pop ebx
:00413908 C9                      leave
:00413909 C3                      ret


:0041390A 55                      push ebp
:0041390B 8BEC                    mov ebp, esp
:0041390D 83EC18                  sub esp, 00000018
:00413910 53                      push ebx
:00413911 56                      push esi
:00413912 57                      push edi
:00413913 E87F360100              call 00426F97
:00413918 B988534500              mov ecx, 00455388
:0041391D E8D0E3FEFF              call 00401CF2
:00413922 B988534500              mov ecx, 00455388
:00413927 E8745BFFFF              call 004094A0
:0041392C 668945F4                mov word ptr [ebp-0C], ax
:00413930 B988534500              mov ecx, 00455388
:00413935 E8865BFFFF              call 004094C0
:0041393A 668945F0                mov word ptr [ebp-10], ax
:0041393E 66C745ECFFFF            mov [ebp-14], FFFF
:00413944 66C745E8FFFF            mov [ebp-18], FFFF
:0041394A 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041394D 25FFFF0000              and eax, 0000FFFF
:00413952 33C9                    xor ecx, ecx
:00413954 668B0D68F74500          mov cx, word ptr [0045F768]
:0041395B 03C1                    add eax, ecx
:0041395D 668945FC                mov word ptr [ebp-04], ax
:00413961 8B45F0                  mov eax, dword ptr [ebp-10]
:00413964 25FFFF0000              and eax, 0000FFFF
:00413969 33C9                    xor ecx, ecx
:0041396B 668B0D6CF74500          mov cx, word ptr [0045F76C]
:00413972 03C1                    add eax, ecx
:00413974 668945F8                mov word ptr [ebp-08], ax
:00413978 8B45FC                  mov eax, dword ptr [ebp-04]
:0041397B 25FFFF0000              and eax, 0000FFFF
:00413980 C1E805                  shr eax, 05
:00413983 668945EC                mov word ptr [ebp-14], ax
:00413987 8B45F8                  mov eax, dword ptr [ebp-08]
:0041398A 25FFFF0000              and eax, 0000FFFF
:0041398F C1E805                  shr eax, 05
:00413992 668945E8                mov word ptr [ebp-18], ax
:00413996 6880010000              push 00000180
:0041399B 6A32                    push 00000032
:0041399D B910BC4600              mov ecx, 0046BC10
:004139A2 E860C20000              call 0041FC07
:004139A7 8B45E8                  mov eax, dword ptr [ebp-18]
:004139AA 25FFFF0000              and eax, 0000FFFF
:004139AF 50                      push eax
:004139B0 8B45EC                  mov eax, dword ptr [ebp-14]
:004139B3 25FFFF0000              and eax, 0000FFFF
:004139B8 50                      push eax

* Possible StringData Ref from Data Obj ->"M0B0QMAPX:%4u QMAPY:%4u"
                                  |
:004139B9 685CF74400              push 0044F75C
:004139BE 6810BC4600              push 0046BC10
:004139C3 E85BD10000              call 00420B23
:004139C8 83C410                  add esp, 00000010
:004139CB E8E7350100              call 00426FB7
:004139D0 E900000000              jmp 004139D5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004139D0(U)
|
:004139D5 5F                      pop edi
:004139D6 5E                      pop esi
:004139D7 5B                      pop ebx
:004139D8 C9                      leave
:004139D9 C3                      ret



* Referenced by a CALL at Address:
|:004147DB   
|
:004139DA 55                      push ebp
:004139DB 8BEC                    mov ebp, esp
:004139DD 83EC04                  sub esp, 00000004
:004139E0 53                      push ebx
:004139E1 56                      push esi
:004139E2 57                      push edi
:004139E3 66C745FC0100            mov [ebp-04], 0001
:004139E9 813D64F94600419C0000    cmp dword ptr [0046F964], 00009C41
:004139F3 0F8C18000000            jl 00413A11
:004139F9 6A00                    push 00000000
:004139FB E828DBFFFF              call 00411528
:00413A00 83C404                  add esp, 00000004
:00413A03 E8F1D1FFFF              call 00410BF9
:00413A08 668B45FC                mov ax, word ptr [ebp-04]
:00413A0C E90F000000              jmp 00413A20

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004139F3(C)
|
:00413A11 66C745FC0000            mov [ebp-04], 0000
:00413A17 668B45FC                mov ax, word ptr [ebp-04]
:00413A1B E900000000              jmp 00413A20

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00413A0C(U), :00413A1B(U)
|
:00413A20 5F                      pop edi
:00413A21 5E                      pop esi
:00413A22 5B                      pop ebx
:00413A23 C9                      leave
:00413A24 C3                      ret



* Referenced by a CALL at Addresses:
|:00413B85   , :00413EFE   , :00414457   
|
:00413A25 55                      push ebp
:00413A26 8BEC                    mov ebp, esp
:00413A28 83EC10                  sub esp, 00000010
:00413A2B 53                      push ebx
:00413A2C 56                      push esi
:00413A2D 57                      push edi
:00413A2E 66FF4D10                dec [ebp+10]
:00413A32 66FF4D14                dec [ebp+14]
:00413A36 8B4518                  mov eax, dword ptr [ebp+18]
:00413A39 25FFFF0000              and eax, 0000FFFF
:00413A3E 0FBF0445B8F44400        movsx eax, word ptr [2*eax+0044F4B8]
:00413A46 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00413A49 0FBF09                  movsx ecx, word ptr [ecx]
:00413A4C 03C1                    add eax, ecx
:00413A4E 8B4D14                  mov ecx, dword ptr [ebp+14]
:00413A51 81E1FFFF0000            and ecx, 0000FFFF
:00413A57 2BC1                    sub eax, ecx
:00413A59 668945F0                mov word ptr [ebp-10], ax
:00413A5D 8B4518                  mov eax, dword ptr [ebp+18]
:00413A60 25FFFF0000              and eax, 0000FFFF
:00413A65 0FBF0445C8F44400        movsx eax, word ptr [2*eax+0044F4C8]
:00413A6D 8B4D08                  mov ecx, dword ptr [ebp+08]
:00413A70 0FBF09                  movsx ecx, word ptr [ecx]
:00413A73 03C1                    add eax, ecx
:00413A75 668945F8                mov word ptr [ebp-08], ax
:00413A79 8B4510                  mov eax, dword ptr [ebp+10]
:00413A7C 25FFFF0000              and eax, 0000FFFF
:00413A81 0FBF4DF8                movsx ecx, word ptr [ebp-08]
:00413A85 03C1                    add eax, ecx
:00413A87 668945FC                mov word ptr [ebp-04], ax
:00413A8B 0FBF45F0                movsx eax, word ptr [ebp-10]
:00413A8F 8B4D14                  mov ecx, dword ptr [ebp+14]
:00413A92 81E1FFFF0000            and ecx, 0000FFFF
:00413A98 2BC1                    sub eax, ecx
:00413A9A 668945F4                mov word ptr [ebp-0C], ax
:00413A9E 0FBF45F8                movsx eax, word ptr [ebp-08]
:00413AA2 85C0                    test eax, eax
:00413AA4 0F8CB5000000            jl 00413B5F
:00413AAA 6A02                    push 00000002
:00413AAC E891E1FFFF              call 00411C42
:00413AB1 83C404                  add esp, 00000004
:00413AB4 0FB7C0                  movzx eax, ax
:00413AB7 0FBF4DF8                movsx ecx, word ptr [ebp-08]
:00413ABB 3BC1                    cmp eax, ecx
:00413ABD 0F8E9C000000            jle 00413B5F
:00413AC3 0FBF45FC                movsx eax, word ptr [ebp-04]
:00413AC7 85C0                    test eax, eax
:00413AC9 0F8C90000000            jl 00413B5F
:00413ACF 6A02                    push 00000002
:00413AD1 E86CE1FFFF              call 00411C42
:00413AD6 83C404                  add esp, 00000004
:00413AD9 0FB7C0                  movzx eax, ax
:00413ADC 0FBF4DFC                movsx ecx, word ptr [ebp-04]
:00413AE0 3BC1                    cmp eax, ecx
:00413AE2 0F8E77000000            jle 00413B5F
:00413AE8 0FBF45F0                movsx eax, word ptr [ebp-10]
:00413AEC 85C0                    test eax, eax
:00413AEE 0F8C6B000000            jl 00413B5F
:00413AF4 6A04                    push 00000004
:00413AF6 E847E1FFFF              call 00411C42
:00413AFB 83C404                  add esp, 00000004
:00413AFE 0FB7C0                  movzx eax, ax
:00413B01 0FBF4DF0                movsx ecx, word ptr [ebp-10]
:00413B05 3BC1                    cmp eax, ecx
:00413B07 0F8E52000000            jle 00413B5F
:00413B0D 0FBF45F4                movsx eax, word ptr [ebp-0C]
:00413B11 85C0                    test eax, eax
:00413B13 0F8C46000000            jl 00413B5F
:00413B19 6A04                    push 00000004
:00413B1B E822E1FFFF              call 00411C42
:00413B20 83C404                  add esp, 00000004
:00413B23 0FB7C0                  movzx eax, ax
:00413B26 0FBF4DF4                movsx ecx, word ptr [ebp-0C]
:00413B2A 3BC1                    cmp eax, ecx
:00413B2C 0F8E2D000000            jle 00413B5F
:00413B32 668B45F8                mov ax, word ptr [ebp-08]
:00413B36 8B4D08                  mov ecx, dword ptr [ebp+08]
:00413B39 668901                  mov word ptr [ecx], ax
:00413B3C 8B4514                  mov eax, dword ptr [ebp+14]
:00413B3F 25FFFF0000              and eax, 0000FFFF
:00413B44 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00413B47 81E1FFFF0000            and ecx, 0000FFFF
:00413B4D 03C1                    add eax, ecx
:00413B4F 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00413B52 668901                  mov word ptr [ecx], ax
:00413B55 B801000000              mov eax, 00000001
:00413B5A E907000000              jmp 00413B66

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00413AA4(C), :00413ABD(C), :00413AC9(C), :00413AE2(C), :00413AEE(C)
|:00413B07(C), :00413B13(C), :00413B2C(C)
|
:00413B5F 33C0                    xor eax, eax
:00413B61 E900000000              jmp 00413B66

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00413B5A(U), :00413B61(U)
|
:00413B66 5F                      pop edi
:00413B67 5E                      pop esi
:00413B68 5B                      pop ebx
:00413B69 C9                      leave
:00413B6A C3                      ret



* Referenced by a CALL at Addresses:
|:00413CB8   , :00414FEB   , :004151A0   , :00417147   
|
:00413B6B 55                      push ebp
:00413B6C 8BEC                    mov ebp, esp
:00413B6E 53                      push ebx
:00413B6F 56                      push esi
:00413B70 57                      push edi
:00413B71 8B4518                  mov eax, dword ptr [ebp+18]
:00413B74 50                      push eax
:00413B75 8B4514                  mov eax, dword ptr [ebp+14]
:00413B78 50                      push eax
:00413B79 8B4510                  mov eax, dword ptr [ebp+10]
:00413B7C 50                      push eax
:00413B7D 8B450C                  mov eax, dword ptr [ebp+0C]
:00413B80 50                      push eax
:00413B81 8B4508                  mov eax, dword ptr [ebp+08]
:00413B84 50                      push eax
:00413B85 E89BFEFFFF              call 00413A25
:00413B8A 83C414                  add esp, 00000014
:00413B8D 85C0                    test eax, eax
:00413B8F 0F8509000000            jne 00413B9E
:00413B95 66B8FFFF                mov ax, FFFF
:00413B99 E93E000000              jmp 00413BDC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413B8F(C)
|
:00413B9E 6A01                    push 00000001
:00413BA0 8B4514                  mov eax, dword ptr [ebp+14]
:00413BA3 50                      push eax
:00413BA4 8B4510                  mov eax, dword ptr [ebp+10]
:00413BA7 50                      push eax
:00413BA8 6A00                    push 00000000
:00413BAA 8B450C                  mov eax, dword ptr [ebp+0C]
:00413BAD 668B00                  mov ax, word ptr [eax]
:00413BB0 50                      push eax
:00413BB1 8B4508                  mov eax, dword ptr [ebp+08]
:00413BB4 668B00                  mov ax, word ptr [eax]
:00413BB7 50                      push eax
:00413BB8 E85DE4FFFF              call 0041201A
:00413BBD 83C418                  add esp, 00000018
:00413BC0 0FB7C0                  movzx eax, ax
:00413BC3 85C0                    test eax, eax
:00413BC5 0F8409000000            je 00413BD4
:00413BCB 66B8FFFF                mov ax, FFFF
:00413BCF E908000000              jmp 00413BDC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413BC5(C)
|
:00413BD4 6633C0                  xor ax, ax
:00413BD7 E900000000              jmp 00413BDC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00413B99(U), :00413BCF(U), :00413BD7(U)
|
:00413BDC 5F                      pop edi
:00413BDD 5E                      pop esi
:00413BDE 5B                      pop ebx
:00413BDF C9                      leave
:00413BE0 C3                      ret



* Referenced by a CALL at Address:
|:0041439D   
|
:00413BE1 55                      push ebp
:00413BE2 8BEC                    mov ebp, esp
:00413BE4 83EC28                  sub esp, 00000028
:00413BE7 53                      push ebx
:00413BE8 56                      push esi
:00413BE9 57                      push edi
:00413BEA 6A04                    push 00000004
:00413BEC 6A00                    push 00000000
:00413BEE 6A00                    push 00000000
:00413BF0 B918E54600              mov ecx, 0046E518
:00413BF5 E8263B0300              call 00447720
:00413BFA 8945FC                  mov dword ptr [ebp-04], eax
:00413BFD 8B45FC                  mov eax, dword ptr [ebp-04]
:00413C00 8945EC                  mov dword ptr [ebp-14], eax
:00413C03 6A02                    push 00000002
:00413C05 E838E0FFFF              call 00411C42
:00413C0A 83C404                  add esp, 00000004
:00413C0D 668945D8                mov word ptr [ebp-28], ax
:00413C11 8B45D8                  mov eax, dword ptr [ebp-28]
:00413C14 25FFFF0000              and eax, 0000FFFF
:00413C19 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00413C1C 81E1FFFF0000            and ecx, 0000FFFF
:00413C22 0FAFC1                  imul eax, ecx
:00413C25 8B4D08                  mov ecx, dword ptr [ebp+08]
:00413C28 81E1FFFF0000            and ecx, 0000FFFF
:00413C2E 03C9                    add ecx, ecx
:00413C30 8D0441                  lea eax, dword ptr [ecx+2*eax]
:00413C33 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00413C36 668B0408                mov ax, word ptr [eax+ecx]
:00413C3A 668945E8                mov word ptr [ebp-18], ax
:00413C3E F745E8FFFF0000          test [ebp-18], 0000FFFF
:00413C45 0F8509000000            jne 00413C54
:00413C4B 66B8FFFF                mov ax, FFFF
:00413C4F E9DA000000              jmp 00413D2E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413C45(C)
|
:00413C54 66C745E4FFFF            mov [ebp-1C], FFFF
:00413C5A 66C745E00000            mov [ebp-20], 0000
:00413C60 E904000000              jmp 00413C69

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413D20(U)
|
:00413C65 66FF45E0                inc [ebp-20]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413C60(U)
|
:00413C69 8B45E0                  mov eax, dword ptr [ebp-20]
:00413C6C 25FFFF0000              and eax, 0000FFFF
:00413C71 83F804                  cmp eax, 00000004
:00413C74 0F8DAB000000            jnl 00413D25
:00413C7A 8B45E0                  mov eax, dword ptr [ebp-20]
:00413C7D 25FFFF0000              and eax, 0000FFFF
:00413C82 33C9                    xor ecx, ecx
:00413C84 668B0D7C674600          mov cx, word ptr [0046677C]
:00413C8B 03C1                    add eax, ecx
:00413C8D 83E003                  and eax, 00000003
:00413C90 668945DC                mov word ptr [ebp-24], ax
:00413C94 668B4508                mov ax, word ptr [ebp+08]
:00413C98 668945F4                mov word ptr [ebp-0C], ax
:00413C9C 668B450C                mov ax, word ptr [ebp+0C]
:00413CA0 668945F0                mov word ptr [ebp-10], ax
:00413CA4 8B45DC                  mov eax, dword ptr [ebp-24]
:00413CA7 50                      push eax
:00413CA8 8B4514                  mov eax, dword ptr [ebp+14]
:00413CAB 50                      push eax
:00413CAC 8B4510                  mov eax, dword ptr [ebp+10]
:00413CAF 50                      push eax
:00413CB0 8D45F0                  lea eax, dword ptr [ebp-10]
:00413CB3 50                      push eax
:00413CB4 8D45F4                  lea eax, dword ptr [ebp-0C]
:00413CB7 50                      push eax
:00413CB8 E8AEFEFFFF              call 00413B6B
:00413CBD 83C414                  add esp, 00000014
:00413CC0 0FB7C0                  movzx eax, ax
:00413CC3 3DFFFF0000              cmp eax, 0000FFFF
:00413CC8 0F8452000000            je 00413D20
:00413CCE 8B45F0                  mov eax, dword ptr [ebp-10]
:00413CD1 25FFFF0000              and eax, 0000FFFF
:00413CD6 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00413CD9 81E1FFFF0000            and ecx, 0000FFFF
:00413CDF 0FAFC1                  imul eax, ecx
:00413CE2 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00413CE5 81E1FFFF0000            and ecx, 0000FFFF
:00413CEB 03C9                    add ecx, ecx
:00413CED 8D0441                  lea eax, dword ptr [ecx+2*eax]
:00413CF0 0345EC                  add eax, dword ptr [ebp-14]
:00413CF3 8945F8                  mov dword ptr [ebp-08], eax
:00413CF6 8B45F8                  mov eax, dword ptr [ebp-08]
:00413CF9 33C9                    xor ecx, ecx
:00413CFB 668B08                  mov cx, word ptr [eax]
:00413CFE 8B45E8                  mov eax, dword ptr [ebp-18]
:00413D01 25FFFF0000              and eax, 0000FFFF
:00413D06 3BC8                    cmp ecx, eax
:00413D08 0F8D12000000            jnl 00413D20
:00413D0E 8B45F8                  mov eax, dword ptr [ebp-08]
:00413D11 668B00                  mov ax, word ptr [eax]
:00413D14 668945E8                mov word ptr [ebp-18], ax
:00413D18 668B45DC                mov ax, word ptr [ebp-24]
:00413D1C 668945E4                mov word ptr [ebp-1C], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00413CC8(C), :00413D08(C)
|
:00413D20 E940FFFFFF              jmp 00413C65

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413C74(C)
|
:00413D25 668B45E4                mov ax, word ptr [ebp-1C]
:00413D29 E900000000              jmp 00413D2E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00413C4F(U), :00413D29(U)
|
:00413D2E 5F                      pop edi
:00413D2F 5E                      pop esi
:00413D30 5B                      pop ebx
:00413D31 C9                      leave
:00413D32 C3                      ret



* Referenced by a CALL at Address:
|:00413FAC   
|
:00413D33 55                      push ebp
:00413D34 8BEC                    mov ebp, esp
:00413D36 53                      push ebx
:00413D37 56                      push esi
:00413D38 57                      push edi
:00413D39 6A01                    push 00000001
:00413D3B 8B4514                  mov eax, dword ptr [ebp+14]
:00413D3E 50                      push eax
:00413D3F 8B4510                  mov eax, dword ptr [ebp+10]
:00413D42 50                      push eax
:00413D43 6A00                    push 00000000
:00413D45 8B450C                  mov eax, dword ptr [ebp+0C]
:00413D48 50                      push eax
:00413D49 8B4508                  mov eax, dword ptr [ebp+08]
:00413D4C 50                      push eax
:00413D4D E8C8E2FFFF              call 0041201A
:00413D52 83C418                  add esp, 00000018
:00413D55 0FB7C0                  movzx eax, ax
:00413D58 85C0                    test eax, eax
:00413D5A 0F8409000000            je 00413D69
:00413D60 66B8FFFF                mov ax, FFFF
:00413D64 E909000000              jmp 00413D72

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413D5A(C)
|
:00413D69 66B80100                mov ax, 0001
:00413D6D E900000000              jmp 00413D72

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00413D64(U), :00413D6D(U)
|
:00413D72 5F                      pop edi
:00413D73 5E                      pop esi
:00413D74 5B                      pop ebx
:00413D75 C9                      leave
:00413D76 C3                      ret



* Referenced by a CALL at Addresses:
|:0041460F   , :004146C7   , :004153D4   
|
:00413D77 55                      push ebp
:00413D78 8BEC                    mov ebp, esp
:00413D7A 83EC44                  sub esp, 00000044
:00413D7D 53                      push ebx
:00413D7E 56                      push esi
:00413D7F 57                      push edi
:00413D80 6A04                    push 00000004
:00413D82 6A00                    push 00000000
:00413D84 6A00                    push 00000000
:00413D86 B918E54600              mov ecx, 0046E518
:00413D8B E890390300              call 00447720
:00413D90 8945FC                  mov dword ptr [ebp-04], eax
:00413D93 8B45FC                  mov eax, dword ptr [ebp-04]
:00413D96 8945E0                  mov dword ptr [ebp-20], eax
:00413D99 68FEFE0000              push 0000FEFE
:00413D9E 68204E0000              push 00004E20
:00413DA3 8B45FC                  mov eax, dword ptr [ebp-04]
:00413DA6 50                      push eax
:00413DA7 E86BD6FFFF              call 00411417
:00413DAC 83C40C                  add esp, 0000000C
:00413DAF 8B45FC                  mov eax, dword ptr [ebp-04]
:00413DB2 05409C0000              add eax, 00009C40
:00413DB7 8945C0                  mov dword ptr [ebp-40], eax
:00413DBA 8B45C0                  mov eax, dword ptr [ebp-40]
:00413DBD 8945E4                  mov dword ptr [ebp-1C], eax
:00413DC0 8B45C0                  mov eax, dword ptr [ebp-40]
:00413DC3 83C002                  add eax, 00000002
:00413DC6 8945F4                  mov dword ptr [ebp-0C], eax
:00413DC9 6A02                    push 00000002
:00413DCB E872DEFFFF              call 00411C42
:00413DD0 83C404                  add esp, 00000004
:00413DD3 668945D8                mov word ptr [ebp-28], ax
:00413DD7 8B45D8                  mov eax, dword ptr [ebp-28]
:00413DDA 25FFFF0000              and eax, 0000FFFF
:00413DDF 8B4D1C                  mov ecx, dword ptr [ebp+1C]
:00413DE2 81E1FFFF0000            and ecx, 0000FFFF
:00413DE8 0FAFC1                  imul eax, ecx
:00413DEB 8B4D18                  mov ecx, dword ptr [ebp+18]
:00413DEE 81E1FFFF0000            and ecx, 0000FFFF
:00413DF4 03C1                    add eax, ecx
:00413DF6 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00413DF9 668901                  mov word ptr [ecx], ax
:00413DFC 668B4518                mov ax, word ptr [ebp+18]
:00413E00 66A370F74500            mov word ptr [0045F770], ax
:00413E06 668B451C                mov ax, word ptr [ebp+1C]
:00413E0A 66A374F74500            mov word ptr [0045F774], ax
:00413E10 8B45E4                  mov eax, dword ptr [ebp-1C]
:00413E13 33C9                    xor ecx, ecx
:00413E15 668B08                  mov cx, word ptr [eax]
:00413E18 8B45E0                  mov eax, dword ptr [ebp-20]
:00413E1B 66C704480000            mov word ptr [eax+2*ecx], 0000
:00413E21 F6452001                test [ebp+20], 01
:00413E25 0F843C000000            je 00413E67
:00413E2B 8B4508                  mov eax, dword ptr [ebp+08]
:00413E2E 25FFFF0000              and eax, 0000FFFF
:00413E33 8B4D18                  mov ecx, dword ptr [ebp+18]
:00413E36 81E1FFFF0000            and ecx, 0000FFFF
:00413E3C 3BC1                    cmp eax, ecx
:00413E3E 0F8523000000            jne 00413E67
:00413E44 8B450C                  mov eax, dword ptr [ebp+0C]
:00413E47 25FFFF0000              and eax, 0000FFFF
:00413E4C 8B4D1C                  mov ecx, dword ptr [ebp+1C]
:00413E4F 81E1FFFF0000            and ecx, 0000FFFF
:00413E55 3BC1                    cmp eax, ecx
:00413E57 0F850A000000            jne 00413E67
:00413E5D B801000000              mov eax, 00000001
:00413E62 E940020000              jmp 004140A7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00413E25(C), :00413E3E(C), :00413E57(C), :0041409B(U)
|
:00413E67 8B45E4                  mov eax, dword ptr [ebp-1C]
:00413E6A 3945F4                  cmp dword ptr [ebp-0C], eax
:00413E6D 0F842D020000            je 004140A0
:00413E73 8B45E4                  mov eax, dword ptr [ebp-1C]
:00413E76 33C9                    xor ecx, ecx
:00413E78 668B08                  mov cx, word ptr [eax]
:00413E7B 8B5DD8                  mov ebx, dword ptr [ebp-28]
:00413E7E 81E3FFFF0000            and ebx, 0000FFFF
:00413E84 8BC1                    mov eax, ecx
:00413E86 99                      cdq
:00413E87 F7FB                    idiv ebx
:00413E89 668955D0                mov word ptr [ebp-30], dx
:00413E8D 8B45E4                  mov eax, dword ptr [ebp-1C]
:00413E90 33C9                    xor ecx, ecx
:00413E92 668B08                  mov cx, word ptr [eax]
:00413E95 8B5DD8                  mov ebx, dword ptr [ebp-28]
:00413E98 81E3FFFF0000            and ebx, 0000FFFF
:00413E9E 8BC1                    mov eax, ecx
:00413EA0 99                      cdq
:00413EA1 F7FB                    idiv ebx
:00413EA3 668945C4                mov word ptr [ebp-3C], ax
:00413EA7 8B45E4                  mov eax, dword ptr [ebp-1C]
:00413EAA 33C9                    xor ecx, ecx
:00413EAC 668B08                  mov cx, word ptr [eax]
:00413EAF 8B45E0                  mov eax, dword ptr [ebp-20]
:00413EB2 668B0448                mov ax, word ptr [eax+2*ecx]
:00413EB6 668945D4                mov word ptr [ebp-2C], ax
:00413EBA 66C745C80000            mov [ebp-38], 0000
:00413EC0 E904000000              jmp 00413EC9

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00413FD1(U), :0041407B(U)
|
:00413EC5 66FF45C8                inc [ebp-38]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413EC0(U)
|
:00413EC9 8B45C8                  mov eax, dword ptr [ebp-38]
:00413ECC 25FFFF0000              and eax, 0000FFFF
:00413ED1 83F804                  cmp eax, 00000004
:00413ED4 0F8DA6010000            jnl 00414080
:00413EDA 668B45D0                mov ax, word ptr [ebp-30]
:00413EDE 668945F0                mov word ptr [ebp-10], ax
:00413EE2 668B45C4                mov ax, word ptr [ebp-3C]
:00413EE6 668945EC                mov word ptr [ebp-14], ax
:00413EEA 8B45C8                  mov eax, dword ptr [ebp-38]
:00413EED 50                      push eax
:00413EEE 8B4514                  mov eax, dword ptr [ebp+14]
:00413EF1 50                      push eax
:00413EF2 8B4510                  mov eax, dword ptr [ebp+10]
:00413EF5 50                      push eax
:00413EF6 8D45EC                  lea eax, dword ptr [ebp-14]
:00413EF9 50                      push eax
:00413EFA 8D45F0                  lea eax, dword ptr [ebp-10]
:00413EFD 50                      push eax
:00413EFE E822FBFFFF              call 00413A25
:00413F03 83C414                  add esp, 00000014
:00413F06 83F801                  cmp eax, 00000001
:00413F09 0F856C010000            jne 0041407B
:00413F0F F6452001                test [ebp+20], 01
:00413F13 0F843C000000            je 00413F55
:00413F19 8B4508                  mov eax, dword ptr [ebp+08]
:00413F1C 25FFFF0000              and eax, 0000FFFF
:00413F21 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00413F24 81E1FFFF0000            and ecx, 0000FFFF
:00413F2A 3BC1                    cmp eax, ecx
:00413F2C 0F8523000000            jne 00413F55
:00413F32 8B450C                  mov eax, dword ptr [ebp+0C]
:00413F35 25FFFF0000              and eax, 0000FFFF
:00413F3A 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00413F3D 81E1FFFF0000            and ecx, 0000FFFF
:00413F43 3BC1                    cmp eax, ecx
:00413F45 0F850A000000            jne 00413F55
:00413F4B B801000000              mov eax, 00000001
:00413F50 E952010000              jmp 004140A7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00413F13(C), :00413F2C(C), :00413F45(C)
|
:00413F55 8B45D8                  mov eax, dword ptr [ebp-28]
:00413F58 25FFFF0000              and eax, 0000FFFF
:00413F5D 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00413F60 81E1FFFF0000            and ecx, 0000FFFF
:00413F66 0FAFC1                  imul eax, ecx
:00413F69 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00413F6C 81E1FFFF0000            and ecx, 0000FFFF
:00413F72 03C1                    add eax, ecx
:00413F74 668945DC                mov word ptr [ebp-24], ax
:00413F78 8B45DC                  mov eax, dword ptr [ebp-24]
:00413F7B 25FFFF0000              and eax, 0000FFFF
:00413F80 03C0                    add eax, eax
:00413F82 0345E0                  add eax, dword ptr [ebp-20]
:00413F85 8945F8                  mov dword ptr [ebp-08], eax
:00413F88 8B45F8                  mov eax, dword ptr [ebp-08]
:00413F8B 33C9                    xor ecx, ecx
:00413F8D 668B08                  mov cx, word ptr [eax]
:00413F90 81F9FEFE0000            cmp ecx, 0000FEFE
:00413F96 0F85DF000000            jne 0041407B
:00413F9C 8B4514                  mov eax, dword ptr [ebp+14]
:00413F9F 50                      push eax
:00413FA0 8B4510                  mov eax, dword ptr [ebp+10]
:00413FA3 50                      push eax
:00413FA4 8B45EC                  mov eax, dword ptr [ebp-14]
:00413FA7 50                      push eax
:00413FA8 8B45F0                  mov eax, dword ptr [ebp-10]
:00413FAB 50                      push eax
:00413FAC E882FDFFFF              call 00413D33
:00413FB1 83C410                  add esp, 00000010
:00413FB4 668945BC                mov word ptr [ebp-44], ax
:00413FB8 8B45BC                  mov eax, dword ptr [ebp-44]
:00413FBB 25FFFF0000              and eax, 0000FFFF
:00413FC0 3DFFFF0000              cmp eax, 0000FFFF
:00413FC5 0F850B000000            jne 00413FD6
:00413FCB 8B45F8                  mov eax, dword ptr [ebp-08]
:00413FCE 66FF00                  inc word ptr [eax]
:00413FD1 E9EFFEFFFF              jmp 00413EC5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413FC5(C)
|
:00413FD6 8B45BC                  mov eax, dword ptr [ebp-44]
:00413FD9 25FFFF0000              and eax, 0000FFFF
:00413FDE 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:00413FE1 81E1FFFF0000            and ecx, 0000FFFF
:00413FE7 03C1                    add eax, ecx
:00413FE9 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00413FEC 668901                  mov word ptr [ecx], ax
:00413FEF 8B45F4                  mov eax, dword ptr [ebp-0C]
:00413FF2 8945CC                  mov dword ptr [ebp-34], eax
:00413FF5 8B45F4                  mov eax, dword ptr [ebp-0C]
:00413FF8 83E802                  sub eax, 00000002
:00413FFB 8945E8                  mov dword ptr [ebp-18], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041405B(U)
|
:00413FFE 8B45C0                  mov eax, dword ptr [ebp-40]
:00414001 3945E8                  cmp dword ptr [ebp-18], eax
:00414004 0F830B000000            jnb 00414015
:0041400A 8B45C0                  mov eax, dword ptr [ebp-40]
:0041400D 051E4E0000              add eax, 00004E1E
:00414012 8945E8                  mov dword ptr [ebp-18], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414004(C)
|
:00414015 8B45E8                  mov eax, dword ptr [ebp-18]
:00414018 668B00                  mov ax, word ptr [eax]
:0041401B 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0041401E 668901                  mov word ptr [ecx], ax
:00414021 8B45E8                  mov eax, dword ptr [ebp-18]
:00414024 33C9                    xor ecx, ecx
:00414026 668B08                  mov cx, word ptr [eax]
:00414029 8B45E0                  mov eax, dword ptr [ebp-20]
:0041402C 33D2                    xor edx, edx
:0041402E 668B1448                mov dx, word ptr [eax+2*ecx]
:00414032 8B45F8                  mov eax, dword ptr [ebp-08]
:00414035 33C9                    xor ecx, ecx
:00414037 668B08                  mov cx, word ptr [eax]
:0041403A 3BD1                    cmp edx, ecx
:0041403C 0F8F0F000000            jg 00414051
:00414042 668B45DC                mov ax, word ptr [ebp-24]
:00414046 8B4DCC                  mov ecx, dword ptr [ebp-34]
:00414049 668901                  mov word ptr [ecx], ax
:0041404C E90F000000              jmp 00414060

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041403C(C)
|
:00414051 8B45E8                  mov eax, dword ptr [ebp-18]
:00414054 8945CC                  mov dword ptr [ebp-34], eax
:00414057 836DE802                sub dword ptr [ebp-18], 00000002
:0041405B E99EFFFFFF              jmp 00413FFE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041404C(U)
|
:00414060 8345F402                add dword ptr [ebp-0C], 00000002
:00414064 8B45C0                  mov eax, dword ptr [ebp-40]
:00414067 05204E0000              add eax, 00004E20
:0041406C 3B45F4                  cmp eax, dword ptr [ebp-0C]
:0041406F 0F8706000000            ja 0041407B
:00414075 8B45C0                  mov eax, dword ptr [ebp-40]
:00414078 8945F4                  mov dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00413F09(C), :00413F96(C), :0041406F(C)
|
:0041407B E945FEFFFF              jmp 00413EC5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413ED4(C)
|
:00414080 8345E402                add dword ptr [ebp-1C], 00000002
:00414084 8B45C0                  mov eax, dword ptr [ebp-40]
:00414087 05204E0000              add eax, 00004E20
:0041408C 3B45E4                  cmp eax, dword ptr [ebp-1C]
:0041408F 0F8706000000            ja 0041409B
:00414095 8B45C0                  mov eax, dword ptr [ebp-40]
:00414098 8945E4                  mov dword ptr [ebp-1C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041408F(C)
|
:0041409B E9C7FDFFFF              jmp 00413E67

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413E6D(C)
|
:004140A0 33C0                    xor eax, eax
:004140A2 E900000000              jmp 004140A7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00413E62(U), :00413F50(U), :004140A2(U)
|
:004140A7 5F                      pop edi
:004140A8 5E                      pop esi
:004140A9 5B                      pop ebx
:004140AA C9                      leave
:004140AB C3                      ret



* Referenced by a CALL at Address:
|:004142E5   
|
:004140AC 55                      push ebp
:004140AD 8BEC                    mov ebp, esp
:004140AF 83EC08                  sub esp, 00000008
:004140B2 53                      push ebx
:004140B3 56                      push esi
:004140B4 57                      push edi
:004140B5 C745F801000000          mov [ebp-08], 00000001
:004140BC C745FC00000000          mov [ebp-04], 00000000
:004140C3 E907000000              jmp 004140CF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004140ED(U)
|
:004140C8 FF45FC                  inc [ebp-04]
:004140CB C165F801                shl dword ptr [ebp-08], 01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004140C3(U)
|
:004140CF 837DFC20                cmp dword ptr [ebp-04], 00000020
:004140D3 0F8319000000            jnb 004140F2
:004140D9 8B45F8                  mov eax, dword ptr [ebp-08]
:004140DC 8505B8164600            test dword ptr [004616B8], eax
:004140E2 0F8505000000            jne 004140ED
:004140E8 E905000000              jmp 004140F2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004140E2(C)
|
:004140ED E9D6FFFFFF              jmp 004140C8

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004140D3(C), :004140E8(U)
|
:004140F2 837DFC20                cmp dword ptr [ebp-04], 00000020
:004140F6 0F8509000000            jne 00414105
:004140FC 66B8FFFF                mov ax, FFFF
:00414100 E919000000              jmp 0041411E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004140F6(C)
|
:00414105 B801000000              mov eax, 00000001
:0041410A 8A4DFC                  mov cl, byte ptr [ebp-04]
:0041410D D3E0                    shl eax, cl
:0041410F 0905B8164600            or dword ptr [004616B8], eax
:00414115 668B45FC                mov ax, word ptr [ebp-04]
:00414119 E900000000              jmp 0041411E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00414100(U), :00414119(U)
|
:0041411E 5F                      pop edi
:0041411F 5E                      pop esi
:00414120 5B                      pop ebx
:00414121 C9                      leave
:00414122 C3                      ret



* Referenced by a CALL at Address:
|:004158F1   
|
:00414123 55                      push ebp
:00414124 8BEC                    mov ebp, esp
:00414126 53                      push ebx
:00414127 56                      push esi
:00414128 57                      push edi
:00414129 8B4508                  mov eax, dword ptr [ebp+08]
:0041412C 25FFFF0000              and eax, 0000FFFF
:00414131 83F820                  cmp eax, 00000020
:00414134 0F8D12000000            jnl 0041414C
:0041413A B801000000              mov eax, 00000001
:0041413F 8A4D08                  mov cl, byte ptr [ebp+08]
:00414142 D3E0                    shl eax, cl
:00414144 F7D0                    not eax
:00414146 2105B8164600            and dword ptr [004616B8], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414134(C)
|
:0041414C E900000000              jmp 00414151

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041414C(U)
|
:00414151 5F                      pop edi
:00414152 5E                      pop esi
:00414153 5B                      pop ebx
:00414154 C9                      leave
:00414155 C3                      ret



* Referenced by a CALL at Addresses:
|:00414379   , :00415C22   
|
:00414156 55                      push ebp
:00414157 8BEC                    mov ebp, esp
:00414159 83EC08                  sub esp, 00000008
:0041415C 53                      push ebx
:0041415D 56                      push esi
:0041415E 57                      push edi
:0041415F 0FBF4510                movsx eax, word ptr [ebp+10]
:00414163 0FBF4D08                movsx ecx, word ptr [ebp+08]
:00414167 3BC1                    cmp eax, ecx
:00414169 0F8EA6000000            jle 00414215
:0041416F 0FBF4514                movsx eax, word ptr [ebp+14]
:00414173 0FBF4D0C                movsx ecx, word ptr [ebp+0C]
:00414177 3BC1                    cmp eax, ecx
:00414179 0F8E4B000000            jle 004141CA
:0041417F 0FBF4510                movsx eax, word ptr [ebp+10]
:00414183 0FBF4D08                movsx ecx, word ptr [ebp+08]
:00414187 2BC1                    sub eax, ecx
:00414189 668945FC                mov word ptr [ebp-04], ax
:0041418D 0FBF4514                movsx eax, word ptr [ebp+14]
:00414191 0FBF4D0C                movsx ecx, word ptr [ebp+0C]
:00414195 2BC1                    sub eax, ecx
:00414197 668945F8                mov word ptr [ebp-08], ax
:0041419B 8B45F8                  mov eax, dword ptr [ebp-08]
:0041419E 25FFFF0000              and eax, 0000FFFF
:004141A3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004141A6 81E1FFFF0000            and ecx, 0000FFFF
:004141AC 3BC1                    cmp eax, ecx
:004141AE 0F8F0B000000            jg 004141BF
:004141B4 66C745FC0100            mov [ebp-04], 0001
:004141BA E906000000              jmp 004141C5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004141AE(C)
|
:004141BF 66C745FC0200            mov [ebp-04], 0002

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004141BA(U)
|
:004141C5 E946000000              jmp 00414210

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414179(C)
|
:004141CA 0FBF4510                movsx eax, word ptr [ebp+10]
:004141CE 0FBF4D08                movsx ecx, word ptr [ebp+08]
:004141D2 2BC1                    sub eax, ecx
:004141D4 668945FC                mov word ptr [ebp-04], ax
:004141D8 0FBF450C                movsx eax, word ptr [ebp+0C]
:004141DC 0FBF4D14                movsx ecx, word ptr [ebp+14]
:004141E0 2BC1                    sub eax, ecx
:004141E2 668945F8                mov word ptr [ebp-08], ax
:004141E6 8B45F8                  mov eax, dword ptr [ebp-08]
:004141E9 25FFFF0000              and eax, 0000FFFF
:004141EE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004141F1 81E1FFFF0000            and ecx, 0000FFFF
:004141F7 3BC1                    cmp eax, ecx
:004141F9 0F8F0B000000            jg 0041420A
:004141FF 66C745FC0100            mov [ebp-04], 0001
:00414205 E906000000              jmp 00414210

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004141F9(C)
|
:0041420A 66C745FC0000            mov [ebp-04], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004141C5(U), :00414205(U)
|
:00414210 E9A1000000              jmp 004142B6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414169(C)
|
:00414215 0FBF4514                movsx eax, word ptr [ebp+14]
:00414219 0FBF4D0C                movsx ecx, word ptr [ebp+0C]
:0041421D 3BC1                    cmp eax, ecx
:0041421F 0F8E4B000000            jle 00414270
:00414225 0FBF4508                movsx eax, word ptr [ebp+08]
:00414229 0FBF4D10                movsx ecx, word ptr [ebp+10]
:0041422D 2BC1                    sub eax, ecx
:0041422F 668945FC                mov word ptr [ebp-04], ax
:00414233 0FBF4514                movsx eax, word ptr [ebp+14]
:00414237 0FBF4D0C                movsx ecx, word ptr [ebp+0C]
:0041423B 2BC1                    sub eax, ecx
:0041423D 668945F8                mov word ptr [ebp-08], ax
:00414241 8B45F8                  mov eax, dword ptr [ebp-08]
:00414244 25FFFF0000              and eax, 0000FFFF
:00414249 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041424C 81E1FFFF0000            and ecx, 0000FFFF
:00414252 3BC1                    cmp eax, ecx
:00414254 0F8F0B000000            jg 00414265
:0041425A 66C745FC0300            mov [ebp-04], 0003
:00414260 E906000000              jmp 0041426B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414254(C)
|
:00414265 66C745FC0200            mov [ebp-04], 0002

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414260(U)
|
:0041426B E946000000              jmp 004142B6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041421F(C)
|
:00414270 0FBF4508                movsx eax, word ptr [ebp+08]
:00414274 0FBF4D10                movsx ecx, word ptr [ebp+10]
:00414278 2BC1                    sub eax, ecx
:0041427A 668945FC                mov word ptr [ebp-04], ax
:0041427E 0FBF450C                movsx eax, word ptr [ebp+0C]
:00414282 0FBF4D14                movsx ecx, word ptr [ebp+14]
:00414286 2BC1                    sub eax, ecx
:00414288 668945F8                mov word ptr [ebp-08], ax
:0041428C 8B45F8                  mov eax, dword ptr [ebp-08]
:0041428F 25FFFF0000              and eax, 0000FFFF
:00414294 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00414297 81E1FFFF0000            and ecx, 0000FFFF
:0041429D 3BC1                    cmp eax, ecx
:0041429F 0F8F0B000000            jg 004142B0
:004142A5 66C745FC0300            mov [ebp-04], 0003
:004142AB E906000000              jmp 004142B6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041429F(C)
|
:004142B0 66C745FC0000            mov [ebp-04], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00414210(U), :0041426B(U), :004142AB(U)
|
:004142B6 668B45FC                mov ax, word ptr [ebp-04]
:004142BA E900000000              jmp 004142BF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004142BA(U)
|
:004142BF 5F                      pop edi
:004142C0 5E                      pop esi
:004142C1 5B                      pop ebx
:004142C2 C9                      leave
:004142C3 C3                      ret



* Referenced by a CALL at Addresses:
|:0041462B   , :004146E3   , :004153EF   
|
:004142C4 55                      push ebp
:004142C5 8BEC                    mov ebp, esp
:004142C7 83EC24                  sub esp, 00000024
:004142CA 53                      push ebx
:004142CB 56                      push esi
:004142CC 57                      push edi
:004142CD 8B4D08                  mov ecx, dword ptr [ebp+08]
:004142D0 E86B3D0000              call 00418040
:004142D5 668945F8                mov word ptr [ebp-08], ax
:004142D9 8B4D08                  mov ecx, dword ptr [ebp+08]
:004142DC E87F3D0000              call 00418060
:004142E1 668945F4                mov word ptr [ebp-0C], ax
:004142E5 E8C2FDFFFF              call 004140AC
:004142EA 668945E8                mov word ptr [ebp-18], ax
:004142EE 8B45E8                  mov eax, dword ptr [ebp-18]
:004142F1 25FFFF0000              and eax, 0000FFFF
:004142F6 3DFFFF0000              cmp eax, 0000FFFF
:004142FB 0F8509000000            jne 0041430A
:00414301 66B8FFFF                mov ax, FFFF
:00414305 E966010000              jmp 00414470

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004142FB(C)
|
:0041430A 8B45E8                  mov eax, dword ptr [ebp-18]
:0041430D 50                      push eax
:0041430E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00414311 E81A3E0000              call 00418130
:00414316 8B45E8                  mov eax, dword ptr [ebp-18]
:00414319 25FFFF0000              and eax, 0000FFFF
:0041431E C1E00A                  shl eax, 0A
:00414321 668945E0                mov word ptr [ebp-20], ax
:00414325 8B45E0                  mov eax, dword ptr [ebp-20]
:00414328 50                      push eax
:00414329 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041432C E82F3E0000              call 00418160
:00414331 6A04                    push 00000004
:00414333 6A00                    push 00000000
:00414335 8B45E0                  mov eax, dword ptr [ebp-20]
:00414338 25FFFF0000              and eax, 0000FFFF
:0041433D 50                      push eax
:0041433E B968F94600              mov ecx, 0046F968
:00414343 E8D8330300              call 00447720
:00414348 8945FC                  mov dword ptr [ebp-04], eax
:0041434B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041434E E89D3D0000              call 004180F0
:00414353 668945F0                mov word ptr [ebp-10], ax
:00414357 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041435A E8B13D0000              call 00418110
:0041435F 668945EC                mov word ptr [ebp-14], ax
:00414363 66A174F74500            mov ax, word ptr [0045F774]
:00414369 50                      push eax
:0041436A 66A170F74500            mov ax, word ptr [0045F770]
:00414370 50                      push eax
:00414371 8B45F4                  mov eax, dword ptr [ebp-0C]
:00414374 50                      push eax
:00414375 8B45F8                  mov eax, dword ptr [ebp-08]
:00414378 50                      push eax
:00414379 E8D8FDFFFF              call 00414156
:0041437E 83C410                  add esp, 00000010
:00414381 66A37C674600            mov word ptr [0046677C], ax
:00414387 66C745DC0000            mov [ebp-24], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414463(U)
|
:0041438D 8B45EC                  mov eax, dword ptr [ebp-14]
:00414390 50                      push eax
:00414391 8B45F0                  mov eax, dword ptr [ebp-10]
:00414394 50                      push eax
:00414395 8B45F4                  mov eax, dword ptr [ebp-0C]
:00414398 50                      push eax
:00414399 8B45F8                  mov eax, dword ptr [ebp-08]
:0041439C 50                      push eax
:0041439D E83FF8FFFF              call 00413BE1
:004143A2 83C410                  add esp, 00000010
:004143A5 668945E4                mov word ptr [ebp-1C], ax
:004143A9 8B45E4                  mov eax, dword ptr [ebp-1C]
:004143AC 25FFFF0000              and eax, 0000FFFF
:004143B1 3DFFFF0000              cmp eax, 0000FFFF
:004143B6 0F8572000000            jne 0041442E
:004143BC 8B450C                  mov eax, dword ptr [ebp+0C]
:004143BF 25FFFF0000              and eax, 0000FFFF
:004143C4 3DFFFF0000              cmp eax, 0000FFFF
:004143C9 0F8414000000            je 004143E3
:004143CF 33C0                    xor eax, eax
:004143D1 8A450C                  mov al, byte ptr [ebp+0C]
:004143D4 0C10                    or al, 10
:004143D6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004143D9 8801                    mov byte ptr [ecx], al
:004143DB FF45FC                  inc [ebp-04]
:004143DE E940000000              jmp 00414423

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004143C9(C)
|
:004143E3 F74510FFFF0000          test [ebp+10], 0000FFFF
:004143EA 0F8433000000            je 00414423
:004143F0 8B4510                  mov eax, dword ptr [ebp+10]
:004143F3 25FFFF0000              and eax, 0000FFFF
:004143F8 8B4DDC                  mov ecx, dword ptr [ebp-24]
:004143FB 81E1FFFF0000            and ecx, 0000FFFF
:00414401 3BC1                    cmp eax, ecx
:00414403 0F8E08000000            jle 00414411
:00414409 668B45DC                mov ax, word ptr [ebp-24]
:0041440D 66894510                mov word ptr [ebp+10], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414403(C)
|
:00414411 33C0                    xor eax, eax
:00414413 8B4D10                  mov ecx, dword ptr [ebp+10]
:00414416 81E1FFFF0000            and ecx, 0000FFFF
:0041441C 2BC1                    sub eax, ecx
:0041441E F7D8                    neg eax
:00414420 2945FC                  sub dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004143DE(U), :004143EA(C)
|
:00414423 8B45FC                  mov eax, dword ptr [ebp-04]
:00414426 C600EF                  mov byte ptr [eax], EF
:00414429 E93A000000              jmp 00414468

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004143B6(C)
|
:0041442E 668B45E4                mov ax, word ptr [ebp-1C]
:00414432 66A37C674600            mov word ptr [0046677C], ax
:00414438 8A45E4                  mov al, byte ptr [ebp-1C]
:0041443B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041443E 8801                    mov byte ptr [ecx], al
:00414440 FF45FC                  inc [ebp-04]
:00414443 8B45E4                  mov eax, dword ptr [ebp-1C]
:00414446 50                      push eax
:00414447 8B45EC                  mov eax, dword ptr [ebp-14]
:0041444A 50                      push eax
:0041444B 8B45F0                  mov eax, dword ptr [ebp-10]
:0041444E 50                      push eax
:0041444F 8D45F4                  lea eax, dword ptr [ebp-0C]
:00414452 50                      push eax
:00414453 8D45F8                  lea eax, dword ptr [ebp-08]
:00414456 50                      push eax
:00414457 E8C9F5FFFF              call 00413A25
:0041445C 83C414                  add esp, 00000014
:0041445F 66FF45DC                inc [ebp-24]
:00414463 E925FFFFFF              jmp 0041438D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414429(U)
|
:00414468 6633C0                  xor ax, ax
:0041446B E900000000              jmp 00414470

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00414305(U), :0041446B(U)
|
:00414470 5F                      pop edi
:00414471 5E                      pop esi
:00414472 5B                      pop ebx
:00414473 C9                      leave
:00414474 C3                      ret



* Referenced by a CALL at Addresses:
|:004144D2   , :00415ABB   
|
:00414475 55                      push ebp
:00414476 8BEC                    mov ebp, esp
:00414478 83EC04                  sub esp, 00000004
:0041447B 53                      push ebx
:0041447C 56                      push esi
:0041447D 57                      push edi
:0041447E 33C0                    xor eax, eax
:00414480 66A158F74500            mov ax, word ptr [0045F758]
:00414486 3DFFFF0000              cmp eax, 0000FFFF
:0041448B 0F8509000000            jne 0041449A
:00414491 66B8FFFF                mov ax, FFFF
:00414495 E92D000000              jmp 004144C7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041448B(C)
|
:0041449A E847D0FFFF              call 004114E6
:0041449F 8945FC                  mov dword ptr [ebp-04], eax
:004144A2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004144A5 E8B6360000              call 00417B60
:004144AA 0FB7C0                  movzx eax, ax
:004144AD F6C480                  test ah, 80
:004144B0 0F8509000000            jne 004144BF
:004144B6 66B8FFFF                mov ax, FFFF
:004144BA E908000000              jmp 004144C7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004144B0(C)
|
:004144BF 6633C0                  xor ax, ax
:004144C2 E900000000              jmp 004144C7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00414495(U), :004144BA(U), :004144C2(U)
|
:004144C7 5F                      pop edi
:004144C8 5E                      pop esi
:004144C9 5B                      pop ebx
:004144CA C9                      leave
:004144CB C3                      ret



* Referenced by a CALL at Addresses:
|:00414776   , :0041584E   , :00416812   
|
:004144CC 55                      push ebp
:004144CD 8BEC                    mov ebp, esp
:004144CF 53                      push ebx
:004144D0 56                      push esi
:004144D1 57                      push edi
:004144D2 E89EFFFFFF              call 00414475
:004144D7 0FB7C0                  movzx eax, ax
:004144DA 85C0                    test eax, eax
:004144DC 0F8529000000            jne 0041450B
:004144E2 E8FFCFFFFF              call 004114E6
:004144E7 8BC8                    mov ecx, eax
:004144E9 E8A23C0000              call 00418190
:004144EE 0FB7C0                  movzx eax, ax
:004144F1 83F804                  cmp eax, 00000004
:004144F4 0F8409000000            je 00414503
:004144FA 66B8FFFF                mov ax, FFFF
:004144FE E911000000              jmp 00414514

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004144F4(C)
|
:00414503 6633C0                  xor ax, ax
:00414506 E909000000              jmp 00414514

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004144DC(C)
|
:0041450B 66B8FFFF                mov ax, FFFF
:0041450F E900000000              jmp 00414514

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004144FE(U), :00414506(U), :0041450F(U)
|
:00414514 5F                      pop edi
:00414515 5E                      pop esi
:00414516 5B                      pop ebx
:00414517 C9                      leave
:00414518 C3                      ret



* Referenced by a CALL at Addresses:
|:0041483C   , :004174CA   
|
:00414519 55                      push ebp
:0041451A 8BEC                    mov ebp, esp
:0041451C 83EC1C                  sub esp, 0000001C
:0041451F 53                      push ebx
:00414520 56                      push esi
:00414521 57                      push edi
:00414522 E8BFCFFFFF              call 004114E6
:00414527 8945F0                  mov dword ptr [ebp-10], eax
:0041452A 8B4508                  mov eax, dword ptr [ebp+08]
:0041452D 25FFFF0000              and eax, 0000FFFF
:00414532 8BC8                    mov ecx, eax
:00414534 C1E003                  shl eax, 03
:00414537 2BC1                    sub eax, ecx
:00414539 8D044508A64600          lea eax, dword ptr [2*eax+0046A608]
:00414540 8945F8                  mov dword ptr [ebp-08], eax
:00414543 8B4508                  mov eax, dword ptr [ebp+08]
:00414546 25FFFF0000              and eax, 0000FFFF
:0041454B 83F804                  cmp eax, 00000004
:0041454E 0F8C19000000            jl 0041456D
:00414554 8B4508                  mov eax, dword ptr [ebp+08]
:00414557 25FFFF0000              and eax, 0000FFFF
:0041455C 83E802                  sub eax, 00000002
:0041455F 66894508                mov word ptr [ebp+08], ax
:00414563 8B4508                  mov eax, dword ptr [ebp+08]
:00414566 83E003                  and eax, 00000003
:00414569 66894508                mov word ptr [ebp+08], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041454E(C)
|
:0041456D 8B4508                  mov eax, dword ptr [ebp+08]
:00414570 25FFFF0000              and eax, 0000FFFF
:00414575 03C0                    add eax, eax
:00414577 66894508                mov word ptr [ebp+08], ax
:0041457B 8B4508                  mov eax, dword ptr [ebp+08]
:0041457E 25FFFF0000              and eax, 0000FFFF
:00414583 668B044520F64400        mov ax, word ptr [2*eax+0044F620]
:0041458B 668945FC                mov word ptr [ebp-04], ax
:0041458F 8B4508                  mov eax, dword ptr [ebp+08]
:00414592 25FFFF0000              and eax, 0000FFFF
:00414597 668B044522F64400        mov ax, word ptr [2*eax+0044F622]
:0041459F 668945F4                mov word ptr [ebp-0C], ax
:004145A3 66C745E80800            mov [ebp-18], 0008
:004145A9 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004145AC E8FF3B0000              call 004181B0
:004145B1 0FBFC0                  movsx eax, ax
:004145B4 0FBF4DE8                movsx ecx, word ptr [ebp-18]
:004145B8 0FBF55FC                movsx edx, word ptr [ebp-04]
:004145BC 0FAFCA                  imul ecx, edx
:004145BF 03C1                    add eax, ecx
:004145C1 668945EC                mov word ptr [ebp-14], ax
:004145C5 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004145C8 E8033C0000              call 004181D0
:004145CD 0FBFC0                  movsx eax, ax
:004145D0 0FBF4DE8                movsx ecx, word ptr [ebp-18]
:004145D4 0FBF55F4                movsx edx, word ptr [ebp-0C]
:004145D8 0FAFCA                  imul ecx, edx
:004145DB 03C1                    add eax, ecx
:004145DD 668945E4                mov word ptr [ebp-1C], ax
:004145E1 6A01                    push 00000001
:004145E3 8B45E4                  mov eax, dword ptr [ebp-1C]
:004145E6 50                      push eax
:004145E7 8B45EC                  mov eax, dword ptr [ebp-14]
:004145EA 50                      push eax
:004145EB 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004145EE E81D3B0000              call 00418110
:004145F3 50                      push eax
:004145F4 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004145F7 E8F43A0000              call 004180F0
:004145FC 50                      push eax
:004145FD 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00414600 E85B3A0000              call 00418060
:00414605 50                      push eax
:00414606 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00414609 E8323A0000              call 00418040
:0041460E 50                      push eax
:0041460F E863F7FFFF              call 00413D77
:00414614 83C41C                  add esp, 0000001C
:00414617 83F801                  cmp eax, 00000001
:0041461A 0F852F000000            jne 0041464F
:00414620 6A00                    push 00000000
:00414622 68FFFF0000              push 0000FFFF
:00414627 8B45F0                  mov eax, dword ptr [ebp-10]
:0041462A 50                      push eax
:0041462B E894FCFFFF              call 004142C4
:00414630 83C40C                  add esp, 0000000C
:00414633 0FB7C0                  movzx eax, ax
:00414636 3DFFFF0000              cmp eax, 0000FFFF
:0041463B 0F8509000000            jne 0041464A
:00414641 66B8FFFF                mov ax, FFFF
:00414645 E920000000              jmp 0041466A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041463B(C)
|
:0041464A E909000000              jmp 00414658

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041461A(C)
|
:0041464F 66B8FFFF                mov ax, FFFF
:00414653 E912000000              jmp 0041466A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041464A(U)
|
:00414658 6A01                    push 00000001
:0041465A 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0041465D E88E3B0000              call 004181F0
:00414662 6633C0                  xor ax, ax
:00414665 E900000000              jmp 0041466A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00414645(U), :00414653(U), :00414665(U)
|
:0041466A 5F                      pop edi
:0041466B 5E                      pop esi
:0041466C 5B                      pop ebx
:0041466D C9                      leave
:0041466E C3                      ret



* Referenced by a CALL at Address:
|:00414877   
|
:0041466F 55                      push ebp
:00414670 8BEC                    mov ebp, esp
:00414672 83EC08                  sub esp, 00000008
:00414675 53                      push ebx
:00414676 56                      push esi
:00414677 57                      push edi
:00414678 8B4508                  mov eax, dword ptr [ebp+08]
:0041467B 50                      push eax
:0041467C E83ECEFFFF              call 004114BF
:00414681 83C404                  add esp, 00000004
:00414684 8945FC                  mov dword ptr [ebp-04], eax
:00414687 E85ACEFFFF              call 004114E6
:0041468C 8945F8                  mov dword ptr [ebp-08], eax
:0041468F 6A01                    push 00000001
:00414691 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00414694 E8C7390000              call 00418060
:00414699 50                      push eax
:0041469A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041469D E89E390000              call 00418040
:004146A2 50                      push eax
:004146A3 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004146A6 E8653A0000              call 00418110
:004146AB 50                      push eax
:004146AC 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004146AF E83C3A0000              call 004180F0
:004146B4 50                      push eax
:004146B5 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004146B8 E8A3390000              call 00418060
:004146BD 50                      push eax
:004146BE 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004146C1 E87A390000              call 00418040
:004146C6 50                      push eax
:004146C7 E8ABF6FFFF              call 00413D77
:004146CC 83C41C                  add esp, 0000001C
:004146CF 83F801                  cmp eax, 00000001
:004146D2 0F852F000000            jne 00414707
:004146D8 6A02                    push 00000002
:004146DA 68FFFF0000              push 0000FFFF
:004146DF 8B45F8                  mov eax, dword ptr [ebp-08]
:004146E2 50                      push eax
:004146E3 E8DCFBFFFF              call 004142C4
:004146E8 83C40C                  add esp, 0000000C
:004146EB 0FB7C0                  movzx eax, ax
:004146EE 3DFFFF0000              cmp eax, 0000FFFF
:004146F3 0F8509000000            jne 00414702
:004146F9 66B8FFFF                mov ax, FFFF
:004146FD E94D000000              jmp 0041474F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004146F3(C)
|
:00414702 E909000000              jmp 00414710

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004146D2(C)
|
:00414707 66B8FFFF                mov ax, FFFF
:0041470B E93F000000              jmp 0041474F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414702(U)
|
:00414710 6A04                    push 00000004
:00414712 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00414715 E8D63A0000              call 004181F0
:0041471A 6800200000              push 00002000
:0041471F 6800200000              push 00002000
:00414724 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00414727 E824350000              call 00417C50
:0041472C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041472F E81C3B0000              call 00418250
:00414734 50                      push eax
:00414735 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00414738 E8E33A0000              call 00418220
:0041473D 6A00                    push 00000000
:0041473F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00414742 E8A93A0000              call 004181F0
:00414747 6633C0                  xor ax, ax
:0041474A E900000000              jmp 0041474F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004146FD(U), :0041470B(U), :0041474A(U)
|
:0041474F 5F                      pop edi
:00414750 5E                      pop esi
:00414751 5B                      pop ebx
:00414752 C9                      leave
:00414753 C3                      ret



* Referenced by a CALL at Address:
|:00415B20   
|
:00414754 55                      push ebp
:00414755 8BEC                    mov ebp, esp
:00414757 83EC10                  sub esp, 00000010
:0041475A 53                      push ebx
:0041475B 56                      push esi
:0041475C 57                      push edi
:0041475D 66C745F40000            mov [ebp-0C], 0000
:00414763 66C745F80000            mov [ebp-08], 0000
:00414769 833D8053450001          cmp dword ptr [00455380], 00000001
:00414770 0F852C010000            jne 004148A2
:00414776 E851FDFFFF              call 004144CC
:0041477B 0FB7C0                  movzx eax, ax
:0041477E 85C0                    test eax, eax
:00414780 0F8517010000            jne 0041489D
:00414786 33C0                    xor eax, eax
:00414788 66A178A64600            mov ax, word ptr [0046A678]
:0041478E 25FF3FFFFF              and eax, FFFF3FFF
:00414793 668945F8                mov word ptr [ebp-08], ax
:00414797 33C0                    xor eax, eax
:00414799 66A178A64600            mov ax, word ptr [0046A678]
:0041479F 3DFFFF0000              cmp eax, 0000FFFF
:004147A4 0F8431000000            je 004147DB
:004147AA 6A00                    push 00000000
:004147AC B994A64600              mov ecx, 0046A694
:004147B1 E86E480000              call 00419024
:004147B6 33C0                    xor eax, eax
:004147B8 66A178A64600            mov ax, word ptr [0046A678]
:004147BE F6C440                  test ah, 40
:004147C1 0F8414000000            je 004147DB
:004147C7 8B45F8                  mov eax, dword ptr [ebp-08]
:004147CA 25FFFF0000              and eax, 0000FFFF
:004147CF 8B0485A82D4500          mov eax, dword ptr [4*eax+00452DA8]
:004147D6 A364F94600              mov dword ptr [0046F964], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004147A4(C), :004147C1(C)
|
:004147DB E8FAF1FFFF              call 004139DA
:004147E0 668945F4                mov word ptr [ebp-0C], ax
:004147E4 C70564F94600FFFFFFFF    mov dword ptr [0046F964], FFFFFFFF
:004147EE 8B45F4                  mov eax, dword ptr [ebp-0C]
:004147F1 25FFFF0000              and eax, 0000FFFF
:004147F6 83F801                  cmp eax, 00000001
:004147F9 0F8509000000            jne 00414808
:004147FF 66B80100                mov ax, 0001
:00414803 E902010000              jmp 0041490A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004147F9(C)
|
:00414808 33C0                    xor eax, eax
:0041480A 66A178A64600            mov ax, word ptr [0046A678]
:00414810 3DFFFF0000              cmp eax, 0000FFFF
:00414815 0F8482000000            je 0041489D
:0041481B 33C0                    xor eax, eax
:0041481D 66A178A64600            mov ax, word ptr [0046A678]
:00414823 F6C480                  test ah, 80
:00414826 0F843B000000            je 00414867
:0041482C 6A00                    push 00000000
:0041482E B994A64600              mov ecx, 0046A694
:00414833 E8EC470000              call 00419024
:00414838 8B45F8                  mov eax, dword ptr [ebp-08]
:0041483B 50                      push eax
:0041483C E8D8FCFFFF              call 00414519
:00414841 83C404                  add esp, 00000004
:00414844 0FB7C0                  movzx eax, ax
:00414847 85C0                    test eax, eax
:00414849 0F8513000000            jne 00414862
:0041484F 6A00                    push 00000000
:00414851 E8D2CCFFFF              call 00411528
:00414856 83C404                  add esp, 00000004
:00414859 66B80200                mov ax, 0002
:0041485D E9A8000000              jmp 0041490A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414849(C)
|
:00414862 E936000000              jmp 0041489D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414826(C)
|
:00414867 6A00                    push 00000000
:00414869 B994A64600              mov ecx, 0046A694
:0041486E E8B1470000              call 00419024
:00414873 8B45F8                  mov eax, dword ptr [ebp-08]
:00414876 50                      push eax
:00414877 E8F3FDFFFF              call 0041466F
:0041487C 83C404                  add esp, 00000004
:0041487F 0FB7C0                  movzx eax, ax
:00414882 85C0                    test eax, eax
:00414884 0F8513000000            jne 0041489D
:0041488A 6A00                    push 00000000
:0041488C E897CCFFFF              call 00411528
:00414891 83C404                  add esp, 00000004
:00414894 66B80200                mov ax, 0002
:00414898 E96D000000              jmp 0041490A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00414780(C), :00414815(C), :00414862(U), :00414884(C)
|
:0041489D E960000000              jmp 00414902

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414770(C)
|
:004148A2 833D8053450002          cmp dword ptr [00455380], 00000002
:004148A9 0F8553000000            jne 00414902
:004148AF E832CCFFFF              call 004114E6
:004148B4 8945FC                  mov dword ptr [ebp-04], eax
:004148B7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004148BA E8D1380000              call 00418190
:004148BF 0FB7C0                  movzx eax, ax
:004148C2 8945F0                  mov dword ptr [ebp-10], eax
:004148C5 E91F000000              jmp 004148E9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004148F7(C)
|
:004148CA 8B45FC                  mov eax, dword ptr [ebp-04]
:004148CD 50                      push eax
:004148CE E805100000              call 004158D8
:004148D3 83C404                  add esp, 00000004
:004148D6 E810F0FFFF              call 004138EB
:004148DB 66B80100                mov ax, 0001
:004148DF E926000000              jmp 0041490A
:004148E4 E919000000              jmp 00414902

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004148C5(U)
|
:004148E9 837DF000                cmp dword ptr [ebp-10], 00000000
:004148ED 0F8C0F000000            jl 00414902
:004148F3 837DF001                cmp dword ptr [ebp-10], 00000001
:004148F7 0F8ECDFFFFFF            jle 004148CA
:004148FD E900000000              jmp 00414902

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041489D(U), :004148A9(C), :004148E4(U), :004148ED(C), :004148FD(U)
|
:00414902 6633C0                  xor ax, ax
:00414905 E900000000              jmp 0041490A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00414803(U), :0041485D(U), :00414898(U), :004148DF(U), :00414905(U)
|
:0041490A 5F                      pop edi
:0041490B 5E                      pop esi
:0041490C 5B                      pop ebx
:0041490D C9                      leave
:0041490E C3                      ret



* Referenced by a CALL at Address:
|:0041784F   
|
:0041490F 55                      push ebp
:00414910 8BEC                    mov ebp, esp
:00414912 53                      push ebx
:00414913 56                      push esi
:00414914 57                      push edi
:00414915 66C705501946000000      mov word ptr [00461950], 0000
:0041491E C7056852450000000000    mov dword ptr [00455268], 00000000
:00414928 C7058053450000000000    mov dword ptr [00455380], 00000000
:00414932 66C705C01846000000      mov word ptr [004618C0], 0000
:0041493B E900000000              jmp 00414940

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041493B(U)
|
:00414940 5F                      pop edi
:00414941 5E                      pop esi
:00414942 5B                      pop ebx
:00414943 C9                      leave
:00414944 C3                      ret



* Referenced by a CALL at Address:
|:00417840   
|
:00414945 55                      push ebp
:00414946 8BEC                    mov ebp, esp
:00414948 83EC04                  sub esp, 00000004
:0041494B 53                      push ebx
:0041494C 56                      push esi
:0041494D 57                      push edi
:0041494E 6A00                    push 00000000
:00414950 68401F0000              push 00001F40
:00414955 6878F74500              push 0045F778
:0041495A E87ACAFFFF              call 004113D9
:0041495F 83C40C                  add esp, 0000000C
:00414962 66C70568F745000000      mov word ptr [0045F768], 0000
:0041496B 66C7056CF745000000      mov word ptr [0045F76C], 0000
:00414974 66C70580A646005000      mov word ptr [0046A680], 0050
:0041497D 66C70584A646003200      mov word ptr [0046A684], 0032
:00414986 66A184A64600            mov ax, word ptr [0046A684]
:0041498C 50                      push eax
:0041498D 66A180A64600            mov ax, word ptr [0046A680]
:00414993 50                      push eax
:00414994 6A28                    push 00000028
:00414996 6A00                    push 00000000
:00414998 E8B2E9FFFF              call 0041334F
:0041499D 83C410                  add esp, 00000010
:004149A0 6A04                    push 00000004
:004149A2 6A00                    push 00000000

* Possible Ref to Menu: APPMENU, Item: "640x480"
                                  |
:004149A4 68509C0000              push 00009C50
:004149A9 B950F94600              mov ecx, 0046F950
:004149AE E86D2D0300              call 00447720
:004149B3 8945FC                  mov dword ptr [ebp-04], eax
:004149B6 6A00                    push 00000000
:004149B8 68204E0000              push 00004E20
:004149BD 8B45FC                  mov eax, dword ptr [ebp-04]
:004149C0 50                      push eax
:004149C1 E851CAFFFF              call 00411417
:004149C6 83C40C                  add esp, 0000000C
:004149C9 8B45FC                  mov eax, dword ptr [ebp-04]
:004149CC 50                      push eax
:004149CD 6A64                    push 00000064
:004149CF 68C8000000              push 000000C8
:004149D4 B864000000              mov eax, 00000064
:004149D9 33C9                    xor ecx, ecx
:004149DB 668B0D84A64600          mov cx, word ptr [0046A684]
:004149E2 2BC1                    sub eax, ecx
:004149E4 99                      cdq
:004149E5 2BC2                    sub eax, edx
:004149E7 C1F801                  sar eax, 01
:004149EA 50                      push eax
:004149EB B8C8000000              mov eax, 000000C8
:004149F0 33C9                    xor ecx, ecx
:004149F2 668B0D80A64600          mov cx, word ptr [0046A680]
:004149F9 2BC1                    sub eax, ecx
:004149FB 99                      cdq
:004149FC 2BC2                    sub eax, edx
:004149FE C1F801                  sar eax, 01
:00414A01 50                      push eax
:00414A02 6A00                    push 00000000
:00414A04 E8D3EDFFFF              call 004137DC
:00414A09 83C418                  add esp, 00000018
:00414A0C E8DEEBFFFF              call 004135EF
:00414A11 6A04                    push 00000004
:00414A13 6A00                    push 00000000
:00414A15 6A00                    push 00000000
:00414A17 B9E8E44600              mov ecx, 0046E4E8
:00414A1C E8FF2C0300              call 00447720
:00414A21 8945FC                  mov dword ptr [ebp-04], eax
:00414A24 8B45FC                  mov eax, dword ptr [ebp-04]
:00414A27 50                      push eax
:00414A28 E819EAFFFF              call 00413446
:00414A2D 83C404                  add esp, 00000004
:00414A30 E900000000              jmp 00414A35

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414A30(U)
|
:00414A35 5F                      pop edi
:00414A36 5E                      pop esi
:00414A37 5B                      pop ebx
:00414A38 C9                      leave
:00414A39 C3                      ret



* Referenced by a CALL at Address:
|:00417836   
|
:00414A3A 55                      push ebp
:00414A3B 8BEC                    mov ebp, esp
:00414A3D 53                      push ebx
:00414A3E 56                      push esi
:00414A3F 57                      push edi
:00414A40 6A00                    push 00000000
:00414A42 6800020000              push 00000200
:00414A47 68C0164600              push 004616C0
:00414A4C E888C9FFFF              call 004113D9
:00414A51 83C40C                  add esp, 0000000C
:00414A54 E829DCFFFF              call 00412682
:00414A59 66C70558F74500FFFF      mov word ptr [0045F758], FFFF
:00414A62 E900000000              jmp 00414A67

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414A62(U)
|
:00414A67 5F                      pop edi
:00414A68 5E                      pop esi
:00414A69 5B                      pop ebx
:00414A6A C9                      leave
:00414A6B C3                      ret



* Referenced by a CALL at Address:
|:0041784A   
|
:00414A6C 55                      push ebp
:00414A6D 8BEC                    mov ebp, esp
:00414A6F 81EC0C010000            sub esp, 0000010C
:00414A75 53                      push ebx
:00414A76 56                      push esi
:00414A77 57                      push edi
:00414A78 8D8DF4FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF4]
:00414A7E E8ED4BFFFF              call 00409670
:00414A83 B900AA4600              mov ecx, 0046AA00
:00414A88 E8F3B2FFFF              call 0040FD80
:00414A8D 660FB6C0                movzx ax, al
:00414A91 668945F8                mov word ptr [ebp-08], ax
:00414A95 B900AA4600              mov ecx, 0046AA00
:00414A9A E891CEFEFF              call 00401930
:00414A9F 660FB6C0                movzx ax, al
:00414AA3 668945FC                mov word ptr [ebp-04], ax
:00414AA7 8B45FC                  mov eax, dword ptr [ebp-04]
:00414AAA 25FFFF0000              and eax, 0000FFFF
:00414AAF 83F81A                  cmp eax, 0000001A
:00414AB2 0F8E06000000            jle 00414ABE
:00414AB8 66C745FC1A00            mov [ebp-04], 001A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414AB2(C)
|
:00414ABE 8B45FC                  mov eax, dword ptr [ebp-04]
:00414AC1 25FFFF0000              and eax, 0000FFFF
:00414AC6 8BC8                    mov ecx, eax
:00414AC8 8D0480                  lea eax, dword ptr [eax+4*eax]
:00414ACB 8D0480                  lea eax, dword ptr [eax+4*eax]
:00414ACE 03C1                    add eax, ecx
:00414AD0 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00414AD3 81E1FFFF0000            and ecx, 0000FFFF
:00414AD9 660FB68408F8144500      movzx ax, byte ptr [eax+ecx+004514F8]
:00414AE2 668945F8                mov word ptr [ebp-08], ax
:00414AE6 8B45F8                  mov eax, dword ptr [ebp-08]
:00414AE9 25FFFF0000              and eax, 0000FFFF
:00414AEE 3DFF000000              cmp eax, 000000FF
:00414AF3 0F850B000000            jne 00414B04
:00414AF9 66C745F80000            mov [ebp-08], 0000
:00414AFF E90F000000              jmp 00414B13

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414AF3(C)
|
:00414B04 8B45F8                  mov eax, dword ptr [ebp-08]
:00414B07 25FFFF0000              and eax, 0000FFFF
:00414B0C 83E81D                  sub eax, 0000001D
:00414B0F 668945F8                mov word ptr [ebp-08], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414AFF(U)
|

* Possible StringData Ref from Data Obj ->"A:PMAP.E2"
                                  |
:00414B13 6830144500              push 00451430
:00414B18 8D8DF4FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF4]
:00414B1E E8EC290100              call 0042750F
:00414B23 B950F94600              mov ecx, 0046F950
:00414B28 E8B345FFFF              call 004090E0
:00414B2D 50                      push eax
:00414B2E 8B45F8                  mov eax, dword ptr [ebp-08]
:00414B31 25FFFF0000              and eax, 0000FFFF
:00414B36 50                      push eax
:00414B37 8D8DF4FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF4]
:00414B3D E83F2B0100              call 00427681
:00414B42 8D8DF4FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF4]
:00414B48 E8D348FFFF              call 00409420
:00414B4D 6A00                    push 00000000
:00414B4F E8EED0FFFF              call 00411C42
:00414B54 83C404                  add esp, 00000004
:00414B57 50                      push eax
:00414B58 E84FD3FFFF              call 00411EAC
:00414B5D 83C404                  add esp, 00000004
:00414B60 E88DDAFFFF              call 004125F2
:00414B65 E900000000              jmp 00414B6A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414B65(U)
|
:00414B6A 5F                      pop edi
:00414B6B 5E                      pop esi
:00414B6C 5B                      pop ebx
:00414B6D C9                      leave
:00414B6E C3                      ret



* Referenced by a CALL at Addresses:
|:00414C62   , :00414D06   , :004150D1   , :004152CA   , :00415350   
|:00415BC4   , :0041608E   , :00416A28   
|
:00414B6F 55                      push ebp
:00414B70 8BEC                    mov ebp, esp
:00414B72 83EC08                  sub esp, 00000008
:00414B75 53                      push ebx
:00414B76 56                      push esi
:00414B77 57                      push edi
:00414B78 C745F8D8D54500          mov [ebp-08], 0045D5D8
:00414B7F 66C745FC0000            mov [ebp-04], 0000
:00414B85 E908000000              jmp 00414B92

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414BDA(U)
|
:00414B8A 66FF45FC                inc [ebp-04]
:00414B8E 8345F83E                add dword ptr [ebp-08], 0000003E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414B85(U)
|
:00414B92 8B45FC                  mov eax, dword ptr [ebp-04]
:00414B95 25FFFF0000              and eax, 0000FFFF
:00414B9A 3D80000000              cmp eax, 00000080
:00414B9F 0F8D3A000000            jnl 00414BDF
:00414BA5 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00414BA8 E8B32F0000              call 00417B60
:00414BAD 0FB7C0                  movzx eax, ax
:00414BB0 F6C480                  test ah, 80
:00414BB3 0F8421000000            je 00414BDA
:00414BB9 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00414BBC E88F360000              call 00418250
:00414BC1 0FB7C0                  movzx eax, ax
:00414BC4 8B4D08                  mov ecx, dword ptr [ebp+08]
:00414BC7 81E1FFFF0000            and ecx, 0000FFFF
:00414BCD 3BC1                    cmp eax, ecx
:00414BCF 0F8505000000            jne 00414BDA
:00414BD5 E905000000              jmp 00414BDF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00414BB3(C), :00414BCF(C)
|
:00414BDA E9ABFFFFFF              jmp 00414B8A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00414B9F(C), :00414BD5(U)
|
:00414BDF 8B45FC                  mov eax, dword ptr [ebp-04]
:00414BE2 25FFFF0000              and eax, 0000FFFF
:00414BE7 3D80000000              cmp eax, 00000080
:00414BEC 0F8506000000            jne 00414BF8
:00414BF2 66C745FCFFFF            mov [ebp-04], FFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414BEC(C)
|
:00414BF8 668B45FC                mov ax, word ptr [ebp-04]
:00414BFC E900000000              jmp 00414C01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414BFC(U)
|
:00414C01 5F                      pop edi
:00414C02 5E                      pop esi
:00414C03 5B                      pop ebx
:00414C04 C9                      leave
:00414C05 C3                      ret



* Referenced by a CALL at Addresses:
|:00414DA6   , :004317C2   , :00433B3A   , :00436EC7   
|
:00414C06 55                      push ebp
:00414C07 8BEC                    mov ebp, esp
:00414C09 53                      push ebx
:00414C0A 56                      push esi
:00414C0B 57                      push edi
:00414C0C E8DAECFFFF              call 004138EB
:00414C11 33C0                    xor eax, eax
:00414C13 E900000000              jmp 00414C18

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414C13(U)
|
:00414C18 5F                      pop edi
:00414C19 5E                      pop esi
:00414C1A 5B                      pop ebx
:00414C1B C9                      leave
:00414C1C C3                      ret



* Referenced by a CALL at Address:
|:004320D3   
|
:00414C1D 55                      push ebp
:00414C1E 8BEC                    mov ebp, esp
:00414C20 53                      push ebx
:00414C21 56                      push esi
:00414C22 57                      push edi
:00414C23 E86F230100              call 00426F97
:00414C28 E862ECFFFF              call 0041388F
:00414C2D E885230100              call 00426FB7
:00414C32 E846230100              call 00426F7D
:00414C37 33C0                    xor eax, eax
:00414C39 E900000000              jmp 00414C3E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414C39(U)
|
:00414C3E 5F                      pop edi
:00414C3F 5E                      pop esi
:00414C40 5B                      pop ebx
:00414C41 C9                      leave
:00414C42 C3                      ret


:00414C43 55                      push ebp
:00414C44 8BEC                    mov ebp, esp
:00414C46 53                      push ebx
:00414C47 56                      push esi
:00414C48 57                      push edi
:00414C49 33C0                    xor eax, eax
:00414C4B E900000000              jmp 00414C50

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414C4B(U)
|
:00414C50 5F                      pop edi
:00414C51 5E                      pop esi
:00414C52 5B                      pop ebx
:00414C53 C9                      leave
:00414C54 C3                      ret



* Referenced by a CALL at Address:
|:00432926   
|
:00414C55 55                      push ebp
:00414C56 8BEC                    mov ebp, esp
:00414C58 83EC08                  sub esp, 00000008
:00414C5B 53                      push ebx
:00414C5C 56                      push esi
:00414C5D 57                      push edi
:00414C5E 8B4508                  mov eax, dword ptr [ebp+08]
:00414C61 50                      push eax
:00414C62 E808FFFFFF              call 00414B6F
:00414C67 83C404                  add esp, 00000004
:00414C6A 668945F8                mov word ptr [ebp-08], ax
:00414C6E 8B45F8                  mov eax, dword ptr [ebp-08]
:00414C71 25FFFF0000              and eax, 0000FFFF
:00414C76 3D80000000              cmp eax, 00000080
:00414C7B 0F8C0A000000            jl 00414C8B
:00414C81 B8FFFF0000              mov eax, 0000FFFF
:00414C86 E93A000000              jmp 00414CC5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414C7B(C)
|
:00414C8B 8B45F8                  mov eax, dword ptr [ebp-08]
:00414C8E 50                      push eax
:00414C8F E82BC8FFFF              call 004114BF
:00414C94 83C404                  add esp, 00000004
:00414C97 8945FC                  mov dword ptr [ebp-04], eax
:00414C9A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00414C9D E82E2F0000              call 00417BD0
:00414CA2 8B4508                  mov eax, dword ptr [ebp+08]
:00414CA5 25FFFF0000              and eax, 0000FFFF
:00414CAA 3D00020000              cmp eax, 00000200
:00414CAF 0F8509000000            jne 00414CBE
:00414CB5 66C70558F74500FFFF      mov word ptr [0045F758], FFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414CAF(C)
|
:00414CBE 33C0                    xor eax, eax
:00414CC0 E900000000              jmp 00414CC5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00414C86(U), :00414CC0(U)
|
:00414CC5 5F                      pop edi
:00414CC6 5E                      pop esi
:00414CC7 5B                      pop ebx
:00414CC8 C9                      leave
:00414CC9 C3                      ret



* Referenced by a CALL at Address:
|:00414D7B   
|
:00414CCA 55                      push ebp
:00414CCB 8BEC                    mov ebp, esp
:00414CCD 53                      push ebx
:00414CCE 56                      push esi
:00414CCF 57                      push edi
:00414CD0 8B4D08                  mov ecx, dword ptr [ebp+08]
:00414CD3 E8D8310000              call 00417EB0
:00414CD8 A900000080              test eax, 80000000
:00414CDD 0F8509000000            jne 00414CEC
:00414CE3 66B8FFFF                mov ax, FFFF
:00414CE7 E908000000              jmp 00414CF4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414CDD(C)
|
:00414CEC 6633C0                  xor ax, ax
:00414CEF E900000000              jmp 00414CF4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00414CE7(U), :00414CEF(U)
|
:00414CF4 5F                      pop edi
:00414CF5 5E                      pop esi
:00414CF6 5B                      pop ebx
:00414CF7 C9                      leave
:00414CF8 C3                      ret



* Referenced by a CALL at Addresses:
|:00414D99   , :00431D32   , :00431D92   
|
:00414CF9 55                      push ebp
:00414CFA 8BEC                    mov ebp, esp
:00414CFC 83EC08                  sub esp, 00000008
:00414CFF 53                      push ebx
:00414D00 56                      push esi
:00414D01 57                      push edi
:00414D02 8B4508                  mov eax, dword ptr [ebp+08]
:00414D05 50                      push eax
:00414D06 E864FEFFFF              call 00414B6F
:00414D0B 83C404                  add esp, 00000004
:00414D0E 668945FC                mov word ptr [ebp-04], ax
:00414D12 8B45FC                  mov eax, dword ptr [ebp-04]
:00414D15 25FFFF0000              and eax, 0000FFFF
:00414D1A 3D80000000              cmp eax, 00000080
:00414D1F 0F8D8D000000            jnl 00414DB2
:00414D25 8B45FC                  mov eax, dword ptr [ebp-04]
:00414D28 50                      push eax
:00414D29 E891C7FFFF              call 004114BF
:00414D2E 83C404                  add esp, 00000004
:00414D31 8945F8                  mov dword ptr [ebp-08], eax
:00414D34 8B450C                  mov eax, dword ptr [ebp+0C]
:00414D37 50                      push eax
:00414D38 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00414D3B E860350000              call 004182A0
:00414D40 6A00                    push 00000000
:00414D42 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00414D45 E826350000              call 00418270
:00414D4A 8B450C                  mov eax, dword ptr [ebp+0C]
:00414D4D 50                      push eax
:00414D4E 6A00                    push 00000000
:00414D50 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00414D53 E827230000              call 0041707F
:00414D58 8B4510                  mov eax, dword ptr [ebp+10]
:00414D5B 25FFFF0000              and eax, 0000FFFF
:00414D60 3DFFFF0000              cmp eax, 0000FFFF
:00414D65 0F840C000000            je 00414D77
:00414D6B 8B4510                  mov eax, dword ptr [ebp+10]
:00414D6E 50                      push eax
:00414D6F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00414D72 E809310000              call 00417E80

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414D65(C)
|
:00414D77 8B45F8                  mov eax, dword ptr [ebp-08]
:00414D7A 50                      push eax
:00414D7B E84AFFFFFF              call 00414CCA
:00414D80 83C404                  add esp, 00000004
:00414D83 0FB7C0                  movzx eax, ax
:00414D86 3DFFFF0000              cmp eax, 0000FFFF
:00414D8B 0F8515000000            jne 00414DA6
:00414D91 6A00                    push 00000000
:00414D93 6A00                    push 00000000
:00414D95 8B4508                  mov eax, dword ptr [ebp+08]
:00414D98 50                      push eax
:00414D99 E85BFFFFFF              call 00414CF9
:00414D9E 83C40C                  add esp, 0000000C
:00414DA1 E905000000              jmp 00414DAB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414D8B(C)
|
:00414DA6 E85BFEFFFF              call 00414C06

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414DA1(U)
|
:00414DAB 33C0                    xor eax, eax
:00414DAD E90A000000              jmp 00414DBC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414D1F(C)
|
:00414DB2 B8FFFFFFFF              mov eax, FFFFFFFF
:00414DB7 E900000000              jmp 00414DBC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00414DAD(U), :00414DB7(U)
|
:00414DBC 5F                      pop edi
:00414DBD 5E                      pop esi
:00414DBE 5B                      pop ebx
:00414DBF C9                      leave
:00414DC0 C3                      ret



* Referenced by a CALL at Addresses:
|:00412339   , :004151F0   
|
:00414DC1 55                      push ebp
:00414DC2 8BEC                    mov ebp, esp
:00414DC4 83EC18                  sub esp, 00000018
:00414DC7 53                      push ebx
:00414DC8 56                      push esi
:00414DC9 57                      push edi
:00414DCA 8B4508                  mov eax, dword ptr [ebp+08]
:00414DCD 50                      push eax
:00414DCE E8E1C2FFFF              call 004110B4
:00414DD3 83C404                  add esp, 00000004
:00414DD6 8945F8                  mov dword ptr [ebp-08], eax
:00414DD9 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00414DDC E88FCDFEFF              call 00401B70
:00414DE1 668945F0                mov word ptr [ebp-10], ax
:00414DE5 66C745FC0000            mov [ebp-04], 0000
:00414DEB 66C745F40400            mov [ebp-0C], 0004
:00414DF1 66C745EC0100            mov [ebp-14], 0001
:00414DF7 8B45F0                  mov eax, dword ptr [ebp-10]
:00414DFA 25FFFF0000              and eax, 0000FFFF
:00414DFF 8945E8                  mov dword ptr [ebp-18], eax
:00414E02 E977000000              jmp 00414E7E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414E92(C)
|
:00414E07 66C745F40500            mov [ebp-0C], 0005
:00414E0D 6A03                    push 00000003
:00414E0F E814250300              call 00447328
:00414E14 83C404                  add esp, 00000004
:00414E17 0FB7C0                  movzx eax, ax
:00414E1A 40                      inc eax
:00414E1B 668945FC                mov word ptr [ebp-04], ax
:00414E1F E986010000              jmp 00414FAA
:00414E24 E906000000              jmp 00414E2F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414E85(C)
|
:00414E29 66C745FC0000            mov [ebp-04], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00414E24(U), :00414FAA(U)
|
:00414E2F 8B4508                  mov eax, dword ptr [ebp+08]
:00414E32 25FFFF0000              and eax, 0000FFFF
:00414E37 3D00020000              cmp eax, 00000200
:00414E3C 0F8517000000            jne 00414E59
:00414E42 8B452C                  mov eax, dword ptr [ebp+2C]
:00414E45 50                      push eax
:00414E46 E819C2FFFF              call 00411064
:00414E4B 83C404                  add esp, 00000004
:00414E4E 66A358F74500            mov word ptr [0045F758], ax
:00414E54 E911000000              jmp 00414E6A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414E3C(C)
|
:00414E59 8B45EC                  mov eax, dword ptr [ebp-14]
:00414E5C 25FFFF0000              and eax, 0000FFFF
:00414E61 0D00400000              or eax, 00004000
:00414E66 668945EC                mov word ptr [ebp-14], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414E54(U)
|
:00414E6A E92E000000              jmp 00414E9D
:00414E6F E929000000              jmp 00414E9D
:00414E74 E924000000              jmp 00414E9D
:00414E79 E91F000000              jmp 00414E9D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414E02(U)
|
:00414E7E 817DE800020000          cmp dword ptr [ebp-18], 00000200
:00414E85 0F849EFFFFFF            je 00414E29
:00414E8B 817DE800040000          cmp dword ptr [ebp-18], 00000400
:00414E92 0F846FFFFFFF            je 00414E07
:00414E98 E900000000              jmp 00414E9D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00414E6A(U), :00414E6F(U), :00414E74(U), :00414E79(U), :00414E98(U)
|
:00414E9D 6A00                    push 00000000
:00414E9F 8B4D2C                  mov ecx, dword ptr [ebp+2C]
:00414EA2 E859340000              call 00418300
:00414EA7 8B4524                  mov eax, dword ptr [ebp+24]
:00414EAA 50                      push eax
:00414EAB 8B4D2C                  mov ecx, dword ptr [ebp+2C]
:00414EAE E8CD2F0000              call 00417E80
:00414EB3 6A00                    push 00000000
:00414EB5 8B4D2C                  mov ecx, dword ptr [ebp+2C]
:00414EB8 E813340000              call 004182D0
:00414EBD 6A00                    push 00000000
:00414EBF 8B4D2C                  mov ecx, dword ptr [ebp+2C]
:00414EC2 E8A9330000              call 00418270
:00414EC7 8B45FC                  mov eax, dword ptr [ebp-04]
:00414ECA 50                      push eax
:00414ECB 8B4D2C                  mov ecx, dword ptr [ebp+2C]
:00414ECE E85D340000              call 00418330
:00414ED3 6A00                    push 00000000
:00414ED5 8B4D2C                  mov ecx, dword ptr [ebp+2C]
:00414ED8 E883340000              call 00418360
:00414EDD 8B450C                  mov eax, dword ptr [ebp+0C]
:00414EE0 50                      push eax
:00414EE1 8B4D2C                  mov ecx, dword ptr [ebp+2C]
:00414EE4 E837350000              call 00418420
:00414EE9 8B4510                  mov eax, dword ptr [ebp+10]
:00414EEC 50                      push eax
:00414EED 8B4D2C                  mov ecx, dword ptr [ebp+2C]
:00414EF0 E85B350000              call 00418450
:00414EF5 8B4514                  mov eax, dword ptr [ebp+14]
:00414EF8 50                      push eax
:00414EF9 8B4D2C                  mov ecx, dword ptr [ebp+2C]
:00414EFC E87F350000              call 00418480
:00414F01 8B4518                  mov eax, dword ptr [ebp+18]
:00414F04 50                      push eax
:00414F05 8B4D2C                  mov ecx, dword ptr [ebp+2C]
:00414F08 E883340000              call 00418390
:00414F0D 8B451C                  mov eax, dword ptr [ebp+1C]
:00414F10 50                      push eax
:00414F11 8B4D2C                  mov ecx, dword ptr [ebp+2C]
:00414F14 E8A7340000              call 004183C0
:00414F19 8B4520                  mov eax, dword ptr [ebp+20]
:00414F1C 50                      push eax
:00414F1D 8B4D2C                  mov ecx, dword ptr [ebp+2C]
:00414F20 E8CB340000              call 004183F0
:00414F25 68FFFF0000              push 0000FFFF
:00414F2A 68FFFF0000              push 0000FFFF
:00414F2F 8B4D2C                  mov ecx, dword ptr [ebp+2C]
:00414F32 E8D9300000              call 00418010
:00414F37 68FFFF0000              push 0000FFFF
:00414F3C 68FFFF0000              push 0000FFFF
:00414F41 8B4D2C                  mov ecx, dword ptr [ebp+2C]
:00414F44 E867350000              call 004184B0
:00414F49 8B45F4                  mov eax, dword ptr [ebp-0C]
:00414F4C 50                      push eax
:00414F4D 8B4D2C                  mov ecx, dword ptr [ebp+2C]
:00414F50 E89B320000              call 004181F0
:00414F55 6A00                    push 00000000
:00414F57 8B4D2C                  mov ecx, dword ptr [ebp+2C]
:00414F5A E8C12C0000              call 00417C20
:00414F5F 68FFFF0000              push 0000FFFF
:00414F64 8B4D2C                  mov ecx, dword ptr [ebp+2C]
:00414F67 E8C4310000              call 00418130
:00414F6C 8B45EC                  mov eax, dword ptr [ebp-14]
:00414F6F 50                      push eax
:00414F70 8B45EC                  mov eax, dword ptr [ebp-14]
:00414F73 50                      push eax
:00414F74 8B4D2C                  mov ecx, dword ptr [ebp+2C]
:00414F77 E8D42C0000              call 00417C50
:00414F7C 8B4528                  mov eax, dword ptr [ebp+28]
:00414F7F 50                      push eax
:00414F80 8B4D2C                  mov ecx, dword ptr [ebp+2C]
:00414F83 E818330000              call 004182A0
:00414F88 8B4528                  mov eax, dword ptr [ebp+28]
:00414F8B 50                      push eax
:00414F8C 6A00                    push 00000000
:00414F8E 8B4D2C                  mov ecx, dword ptr [ebp+2C]
:00414F91 E8E9200000              call 0041707F
:00414F96 8B452C                  mov eax, dword ptr [ebp+2C]
:00414F99 50                      push eax
:00414F9A E8C5C0FFFF              call 00411064
:00414F9F 83C404                  add esp, 00000004
:00414FA2 0FB7C0                  movzx eax, ax
:00414FA5 E905000000              jmp 00414FAF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414E1F(U)
|
:00414FAA E980FEFFFF              jmp 00414E2F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414FA5(U)
|
:00414FAF 5F                      pop edi
:00414FB0 5E                      pop esi
:00414FB1 5B                      pop ebx
:00414FB2 C9                      leave
:00414FB3 C3                      ret



* Referenced by a CALL at Addresses:
|:004151C0   , :004157FC   
|
:00414FB4 55                      push ebp
:00414FB5 8BEC                    mov ebp, esp
:00414FB7 83EC08                  sub esp, 00000008
:00414FBA 53                      push ebx
:00414FBB 56                      push esi
:00414FBC 57                      push edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004150B5(U)
|
:00414FBD 6A64                    push 00000064
:00414FBF E864230300              call 00447328
:00414FC4 83C404                  add esp, 00000004
:00414FC7 8B4D08                  mov ecx, dword ptr [ebp+08]
:00414FCA 668901                  mov word ptr [ecx], ax
:00414FCD 6A64                    push 00000064
:00414FCF E854230300              call 00447328
:00414FD4 83C404                  add esp, 00000004
:00414FD7 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00414FDA 668901                  mov word ptr [ecx], ax
:00414FDD 6A04                    push 00000004
:00414FDF 6A02                    push 00000002
:00414FE1 6A02                    push 00000002
:00414FE3 8B450C                  mov eax, dword ptr [ebp+0C]
:00414FE6 50                      push eax
:00414FE7 8B4508                  mov eax, dword ptr [ebp+08]
:00414FEA 50                      push eax
:00414FEB E87BEBFFFF              call 00413B6B
:00414FF0 83C414                  add esp, 00000014
:00414FF3 0FB7C0                  movzx eax, ax
:00414FF6 3DFFFF0000              cmp eax, 0000FFFF
:00414FFB 0F84B4000000            je 004150B5
:00415001 8B4510                  mov eax, dword ptr [ebp+10]
:00415004 25FFFF0000              and eax, 0000FFFF
:00415009 83F801                  cmp eax, 00000001
:0041500C 0F859E000000            jne 004150B0
:00415012 C745FCD8D54500          mov [ebp-04], 0045D5D8
:00415019 66C745F80000            mov [ebp-08], 0000
:0041501F E908000000              jmp 0041502C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041508E(U)
|
:00415024 66FF45F8                inc [ebp-08]
:00415028 8345FC3E                add dword ptr [ebp-04], 0000003E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041501F(U)
|
:0041502C 8B45F8                  mov eax, dword ptr [ebp-08]
:0041502F 25FFFF0000              and eax, 0000FFFF
:00415034 3D80000000              cmp eax, 00000080
:00415039 0F8D54000000            jnl 00415093
:0041503F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00415042 E8192B0000              call 00417B60
:00415047 0FB7C0                  movzx eax, ax
:0041504A F6C480                  test ah, 80
:0041504D 0F843B000000            je 0041508E
:00415053 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00415056 E8E52F0000              call 00418040
:0041505B 0FB7C0                  movzx eax, ax
:0041505E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00415061 33D2                    xor edx, edx
:00415063 668B11                  mov dx, word ptr [ecx]
:00415066 3BC2                    cmp eax, edx
:00415068 0F8520000000            jne 0041508E
:0041506E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00415071 E8EA2F0000              call 00418060
:00415076 0FB7C0                  movzx eax, ax
:00415079 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0041507C 33D2                    xor edx, edx
:0041507E 668B11                  mov dx, word ptr [ecx]
:00415081 3BC2                    cmp eax, edx
:00415083 0F8505000000            jne 0041508E
:00415089 E905000000              jmp 00415093

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041504D(C), :00415068(C), :00415083(C)
|
:0041508E E991FFFFFF              jmp 00415024

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00415039(C), :00415089(U)
|
:00415093 8B45F8                  mov eax, dword ptr [ebp-08]
:00415096 25FFFF0000              and eax, 0000FFFF
:0041509B 3D80000000              cmp eax, 00000080
:004150A0 0F8505000000            jne 004150AB
:004150A6 E914000000              jmp 004150BF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004150A0(C)
|
:004150AB E905000000              jmp 004150B5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041500C(C)
|
:004150B0 E90A000000              jmp 004150BF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00414FFB(C), :004150AB(U)
|
:004150B5 E903FFFFFF              jmp 00414FBD
:004150BA E900000000              jmp 004150BF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004150A6(U), :004150B0(U), :004150BA(U)
|
:004150BF 5F                      pop edi
:004150C0 5E                      pop esi
:004150C1 5B                      pop ebx
:004150C2 C9                      leave
:004150C3 C3                      ret



* Referenced by a CALL at Addresses:
|:004125BD   , :00415247   , :0041582F   , :00417451   , :004176EA   
|
:004150C4 55                      push ebp
:004150C5 8BEC                    mov ebp, esp
:004150C7 83EC14                  sub esp, 00000014
:004150CA 53                      push ebx
:004150CB 56                      push esi
:004150CC 57                      push edi
:004150CD 8B4508                  mov eax, dword ptr [ebp+08]
:004150D0 50                      push eax
:004150D1 E899FAFFFF              call 00414B6F
:004150D6 83C404                  add esp, 00000004
:004150D9 668945EC                mov word ptr [ebp-14], ax
:004150DD 8B45EC                  mov eax, dword ptr [ebp-14]
:004150E0 25FFFF0000              and eax, 0000FFFF
:004150E5 3D80000000              cmp eax, 00000080
:004150EA 0F8D0A000000            jnl 004150FA
:004150F0 B880000000              mov eax, 00000080
:004150F5 E903010000              jmp 004151FD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004150EA(C)
|
:004150FA 66C745140000            mov [ebp+14], 0000
:00415100 66C745FC0000            mov [ebp-04], 0000
:00415106 8B4508                  mov eax, dword ptr [ebp+08]
:00415109 50                      push eax
:0041510A E8A5BFFFFF              call 004110B4
:0041510F 83C404                  add esp, 00000004
:00415112 8945F4                  mov dword ptr [ebp-0C], eax
:00415115 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00415118 E853CAFEFF              call 00401B70
:0041511D 668945F0                mov word ptr [ebp-10], ax
:00415121 8B45F0                  mov eax, dword ptr [ebp-10]
:00415124 25FFFF0000              and eax, 0000FFFF
:00415129 3D00020000              cmp eax, 00000200
:0041512E 0F841D000000            je 00415151
:00415134 8B45F0                  mov eax, dword ptr [ebp-10]
:00415137 25FFFF0000              and eax, 0000FFFF
:0041513C 3D00040000              cmp eax, 00000400
:00415141 0F840A000000            je 00415151
:00415147 B8FFFFFFFF              mov eax, FFFFFFFF
:0041514C E9AC000000              jmp 004151FD

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041512E(C), :00415141(C)
|
:00415151 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00415154 E8A7330000              call 00418500
:00415159 660FB6C0                movzx ax, al
:0041515D 50                      push eax
:0041515E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00415161 E87A330000              call 004184E0
:00415166 50                      push eax
:00415167 E8D8CBFFFF              call 00411D44
:0041516C 83C408                  add esp, 00000008
:0041516F 8945F8                  mov dword ptr [ebp-08], eax
:00415172 6880000000              push 00000080
:00415177 E843C3FFFF              call 004114BF
:0041517C 83C404                  add esp, 00000004
:0041517F 3B45F8                  cmp eax, dword ptr [ebp-08]
:00415182 0F850A000000            jne 00415192
:00415188 B880000000              mov eax, 00000080
:0041518D E96B000000              jmp 004151FD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415182(C)
|
:00415192 6A04                    push 00000004
:00415194 6A02                    push 00000002
:00415196 6A02                    push 00000002
:00415198 8D4510                  lea eax, dword ptr [ebp+10]
:0041519B 50                      push eax
:0041519C 8D450C                  lea eax, dword ptr [ebp+0C]
:0041519F 50                      push eax
:004151A0 E8C6E9FFFF              call 00413B6B
:004151A5 83C414                  add esp, 00000014
:004151A8 0FB7C0                  movzx eax, ax
:004151AB 3DFFFF0000              cmp eax, 0000FFFF
:004151B0 0F8512000000            jne 004151C8
:004151B6 6A01                    push 00000001
:004151B8 8D4510                  lea eax, dword ptr [ebp+10]
:004151BB 50                      push eax
:004151BC 8D450C                  lea eax, dword ptr [ebp+0C]
:004151BF 50                      push eax
:004151C0 E8EFFDFFFF              call 00414FB4
:004151C5 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004151B0(C)
|
:004151C8 8B45F8                  mov eax, dword ptr [ebp-08]
:004151CB 50                      push eax
:004151CC 8B4528                  mov eax, dword ptr [ebp+28]
:004151CF 50                      push eax
:004151D0 8B4524                  mov eax, dword ptr [ebp+24]
:004151D3 50                      push eax
:004151D4 8B4520                  mov eax, dword ptr [ebp+20]
:004151D7 50                      push eax
:004151D8 8B451C                  mov eax, dword ptr [ebp+1C]
:004151DB 50                      push eax
:004151DC 8B4518                  mov eax, dword ptr [ebp+18]
:004151DF 50                      push eax
:004151E0 8B4514                  mov eax, dword ptr [ebp+14]
:004151E3 50                      push eax
:004151E4 8B4510                  mov eax, dword ptr [ebp+10]
:004151E7 50                      push eax
:004151E8 8B450C                  mov eax, dword ptr [ebp+0C]
:004151EB 50                      push eax
:004151EC 8B4508                  mov eax, dword ptr [ebp+08]
:004151EF 50                      push eax
:004151F0 E8CCFBFFFF              call 00414DC1
:004151F5 83C428                  add esp, 00000028
:004151F8 E900000000              jmp 004151FD

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004150F5(U), :0041514C(U), :0041518D(U), :004151F8(U)
|
:004151FD 5F                      pop edi
:004151FE 5E                      pop esi
:004151FF 5B                      pop ebx
:00415200 C9                      leave
:00415201 C3                      ret



* Referenced by a CALL at Address:
|:004323B0   
|
:00415202 55                      push ebp
:00415203 8BEC                    mov ebp, esp
:00415205 53                      push ebx
:00415206 56                      push esi
:00415207 57                      push edi
:00415208 8B4518                  mov eax, dword ptr [ebp+18]
:0041520B 83E003                  and eax, 00000003
:0041520E 66894518                mov word ptr [ebp+18], ax
:00415212 8B451C                  mov eax, dword ptr [ebp+1C]
:00415215 25FFFF0000              and eax, 0000FFFF
:0041521A 83F809                  cmp eax, 00000009
:0041521D 0F8E06000000            jle 00415229
:00415223 66C7451C0000            mov [ebp+1C], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041521D(C)
|
:00415229 8B451C                  mov eax, dword ptr [ebp+1C]
:0041522C 50                      push eax
:0041522D 8B4518                  mov eax, dword ptr [ebp+18]
:00415230 50                      push eax
:00415231 6A01                    push 00000001
:00415233 6A02                    push 00000002
:00415235 6A02                    push 00000002
:00415237 8B4514                  mov eax, dword ptr [ebp+14]
:0041523A 50                      push eax
:0041523B 8B4510                  mov eax, dword ptr [ebp+10]
:0041523E 50                      push eax
:0041523F 8B450C                  mov eax, dword ptr [ebp+0C]
:00415242 50                      push eax
:00415243 8B4508                  mov eax, dword ptr [ebp+08]
:00415246 50                      push eax
:00415247 E878FEFFFF              call 004150C4
:0041524C 83C424                  add esp, 00000024
:0041524F 3D80000000              cmp eax, 00000080
:00415254 0F8D07000000            jnl 00415261
:0041525A 33C0                    xor eax, eax
:0041525C E90A000000              jmp 0041526B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415254(C)
|
:00415261 B8FFFF0000              mov eax, 0000FFFF
:00415266 E900000000              jmp 0041526B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041525C(U), :00415266(U)
|
:0041526B 5F                      pop edi
:0041526C 5E                      pop esi
:0041526D 5B                      pop ebx
:0041526E C9                      leave
:0041526F C3                      ret



* Referenced by a CALL at Address:
|:0040153B   
|
:00415270 55                      push ebp
:00415271 8BEC                    mov ebp, esp
:00415273 83EC04                  sub esp, 00000004
:00415276 53                      push ebx
:00415277 56                      push esi
:00415278 57                      push edi
:00415279 C745FC00AA4600          mov [ebp-04], 0046AA00
:00415280 6A02                    push 00000002
:00415282 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00415285 E896C5FEFF              call 00401820
:0041528A 8B4508                  mov eax, dword ptr [ebp+08]
:0041528D 50                      push eax
:0041528E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00415291 E84AC7FEFF              call 004019E0
:00415296 6A00                    push 00000000
:00415298 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041529B E8B0C6FEFF              call 00401950
:004152A0 6A01                    push 00000001
:004152A2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004152A5 E866C7FEFF              call 00401A10
:004152AA 830D7853450002          or dword ptr [00455378], 00000002
:004152B1 33C0                    xor eax, eax
:004152B3 E900000000              jmp 004152B8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004152B3(U)
|
:004152B8 5F                      pop edi
:004152B9 5E                      pop esi
:004152BA 5B                      pop ebx
:004152BB C9                      leave
:004152BC C3                      ret



* Referenced by a CALL at Address:
|:004326FF   
|
:004152BD 55                      push ebp
:004152BE 8BEC                    mov ebp, esp
:004152C0 83EC08                  sub esp, 00000008
:004152C3 53                      push ebx
:004152C4 56                      push esi
:004152C5 57                      push edi
:004152C6 8B4508                  mov eax, dword ptr [ebp+08]
:004152C9 50                      push eax
:004152CA E8A0F8FFFF              call 00414B6F
:004152CF 83C404                  add esp, 00000004
:004152D2 668945F8                mov word ptr [ebp-08], ax
:004152D6 8B45F8                  mov eax, dword ptr [ebp-08]
:004152D9 25FFFF0000              and eax, 0000FFFF
:004152DE 3D80000000              cmp eax, 00000080
:004152E3 0F8C0A000000            jl 004152F3
:004152E9 B8FFFF0000              mov eax, 0000FFFF
:004152EE E934000000              jmp 00415327

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004152E3(C)
|
:004152F3 8B45F8                  mov eax, dword ptr [ebp-08]
:004152F6 50                      push eax
:004152F7 E8C3C1FFFF              call 004114BF
:004152FC 83C404                  add esp, 00000004
:004152FF 8945FC                  mov dword ptr [ebp-04], eax
:00415302 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00415305 E8862E0000              call 00418190
:0041530A 0FB7C0                  movzx eax, ax
:0041530D 83F804                  cmp eax, 00000004
:00415310 0F840A000000            je 00415320
:00415316 B801000000              mov eax, 00000001
:0041531B E907000000              jmp 00415327

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415310(C)
|
:00415320 33C0                    xor eax, eax
:00415322 E900000000              jmp 00415327

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004152EE(U), :0041531B(U), :00415322(U)
|
:00415327 5F                      pop edi
:00415328 5E                      pop esi
:00415329 5B                      pop ebx
:0041532A C9                      leave
:0041532B C3                      ret



* Referenced by a CALL at Address:
|:0043255B   
|
:0041532C 55                      push ebp
:0041532D 8BEC                    mov ebp, esp
:0041532F 83EC08                  sub esp, 00000008
:00415332 53                      push ebx
:00415333 56                      push esi
:00415334 57                      push edi
:00415335 8B4514                  mov eax, dword ptr [ebp+14]
:00415338 25FFFF0000              and eax, 0000FFFF
:0041533D 83F803                  cmp eax, 00000003
:00415340 0F8E06000000            jle 0041534C
:00415346 66C745140000            mov [ebp+14], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415340(C)
|
:0041534C 8B4508                  mov eax, dword ptr [ebp+08]
:0041534F 50                      push eax
:00415350 E81AF8FFFF              call 00414B6F
:00415355 83C404                  add esp, 00000004
:00415358 668945F8                mov word ptr [ebp-08], ax
:0041535C 8B45F8                  mov eax, dword ptr [ebp-08]
:0041535F 25FFFF0000              and eax, 0000FFFF
:00415364 3D80000000              cmp eax, 00000080
:00415369 0F8C0A000000            jl 00415379
:0041536F B8FFFF0000              mov eax, 0000FFFF
:00415374 E9B6000000              jmp 0041542F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415369(C)
|
:00415379 8B45F8                  mov eax, dword ptr [ebp-08]
:0041537C 50                      push eax
:0041537D E83DC1FFFF              call 004114BF
:00415382 83C404                  add esp, 00000004
:00415385 8945FC                  mov dword ptr [ebp-04], eax
:00415388 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041538B E8002E0000              call 00418190
:00415390 0FB7C0                  movzx eax, ax
:00415393 83F804                  cmp eax, 00000004
:00415396 0F840A000000            je 004153A6
:0041539C B8FFFF0000              mov eax, 0000FFFF
:004153A1 E989000000              jmp 0041542F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415396(C)
|
:004153A6 6A01                    push 00000001
:004153A8 8B4510                  mov eax, dword ptr [ebp+10]
:004153AB 50                      push eax
:004153AC 8B450C                  mov eax, dword ptr [ebp+0C]
:004153AF 50                      push eax
:004153B0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004153B3 E8582D0000              call 00418110
:004153B8 50                      push eax
:004153B9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004153BC E82F2D0000              call 004180F0
:004153C1 50                      push eax
:004153C2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004153C5 E8962C0000              call 00418060
:004153CA 50                      push eax
:004153CB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004153CE E86D2C0000              call 00418040
:004153D3 50                      push eax
:004153D4 E89EE9FFFF              call 00413D77
:004153D9 83C41C                  add esp, 0000001C
:004153DC 83F801                  cmp eax, 00000001
:004153DF 0F852F000000            jne 00415414
:004153E5 6A00                    push 00000000
:004153E7 8B4514                  mov eax, dword ptr [ebp+14]
:004153EA 50                      push eax
:004153EB 8B45FC                  mov eax, dword ptr [ebp-04]
:004153EE 50                      push eax
:004153EF E8D0EEFFFF              call 004142C4
:004153F4 83C40C                  add esp, 0000000C
:004153F7 0FB7C0                  movzx eax, ax
:004153FA 3DFFFF0000              cmp eax, 0000FFFF
:004153FF 0F850A000000            jne 0041540F
:00415405 B8FFFF0000              mov eax, 0000FFFF
:0041540A E920000000              jmp 0041542F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004153FF(C)
|
:0041540F E90A000000              jmp 0041541E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004153DF(C)
|
:00415414 B8FFFF0000              mov eax, 0000FFFF
:00415419 E911000000              jmp 0041542F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041540F(U)
|
:0041541E 6A02                    push 00000002
:00415420 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00415423 E8C82D0000              call 004181F0
:00415428 33C0                    xor eax, eax
:0041542A E900000000              jmp 0041542F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00415374(U), :004153A1(U), :0041540A(U), :00415419(U), :0041542A(U)
|
:0041542F 5F                      pop edi
:00415430 5E                      pop esi
:00415431 5B                      pop ebx
:00415432 C9                      leave
:00415433 C3                      ret



* Referenced by a CALL at Addresses:
|:00415CDC   , :00415DBA   , :0041664B   , :00416DF0   
|
:00415434 55                      push ebp
:00415435 8BEC                    mov ebp, esp
:00415437 83EC10                  sub esp, 00000010
:0041543A 53                      push ebx
:0041543B 56                      push esi
:0041543C 57                      push edi
:0041543D 66C745FCFFFF            mov [ebp-04], FFFF
:00415443 33C0                    xor eax, eax
:00415445 66A178674600            mov ax, word ptr [00466778]
:0041544B 85C0                    test eax, eax
:0041544D 0F8561010000            jne 004155B4
:00415453 833D7853450002          cmp dword ptr [00455378], 00000002
:0041545A 0F8454010000            je 004155B4
:00415460 8B4508                  mov eax, dword ptr [ebp+08]
:00415463 25FFFF0000              and eax, 0000FFFF
:00415468 8945F4                  mov dword ptr [ebp-0C], eax
:0041546B E95F000000              jmp 004154CF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004154D3(C)
|
:00415470 B9B0C44600              mov ecx, 0046C4B0
:00415475 E8FF9B0100              call 0042F079
:0041547A 668945FC                mov word ptr [ebp-04], ax
:0041547E E96F000000              jmp 004154F2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004154DD(C)
|
:00415483 8B450C                  mov eax, dword ptr [ebp+0C]
:00415486 25FFFF0000              and eax, 0000FFFF
:0041548B 50                      push eax
:0041548C B9B0C44600              mov ecx, 0046C4B0
:00415491 E8B39C0100              call 0042F149
:00415496 668945FC                mov word ptr [ebp-04], ax
:0041549A E953000000              jmp 004154F2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004154E7(C)
|
:0041549F 8B450C                  mov eax, dword ptr [ebp+0C]
:004154A2 25FFFF0000              and eax, 0000FFFF
:004154A7 50                      push eax
:004154A8 B900AA4600              mov ecx, 0046AA00
:004154AD E87EC4FEFF              call 00401930
:004154B2 33C9                    xor ecx, ecx
:004154B4 8AC8                    mov cl, al
:004154B6 51                      push ecx
:004154B7 B9B0C44600              mov ecx, 0046C4B0
:004154BC E8389E0100              call 0042F2F9
:004154C1 668945FC                mov word ptr [ebp-04], ax
:004154C5 E928000000              jmp 004154F2
:004154CA E923000000              jmp 004154F2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041546B(U)
|
:004154CF 837DF400                cmp dword ptr [ebp-0C], 00000000
:004154D3 0F8497FFFFFF            je 00415470
:004154D9 837DF401                cmp dword ptr [ebp-0C], 00000001
:004154DD 0F84A0FFFFFF            je 00415483
:004154E3 837DF402                cmp dword ptr [ebp-0C], 00000002
:004154E7 0F84B2FFFFFF            je 0041549F
:004154ED E900000000              jmp 004154F2

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041547E(U), :0041549A(U), :004154C5(U), :004154CA(U), :004154ED(U)
|
:004154F2 8B45FC                  mov eax, dword ptr [ebp-04]
:004154F5 25FFFF0000              and eax, 0000FFFF
:004154FA 3DFFFF0000              cmp eax, 0000FFFF
:004154FF 0F84AF000000            je 004155B4
:00415505 6A00                    push 00000000
:00415507 E81CC0FFFF              call 00411528
:0041550C 83C404                  add esp, 00000004
:0041550F 8B45FC                  mov eax, dword ptr [ebp-04]
:00415512 25FFFF0000              and eax, 0000FFFF
:00415517 50                      push eax
:00415518 B9B0C44600              mov ecx, 0046C4B0
:0041551D E866A60100              call 0042FB88
:00415522 668945F8                mov word ptr [ebp-08], ax
:00415526 8B45F8                  mov eax, dword ptr [ebp-08]
:00415529 25FFFF0000              and eax, 0000FFFF
:0041552E 8945F0                  mov dword ptr [ebp-10], eax
:00415531 E947000000              jmp 0041557D
:00415536 E8AFBFFEFF              call 004014EA
:0041553B E974000000              jmp 004155B4
:00415540 8B4508                  mov eax, dword ptr [ebp+08]
:00415543 25FFFF0000              and eax, 0000FFFF
:00415548 83F802                  cmp eax, 00000002
:0041554B 0F8505000000            jne 00415556
:00415551 E871010000              call 004156C7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041554B(C)
|
:00415556 E959000000              jmp 004155B4
:0041555B 830D7853450020          or dword ptr [00455378], 00000020
:00415562 E94D000000              jmp 004155B4
:00415567 830D7853450004          or dword ptr [00455378], 00000004
:0041556E E941000000              jmp 004155B4
:00415573 E93C000000              jmp 004155B4
:00415578 E937000000              jmp 004155B4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415531(U)
|
:0041557D FF4DF0                  dec [ebp-10]
:00415580 837DF007                cmp dword ptr [ebp-10], 00000007
:00415584 0F872A000000            ja 004155B4
:0041558A 8B45F0                  mov eax, dword ptr [ebp-10]
:0041558D FF248594554100          jmp dword ptr [4*eax+00415594]

:00415594 40554100                DWORD 00415540
:00415598 36554100                DWORD 00415536
:0041559C 73554100                DWORD 00415573
:004155A0 73554100                DWORD 00415573
:004155A4 73554100                DWORD 00415573
:004155A8 73554100                DWORD 00415573
:004155AC 5B554100                DWORD 0041555B
:004155B0 67554100                DWORD 00415567



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041544D(C), :0041545A(C), :004154FF(C), :0041553B(U), :00415556(U)
|:00415562(U), :0041556E(U), :00415573(U), :00415578(U), :00415584(C)
|
:004155B4 E8C9020000              call 00415882
:004155B9 8B45FC                  mov eax, dword ptr [ebp-04]
:004155BC 25FFFF0000              and eax, 0000FFFF
:004155C1 E900000000              jmp 004155C6
:004155C6 5F                      pop edi
:004155C7 5E                      pop esi
:004155C8 5B                      pop ebx
:004155C9 C9                      leave
:004155CA C3                      ret



* Referenced by a CALL at Addresses:
|:0041570B   , :00417731   
|
:004155CB 55                      push ebp
:004155CC 8BEC                    mov ebp, esp
:004155CE 81EC08010000            sub esp, 00000108
:004155D4 53                      push ebx
:004155D5 56                      push esi
:004155D6 57                      push edi
:004155D7 8D8DF8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF8]
:004155DD E88E40FFFF              call 00409670
:004155E2 B9D0A64600              mov ecx, 0046A6D0
:004155E7 E8F465FFFF              call 0040BBE0
:004155EC 33C9                    xor ecx, ecx
:004155EE 8AC8                    mov cl, al
:004155F0 668B044D30F64400        mov ax, word ptr [2*ecx+0044F630]
:004155F8 668945FC                mov word ptr [ebp-04], ax

* Possible StringData Ref from Data Obj ->"A:IP.E2"
                                  |
:004155FC 6828144500              push 00451428
:00415601 8D8DF8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF8]
:00415607 E8031F0100              call 0042750F
:0041560C B9B8E44600              mov ecx, 0046E4B8
:00415611 E8CA3AFFFF              call 004090E0
:00415616 50                      push eax
:00415617 8B45FC                  mov eax, dword ptr [ebp-04]
:0041561A 25FFFF0000              and eax, 0000FFFF
:0041561F 50                      push eax
:00415620 8D8DF8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF8]
:00415626 E856200100              call 00427681
:0041562B 8D8DF8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF8]
:00415631 E8EA3DFFFF              call 00409420
:00415636 E900000000              jmp 0041563B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415636(U)
|
:0041563B 5F                      pop edi
:0041563C 5E                      pop esi
:0041563D 5B                      pop ebx
:0041563E C9                      leave
:0041563F C3                      ret



* Referenced by a CALL at Address:
|:004156D7   
|
:00415640 55                      push ebp
:00415641 8BEC                    mov ebp, esp
:00415643 83EC08                  sub esp, 00000008
:00415646 53                      push ebx
:00415647 56                      push esi
:00415648 57                      push edi
:00415649 6A00                    push 00000000
:0041564B E86FBEFFFF              call 004114BF
:00415650 83C404                  add esp, 00000004
:00415653 8945FC                  mov dword ptr [ebp-04], eax
:00415656 66C745F80000            mov [ebp-08], 0000
:0041565C E908000000              jmp 00415669

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004156B4(U)
|
:00415661 66FF45F8                inc [ebp-08]
:00415665 8345FC3E                add dword ptr [ebp-04], 0000003E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041565C(U)
|
:00415669 8B45F8                  mov eax, dword ptr [ebp-08]
:0041566C 25FFFF0000              and eax, 0000FFFF
:00415671 3D80000000              cmp eax, 00000080
:00415676 0F8D3D000000            jnl 004156B9
:0041567C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041567F E8DC240000              call 00417B60
:00415684 0FB7C0                  movzx eax, ax
:00415687 F6C480                  test ah, 80
:0041568A 0F8424000000            je 004156B4
:00415690 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00415693 E8B82B0000              call 00418250
:00415698 50                      push eax
:00415699 E8E6B9FFFF              call 00411084
:0041569E 83C404                  add esp, 00000004
:004156A1 0FB7C0                  movzx eax, ax
:004156A4 3D00040000              cmp eax, 00000400
:004156A9 0F8505000000            jne 004156B4
:004156AF E905000000              jmp 004156B9

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041568A(C), :004156A9(C)
|
:004156B4 E9A8FFFFFF              jmp 00415661

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00415676(C), :004156AF(U)
|
:004156B9 668B45F8                mov ax, word ptr [ebp-08]
:004156BD E900000000              jmp 004156C2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004156BD(U)
|
:004156C2 5F                      pop edi
:004156C3 5E                      pop esi
:004156C4 5B                      pop ebx
:004156C5 C9                      leave
:004156C6 C3                      ret



* Referenced by a CALL at Addresses:
|:00415551   , :00417787   , :00430C09   
|
:004156C7 55                      push ebp
:004156C8 8BEC                    mov ebp, esp
:004156CA 83EC34                  sub esp, 00000034
:004156CD 53                      push ebx
:004156CE 56                      push esi
:004156CF 57                      push edi
:004156D0 C745D800000000          mov [ebp-28], 00000000
:004156D7 E864FFFFFF              call 00415640
:004156DC 0FB7C0                  movzx eax, ax
:004156DF 3D80000000              cmp eax, 00000080
:004156E4 0F8D0A000000            jnl 004156F4
:004156EA B8FFFFFFFF              mov eax, FFFFFFFF
:004156EF E94F010000              jmp 00415843

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004156E4(C)
|
:004156F4 C745F000AA4600          mov [ebp-10], 0046AA00
:004156FB 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004156FE E87DA6FFFF              call 0040FD80
:00415703 660FB6C0                movzx ax, al
:00415707 668945D0                mov word ptr [ebp-30], ax
:0041570B E8BBFEFFFF              call 004155CB
:00415710 6A04                    push 00000004
:00415712 6A00                    push 00000000
:00415714 6A00                    push 00000000
:00415716 B9B8E44600              mov ecx, 0046E4B8
:0041571B E800200300              call 00447720
:00415720 8945D4                  mov dword ptr [ebp-2C], eax
:00415723 8B45D4                  mov eax, dword ptr [ebp-2C]
:00415726 668B00                  mov ax, word ptr [eax]
:00415729 668945CC                mov word ptr [ebp-34], ax
:0041572D 8345D402                add dword ptr [ebp-2C], 00000002
:00415731 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00415734 E8F7C1FEFF              call 00401930
:00415739 33C9                    xor ecx, ecx
:0041573B 8AC8                    mov cl, al
:0041573D 8B45D0                  mov eax, dword ptr [ebp-30]
:00415740 25FFFF0000              and eax, 0000FFFF
:00415745 8BD0                    mov edx, eax
:00415747 8D0480                  lea eax, dword ptr [eax+4*eax]
:0041574A 8D0480                  lea eax, dword ptr [eax+4*eax]
:0041574D 03C2                    add eax, edx
:0041574F 03C8                    add ecx, eax
:00415751 C1E102                  shl ecx, 02
:00415754 034DD4                  add ecx, dword ptr [ebp-2C]
:00415757 894DF4                  mov dword ptr [ebp-0C], ecx
:0041575A 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041575D 668B00                  mov ax, word ptr [eax]
:00415760 668945FC                mov word ptr [ebp-04], ax
:00415764 8345F402                add dword ptr [ebp-0C], 00000002
:00415768 8B45FC                  mov eax, dword ptr [ebp-04]
:0041576B 25FFFF0000              and eax, 0000FFFF
:00415770 3DFFFF0000              cmp eax, 0000FFFF
:00415775 0F850A000000            jne 00415785
:0041577B B8FFFFFFFF              mov eax, FFFFFFFF
:00415780 E9BE000000              jmp 00415843

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415775(C)
|
:00415785 8B45F4                  mov eax, dword ptr [ebp-0C]
:00415788 668B00                  mov ax, word ptr [eax]
:0041578B 668945DC                mov word ptr [ebp-24], ax
:0041578F 8B45DC                  mov eax, dword ptr [ebp-24]
:00415792 25FFFF0000              and eax, 0000FFFF
:00415797 0345D4                  add eax, dword ptr [ebp-2C]
:0041579A 05900A0000              add eax, 00000A90
:0041579F 8945F8                  mov dword ptr [ebp-08], eax
:004157A2 66C745E00000            mov [ebp-20], 0000
:004157A8 E904000000              jmp 004157B1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415837(U)
|
:004157AD 66FF45E0                inc [ebp-20]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004157A8(U)
|
:004157B1 8B45FC                  mov eax, dword ptr [ebp-04]
:004157B4 25FFFF0000              and eax, 0000FFFF
:004157B9 8B4DE0                  mov ecx, dword ptr [ebp-20]
:004157BC 81E1FFFF0000            and ecx, 0000FFFF
:004157C2 3BC1                    cmp eax, ecx
:004157C4 0F8E72000000            jle 0041583C
:004157CA 8B45F8                  mov eax, dword ptr [ebp-08]
:004157CD 668B00                  mov ax, word ptr [eax]
:004157D0 668945EC                mov word ptr [ebp-14], ax
:004157D4 8345F802                add dword ptr [ebp-08], 00000002
:004157D8 8B45EC                  mov eax, dword ptr [ebp-14]
:004157DB 25FF000000              and eax, 000000FF
:004157E0 668945EC                mov word ptr [ebp-14], ax
:004157E4 8B45F8                  mov eax, dword ptr [ebp-08]
:004157E7 668B00                  mov ax, word ptr [eax]
:004157EA 668945CC                mov word ptr [ebp-34], ax
:004157EE 8345F802                add dword ptr [ebp-08], 00000002
:004157F2 6A00                    push 00000000
:004157F4 8D45E4                  lea eax, dword ptr [ebp-1C]
:004157F7 50                      push eax
:004157F8 8D45E8                  lea eax, dword ptr [ebp-18]
:004157FB 50                      push eax
:004157FC E8B3F7FFFF              call 00414FB4
:00415801 83C40C                  add esp, 0000000C
:00415804 6A00                    push 00000000
:00415806 6A04                    push 00000004
:00415808 E81B1B0300              call 00447328
:0041580D 83C404                  add esp, 00000004
:00415810 50                      push eax
:00415811 6A01                    push 00000001
:00415813 6A02                    push 00000002
:00415815 6A02                    push 00000002
:00415817 6A00                    push 00000000
:00415819 8B45E4                  mov eax, dword ptr [ebp-1C]
:0041581C 50                      push eax
:0041581D 8B45E8                  mov eax, dword ptr [ebp-18]
:00415820 50                      push eax
:00415821 8B45EC                  mov eax, dword ptr [ebp-14]
:00415824 25FFFF0000              and eax, 0000FFFF
:00415829 0D00040000              or eax, 00000400
:0041582E 50                      push eax
:0041582F E890F8FFFF              call 004150C4
:00415834 83C424                  add esp, 00000024
:00415837 E971FFFFFF              jmp 004157AD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004157C4(C)
|
:0041583C 33C0                    xor eax, eax
:0041583E E900000000              jmp 00415843

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004156EF(U), :00415780(U), :0041583E(U)
|
:00415843 5F                      pop edi
:00415844 5E                      pop esi
:00415845 5B                      pop ebx
:00415846 C9                      leave
:00415847 C3                      ret



* Referenced by a CALL at Address:
|:00415897   
|
:00415848 55                      push ebp
:00415849 8BEC                    mov ebp, esp
:0041584B 53                      push ebx
:0041584C 56                      push esi
:0041584D 57                      push edi
:0041584E E879ECFFFF              call 004144CC
:00415853 0FB7C0                  movzx eax, ax
:00415856 85C0                    test eax, eax
:00415858 0F8518000000            jne 00415876
:0041585E E84D1E0200              call 004376B0
:00415863 83F801                  cmp eax, 00000001
:00415866 0F850A000000            jne 00415876
:0041586C B801000000              mov eax, 00000001
:00415871 E907000000              jmp 0041587D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00415858(C), :00415866(C)
|
:00415876 33C0                    xor eax, eax
:00415878 E900000000              jmp 0041587D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00415871(U), :00415878(U)
|
:0041587D 5F                      pop edi
:0041587E 5E                      pop esi
:0041587F 5B                      pop ebx
:00415880 C9                      leave
:00415881 C3                      ret



* Referenced by a CALL at Addresses:
|:00415B31   , :00415D82   , :00415E3A   , :004160F9   , :00416D76   
|
:00415882 55                      push ebp
:00415883 8BEC                    mov ebp, esp
:00415885 53                      push ebx
:00415886 56                      push esi
:00415887 57                      push edi
:00415888 C70564F94600FFFFFFFF    mov dword ptr [0046F964], FFFFFFFF
:00415892 E810040100              call 00425CA7
:00415897 E8ACFFFFFF              call 00415848
:0041589C 50                      push eax
:0041589D E886BCFFFF              call 00411528
:004158A2 83C404                  add esp, 00000004
:004158A5 E900000000              jmp 004158AA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004158A5(U)
|
:004158AA 5F                      pop edi
:004158AB 5E                      pop esi
:004158AC 5B                      pop ebx
:004158AD C9                      leave
:004158AE C3                      ret



* Referenced by a CALL at Address:
|:00415BF6   
|
:004158AF 55                      push ebp
:004158B0 8BEC                    mov ebp, esp
:004158B2 53                      push ebx
:004158B3 56                      push esi
:004158B4 57                      push edi
:004158B5 6800200000              push 00002000
:004158BA 6A00                    push 00000000
:004158BC 8B4D08                  mov ecx, dword ptr [ebp+08]
:004158BF E88C230000              call 00417C50
:004158C4 6A00                    push 00000000
:004158C6 8B4D08                  mov ecx, dword ptr [ebp+08]
:004158C9 E852230000              call 00417C20
:004158CE E900000000              jmp 004158D3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004158CE(U)
|
:004158D3 5F                      pop edi
:004158D4 5E                      pop esi
:004158D5 5B                      pop ebx
:004158D6 C9                      leave
:004158D7 C3                      ret



* Referenced by a CALL at Addresses:
|:004148CE   , :00415B6B   , :00415BAC   , :00415DA6   , :00415E5E   
|:00415E74   , :00415F9C   , :00415FBA   
|
:004158D8 55                      push ebp
:004158D9 8BEC                    mov ebp, esp
:004158DB 53                      push ebx
:004158DC 56                      push esi
:004158DD 57                      push edi
:004158DE 6A04                    push 00000004
:004158E0 8B4D08                  mov ecx, dword ptr [ebp+08]
:004158E3 E808290000              call 004181F0
:004158E8 8B4D08                  mov ecx, dword ptr [ebp+08]
:004158EB E8302C0000              call 00418520
:004158F0 50                      push eax
:004158F1 E82DE8FFFF              call 00414123
:004158F6 83C404                  add esp, 00000004
:004158F9 68FFFF0000              push 0000FFFF
:004158FE 8B4D08                  mov ecx, dword ptr [ebp+08]
:00415901 E82A280000              call 00418130
:00415906 E900000000              jmp 0041590B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415906(U)
|
:0041590B 5F                      pop edi
:0041590C 5E                      pop esi
:0041590D 5B                      pop ebx
:0041590E C9                      leave
:0041590F C3                      ret



* Referenced by a CALL at Address:
|:00415D19   
|
:00415910 55                      push ebp
:00415911 8BEC                    mov ebp, esp
:00415913 83EC28                  sub esp, 00000028
:00415916 53                      push ebx
:00415917 56                      push esi
:00415918 57                      push edi
:00415919 8B4508                  mov eax, dword ptr [ebp+08]
:0041591C 50                      push eax
:0041591D E87AB7FFFF              call 0041109C
:00415922 83C404                  add esp, 00000004
:00415925 0FB7C0                  movzx eax, ax
:00415928 25FF000000              and eax, 000000FF
:0041592D 668945E4                mov word ptr [ebp-1C], ax
:00415931 8B4508                  mov eax, dword ptr [ebp+08]
:00415934 50                      push eax
:00415935 E84AB7FFFF              call 00411084
:0041593A 83C404                  add esp, 00000004
:0041593D 0FB7C0                  movzx eax, ax
:00415940 3D00040000              cmp eax, 00000400
:00415945 0F8547010000            jne 00415A92
:0041594B C745F000AA4600          mov [ebp-10], 0046AA00
:00415952 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00415955 E826A4FFFF              call 0040FD80
:0041595A 660FB6C0                movzx ax, al
:0041595E 668945D8                mov word ptr [ebp-28], ax
:00415962 6A04                    push 00000004
:00415964 6A00                    push 00000000
:00415966 6A00                    push 00000000
:00415968 B9B8E44600              mov ecx, 0046E4B8
:0041596D E8AE1D0300              call 00447720
:00415972 8945E0                  mov dword ptr [ebp-20], eax
:00415975 8B45E0                  mov eax, dword ptr [ebp-20]
:00415978 668B00                  mov ax, word ptr [eax]
:0041597B 668945DC                mov word ptr [ebp-24], ax
:0041597F 8345E002                add dword ptr [ebp-20], 00000002
:00415983 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00415986 E8A5BFFEFF              call 00401930
:0041598B 33C9                    xor ecx, ecx
:0041598D 8AC8                    mov cl, al
:0041598F 8B45D8                  mov eax, dword ptr [ebp-28]
:00415992 25FFFF0000              and eax, 0000FFFF
:00415997 8BD0                    mov edx, eax
:00415999 8D0480                  lea eax, dword ptr [eax+4*eax]
:0041599C 8D0480                  lea eax, dword ptr [eax+4*eax]
:0041599F 03C2                    add eax, edx
:004159A1 03C8                    add ecx, eax
:004159A3 C1E102                  shl ecx, 02
:004159A6 034DE0                  add ecx, dword ptr [ebp-20]
:004159A9 894DF8                  mov dword ptr [ebp-08], ecx
:004159AC 8B45F8                  mov eax, dword ptr [ebp-08]
:004159AF 668B00                  mov ax, word ptr [eax]
:004159B2 668945F4                mov word ptr [ebp-0C], ax
:004159B6 8345F802                add dword ptr [ebp-08], 00000002
:004159BA 8B45F4                  mov eax, dword ptr [ebp-0C]
:004159BD 25FFFF0000              and eax, 0000FFFF
:004159C2 3DFFFF0000              cmp eax, 0000FFFF
:004159C7 0F8505000000            jne 004159D2
:004159CD E9C5000000              jmp 00415A97

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004159C7(C)
|
:004159D2 8B45F8                  mov eax, dword ptr [ebp-08]
:004159D5 668B00                  mov ax, word ptr [eax]
:004159D8 668945E8                mov word ptr [ebp-18], ax
:004159DC 8B45E8                  mov eax, dword ptr [ebp-18]
:004159DF 25FFFF0000              and eax, 0000FFFF
:004159E4 0345E0                  add eax, dword ptr [ebp-20]
:004159E7 05900A0000              add eax, 00000A90
:004159EC 8945FC                  mov dword ptr [ebp-04], eax
:004159EF 66C745EC0000            mov [ebp-14], 0000
:004159F5 E908000000              jmp 00415A02

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415A3E(U)
|
:004159FA 66FF45EC                inc [ebp-14]
:004159FE 8345FC04                add dword ptr [ebp-04], 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004159F5(U)
|
:00415A02 8B45EC                  mov eax, dword ptr [ebp-14]
:00415A05 25FFFF0000              and eax, 0000FFFF
:00415A0A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00415A0D 81E1FFFF0000            and ecx, 0000FFFF
:00415A13 3BC1                    cmp eax, ecx
:00415A15 0F8D28000000            jnl 00415A43
:00415A1B 8B45FC                  mov eax, dword ptr [ebp-04]
:00415A1E 33C9                    xor ecx, ecx
:00415A20 668B08                  mov cx, word ptr [eax]
:00415A23 81E1FF000000            and ecx, 000000FF
:00415A29 8B45E4                  mov eax, dword ptr [ebp-1C]
:00415A2C 25FFFF0000              and eax, 0000FFFF
:00415A31 3BC8                    cmp ecx, eax
:00415A33 0F8505000000            jne 00415A3E
:00415A39 E905000000              jmp 00415A43

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415A33(C)
|
:00415A3E E9B7FFFFFF              jmp 004159FA

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00415A15(C), :00415A39(U)
|
:00415A43 8B45EC                  mov eax, dword ptr [ebp-14]
:00415A46 25FFFF0000              and eax, 0000FFFF
:00415A4B 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00415A4E 81E1FFFF0000            and ecx, 0000FFFF
:00415A54 3BC1                    cmp eax, ecx
:00415A56 0F8436000000            je 00415A92
:00415A5C 8345FC02                add dword ptr [ebp-04], 00000002
:00415A60 6A20                    push 00000020
:00415A62 8B4508                  mov eax, dword ptr [ebp+08]
:00415A65 50                      push eax
:00415A66 E849B6FFFF              call 004110B4
:00415A6B 83C404                  add esp, 00000004
:00415A6E 50                      push eax
:00415A6F 8B45FC                  mov eax, dword ptr [ebp-04]
:00415A72 33C9                    xor ecx, ecx
:00415A74 668B08                  mov cx, word ptr [eax]
:00415A77 8B45DC                  mov eax, dword ptr [ebp-24]
:00415A7A 25FFFF0000              and eax, 0000FFFF
:00415A7F 03C8                    add ecx, eax
:00415A81 8B45E0                  mov eax, dword ptr [ebp-20]
:00415A84 83E802                  sub eax, 00000002
:00415A87 03C8                    add ecx, eax
:00415A89 51                      push ecx
:00415A8A E8E2B6FEFF              call 00401171
:00415A8F 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00415945(C), :00415A56(C)
|
:00415A92 E900000000              jmp 00415A97

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004159CD(U), :00415A92(U)
|
:00415A97 5F                      pop edi
:00415A98 5E                      pop esi
:00415A99 5B                      pop ebx
:00415A9A C9                      leave
:00415A9B C3                      ret



* Referenced by a CALL at Address:
|:00416DB4   
|
:00415A9C 55                      push ebp
:00415A9D 8BEC                    mov ebp, esp
:00415A9F 83EC2C                  sub esp, 0000002C
:00415AA2 53                      push ebx
:00415AA3 56                      push esi
:00415AA4 57                      push edi
:00415AA5 66C745F00000            mov [ebp-10], 0000
:00415AAB 6880000000              push 00000080
:00415AB0 E80ABAFFFF              call 004114BF
:00415AB5 83C404                  add esp, 00000004
:00415AB8 8945FC                  mov dword ptr [ebp-04], eax
:00415ABB E8B5E9FFFF              call 00414475
:00415AC0 0FB7C0                  movzx eax, ax
:00415AC3 3DFFFF0000              cmp eax, 0000FFFF
:00415AC8 0F8505000000            jne 00415AD3
:00415ACE E9DC030000              jmp 00415EAF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415AC8(C)
|
:00415AD3 E8D81B0200              call 004376B0
:00415AD8 83F801                  cmp eax, 00000001
:00415ADB 0F8555000000            jne 00415B36
:00415AE1 A180534500              mov eax, dword ptr [00455380]
:00415AE6 390568524500            cmp dword ptr [00455268], eax
:00415AEC 0F850D000000            jne 00415AFF
:00415AF2 833D64F94600FF          cmp dword ptr [0046F964], FFFFFFFF
:00415AF9 0F8437000000            je 00415B36

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415AEC(C)
|
:00415AFF 833D64F94600FF          cmp dword ptr [0046F964], FFFFFFFF
:00415B06 0F840A000000            je 00415B16
:00415B0C C7058053450001000000    mov dword ptr [00455380], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415B06(C)
|
:00415B16 A180534500              mov eax, dword ptr [00455380]
:00415B1B A368524500              mov dword ptr [00455268], eax
:00415B20 E82FECFFFF              call 00414754
:00415B25 0FB7C0                  movzx eax, ax
:00415B28 83F801                  cmp eax, 00000001
:00415B2B 0F8505000000            jne 00415B36
:00415B31 E84CFDFFFF              call 00415882

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00415ADB(C), :00415AF9(C), :00415B2B(C)
|
:00415B36 E8ABB9FFFF              call 004114E6
:00415B3B 8945F8                  mov dword ptr [ebp-08], eax
:00415B3E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00415B41 E84A260000              call 00418190
:00415B46 0FB7C0                  movzx eax, ax
:00415B49 8945D8                  mov dword ptr [ebp-28], eax
:00415B4C E935030000              jmp 00415E86
:00415B51 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00415B54 E8B3130000              call 00416F0C
:00415B59 0FB7C0                  movzx eax, ax
:00415B5C 3DFFFF0000              cmp eax, 0000FFFF
:00415B61 0F8526000000            jne 00415B8D
:00415B67 8B45F8                  mov eax, dword ptr [ebp-08]
:00415B6A 50                      push eax
:00415B6B E868FDFFFF              call 004158D8
:00415B70 83C404                  add esp, 00000004
:00415B73 33C0                    xor eax, eax
:00415B75 66A184674600            mov ax, word ptr [00466784]
:00415B7B 50                      push eax
:00415B7C E8EC1A0200              call 0043766D
:00415B81 83C404                  add esp, 00000004
:00415B84 66C705786746000000      mov word ptr [00466778], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415B61(C)
|
:00415B8D E918030000              jmp 00415EAA
:00415B92 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00415B95 E872130000              call 00416F0C
:00415B9A 0FB7C0                  movzx eax, ax
:00415B9D 3DFFFF0000              cmp eax, 0000FFFF
:00415BA2 0F85DF010000            jne 00415D87
:00415BA8 8B45F8                  mov eax, dword ptr [ebp-08]
:00415BAB 50                      push eax
:00415BAC E827FDFFFF              call 004158D8
:00415BB1 83C404                  add esp, 00000004
:00415BB4 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00415BB7 E884290000              call 00418540
:00415BBC 668945EC                mov word ptr [ebp-14], ax
:00415BC0 8B45EC                  mov eax, dword ptr [ebp-14]
:00415BC3 50                      push eax
:00415BC4 E8A6EFFFFF              call 00414B6F
:00415BC9 83C404                  add esp, 00000004
:00415BCC 668945F4                mov word ptr [ebp-0C], ax
:00415BD0 8B45F4                  mov eax, dword ptr [ebp-0C]
:00415BD3 25FFFF0000              and eax, 0000FFFF
:00415BD8 3D80000000              cmp eax, 00000080
:00415BDD 0F8D84000000            jnl 00415C67
:00415BE3 8B45F4                  mov eax, dword ptr [ebp-0C]
:00415BE6 50                      push eax
:00415BE7 E8D3B8FFFF              call 004114BF
:00415BEC 83C404                  add esp, 00000004
:00415BEF 8945FC                  mov dword ptr [ebp-04], eax
:00415BF2 8B45FC                  mov eax, dword ptr [ebp-04]
:00415BF5 50                      push eax
:00415BF6 E8B4FCFFFF              call 004158AF
:00415BFB 83C404                  add esp, 00000004
:00415BFE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00415C01 E85A240000              call 00418060
:00415C06 50                      push eax
:00415C07 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00415C0A E831240000              call 00418040
:00415C0F 50                      push eax
:00415C10 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00415C13 E848240000              call 00418060
:00415C18 50                      push eax
:00415C19 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00415C1C E81F240000              call 00418040
:00415C21 50                      push eax
:00415C22 E82FE5FFFF              call 00414156
:00415C27 83C410                  add esp, 00000010
:00415C2A 668945E8                mov word ptr [ebp-18], ax
:00415C2E 8B45E8                  mov eax, dword ptr [ebp-18]
:00415C31 50                      push eax
:00415C32 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00415C35 E846220000              call 00417E80
:00415C3A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00415C3D E81E290000              call 00418560
:00415C42 668945F0                mov word ptr [ebp-10], ax
:00415C46 8B45E8                  mov eax, dword ptr [ebp-18]
:00415C49 25FFFF0000              and eax, 0000FFFF
:00415C4E 83E802                  sub eax, 00000002
:00415C51 83E003                  and eax, 00000003
:00415C54 50                      push eax
:00415C55 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00415C58 E823220000              call 00417E80
:00415C5D 6A00                    push 00000000
:00415C5F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00415C62 E8B91F0000              call 00417C20

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415BDD(C)
|
:00415C67 E87FDCFFFF              call 004138EB
:00415C6C 8B45F4                  mov eax, dword ptr [ebp-0C]
:00415C6F 25FFFF0000              and eax, 0000FFFF
:00415C74 3D80000000              cmp eax, 00000080
:00415C79 0F8DFE000000            jnl 00415D7D
:00415C7F 8B45EC                  mov eax, dword ptr [ebp-14]
:00415C82 50                      push eax
:00415C83 E814B4FFFF              call 0041109C
:00415C88 83C404                  add esp, 00000004
:00415C8B 668945E4                mov word ptr [ebp-1C], ax
:00415C8F 8B45EC                  mov eax, dword ptr [ebp-14]
:00415C92 50                      push eax
:00415C93 E8ECB3FFFF              call 00411084
:00415C98 83C404                  add esp, 00000004
:00415C9B 0FB7C0                  movzx eax, ax
:00415C9E 8945D4                  mov dword ptr [ebp-2C], eax
:00415CA1 E9AC000000              jmp 00415D52

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415D59(C)
|
:00415CA6 8B45EC                  mov eax, dword ptr [ebp-14]
:00415CA9 25FFFF0000              and eax, 0000FFFF
:00415CAE 3DFE030000              cmp eax, 000003FE
:00415CB3 0F8413000000            je 00415CCC
:00415CB9 8B45EC                  mov eax, dword ptr [ebp-14]
:00415CBC 25FFFF0000              and eax, 0000FFFF
:00415CC1 3DFD030000              cmp eax, 000003FD
:00415CC6 0F850A000000            jne 00415CD6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415CB3(C)
|
:00415CCC E8F30F0200              call 00436CC4
:00415CD1 E93A000000              jmp 00415D10

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415CC6(C)
|
:00415CD6 8B45E4                  mov eax, dword ptr [ebp-1C]
:00415CD9 50                      push eax
:00415CDA 6A01                    push 00000001
:00415CDC E853F7FFFF              call 00415434
:00415CE1 83C408                  add esp, 00000008
:00415CE4 3DFFFF0000              cmp eax, 0000FFFF
:00415CE9 0F8521000000            jne 00415D10
:00415CEF 6A20                    push 00000020
:00415CF1 8B45E4                  mov eax, dword ptr [ebp-1C]
:00415CF4 25FFFF0000              and eax, 0000FFFF
:00415CF9 50                      push eax
:00415CFA E8DA910000              call 0041EED9
:00415CFF 83C404                  add esp, 00000004
:00415D02 50                      push eax

* Possible StringData Ref from Data Obj ->""
                                  |
:00415D03 6878F74400              push 0044F778
:00415D08 E864B4FEFF              call 00401171
:00415D0D 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00415CD1(U), :00415CE9(C)
|
:00415D10 E95C000000              jmp 00415D71

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415D66(C)
|
:00415D15 8B45EC                  mov eax, dword ptr [ebp-14]
:00415D18 50                      push eax
:00415D19 E8F2FBFFFF              call 00415910
:00415D1E 83C404                  add esp, 00000004
:00415D21 8B45F4                  mov eax, dword ptr [ebp-0C]
:00415D24 50                      push eax
:00415D25 E895B7FFFF              call 004114BF
:00415D2A 83C404                  add esp, 00000004
:00415D2D 8945F8                  mov dword ptr [ebp-08], eax
:00415D30 6A05                    push 00000005
:00415D32 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00415D35 E8B6240000              call 004181F0
:00415D3A 8B45F8                  mov eax, dword ptr [ebp-08]
:00415D3D 668B4018                mov ax, word ptr [eax+18]
:00415D41 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00415D44 66894116                mov word ptr [ecx+16], ax
:00415D48 E924000000              jmp 00415D71
:00415D4D E91F000000              jmp 00415D71

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415CA1(U)
|
:00415D52 817DD400020000          cmp dword ptr [ebp-2C], 00000200
:00415D59 0F8447FFFFFF            je 00415CA6
:00415D5F 817DD400040000          cmp dword ptr [ebp-2C], 00000400
:00415D66 0F84A9FFFFFF            je 00415D15
:00415D6C E900000000              jmp 00415D71

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00415D10(U), :00415D48(U), :00415D4D(U), :00415D6C(U)
|
:00415D71 8B45F0                  mov eax, dword ptr [ebp-10]
:00415D74 50                      push eax
:00415D75 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00415D78 E803210000              call 00417E80

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415C79(C)
|
:00415D7D E869DBFFFF              call 004138EB
:00415D82 E8FBFAFFFF              call 00415882

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415BA2(C)
|
:00415D87 E91E010000              jmp 00415EAA
:00415D8C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00415D8F E878110000              call 00416F0C
:00415D94 0FB7C0                  movzx eax, ax
:00415D97 3DFFFF0000              cmp eax, 0000FFFF
:00415D9C 0F859D000000            jne 00415E3F
:00415DA2 8B45F8                  mov eax, dword ptr [ebp-08]
:00415DA5 50                      push eax
:00415DA6 E82DFBFFFF              call 004158D8
:00415DAB 83C404                  add esp, 00000004
:00415DAE E838DBFFFF              call 004138EB
:00415DB3 68FE000000              push 000000FE
:00415DB8 6A02                    push 00000002
:00415DBA E875F6FFFF              call 00415434
:00415DBF 83C408                  add esp, 00000008
:00415DC2 8945DC                  mov dword ptr [ebp-24], eax
:00415DC5 C745E000AA4600          mov [ebp-20], 0046AA00
:00415DCC 6A00                    push 00000000
:00415DCE 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00415DD1 E80ABDFEFF              call 00401AE0
:00415DD6 6A00                    push 00000000
:00415DD8 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00415DDB E830BCFEFF              call 00401A10
:00415DE0 6A00                    push 00000000
:00415DE2 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00415DE5 E866BBFEFF              call 00401950
:00415DEA 830D7853450002          or dword ptr [00455378], 00000002
:00415DF1 837DDC04                cmp dword ptr [ebp-24], 00000004
:00415DF5 0F8417000000            je 00415E12
:00415DFB 817DDCFFFF0000          cmp dword ptr [ebp-24], 0000FFFF
:00415E02 0F840A000000            je 00415E12
:00415E08 837DDC00                cmp dword ptr [ebp-24], 00000000
:00415E0C 0F8528000000            jne 00415E3A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00415DF5(C), :00415E02(C)
|
:00415E12 6A00                    push 00000000
:00415E14 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00415E17 E804BAFEFF              call 00401820
:00415E1C 6A00                    push 00000000
:00415E1E 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00415E21 E82ABBFEFF              call 00401950
:00415E26 6A01                    push 00000001
:00415E28 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00415E2B E8E0BBFEFF              call 00401A10
:00415E30 6A01                    push 00000001
:00415E32 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00415E35 E8A6BCFEFF              call 00401AE0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415E0C(C)
|
:00415E3A E843FAFFFF              call 00415882

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415D9C(C)
|
:00415E3F E966000000              jmp 00415EAA
:00415E44 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00415E47 E8C0100000              call 00416F0C
:00415E4C 0FB7C0                  movzx eax, ax
:00415E4F 3DFFFF0000              cmp eax, 0000FFFF
:00415E54 0F8511000000            jne 00415E6B
:00415E5A 8B45F8                  mov eax, dword ptr [ebp-08]
:00415E5D 50                      push eax
:00415E5E E875FAFFFF              call 004158D8
:00415E63 83C404                  add esp, 00000004
:00415E66 E880DAFFFF              call 004138EB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415E54(C)
|
:00415E6B E93A000000              jmp 00415EAA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415E8A(C)
|
:00415E70 8B45F8                  mov eax, dword ptr [ebp-08]
:00415E73 50                      push eax
:00415E74 E85FFAFFFF              call 004158D8
:00415E79 83C404                  add esp, 00000004
:00415E7C E929000000              jmp 00415EAA
:00415E81 E924000000              jmp 00415EAA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415B4C(U)
|
:00415E86 837DD803                cmp dword ptr [ebp-28], 00000003
:00415E8A 0F87E0FFFFFF            ja 00415E70
:00415E90 8B45D8                  mov eax, dword ptr [ebp-28]
:00415E93 FF24859A5E4100          jmp dword ptr [4*eax+00415E9A]

:00415E9A 925B4100                DWORD 00415B92
:00415E9E 8C5D4100                DWORD 00415D8C
:00415EA2 445E4100                DWORD 00415E44
:00415EA6 515B4100                DWORD 00415B51



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00415B8D(U), :00415D87(U), :00415E3F(U), :00415E6B(U), :00415E7C(U)
|:00415E81(U)
|
:00415EAA E900000000              jmp 00415EAF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415ACE(U)
|
:00415EAF 5F                      pop edi
:00415EB0 5E                      pop esi
:00415EB1 5B                      pop ebx
:00415EB2 C9                      leave
:00415EB3 C3                      ret



* Referenced by a CALL at Address:
|:00416DAF   
|
:00415EB4 55                      push ebp
:00415EB5 8BEC                    mov ebp, esp
:00415EB7 53                      push ebx
:00415EB8 56                      push esi
:00415EB9 57                      push edi
:00415EBA E900000000              jmp 00415EBF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415EBA(U)
|
:00415EBF 5F                      pop edi
:00415EC0 5E                      pop esi
:00415EC1 5B                      pop ebx
:00415EC2 C9                      leave
:00415EC3 C3                      ret



* Referenced by a CALL at Address:
|:00416DCB   
|
:00415EC4 55                      push ebp
:00415EC5 8BEC                    mov ebp, esp
:00415EC7 83EC14                  sub esp, 00000014
:00415ECA 53                      push ebx
:00415ECB 56                      push esi
:00415ECC 57                      push edi
:00415ECD 6A00                    push 00000000
:00415ECF E8EBB5FFFF              call 004114BF
:00415ED4 83C404                  add esp, 00000004
:00415ED7 8945F8                  mov dword ptr [ebp-08], eax
:00415EDA 66C745F00000            mov [ebp-10], 0000
:00415EE0 E908000000              jmp 00415EED

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00415F2F(U), :00415FE5(U)
|
:00415EE5 66FF45F0                inc [ebp-10]
:00415EE9 8345F83E                add dword ptr [ebp-08], 0000003E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415EE0(U)
|
:00415EED 8B45F0                  mov eax, dword ptr [ebp-10]
:00415EF0 25FFFF0000              and eax, 0000FFFF
:00415EF5 3D80000000              cmp eax, 00000080
:00415EFA 0F8DEA000000            jnl 00415FEA
:00415F00 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00415F03 E8581C0000              call 00417B60
:00415F08 668945F4                mov word ptr [ebp-0C], ax
:00415F0C F645F580                test [ebp-0B], 80
:00415F10 0F8419000000            je 00415F2F
:00415F16 33C0                    xor eax, eax
:00415F18 66A158F74500            mov ax, word ptr [0045F758]
:00415F1E 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00415F21 81E1FFFF0000            and ecx, 0000FFFF
:00415F27 3BC1                    cmp eax, ecx
:00415F29 0F8505000000            jne 00415F34

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415F10(C)
|
:00415F2F E9B1FFFFFF              jmp 00415EE5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415F29(C)
|
:00415F34 66C745FC0000            mov [ebp-04], 0000
:00415F3A 8B45F4                  mov eax, dword ptr [ebp-0C]
:00415F3D 2501200000              and eax, 00002001
:00415F42 3D01200000              cmp eax, 00002001
:00415F47 0F8516000000            jne 00415F63
:00415F4D 33C0                    xor eax, eax
:00415F4F 66A150194600            mov ax, word ptr [00461950]
:00415F55 85C0                    test eax, eax
:00415F57 0F8506000000            jne 00415F63
:00415F5D 66C745FC1700            mov [ebp-04], 0017

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00415F47(C), :00415F57(C)
|
:00415F63 8B45FC                  mov eax, dword ptr [ebp-04]
:00415F66 50                      push eax
:00415F67 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00415F6A E8B11C0000              call 00417C20
:00415F6F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00415F72 E819220000              call 00418190
:00415F77 0FB7C0                  movzx eax, ax
:00415F7A 8945EC                  mov dword ptr [ebp-14], eax
:00415F7D E94A000000              jmp 00415FCC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415FD0(C)
|
:00415F82 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00415F85 E8820F0000              call 00416F0C
:00415F8A 0FB7C0                  movzx eax, ax
:00415F8D 3DFFFF0000              cmp eax, 0000FFFF
:00415F92 0F850C000000            jne 00415FA4
:00415F98 8B45F8                  mov eax, dword ptr [ebp-08]
:00415F9B 50                      push eax
:00415F9C E837F9FFFF              call 004158D8
:00415FA1 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415F92(C)
|
:00415FA4 E93C000000              jmp 00415FE5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415FDA(C)
|
:00415FA9 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00415FAC E8A60E0000              call 00416E57
:00415FB1 E92F000000              jmp 00415FE5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415FE0(U)
|
:00415FB6 8B45F8                  mov eax, dword ptr [ebp-08]
:00415FB9 50                      push eax
:00415FBA E819F9FFFF              call 004158D8
:00415FBF 83C404                  add esp, 00000004
:00415FC2 E91E000000              jmp 00415FE5
:00415FC7 E919000000              jmp 00415FE5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415F7D(U)
|
:00415FCC 837DEC02                cmp dword ptr [ebp-14], 00000002
:00415FD0 0F84ACFFFFFF            je 00415F82
:00415FD6 837DEC05                cmp dword ptr [ebp-14], 00000005
:00415FDA 0F84C9FFFFFF            je 00415FA9
:00415FE0 E9D1FFFFFF              jmp 00415FB6

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00415FA4(U), :00415FB1(U), :00415FC2(U), :00415FC7(U)
|
:00415FE5 E9FBFEFFFF              jmp 00415EE5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415EFA(C)
|
:00415FEA E900000000              jmp 00415FEF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415FEA(U)
|
:00415FEF 5F                      pop edi
:00415FF0 5E                      pop esi
:00415FF1 5B                      pop ebx
:00415FF2 C9                      leave
:00415FF3 C3                      ret



* Referenced by a CALL at Address:
|:00416DA0   
|
:00415FF4 55                      push ebp
:00415FF5 8BEC                    mov ebp, esp
:00415FF7 53                      push ebx
:00415FF8 56                      push esi
:00415FF9 57                      push edi
:00415FFA C7057853450000000000    mov dword ptr [00455378], 00000000
:00416004 B988534500              mov ecx, 00455388
:00416009 E8E4BCFEFF              call 00401CF2
:0041600E E86A140200              call 0043747D
:00416013 A380534500              mov dword ptr [00455380], eax
:00416018 E900000000              jmp 0041601D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416018(U)
|
:0041601D 5F                      pop edi
:0041601E 5E                      pop esi
:0041601F 5B                      pop ebx
:00416020 C9                      leave
:00416021 C3                      ret



* Referenced by a CALL at Addresses:
|:004160F4   , :00416837   
|
:00416022 55                      push ebp
:00416023 8BEC                    mov ebp, esp
:00416025 83EC08                  sub esp, 00000008
:00416028 53                      push ebx
:00416029 56                      push esi
:0041602A 57                      push edi
:0041602B 6A00                    push 00000000
:0041602D E88DB4FFFF              call 004114BF
:00416032 83C404                  add esp, 00000004
:00416035 8945FC                  mov dword ptr [ebp-04], eax
:00416038 66C745F80000            mov [ebp-08], 0000
:0041603E E908000000              jmp 0041604B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041606D(U)
|
:00416043 66FF45F8                inc [ebp-08]
:00416047 8345FC3E                add dword ptr [ebp-04], 0000003E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041603E(U)
|
:0041604B 8B45F8                  mov eax, dword ptr [ebp-08]
:0041604E 25FFFF0000              and eax, 0000FFFF
:00416053 3D80000000              cmp eax, 00000080
:00416058 0F8D14000000            jnl 00416072
:0041605E 6800200000              push 00002000
:00416063 6A00                    push 00000000
:00416065 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00416068 E8E31B0000              call 00417C50
:0041606D E9D1FFFFFF              jmp 00416043

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416058(C)
|
:00416072 E900000000              jmp 00416077

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416072(U)
|
:00416077 5F                      pop edi
:00416078 5E                      pop esi
:00416079 5B                      pop ebx
:0041607A C9                      leave
:0041607B C3                      ret



* Referenced by a CALL at Address:
|:0040109F   
|
:0041607C 55                      push ebp
:0041607D 8BEC                    mov ebp, esp
:0041607F 83EC0C                  sub esp, 0000000C
:00416082 53                      push ebx
:00416083 56                      push esi
:00416084 57                      push edi
:00416085 8B4D08                  mov ecx, dword ptr [ebp+08]
:00416088 E853240000              call 004184E0
:0041608D 50                      push eax
:0041608E E8DCEAFFFF              call 00414B6F
:00416093 83C404                  add esp, 00000004
:00416096 668945FC                mov word ptr [ebp-04], ax
:0041609A 8B45FC                  mov eax, dword ptr [ebp-04]
:0041609D 25FFFF0000              and eax, 0000FFFF
:004160A2 3DFFFF0000              cmp eax, 0000FFFF
:004160A7 0F8507000000            jne 004160B4
:004160AD 33C0                    xor eax, eax
:004160AF E92B000000              jmp 004160DF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004160A7(C)
|
:004160B4 8D45F4                  lea eax, dword ptr [ebp-0C]
:004160B7 50                      push eax
:004160B8 8D45F8                  lea eax, dword ptr [ebp-08]
:004160BB 50                      push eax
:004160BC 8B45FC                  mov eax, dword ptr [ebp-04]
:004160BF 50                      push eax
:004160C0 E8FAB3FFFF              call 004114BF
:004160C5 83C404                  add esp, 00000004
:004160C8 8BC8                    mov ecx, eax
:004160CA E8B1240000              call 00418580
:004160CF 8B45F4                  mov eax, dword ptr [ebp-0C]
:004160D2 25FFFF0000              and eax, 0000FFFF
:004160D7 83C028                  add eax, 00000028
:004160DA E900000000              jmp 004160DF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004160AF(U), :004160DA(U)
|
:004160DF 5F                      pop edi
:004160E0 5E                      pop esi
:004160E1 5B                      pop ebx
:004160E2 C9                      leave
:004160E3 C3                      ret



* Referenced by a CALL at Address:
|:0043769C   
|
:004160E4 55                      push ebp
:004160E5 8BEC                    mov ebp, esp
:004160E7 53                      push ebx
:004160E8 56                      push esi
:004160E9 57                      push edi
:004160EA 837D0800                cmp dword ptr [ebp+08], 00000000
:004160EE 0F8505000000            jne 004160F9
:004160F4 E829FFFFFF              call 00416022

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004160EE(C)
|
:004160F9 E884F7FFFF              call 00415882
:004160FE E900000000              jmp 00416103

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004160FE(U)
|
:00416103 5F                      pop edi
:00416104 5E                      pop esi
:00416105 5B                      pop ebx
:00416106 C9                      leave
:00416107 C3                      ret


:00416108 55                      push ebp
:00416109 8BEC                    mov ebp, esp
:0041610B 83EC18                  sub esp, 00000018
:0041610E 53                      push ebx
:0041610F 56                      push esi
:00416110 57                      push edi
:00416111 C745ECE8564500          mov [ebp-14], 004556E8
:00416118 66C745E80000            mov [ebp-18], 0000
:0041611E E908000000              jmp 0041612B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416208(U)
|
:00416123 66FF45E8                inc [ebp-18]
:00416127 8345EC36                add dword ptr [ebp-14], 00000036

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041611E(U)
|
:0041612B 8B45E8                  mov eax, dword ptr [ebp-18]
:0041612E 25FFFF0000              and eax, 0000FFFF
:00416133 3D00020000              cmp eax, 00000200
:00416138 0F8DCF000000            jnl 0041620D
:0041613E 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00416141 E80AADFFFF              call 00410E50
:00416146 8845FC                  mov byte ptr [ebp-04], al
:00416149 33C0                    xor eax, eax
:0041614B 8A45FC                  mov al, byte ptr [ebp-04]
:0041614E 85C0                    test eax, eax
:00416150 0F840E000000            je 00416164
:00416156 33C0                    xor eax, eax
:00416158 8A45FC                  mov al, byte ptr [ebp-04]
:0041615B 83F806                  cmp eax, 00000006
:0041615E 0F85A4000000            jne 00416208

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00416150(C), :00416203(U)
|
:00416164 68FF000000              push 000000FF
:00416169 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041616C E8BB6AFFFF              call 0040CC2C
:00416171 660FB6C0                movzx ax, al
:00416175 668945F0                mov word ptr [ebp-10], ax
:00416179 8B45F0                  mov eax, dword ptr [ebp-10]
:0041617C 25FFFF0000              and eax, 0000FFFF
:00416181 3DFF000000              cmp eax, 000000FF
:00416186 0F8505000000            jne 00416191
:0041618C E977000000              jmp 00416208

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00416186(C), :004161EE(U)
|
:00416191 68FF000000              push 000000FF
:00416196 E88D110300              call 00447328
:0041619B 83C404                  add esp, 00000004
:0041619E 668945F8                mov word ptr [ebp-08], ax
:004161A2 8B45F8                  mov eax, dword ptr [ebp-08]
:004161A5 25FFFF0000              and eax, 0000FFFF
:004161AA 50                      push eax
:004161AB E82B840000              call 0041E5DB
:004161B0 83C404                  add esp, 00000004
:004161B3 8945F4                  mov dword ptr [ebp-0C], eax
:004161B6 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004161B9 E86234FFFF              call 00409620
:004161BE 33C9                    xor ecx, ecx
:004161C0 8AC8                    mov cl, al
:004161C2 83F919                  cmp ecx, 00000019
:004161C5 0F8C23000000            jl 004161EE

* Possible StringData Ref from Data Obj ->"û"
                                  |
:004161CB 6880F74400              push 0044F780
:004161D0 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004161D3 E88833FFFF              call 00409560
:004161D8 50                      push eax
:004161D9 E835120300              call 00447413
:004161DE 83C408                  add esp, 00000008
:004161E1 85C0                    test eax, eax
:004161E3 0F8405000000            je 004161EE
:004161E9 E905000000              jmp 004161F3

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004161C5(C), :004161E3(C)
|
:004161EE E99EFFFFFF              jmp 00416191

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004161E9(U)
|
:004161F3 8B45F8                  mov eax, dword ptr [ebp-08]
:004161F6 50                      push eax
:004161F7 8B45F0                  mov eax, dword ptr [ebp-10]
:004161FA 50                      push eax
:004161FB 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004161FE E82D33FFFF              call 00409530
:00416203 E95CFFFFFF              jmp 00416164

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041615E(C), :0041618C(U)
|
:00416208 E916FFFFFF              jmp 00416123

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416138(C)
|
:0041620D E900000000              jmp 00416212

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041620D(U)
|
:00416212 5F                      pop edi
:00416213 5E                      pop esi
:00416214 5B                      pop ebx
:00416215 C9                      leave
:00416216 C3                      ret


:00416217 55                      push ebp
:00416218 8BEC                    mov ebp, esp
:0041621A 83EC18                  sub esp, 00000018
:0041621D 53                      push ebx
:0041621E 56                      push esi
:0041621F 57                      push edi
:00416220 C745ECE8564500          mov [ebp-14], 004556E8
:00416227 66C745E80000            mov [ebp-18], 0000
:0041622D E908000000              jmp 0041623A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416302(U)
|
:00416232 66FF45E8                inc [ebp-18]
:00416236 8345EC36                add dword ptr [ebp-14], 00000036

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041622D(U)
|
:0041623A 8B45E8                  mov eax, dword ptr [ebp-18]
:0041623D 25FFFF0000              and eax, 0000FFFF
:00416242 3D00020000              cmp eax, 00000200
:00416247 0F8DBA000000            jnl 00416307
:0041624D 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00416250 E8FBABFFFF              call 00410E50
:00416255 8845FC                  mov byte ptr [ebp-04], al
:00416258 33C0                    xor eax, eax
:0041625A 8A45FC                  mov al, byte ptr [ebp-04]
:0041625D 85C0                    test eax, eax
:0041625F 0F840E000000            je 00416273
:00416265 33C0                    xor eax, eax
:00416267 8A45FC                  mov al, byte ptr [ebp-04]
:0041626A 83F806                  cmp eax, 00000006
:0041626D 0F858F000000            jne 00416302

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041625F(C), :004162FD(U)
|
:00416273 68FF000000              push 000000FF
:00416278 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041627B E8AC69FFFF              call 0040CC2C
:00416280 660FB6C0                movzx ax, al
:00416284 668945F0                mov word ptr [ebp-10], ax
:00416288 8B45F0                  mov eax, dword ptr [ebp-10]
:0041628B 25FFFF0000              and eax, 0000FFFF
:00416290 3DFF000000              cmp eax, 000000FF
:00416295 0F8505000000            jne 004162A0
:0041629B E962000000              jmp 00416302

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00416295(C), :004162E8(U)
|
:004162A0 68FF000000              push 000000FF
:004162A5 E87E100300              call 00447328
:004162AA 83C404                  add esp, 00000004
:004162AD 668945F8                mov word ptr [ebp-08], ax
:004162B1 8B45F8                  mov eax, dword ptr [ebp-08]
:004162B4 25FFFF0000              and eax, 0000FFFF
:004162B9 50                      push eax
:004162BA E81C830000              call 0041E5DB
:004162BF 83C404                  add esp, 00000004
:004162C2 8945F4                  mov dword ptr [ebp-0C], eax

* Possible StringData Ref from Data Obj ->"û"
                                  |
:004162C5 6888F74400              push 0044F788
:004162CA 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004162CD E88E32FFFF              call 00409560
:004162D2 50                      push eax
:004162D3 E83B110300              call 00447413
:004162D8 83C408                  add esp, 00000008
:004162DB 85C0                    test eax, eax
:004162DD 0F8405000000            je 004162E8
:004162E3 E905000000              jmp 004162ED

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004162DD(C)
|
:004162E8 E9B3FFFFFF              jmp 004162A0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004162E3(U)
|
:004162ED 8B45F8                  mov eax, dword ptr [ebp-08]
:004162F0 50                      push eax
:004162F1 8B45F0                  mov eax, dword ptr [ebp-10]
:004162F4 50                      push eax
:004162F5 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004162F8 E83332FFFF              call 00409530
:004162FD E971FFFFFF              jmp 00416273

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041626D(C), :0041629B(U)
|
:00416302 E92BFFFFFF              jmp 00416232

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416247(C)
|
:00416307 E900000000              jmp 0041630C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416307(U)
|
:0041630C 5F                      pop edi
:0041630D 5E                      pop esi
:0041630E 5B                      pop ebx
:0041630F C9                      leave
:00416310 C3                      ret


:00416311 55                      push ebp
:00416312 8BEC                    mov ebp, esp
:00416314 83EC10                  sub esp, 00000010
:00416317 53                      push ebx
:00416318 56                      push esi
:00416319 57                      push edi
:0041631A C745F8E8564500          mov [ebp-08], 004556E8
:00416321 66C745F40000            mov [ebp-0C], 0000
:00416327 E908000000              jmp 00416334

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004163A3(U)
|
:0041632C 66FF45F4                inc [ebp-0C]
:00416330 8345F836                add dword ptr [ebp-08], 00000036

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416327(U)
|
:00416334 8B45F4                  mov eax, dword ptr [ebp-0C]
:00416337 25FFFF0000              and eax, 0000FFFF
:0041633C 3D00020000              cmp eax, 00000200
:00416341 0F8D61000000            jnl 004163A8
:00416347 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041634A E801ABFFFF              call 00410E50
:0041634F 8845FC                  mov byte ptr [ebp-04], al
:00416352 33C0                    xor eax, eax
:00416354 8A45FC                  mov al, byte ptr [ebp-04]
:00416357 85C0                    test eax, eax
:00416359 0F840E000000            je 0041636D
:0041635F 33C0                    xor eax, eax
:00416361 8A45FC                  mov al, byte ptr [ebp-04]
:00416364 83F806                  cmp eax, 00000006
:00416367 0F8536000000            jne 004163A3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416359(C)
|
:0041636D 66C745F00000            mov [ebp-10], 0000
:00416373 E904000000              jmp 0041637C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041639E(U)
|
:00416378 66FF45F0                inc [ebp-10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416373(U)
|
:0041637C 8B45F0                  mov eax, dword ptr [ebp-10]
:0041637F 25FFFF0000              and eax, 0000FFFF
:00416384 83F80F                  cmp eax, 0000000F
:00416387 0F8D16000000            jnl 004163A3
:0041638D 68FF000000              push 000000FF
:00416392 8B45F0                  mov eax, dword ptr [ebp-10]
:00416395 50                      push eax
:00416396 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00416399 E89231FFFF              call 00409530
:0041639E E9D5FFFFFF              jmp 00416378

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00416367(C), :00416387(C)
|
:004163A3 E984FFFFFF              jmp 0041632C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416341(C)
|
:004163A8 E900000000              jmp 004163AD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004163A8(U)
|
:004163AD 5F                      pop edi
:004163AE 5E                      pop esi
:004163AF 5B                      pop ebx
:004163B0 C9                      leave
:004163B1 C3                      ret


:004163B2 55                      push ebp
:004163B3 8BEC                    mov ebp, esp
:004163B5 83EC0C                  sub esp, 0000000C
:004163B8 53                      push ebx
:004163B9 56                      push esi
:004163BA 57                      push edi
:004163BB 68409C0000              push 00009C40
:004163C0 B9D0A64600              mov ecx, 0046A6D0
:004163C5 E8F6210000              call 004185C0
:004163CA 68AC260000              push 000026AC
:004163CF B9D0A64600              mov ecx, 0046A6D0
:004163D4 E8C755FFFF              call 0040B9A0
:004163D9 C745F8E8564500          mov [ebp-08], 004556E8
:004163E0 66C745F40000            mov [ebp-0C], 0000
:004163E6 E908000000              jmp 004163F3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004164B8(U)
|
:004163EB 66FF45F4                inc [ebp-0C]
:004163EF 8345F836                add dword ptr [ebp-08], 00000036

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004163E6(U)
|
:004163F3 8B45F4                  mov eax, dword ptr [ebp-0C]
:004163F6 25FFFF0000              and eax, 0000FFFF
:004163FB 3D00020000              cmp eax, 00000200
:00416400 0F8DB7000000            jnl 004164BD
:00416406 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00416409 E842AAFFFF              call 00410E50
:0041640E 8845FC                  mov byte ptr [ebp-04], al
:00416411 33C0                    xor eax, eax
:00416413 8A45FC                  mov al, byte ptr [ebp-04]
:00416416 85C0                    test eax, eax
:00416418 0F840E000000            je 0041642C
:0041641E 33C0                    xor eax, eax
:00416420 8A45FC                  mov al, byte ptr [ebp-04]
:00416423 83F806                  cmp eax, 00000006
:00416426 0F8550000000            jne 0041647C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416418(C)
|
:0041642C 68FA000000              push 000000FA
:00416431 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00416434 E8F779FFFF              call 0040DE30
:00416439 68FA000000              push 000000FA
:0041643E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00416441 E8BA79FFFF              call 0040DE00
:00416446 68FA000000              push 000000FA
:0041644B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041644E E80D7AFFFF              call 0040DE60
:00416453 68DE030000              push 000003DE
:00416458 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041645B E8607AFFFF              call 0040DEC0
:00416460 68FA000000              push 000000FA
:00416465 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00416468 E8237AFFFF              call 0040DE90
:0041646D 6A5A                    push 0000005A
:0041646F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00416472 E869210000              call 004185E0
:00416477 E93C000000              jmp 004164B8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416426(C)
|
:0041647C 6A01                    push 00000001
:0041647E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00416481 E8AA79FFFF              call 0040DE30
:00416486 6A01                    push 00000001
:00416488 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041648B E87079FFFF              call 0040DE00
:00416490 6A01                    push 00000001
:00416492 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00416495 E8C679FFFF              call 0040DE60
:0041649A 6A01                    push 00000001
:0041649C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041649F E81C7AFFFF              call 0040DEC0
:004164A4 6A01                    push 00000001
:004164A6 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004164A9 E8E279FFFF              call 0040DE90
:004164AE 6A01                    push 00000001
:004164B0 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004164B3 E828210000              call 004185E0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416477(U)
|
:004164B8 E92EFFFFFF              jmp 004163EB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416400(C)
|
:004164BD E900000000              jmp 004164C2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004164BD(U)
|
:004164C2 5F                      pop edi
:004164C3 5E                      pop esi
:004164C4 5B                      pop ebx
:004164C5 C9                      leave
:004164C6 C3                      ret


:004164C7 55                      push ebp
:004164C8 8BEC                    mov ebp, esp
:004164CA 53                      push ebx
:004164CB 56                      push esi
:004164CC 57                      push edi
:004164CD 6AFF                    push FFFFFFFF
:004164CF E8CBB1FEFF              call 0040169F
:004164D4 83C404                  add esp, 00000004
:004164D7 E900000000              jmp 004164DC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004164D7(U)
|
:004164DC 5F                      pop edi
:004164DD 5E                      pop esi
:004164DE 5B                      pop ebx
:004164DF C9                      leave
:004164E0 C3                      ret


:004164E1 55                      push ebp
:004164E2 8BEC                    mov ebp, esp
:004164E4 83EC38                  sub esp, 00000038
:004164E7 53                      push ebx
:004164E8 56                      push esi
:004164E9 57                      push edi
:004164EA C745C808494500          mov [ebp-38], 00454908
:004164F1 B900AA4600              mov ecx, 0046AA00
:004164F6 E855B3FEFF              call 00401850
:004164FB 33C9                    xor ecx, ecx
:004164FD 8AC8                    mov cl, al
:004164FF 83F902                  cmp ecx, 00000002
:00416502 0F854B010000            jne 00416653
:00416508 8B45C8                  mov eax, dword ptr [ebp-38]
:0041650B 8945D8                  mov dword ptr [ebp-28], eax
:0041650E C745FCD8D54500          mov [ebp-04], 0045D5D8
:00416515 66C745D00000            mov [ebp-30], 0000
:0041651B 66C745D40000            mov [ebp-2C], 0000
:00416521 E908000000              jmp 0041652E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041656E(U), :004165D1(U)
|
:00416526 66FF45D4                inc [ebp-2C]
:0041652A 8345FC3E                add dword ptr [ebp-04], 0000003E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416521(U)
|
:0041652E 8B45D4                  mov eax, dword ptr [ebp-2C]
:00416531 25FFFF0000              and eax, 0000FFFF
:00416536 3D80000000              cmp eax, 00000080
:0041653B 0F8D95000000            jnl 004165D6
:00416541 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00416544 E817160000              call 00417B60
:00416549 0FB7C0                  movzx eax, ax
:0041654C F6C480                  test ah, 80
:0041654F 0F8419000000            je 0041656E
:00416555 33C0                    xor eax, eax
:00416557 66A158F74500            mov ax, word ptr [0045F758]
:0041655D 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:00416560 81E1FFFF0000            and ecx, 0000FFFF
:00416566 3BC1                    cmp eax, ecx
:00416568 0F8505000000            jne 00416573

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041654F(C)
|
:0041656E E9B3FFFFFF              jmp 00416526

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416568(C)
|
:00416573 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00416576 E8D51C0000              call 00418250
:0041657B 50                      push eax
:0041657C E803ABFFFF              call 00411084
:00416581 83C404                  add esp, 00000004
:00416584 0FB7C0                  movzx eax, ax
:00416587 3D00020000              cmp eax, 00000200
:0041658C 0F853F000000            jne 004165D1
:00416592 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00416595 E8B61C0000              call 00418250
:0041659A 0FB7C0                  movzx eax, ax
:0041659D 25FF01FFFF              and eax, FFFF01FF
:004165A2 50                      push eax
:004165A3 E831890000              call 0041EED9
:004165A8 83C404                  add esp, 00000004
:004165AB 8BC8                    mov ecx, eax
:004165AD E82E2FFFFF              call 004094E0
:004165B2 8B4DD8                  mov ecx, dword ptr [ebp-28]
:004165B5 8901                    mov dword ptr [ecx], eax
:004165B7 8345D804                add dword ptr [ebp-28], 00000004
:004165BB 668B45D4                mov ax, word ptr [ebp-2C]
:004165BF 8B4DD0                  mov ecx, dword ptr [ebp-30]
:004165C2 81E1FFFF0000            and ecx, 0000FFFF
:004165C8 6689444DDC              mov word ptr [ebp+2*ecx-24], ax
:004165CD 66FF45D0                inc [ebp-30]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041658C(C)
|
:004165D1 E950FFFFFF              jmp 00416526

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041653B(C)
|
:004165D6 8B45D8                  mov eax, dword ptr [ebp-28]
:004165D9 C70000000000            mov dword ptr [eax], 00000000
:004165DF F745D0FFFF0000          test [ebp-30], 0000FFFF
:004165E6 0F8467000000            je 00416653
:004165EC 6A00                    push 00000000
:004165EE 6A00                    push 00000000
:004165F0 6A00                    push 00000000
:004165F2 6880000000              push 00000080
:004165F7 6A04                    push 00000004
:004165F9 8B45C8                  mov eax, dword ptr [ebp-38]
:004165FC 50                      push eax
:004165FD 6A01                    push 00000001
:004165FF 6A01                    push 00000001
:00416601 E8EE170200              call 00437DF4
:00416606 83C420                  add esp, 00000020
:00416609 660FB6C0                movzx ax, al
:0041660D 668945CC                mov word ptr [ebp-34], ax
:00416611 8B45CC                  mov eax, dword ptr [ebp-34]
:00416614 25FFFF0000              and eax, 0000FFFF
:00416619 3DFF000000              cmp eax, 000000FF
:0041661E 0F842F000000            je 00416653
:00416624 8B45CC                  mov eax, dword ptr [ebp-34]
:00416627 25FFFF0000              and eax, 0000FFFF
:0041662C 8B4445DC                mov eax, dword ptr [ebp+2*eax-24]
:00416630 50                      push eax
:00416631 E889AEFFFF              call 004114BF
:00416636 83C404                  add esp, 00000004
:00416639 8BC8                    mov ecx, eax
:0041663B E8101C0000              call 00418250
:00416640 0FB7C0                  movzx eax, ax
:00416643 25FF01FFFF              and eax, FFFF01FF
:00416648 50                      push eax
:00416649 6A01                    push 00000001
:0041664B E8E4EDFFFF              call 00415434
:00416650 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00416502(C), :004165E6(C), :0041661E(C)
|
:00416653 E900000000              jmp 00416658

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416653(U)
|
:00416658 5F                      pop edi
:00416659 5E                      pop esi
:0041665A 5B                      pop ebx
:0041665B C9                      leave
:0041665C C3                      ret


:0041665D 55                      push ebp
:0041665E 8BEC                    mov ebp, esp
:00416660 83EC10                  sub esp, 00000010
:00416663 53                      push ebx
:00416664 56                      push esi
:00416665 57                      push edi
:00416666 66C745F00000            mov [ebp-10], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004167B8(U)
|
:0041666C 68027F0000              push 00007F02
:00416671 6A00                    push 00000000

* Reference To: USER32.LoadCursorA, Ord:0167h
                                  |
:00416673 FF15B4744700            Call dword ptr [004774B4]
:00416679 50                      push eax

* Reference To: USER32.SetCursor, Ord:01D8h
                                  |
:0041667A FF157C744700            Call dword ptr [0047747C]
:00416680 8945F4                  mov dword ptr [ebp-0C], eax
:00416683 E80F090100              call 00426F97
:00416688 66C745F82800            mov [ebp-08], 0028
:0041668E E90F000000              jmp 004166A2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416791(U)
|
:00416693 8B45F8                  mov eax, dword ptr [ebp-08]
:00416696 25FFFF0000              and eax, 0000FFFF
:0041669B 83C050                  add eax, 00000050
:0041669E 668945F8                mov word ptr [ebp-08], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041668E(U)
|
:004166A2 8B45F8                  mov eax, dword ptr [ebp-08]
:004166A5 25FFFF0000              and eax, 0000FFFF
:004166AA 3DB8010000              cmp eax, 000001B8
:004166AF 0F8DE1000000            jnl 00416796
:004166B5 66C745FC0000            mov [ebp-04], 0000
:004166BB E90F000000              jmp 004166CF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041678C(U)
|
:004166C0 8B45FC                  mov eax, dword ptr [ebp-04]
:004166C3 25FFFF0000              and eax, 0000FFFF
:004166C8 83C040                  add eax, 00000040
:004166CB 668945FC                mov word ptr [ebp-04], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004166BB(U)
|
:004166CF 8B45FC                  mov eax, dword ptr [ebp-04]
:004166D2 25FFFF0000              and eax, 0000FFFF
:004166D7 3D80020000              cmp eax, 00000280
:004166DC 0F8DAF000000            jnl 00416791
:004166E2 8B45F0                  mov eax, dword ptr [ebp-10]
:004166E5 25FFFF0000              and eax, 0000FFFF
:004166EA 50                      push eax
:004166EB 8B45F8                  mov eax, dword ptr [ebp-08]
:004166EE 25FFFF0000              and eax, 0000FFFF
:004166F3 50                      push eax
:004166F4 8B45FC                  mov eax, dword ptr [ebp-04]
:004166F7 25FFFF0000              and eax, 0000FFFF
:004166FC 50                      push eax
:004166FD E8DB090100              call 004270DD
:00416702 83C40C                  add esp, 0000000C
:00416705 8B45F8                  mov eax, dword ptr [ebp-08]
:00416708 25FFFF0000              and eax, 0000FFFF
:0041670D 50                      push eax
:0041670E 8B45FC                  mov eax, dword ptr [ebp-04]
:00416711 25FFFF0000              and eax, 0000FFFF
:00416716 C1E803                  shr eax, 03
:00416719 50                      push eax
:0041671A B910BC4600              mov ecx, 0046BC10
:0041671F E8E3940000              call 0041FC07
:00416724 6A01                    push 00000001
:00416726 B910BC4600              mov ecx, 0046BC10
:0041672B E830970000              call 0041FE60
:00416730 8B45F0                  mov eax, dword ptr [ebp-10]
:00416733 25FFFF0000              and eax, 0000FFFF
:00416738 50                      push eax

* Possible StringData Ref from Data Obj ->"C7%d"
                                  |
:00416739 6890F74400              push 0044F790
:0041673E 6810BC4600              push 0046BC10
:00416743 E8DBA30000              call 00420B23
:00416748 83C40C                  add esp, 0000000C
:0041674B 6A00                    push 00000000
:0041674D B910BC4600              mov ecx, 0046BC10
:00416752 E809970000              call 0041FE60
:00416757 66FF45F0                inc [ebp-10]
:0041675B 8B45F0                  mov eax, dword ptr [ebp-10]
:0041675E 25FFFF0000              and eax, 0000FFFF
:00416763 3D20010000              cmp eax, 00000120
:00416768 0F851E000000            jne 0041678C
:0041676E E844080100              call 00426FB7
:00416773 8B45F4                  mov eax, dword ptr [ebp-0C]
:00416776 50                      push eax

* Reference To: USER32.SetCursor, Ord:01D8h
                                  |
:00416777 FF157C744700            Call dword ptr [0047747C]
:0041677D E8870D0200              call 00437509
:00416782 E864D1FFFF              call 004138EB
:00416787 E93B000000              jmp 004167C7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416768(C)
|
:0041678C E92FFFFFFF              jmp 004166C0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004166DC(C)
|
:00416791 E9FDFEFFFF              jmp 00416693

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004166AF(C)
|
:00416796 E81C080100              call 00426FB7
:0041679B 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041679E 50                      push eax

* Reference To: USER32.SetCursor, Ord:01D8h
                                  |
:0041679F FF157C744700            Call dword ptr [0047747C]
:004167A5 E85F0D0200              call 00437509
:004167AA 83F802                  cmp eax, 00000002
:004167AD 0F8505000000            jne 004167B8
:004167B3 E905000000              jmp 004167BD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004167AD(C)
|
:004167B8 E9AFFEFFFF              jmp 0041666C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004167B3(U)
|
:004167BD E829D1FFFF              call 004138EB
:004167C2 E900000000              jmp 004167C7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00416787(U), :004167C2(U)
|
:004167C7 5F                      pop edi
:004167C8 5E                      pop esi
:004167C9 5B                      pop ebx
:004167CA C9                      leave
:004167CB C3                      ret



* Referenced by a CALL at Address:
|:00416DA5   
|
:004167CC 55                      push ebp
:004167CD 8BEC                    mov ebp, esp
:004167CF 83EC30                  sub esp, 00000030
:004167D2 53                      push ebx
:004167D3 56                      push esi
:004167D4 57                      push edi
:004167D5 66C70578A64600FFFF      mov word ptr [0046A678], FFFF

* Possible StringData Ref from Data Obj ->"        "
                                  |
:004167DE A1DCF44400              mov eax, dword ptr [0044F4DC]
:004167E3 A37CA64600              mov dword ptr [0046A67C], eax
:004167E8 B988534500              mov ecx, 00455388
:004167ED E8AE2CFFFF              call 004094A0
:004167F2 668945E0                mov word ptr [ebp-20], ax
:004167F6 B988534500              mov ecx, 00455388
:004167FB E8C02CFFFF              call 004094C0
:00416800 668945D4                mov word ptr [ebp-2C], ax
:00416804 E861FC0200              call 0044646A
:00416809 50                      push eax
:0041680A E80B0B0300              call 0044731A
:0041680F 83C404                  add esp, 00000004
:00416812 E8B5DCFFFF              call 004144CC
:00416817 0FB7C0                  movzx eax, ax
:0041681A 3DFFFF0000              cmp eax, 0000FFFF
:0041681F 0F840D000000            je 00416832
:00416825 E8860E0200              call 004376B0
:0041682A 85C0                    test eax, eax
:0041682C 0F8505000000            jne 00416837

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041681F(C)
|
:00416832 E940040000              jmp 00416C77

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041682C(C)
|
:00416837 E8E6F7FFFF              call 00416022
:0041683C 8B45E0                  mov eax, dword ptr [ebp-20]
:0041683F 25FFFF0000              and eax, 0000FFFF
:00416844 83F808                  cmp eax, 00000008
:00416847 0F8C9B000000            jl 004168E8
:0041684D 8B45E0                  mov eax, dword ptr [ebp-20]
:00416850 25FFFF0000              and eax, 0000FFFF
:00416855 3D10010000              cmp eax, 00000110
:0041685A 0F8D88000000            jnl 004168E8
:00416860 8B45D4                  mov eax, dword ptr [ebp-2C]
:00416863 25FFFF0000              and eax, 0000FFFF
:00416868 83F808                  cmp eax, 00000008
:0041686B 0F8C77000000            jl 004168E8
:00416871 8B45D4                  mov eax, dword ptr [ebp-2C]
:00416874 25FFFF0000              and eax, 0000FFFF
:00416879 83F820                  cmp eax, 00000020
:0041687C 0F8D66000000            jnl 004168E8
:00416882 833D64F94600FF          cmp dword ptr [0046F964], FFFFFFFF
:00416889 0F8559000000            jne 004168E8
:0041688F 8B45E0                  mov eax, dword ptr [ebp-20]
:00416892 25FFFF0000              and eax, 0000FFFF
:00416897 B918000000              mov ecx, 00000018
:0041689C 83E808                  sub eax, 00000008
:0041689F 99                      cdq
:004168A0 F7F9                    idiv ecx
:004168A2 668945E0                mov word ptr [ebp-20], ax
:004168A6 8B45E0                  mov eax, dword ptr [ebp-20]
:004168A9 25FFFF0000              and eax, 0000FFFF
:004168AE 0D00400000              or eax, 00004000
:004168B3 66A378A64600            mov word ptr [0046A678], ax
:004168B9 8B45E0                  mov eax, dword ptr [ebp-20]
:004168BC 25FFFF0000              and eax, 0000FFFF
:004168C1 8B0485E02D4500          mov eax, dword ptr [4*eax+00452DE0]
:004168C8 A37CA64600              mov dword ptr [0046A67C], eax
:004168CD F745E0FFFF0000          test [ebp-20], 0000FFFF
:004168D4 0F8509000000            jne 004168E3
:004168DA 66C70518F545000000      mov word ptr [0045F518], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004168D4(C)
|
:004168E3 E98F030000              jmp 00416C77

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00416847(C), :0041685A(C), :0041686B(C), :0041687C(C), :00416889(C)
|
:004168E8 33C0                    xor eax, eax
:004168EA 66A1C0184600            mov ax, word ptr [004618C0]
:004168F0 85C0                    test eax, eax
:004168F2 0F8E91020000            jle 00416B89
:004168F8 66A1C0184600            mov ax, word ptr [004618C0]
:004168FE 668945D8                mov word ptr [ebp-28], ax
:00416902 E908000000              jmp 0041690F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00416959(U), :00416994(U), :00416B84(U)
|
:00416907 66FF4DD8                dec [ebp-28]
:0041690B 836DF43E                sub dword ptr [ebp-0C], 0000003E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416902(U)
|
:0041690F F745D8FFFF0000          test [ebp-28], 0000FFFF
:00416916 0F846D020000            je 00416B89
:0041691C 8B45D8                  mov eax, dword ptr [ebp-28]
:0041691F 25FFFF0000              and eax, 0000FFFF
:00416924 8B04851CF54500          mov eax, dword ptr [4*eax+0045F51C]
:0041692B 8945F4                  mov dword ptr [ebp-0C], eax
:0041692E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00416931 E82A120000              call 00417B60
:00416936 668945DC                mov word ptr [ebp-24], ax
:0041693A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041693D E80E190000              call 00418250
:00416942 50                      push eax
:00416943 E83CA7FFFF              call 00411084
:00416948 83C404                  add esp, 00000004
:0041694B 0FB7C0                  movzx eax, ax
:0041694E 3D00060000              cmp eax, 00000600
:00416953 0F8505000000            jne 0041695E
:00416959 E9A9FFFFFF              jmp 00416907

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416953(C)
|
:0041695E 8D45D0                  lea eax, dword ptr [ebp-30]
:00416961 50                      push eax
:00416962 8D45E4                  lea eax, dword ptr [ebp-1C]
:00416965 50                      push eax
:00416966 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00416969 E8121C0000              call 00418580
:0041696E 8B45E4                  mov eax, dword ptr [ebp-1C]
:00416971 25FFFF0000              and eax, 0000FFFF
:00416976 3DFFFF0000              cmp eax, 0000FFFF
:0041697B 0F8518000000            jne 00416999
:00416981 8B45D0                  mov eax, dword ptr [ebp-30]
:00416984 25FFFF0000              and eax, 0000FFFF
:00416989 3DFFFF0000              cmp eax, 0000FFFF
:0041698E 0F8505000000            jne 00416999
:00416994 E96EFFFFFF              jmp 00416907

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041697B(C), :0041698E(C)
|
:00416999 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041699C E87F150000              call 00417F20
:004169A1 8945FC                  mov dword ptr [ebp-04], eax
:004169A4 8B45FC                  mov eax, dword ptr [ebp-04]
:004169A7 668B00                  mov ax, word ptr [eax]
:004169AA 668945F0                mov word ptr [ebp-10], ax
:004169AE 8345FC02                add dword ptr [ebp-04], 00000002
:004169B2 8B45FC                  mov eax, dword ptr [ebp-04]
:004169B5 668B00                  mov ax, word ptr [eax]
:004169B8 668945EC                mov word ptr [ebp-14], ax
:004169BC 0FBF45E4                movsx eax, word ptr [ebp-1C]
:004169C0 0FBF4DE0                movsx ecx, word ptr [ebp-20]
:004169C4 3BC1                    cmp eax, ecx
:004169C6 0F8FB8010000            jg 00416B84
:004169CC 8B45F0                  mov eax, dword ptr [ebp-10]
:004169CF 25FFFF0000              and eax, 0000FFFF
:004169D4 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004169D7 81E1FFFF0000            and ecx, 0000FFFF
:004169DD 03C1                    add eax, ecx
:004169DF 0FBFC0                  movsx eax, ax
:004169E2 0FBF4DE0                movsx ecx, word ptr [ebp-20]
:004169E6 3BC1                    cmp eax, ecx
:004169E8 0F8C96010000            jl 00416B84
:004169EE 0FBF45D0                movsx eax, word ptr [ebp-30]
:004169F2 0FBF4DD4                movsx ecx, word ptr [ebp-2C]
:004169F6 3BC1                    cmp eax, ecx
:004169F8 0F8F86010000            jg 00416B84
:004169FE 8B45EC                  mov eax, dword ptr [ebp-14]
:00416A01 25FFFF0000              and eax, 0000FFFF
:00416A06 0FBF4DD0                movsx ecx, word ptr [ebp-30]
:00416A0A 03C1                    add eax, ecx
:00416A0C 0FBF4DD4                movsx ecx, word ptr [ebp-2C]
:00416A10 3BC1                    cmp eax, ecx
:00416A12 0F8C6C010000            jl 00416B84
:00416A18 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00416A1B E830180000              call 00418250
:00416A20 668945E8                mov word ptr [ebp-18], ax
:00416A24 8B45E8                  mov eax, dword ptr [ebp-18]
:00416A27 50                      push eax
:00416A28 E842E1FFFF              call 00414B6F
:00416A2D 83C404                  add esp, 00000004
:00416A30 668945EC                mov word ptr [ebp-14], ax
:00416A34 8B45EC                  mov eax, dword ptr [ebp-14]
:00416A37 25FFFF0000              and eax, 0000FFFF
:00416A3C 3DFFFF0000              cmp eax, 0000FFFF
:00416A41 0F8505000000            jne 00416A4C
:00416A47 E92B020000              jmp 00416C77

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416A41(C)
|
:00416A4C 8B45E8                  mov eax, dword ptr [ebp-18]
:00416A4F 50                      push eax
:00416A50 E8FAA6FFFF              call 0041114F
:00416A55 83C404                  add esp, 00000004
:00416A58 A37CA64600              mov dword ptr [0046A67C], eax
:00416A5D 8B45E8                  mov eax, dword ptr [ebp-18]
:00416A60 25FFFF0000              and eax, 0000FFFF
:00416A65 3D00020000              cmp eax, 00000200
:00416A6A 0F85E5000000            jne 00416B55
:00416A70 33C0                    xor eax, eax
:00416A72 66A118F54500            mov ax, word ptr [0045F518]
:00416A78 3DA0000000              cmp eax, 000000A0
:00416A7D 0F8D0C000000            jnl 00416A8F
:00416A83 66FF0518F54500          inc word ptr [0045F518]
:00416A8A E9C1000000              jmp 00416B50

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416A7D(C)
|
:00416A8F 33C0                    xor eax, eax
:00416A91 66A118F54500            mov ax, word ptr [0045F518]
:00416A97 3DA0000000              cmp eax, 000000A0
:00416A9C 0F85AE000000            jne 00416B50
:00416AA2 33C0                    xor eax, eax
:00416AA4 66A180674600            mov ax, word ptr [00466780]
:00416AAA 85C0                    test eax, eax
:00416AAC 0F8418000000            je 00416ACA
:00416AB2 6A2C                    push 0000002C
:00416AB4 E86F080300              call 00447328
:00416AB9 83C404                  add esp, 00000004
:00416ABC 83C002                  add eax, 00000002
:00416ABF 50                      push eax
:00416AC0 B994A64600              mov ecx, 0046A694
:00416AC5 E85A250000              call 00419024

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416AAC(C)
|
:00416ACA 66FF0580674600          inc word ptr [00466780]
:00416AD1 33C0                    xor eax, eax
:00416AD3 66A180674600            mov ax, word ptr [00466780]
:00416AD9 83F804                  cmp eax, 00000004
:00416ADC 0F8C65000000            jl 00416B47

* Possible StringData Ref from Data Obj ->"Խָֹʾģʽִн
κ"
                                        ->"Ρ
ңԴ˵ҲԻش
"
                                  |
:00416AE2 6898F74400              push 0044F798
:00416AE7 6A06                    push 00000006
:00416AE9 E847240200              call 00438F35
:00416AEE 83C408                  add esp, 00000008
:00416AF1 85C0                    test eax, eax
:00416AF3 0F844E000000            je 00416B47
:00416AF9 6A00                    push 00000000
:00416AFB 6A07                    push 00000007
:00416AFD 6A00                    push 00000000
:00416AFF 6A00                    push 00000000
:00416B01 6A07                    push 00000007

* Possible Indirect StringData Ref from Data Obj ->"״̬"
                                  |
:00416B03 6840F64400              push 0044F640
:00416B08 6A64                    push 00000064
:00416B0A 6A64                    push 00000064
:00416B0C E8E3120200              call 00437DF4
:00416B11 83C420                  add esp, 00000020
:00416B14 660FB6C0                movzx ax, al
:00416B18 668945E8                mov word ptr [ebp-18], ax
:00416B1C 8B45E8                  mov eax, dword ptr [ebp-18]
:00416B1F 25FFFF0000              and eax, 0000FFFF
:00416B24 3DFF000000              cmp eax, 000000FF
:00416B29 0F840F000000            je 00416B3E
:00416B2F 8B45E8                  mov eax, dword ptr [ebp-18]
:00416B32 25FFFF0000              and eax, 0000FFFF
:00416B37 FF148560F64400          call dword ptr [4*eax+0044F660]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416B29(C)
|
:00416B3E 66C705806746000000      mov word ptr [00466780], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00416ADC(C), :00416AF3(C)
|
:00416B47 66C70518F54500A003      mov word ptr [0045F518], 03A0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00416A8A(U), :00416A9C(C)
|
:00416B50 E922010000              jmp 00416C77

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416A6A(C)
|
:00416B55 668B45EC                mov ax, word ptr [ebp-14]
:00416B59 66A378A64600            mov word ptr [0046A678], ax
:00416B5F 6800200000              push 00002000
:00416B64 6800200000              push 00002000
:00416B69 66A178A64600            mov ax, word ptr [0046A678]
:00416B6F 50                      push eax
:00416B70 E84AA9FFFF              call 004114BF
:00416B75 83C404                  add esp, 00000004
:00416B78 8BC8                    mov ecx, eax
:00416B7A E8D1100000              call 00417C50
:00416B7F E9F3000000              jmp 00416C77

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004169C6(C), :004169E8(C), :004169F8(C), :00416A12(C)
|
:00416B84 E97EFDFFFF              jmp 00416907

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004168F2(C), :00416916(C)
|
:00416B89 C745F808A64600          mov [ebp-08], 0046A608
:00416B90 66C745D80000            mov [ebp-28], 0000
:00416B96 E908000000              jmp 00416BA3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416C3F(U)
|
:00416B9B 66FF45D8                inc [ebp-28]
:00416B9F 8345F80E                add dword ptr [ebp-08], 0000000E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416B96(U)
|
:00416BA3 8B45D8                  mov eax, dword ptr [ebp-28]
:00416BA6 25FFFF0000              and eax, 0000FFFF
:00416BAB 83F804                  cmp eax, 00000004
:00416BAE 0F8D90000000            jnl 00416C44
:00416BB4 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00416BB7 E824110000              call 00417CE0
:00416BBC 0FB7C0                  movzx eax, ax
:00416BBF F6C480                  test ah, 80
:00416BC2 0F8477000000            je 00416C3F
:00416BC8 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00416BCB E8401A0000              call 00418610
:00416BD0 668945E4                mov word ptr [ebp-1C], ax
:00416BD4 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00416BD7 E8541A0000              call 00418630
:00416BDC 668945D0                mov word ptr [ebp-30], ax
:00416BE0 0FBF45E4                movsx eax, word ptr [ebp-1C]
:00416BE4 0FBF4DE0                movsx ecx, word ptr [ebp-20]
:00416BE8 3BC1                    cmp eax, ecx
:00416BEA 0F8F4F000000            jg 00416C3F
:00416BF0 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00416BF3 E8581A0000              call 00418650
:00416BF8 0FBFC0                  movsx eax, ax
:00416BFB 0FBF4DE4                movsx ecx, word ptr [ebp-1C]
:00416BFF 03C1                    add eax, ecx
:00416C01 0FBF4DE0                movsx ecx, word ptr [ebp-20]
:00416C05 3BC1                    cmp eax, ecx
:00416C07 0F8E32000000            jle 00416C3F
:00416C0D 0FBF45D0                movsx eax, word ptr [ebp-30]
:00416C11 0FBF4DD4                movsx ecx, word ptr [ebp-2C]
:00416C15 3BC1                    cmp eax, ecx
:00416C17 0F8F22000000            jg 00416C3F
:00416C1D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00416C20 E84B1A0000              call 00418670
:00416C25 0FBFC0                  movsx eax, ax
:00416C28 0FBF4DD0                movsx ecx, word ptr [ebp-30]
:00416C2C 03C1                    add eax, ecx
:00416C2E 0FBF4DD4                movsx ecx, word ptr [ebp-2C]
:00416C32 3BC1                    cmp eax, ecx
:00416C34 0F8E05000000            jle 00416C3F
:00416C3A E905000000              jmp 00416C44

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00416BC2(C), :00416BEA(C), :00416C07(C), :00416C17(C), :00416C34(C)
|
:00416C3F E957FFFFFF              jmp 00416B9B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00416BAE(C), :00416C3A(U)
|
:00416C44 8B45D8                  mov eax, dword ptr [ebp-28]
:00416C47 25FFFF0000              and eax, 0000FFFF
:00416C4C 83F804                  cmp eax, 00000004
:00416C4F 0F841D000000            je 00416C72
:00416C55 8B45D8                  mov eax, dword ptr [ebp-28]
:00416C58 25FFFF0000              and eax, 0000FFFF
:00416C5D 0D00800000              or eax, 00008000
:00416C62 66A378A64600            mov word ptr [0046A678], ax

* Possible StringData Ref from Data Obj ->""
                                  |
:00416C68 A1D8F44400              mov eax, dword ptr [0044F4D8]
:00416C6D A37CA64600              mov dword ptr [0046A67C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416C4F(C)
|
:00416C72 E900000000              jmp 00416C77

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00416832(U), :004168E3(U), :00416A47(U), :00416B50(U), :00416B7F(U)
|:00416C72(U)
|
:00416C77 5F                      pop edi
:00416C78 5E                      pop esi
:00416C79 5B                      pop ebx
:00416C7A C9                      leave
:00416C7B C3                      ret



* Referenced by a CALL at Address:
|:00416DAA   
|
:00416C7C 55                      push ebp
:00416C7D 8BEC                    mov ebp, esp
:00416C7F 83EC14                  sub esp, 00000014
:00416C82 53                      push ebx
:00416C83 56                      push esi
:00416C84 57                      push edi
:00416C85 66C745F03002            mov [ebp-10], 0230
:00416C8B 66C745EC0C00            mov [ebp-14], 000C
:00416C91 66C745FC4000            mov [ebp-04], 0040
:00416C97 66C745F81000            mov [ebp-08], 0010
:00416C9D E8F5020100              call 00426F97
:00416CA2 E8A8AAFEFF              call 0040174F
:00416CA7 6A0C                    push 0000000C
:00416CA9 BB08000000              mov ebx, 00000008
:00416CAE A17CA64600              mov eax, dword ptr [0046A67C]
:00416CB3 50                      push eax
:00416CB4 E8F1060300              call 004473AA
:00416CB9 83C404                  add esp, 00000004
:00416CBC 2BD8                    sub ebx, eax
:00416CBE C1EB01                  shr ebx, 01
:00416CC1 83C346                  add ebx, 00000046
:00416CC4 53                      push ebx
:00416CC5 B910BC4600              mov ecx, 0046BC10
:00416CCA E8388F0000              call 0041FC07
:00416CCF 6A04                    push 00000004
:00416CD1 B910BC4600              mov ecx, 0046BC10
:00416CD6 E8A6910000              call 0041FE81
:00416CDB 6A07                    push 00000007
:00416CDD B910BC4600              mov ecx, 0046BC10
:00416CE2 E8EC8F0000              call 0041FCD3
:00416CE7 6A00                    push 00000000
:00416CE9 B910BC4600              mov ecx, 0046BC10
:00416CEE E8DD900000              call 0041FDD0
:00416CF3 A17CA64600              mov eax, dword ptr [0046A67C]
:00416CF8 50                      push eax
:00416CF9 6810BC4600              push 0046BC10
:00416CFE E8209E0000              call 00420B23
:00416D03 83C408                  add esp, 00000008
:00416D06 C745F400000000          mov [ebp-0C], 00000000
:00416D0D 33C0                    xor eax, eax
:00416D0F 66A178A64600            mov ax, word ptr [0046A678]
:00416D15 3DFFFF0000              cmp eax, 0000FFFF
:00416D1A 0F8407000000            je 00416D27
:00416D20 C745F401000000          mov [ebp-0C], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416D1A(C)
|
:00416D27 8B45F4                  mov eax, dword ptr [ebp-0C]
:00416D2A 50                      push eax
:00416D2B E858F10000              call 00425E88
:00416D30 83C404                  add esp, 00000004
:00416D33 E87F020100              call 00426FB7
:00416D38 E900000000              jmp 00416D3D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416D38(U)
|
:00416D3D 5F                      pop edi
:00416D3E 5E                      pop esi
:00416D3F 5B                      pop ebx
:00416D40 C9                      leave
:00416D41 C3                      ret



* Referenced by a CALL at Address:
|:0041787C   
|
:00416D42 55                      push ebp
:00416D43 8BEC                    mov ebp, esp
:00416D45 83EC08                  sub esp, 00000008
:00416D48 53                      push ebx
:00416D49 56                      push esi
:00416D4A 57                      push edi
:00416D4B C745FC00AA4600          mov [ebp-04], 0046AA00
:00416D52 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00416D55 E836190000              call 00418690
:00416D5A 33C9                    xor ecx, ecx
:00416D5C 8AC8                    mov cl, al
:00416D5E 83F901                  cmp ecx, 00000001
:00416D61 0F8505000000            jne 00416D6C
:00416D67 E811020100              call 00426F7D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416D61(C)
|
:00416D6C 6A01                    push 00000001
:00416D6E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00416D71 E89AACFEFF              call 00401A10
:00416D76 E807EBFFFF              call 00415882

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416E42(U)
|
:00416D7B B9D0A64600              mov ecx, 0046A6D0
:00416D80 E84B4CFFFF              call 0040B9D0
:00416D85 660FB6C0                movzx ax, al
:00416D89 668945F8                mov word ptr [ebp-08], ax
:00416D8D 8B45F8                  mov eax, dword ptr [ebp-08]
:00416D90 25FFFF0000              and eax, 0000FFFF
:00416D95 50                      push eax
:00416D96 B9B0FA4600              mov ecx, 0046FAB0
:00416D9B E81024FFFF              call 004091B0
:00416DA0 E84FF2FFFF              call 00415FF4
:00416DA5 E822FAFFFF              call 004167CC
:00416DAA E8CDFEFFFF              call 00416C7C
:00416DAF E800F1FFFF              call 00415EB4
:00416DB4 E8E3ECFFFF              call 00415A9C
:00416DB9 F605785345006E          test byte ptr [00455378], 6E
:00416DC0 0F8405000000            je 00416DCB
:00416DC6 E97C000000              jmp 00416E47

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416DC0(C)
|
:00416DCB E8F4F0FFFF              call 00415EC4
:00416DD0 E847C8FFFF              call 0041361C
:00416DD5 E85CC6FFFF              call 00413436
:00416DDA E8B8010100              call 00426F97
:00416DDF E8B1C8FFFF              call 00413695
:00416DE4 E8CE010100              call 00426FB7
:00416DE9 68FF000000              push 000000FF
:00416DEE 6A00                    push 00000000
:00416DF0 E83FE6FFFF              call 00415434
:00416DF5 83C408                  add esp, 00000008
:00416DF8 F605785345006E          test byte ptr [00455378], 6E
:00416DFF 0F8405000000            je 00416E0A
:00416E05 E93D000000              jmp 00416E47

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416DFF(C)
|
:00416E0A 66FF0550194600          inc word ptr [00461950]
:00416E11 33C0                    xor eax, eax
:00416E13 66A150194600            mov ax, word ptr [00461950]
:00416E19 83F802                  cmp eax, 00000002
:00416E1C 0F8C09000000            jl 00416E2B
:00416E22 66C705501946000000      mov word ptr [00461950], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00416E1C(C), :00416E3D(U)
|
:00416E2B B9B0FA4600              mov ecx, 0046FAB0
:00416E30 E87B180000              call 004186B0
:00416E35 85C0                    test eax, eax
:00416E37 0F8505000000            jne 00416E42
:00416E3D E9E9FFFFFF              jmp 00416E2B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416E37(C)
|
:00416E42 E934FFFFFF              jmp 00416D7B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00416DC6(U), :00416E05(U)
|
:00416E47 66A178534500            mov ax, word ptr [00455378]
:00416E4D E900000000              jmp 00416E52

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416E4D(U)
|
:00416E52 5F                      pop edi
:00416E53 5E                      pop esi
:00416E54 5B                      pop ebx
:00416E55 C9                      leave
:00416E56 C3                      ret



* Referenced by a CALL at Address:
|:00415FAC   
|
:00416E57 55                      push ebp
:00416E58 8BEC                    mov ebp, esp
:00416E5A 83EC04                  sub esp, 00000004
:00416E5D 53                      push ebx
:00416E5E 56                      push esi
:00416E5F 57                      push edi
:00416E60 894DFC                  mov dword ptr [ebp-04], ecx
:00416E63 8B45FC                  mov eax, dword ptr [ebp-04]
:00416E66 33C9                    xor ecx, ecx
:00416E68 668B4802                mov cx, word ptr [eax+02]
:00416E6C 8B45FC                  mov eax, dword ptr [ebp-04]
:00416E6F 33D2                    xor edx, edx
:00416E71 668B10                  mov dx, word ptr [eax]
:00416E74 3BCA                    cmp ecx, edx
:00416E76 0F8D0C000000            jnl 00416E88
:00416E7C 8B45FC                  mov eax, dword ptr [ebp-04]
:00416E7F 66FF4002                inc [eax+02]
:00416E83 E977000000              jmp 00416EFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416E76(C)
|
:00416E88 8B45FC                  mov eax, dword ptr [ebp-04]
:00416E8B 66C740020000            mov [eax+02], 0000
:00416E91 8B45FC                  mov eax, dword ptr [ebp-04]
:00416E94 66FF4016                inc [eax+16]
:00416E98 8B45FC                  mov eax, dword ptr [ebp-04]
:00416E9B 33C9                    xor ecx, ecx
:00416E9D 668B4816                mov cx, word ptr [eax+16]
:00416EA1 8B45FC                  mov eax, dword ptr [ebp-04]
:00416EA4 33D2                    xor edx, edx
:00416EA6 668B5018                mov dx, word ptr [eax+18]
:00416EAA 3BCA                    cmp ecx, edx
:00416EAC 0F8C2B000000            jl 00416EDD
:00416EB2 6A08                    push 00000008
:00416EB4 E86F040300              call 00447328
:00416EB9 83C404                  add esp, 00000004
:00416EBC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00416EBF 66894118                mov word ptr [ecx+18], ax
:00416EC3 6A05                    push 00000005
:00416EC5 E85E040300              call 00447328
:00416ECA 83C404                  add esp, 00000004
:00416ECD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00416ED0 6689411C                mov word ptr [ecx+1C], ax
:00416ED4 8B45FC                  mov eax, dword ptr [ebp-04]
:00416ED7 66C740160000            mov [eax+16], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416EAC(C)
|
:00416EDD 8B45FC                  mov eax, dword ptr [ebp-04]
:00416EE0 33C9                    xor ecx, ecx
:00416EE2 668B481C                mov cx, word ptr [eax+1C]
:00416EE6 83F904                  cmp ecx, 00000004
:00416EE9 0F8D10000000            jnl 00416EFF
:00416EEF 8B45FC                  mov eax, dword ptr [ebp-04]
:00416EF2 668B401C                mov ax, word ptr [eax+1C]
:00416EF6 50                      push eax
:00416EF7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00416EFA E8C3010000              call 004170C2

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00416E83(U), :00416EE9(C)
|
:00416EFF 6633C0                  xor ax, ax
:00416F02 E900000000              jmp 00416F07

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416F02(U)
|
:00416F07 5F                      pop edi
:00416F08 5E                      pop esi
:00416F09 5B                      pop ebx
:00416F0A C9                      leave
:00416F0B C3                      ret



* Referenced by a CALL at Addresses:
|:00415B54   , :00415B95   , :00415D8F   , :00415E47   , :00415F85   
|
:00416F0C 55                      push ebp
:00416F0D 8BEC                    mov ebp, esp
:00416F0F 83EC28                  sub esp, 00000028
:00416F12 53                      push ebx
:00416F13 56                      push esi
:00416F14 57                      push edi
:00416F15 894DDC                  mov dword ptr [ebp-24], ecx
:00416F18 8B45DC                  mov eax, dword ptr [ebp-24]
:00416F1B 33C9                    xor ecx, ecx
:00416F1D 668B4802                mov cx, word ptr [eax+02]
:00416F21 8B45DC                  mov eax, dword ptr [ebp-24]
:00416F24 33D2                    xor edx, edx
:00416F26 668B10                  mov dx, word ptr [eax]
:00416F29 3BCA                    cmp ecx, edx
:00416F2B 0F8D0C000000            jnl 00416F3D
:00416F31 8B45DC                  mov eax, dword ptr [ebp-24]
:00416F34 66FF4002                inc [eax+02]
:00416F38 E935010000              jmp 00417072

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416F2B(C)
|
:00416F3D 8B45DC                  mov eax, dword ptr [ebp-24]
:00416F40 66C740020000            mov [eax+02], 0000
:00416F46 66C745E80000            mov [ebp-18], 0000
:00416F4C 8B45DC                  mov eax, dword ptr [ebp-24]
:00416F4F 33C9                    xor ecx, ecx
:00416F51 668B483A                mov cx, word ptr [eax+3A]
:00416F55 81F9FFFF0000            cmp ecx, 0000FFFF
:00416F5B 0F8509000000            jne 00416F6A
:00416F61 66B8FFFF                mov ax, FFFF
:00416F65 E910010000              jmp 0041707A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416F5B(C)
|
:00416F6A 6A04                    push 00000004
:00416F6C 6A00                    push 00000000
:00416F6E 8B45DC                  mov eax, dword ptr [ebp-24]
:00416F71 33C9                    xor ecx, ecx
:00416F73 668B483C                mov cx, word ptr [eax+3C]
:00416F77 51                      push ecx
:00416F78 B968F94600              mov ecx, 0046F968
:00416F7D E89E070300              call 00447720
:00416F82 8945F8                  mov dword ptr [ebp-08], eax
:00416F85 8B45F8                  mov eax, dword ptr [ebp-08]
:00416F88 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041706D(U)
|
:00416F8B 8D45E0                  lea eax, dword ptr [ebp-20]
:00416F8E 50                      push eax
:00416F8F 8B45F8                  mov eax, dword ptr [ebp-08]
:00416F92 50                      push eax
:00416F93 E858C3FFFF              call 004132F0
:00416F98 83C408                  add esp, 00000008
:00416F9B 8845F4                  mov byte ptr [ebp-0C], al
:00416F9E 33C0                    xor eax, eax
:00416FA0 8A45F4                  mov al, byte ptr [ebp-0C]
:00416FA3 3DEF000000              cmp eax, 000000EF
:00416FA8 0F8509000000            jne 00416FB7
:00416FAE 66B8FFFF                mov ax, FFFF
:00416FB2 E9C3000000              jmp 0041707A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416FA8(C)
|
:00416FB7 8B45E8                  mov eax, dword ptr [ebp-18]
:00416FBA 25FFFF0000              and eax, 0000FFFF
:00416FBF 83F801                  cmp eax, 00000001
:00416FC2 0F8505000000            jne 00416FCD
:00416FC8 E9A5000000              jmp 00417072

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416FC2(C)
|
:00416FCD 8B45F8                  mov eax, dword ptr [ebp-08]
:00416FD0 8945EC                  mov dword ptr [ebp-14], eax
:00416FD3 FF45EC                  inc [ebp-14]
:00416FD6 33C0                    xor eax, eax
:00416FD8 8A45F4                  mov al, byte ptr [ebp-0C]
:00416FDB 24F0                    and al, F0
:00416FDD 8845E4                  mov byte ptr [ebp-1C], al
:00416FE0 33C0                    xor eax, eax
:00416FE2 8A45F4                  mov al, byte ptr [ebp-0C]
:00416FE5 240F                    and al, 0F
:00416FE7 8845FC                  mov byte ptr [ebp-04], al
:00416FEA 66C745E80100            mov [ebp-18], 0001
:00416FF0 33C0                    xor eax, eax
:00416FF2 8A45E4                  mov al, byte ptr [ebp-1C]
:00416FF5 8945D8                  mov dword ptr [ebp-28], eax
:00416FF8 E92E000000              jmp 0041702B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041702F(C)
|
:00416FFD 660FB645FC              movzx ax, byte ptr [ebp-04]
:00417002 50                      push eax
:00417003 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00417006 E8B7000000              call 004170C2
:0041700B E934000000              jmp 00417044

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417039(C)
|
:00417010 660FB645FC              movzx ax, byte ptr [ebp-04]
:00417015 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00417018 6689412E                mov word ptr [ecx+2E], ax
:0041701C E923000000              jmp 00417044
:00417021 E91E000000              jmp 00417044
:00417026 E919000000              jmp 00417044

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416FF8(U)
|
:0041702B 837DD800                cmp dword ptr [ebp-28], 00000000
:0041702F 0F84C8FFFFFF            je 00416FFD
:00417035 837DD810                cmp dword ptr [ebp-28], 00000010
:00417039 0F84D1FFFFFF            je 00417010
:0041703F E900000000              jmp 00417044

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041700B(U), :0041701C(U), :00417021(U), :00417026(U), :0041703F(U)
|
:00417044 8B45F8                  mov eax, dword ptr [ebp-08]
:00417047 50                      push eax
:00417048 E8D4C2FFFF              call 00413321
:0041704D 83C404                  add esp, 00000004
:00417050 8945F8                  mov dword ptr [ebp-08], eax
:00417053 8B45DC                  mov eax, dword ptr [ebp-24]
:00417056 33C9                    xor ecx, ecx
:00417058 668B483C                mov cx, word ptr [eax+3C]
:0041705C 8B45E0                  mov eax, dword ptr [ebp-20]
:0041705F 25FFFF0000              and eax, 0000FFFF
:00417064 03C8                    add ecx, eax
:00417066 8B45DC                  mov eax, dword ptr [ebp-24]
:00417069 6689483C                mov word ptr [eax+3C], cx
:0041706D E919FFFFFF              jmp 00416F8B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00416F38(U), :00416FC8(U)
|
:00417072 6633C0                  xor ax, ax
:00417075 E900000000              jmp 0041707A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00416F65(U), :00416FB2(U), :00417075(U)
|
:0041707A 5F                      pop edi
:0041707B 5E                      pop esi
:0041707C 5B                      pop ebx
:0041707D C9                      leave
:0041707E C3                      ret



* Referenced by a CALL at Addresses:
|:00414D53   , :00414F91   
|
:0041707F 55                      push ebp
:00417080 8BEC                    mov ebp, esp
:00417082 83EC08                  sub esp, 00000008
:00417085 53                      push ebx
:00417086 56                      push esi
:00417087 57                      push edi
:00417088 894DF8                  mov dword ptr [ebp-08], ecx
:0041708B 8B450C                  mov eax, dword ptr [ebp+0C]
:0041708E 50                      push eax
:0041708F 8B4508                  mov eax, dword ptr [ebp+08]
:00417092 50                      push eax
:00417093 E87D9FFFFF              call 00411015
:00417098 83C408                  add esp, 00000008
:0041709B 8945FC                  mov dword ptr [ebp-04], eax
:0041709E 8B45FC                  mov eax, dword ptr [ebp-04]
:004170A1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004170A4 894132                  mov dword ptr [ecx+32], eax
:004170A7 8B45FC                  mov eax, dword ptr [ebp-04]
:004170AA 660FB64001              movzx ax, byte ptr [eax+01]
:004170AF 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004170B2 6689412A                mov word ptr [ecx+2A], ax
:004170B6 E900000000              jmp 004170BB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004170B6(U)
|
:004170BB 5F                      pop edi
:004170BC 5E                      pop esi
:004170BD 5B                      pop ebx
:004170BE C9                      leave
:004170BF C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:00416EFA   , :00417006   
|
:004170C2 55                      push ebp
:004170C3 8BEC                    mov ebp, esp
:004170C5 83EC0C                  sub esp, 0000000C
:004170C8 53                      push ebx
:004170C9 56                      push esi
:004170CA 57                      push edi
:004170CB 894DF4                  mov dword ptr [ebp-0C], ecx
:004170CE 8B45F4                  mov eax, dword ptr [ebp-0C]
:004170D1 66FF401A                inc [eax+1A]
:004170D5 8B45F4                  mov eax, dword ptr [ebp-0C]
:004170D8 8B4032                  mov eax, dword ptr [eax+32]
:004170DB 33C9                    xor ecx, ecx
:004170DD 8A08                    mov cl, byte ptr [eax]
:004170DF 8B45F4                  mov eax, dword ptr [ebp-0C]
:004170E2 33D2                    xor edx, edx
:004170E4 668B501A                mov dx, word ptr [eax+1A]
:004170E8 3BCA                    cmp ecx, edx
:004170EA 0F8F09000000            jg 004170F9
:004170F0 8B45F4                  mov eax, dword ptr [ebp-0C]
:004170F3 66C7401A0000            mov [eax+1A], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004170EA(C)
|
:004170F9 8B45F4                  mov eax, dword ptr [ebp-0C]
:004170FC 33C9                    xor ecx, ecx
:004170FE 668B481A                mov cx, word ptr [eax+1A]
:00417102 8B45F4                  mov eax, dword ptr [ebp-0C]
:00417105 8B4032                  mov eax, dword ptr [eax+32]
:00417108 660FB6440101            movzx ax, byte ptr [ecx+eax+01]
:0041710E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00417111 6689412A                mov word ptr [ecx+2A], ax
:00417115 8B45F4                  mov eax, dword ptr [ebp-0C]
:00417118 668B4004                mov ax, word ptr [eax+04]
:0041711C 668945FC                mov word ptr [ebp-04], ax
:00417120 8B45F4                  mov eax, dword ptr [ebp-0C]
:00417123 668B4006                mov ax, word ptr [eax+06]
:00417127 668945F8                mov word ptr [ebp-08], ax
:0041712B 8B4508                  mov eax, dword ptr [ebp+08]
:0041712E 50                      push eax
:0041712F 8B45F4                  mov eax, dword ptr [ebp-0C]
:00417132 668B400C                mov ax, word ptr [eax+0C]
:00417136 50                      push eax
:00417137 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041713A 668B400A                mov ax, word ptr [eax+0A]
:0041713E 50                      push eax
:0041713F 8D45F8                  lea eax, dword ptr [ebp-08]
:00417142 50                      push eax
:00417143 8D45FC                  lea eax, dword ptr [ebp-04]
:00417146 50                      push eax
:00417147 E81FCAFFFF              call 00413B6B
:0041714C 83C414                  add esp, 00000014
:0041714F 0FB7C0                  movzx eax, ax
:00417152 3DFFFF0000              cmp eax, 0000FFFF
:00417157 0F842B000000            je 00417188
:0041715D 668B45FC                mov ax, word ptr [ebp-04]
:00417161 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00417164 66894104                mov word ptr [ecx+04], ax
:00417168 668B45F8                mov ax, word ptr [ebp-08]
:0041716C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041716F 66894106                mov word ptr [ecx+06], ax
:00417173 668B4508                mov ax, word ptr [ebp+08]
:00417177 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041717A 6689412E                mov word ptr [ecx+2E], ax
:0041717E B801000000              mov eax, 00000001
:00417183 E907000000              jmp 0041718F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417157(C)
|
:00417188 33C0                    xor eax, eax
:0041718A E900000000              jmp 0041718F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00417183(U), :0041718A(U)
|
:0041718F 5F                      pop edi
:00417190 5E                      pop esi
:00417191 5B                      pop ebx
:00417192 C9                      leave
:00417193 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00409B90   , :004175B3   
|
:00417196 55                      push ebp
:00417197 8BEC                    mov ebp, esp
:00417199 83EC08                  sub esp, 00000008
:0041719C 53                      push ebx
:0041719D 56                      push esi
:0041719E 57                      push edi
:0041719F 894DF8                  mov dword ptr [ebp-08], ecx
:004171A2 8B4508                  mov eax, dword ptr [ebp+08]
:004171A5 8945FC                  mov dword ptr [ebp-04], eax
:004171A8 8B45FC                  mov eax, dword ptr [ebp-04]
:004171AB 668B00                  mov ax, word ptr [eax]
:004171AE 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004171B1 668901                  mov word ptr [ecx], ax
:004171B4 8345FC02                add dword ptr [ebp-04], 00000002
:004171B8 8B45FC                  mov eax, dword ptr [ebp-04]
:004171BB 668B00                  mov ax, word ptr [eax]
:004171BE 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004171C1 66894102                mov word ptr [ecx+02], ax
:004171C5 8345FC02                add dword ptr [ebp-04], 00000002
:004171C9 8B45FC                  mov eax, dword ptr [ebp-04]
:004171CC 668B00                  mov ax, word ptr [eax]
:004171CF 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004171D2 66894104                mov word ptr [ecx+04], ax
:004171D6 8345FC02                add dword ptr [ebp-04], 00000002
:004171DA 8B45FC                  mov eax, dword ptr [ebp-04]
:004171DD 668B00                  mov ax, word ptr [eax]
:004171E0 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004171E3 66894106                mov word ptr [ecx+06], ax
:004171E7 8345FC02                add dword ptr [ebp-04], 00000002
:004171EB 8B45FC                  mov eax, dword ptr [ebp-04]
:004171EE 668B00                  mov ax, word ptr [eax]
:004171F1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004171F4 66894108                mov word ptr [ecx+08], ax
:004171F8 8345FC02                add dword ptr [ebp-04], 00000002
:004171FC 8B45FC                  mov eax, dword ptr [ebp-04]
:004171FF 668B00                  mov ax, word ptr [eax]
:00417202 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00417205 6689410A                mov word ptr [ecx+0A], ax
:00417209 8345FC02                add dword ptr [ebp-04], 00000002
:0041720D 8B45FC                  mov eax, dword ptr [ebp-04]
:00417210 668B00                  mov ax, word ptr [eax]
:00417213 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00417216 6689410C                mov word ptr [ecx+0C], ax
:0041721A 8345FC02                add dword ptr [ebp-04], 00000002
:0041721E 8B45FC                  mov eax, dword ptr [ebp-04]
:00417221 668B00                  mov ax, word ptr [eax]
:00417224 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00417227 6689410E                mov word ptr [ecx+0E], ax
:0041722B 8345FC02                add dword ptr [ebp-04], 00000002
:0041722F 8B45FC                  mov eax, dword ptr [ebp-04]
:00417232 668B00                  mov ax, word ptr [eax]
:00417235 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00417238 66894116                mov word ptr [ecx+16], ax
:0041723C 8345FC02                add dword ptr [ebp-04], 00000002
:00417240 8B45FC                  mov eax, dword ptr [ebp-04]
:00417243 668B00                  mov ax, word ptr [eax]
:00417246 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00417249 66894118                mov word ptr [ecx+18], ax
:0041724D 8345FC02                add dword ptr [ebp-04], 00000002
:00417251 8B45FC                  mov eax, dword ptr [ebp-04]
:00417254 668B00                  mov ax, word ptr [eax]
:00417257 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041725A 6689411A                mov word ptr [ecx+1A], ax
:0041725E 8345FC02                add dword ptr [ebp-04], 00000002
:00417262 8B45FC                  mov eax, dword ptr [ebp-04]
:00417265 668B00                  mov ax, word ptr [eax]
:00417268 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041726B 6689411C                mov word ptr [ecx+1C], ax
:0041726F 8345FC02                add dword ptr [ebp-04], 00000002
:00417273 8B45FC                  mov eax, dword ptr [ebp-04]
:00417276 668B00                  mov ax, word ptr [eax]
:00417279 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041727C 66894128                mov word ptr [ecx+28], ax
:00417280 8345FC02                add dword ptr [ebp-04], 00000002
:00417284 8B45FC                  mov eax, dword ptr [ebp-04]
:00417287 668B00                  mov ax, word ptr [eax]
:0041728A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041728D 6689412C                mov word ptr [ecx+2C], ax
:00417291 8345FC02                add dword ptr [ebp-04], 00000002
:00417295 8B45FC                  mov eax, dword ptr [ebp-04]
:00417298 668B00                  mov ax, word ptr [eax]
:0041729B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041729E 6689412E                mov word ptr [ecx+2E], ax
:004172A2 8345FC02                add dword ptr [ebp-04], 00000002
:004172A6 8B45FC                  mov eax, dword ptr [ebp-04]
:004172A9 668B00                  mov ax, word ptr [eax]
:004172AC 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004172AF 66894130                mov word ptr [ecx+30], ax
:004172B3 8345FC02                add dword ptr [ebp-04], 00000002
:004172B7 8B45FC                  mov eax, dword ptr [ebp-04]
:004172BA 668B00                  mov ax, word ptr [eax]
:004172BD 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004172C0 66894136                mov word ptr [ecx+36], ax
:004172C4 8345FC02                add dword ptr [ebp-04], 00000002
:004172C8 8B45FC                  mov eax, dword ptr [ebp-04]
:004172CB 668B00                  mov ax, word ptr [eax]
:004172CE 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004172D1 66894138                mov word ptr [ecx+38], ax
:004172D5 E900000000              jmp 004172DA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004172D5(U)
|
:004172DA 5F                      pop edi
:004172DB 5E                      pop esi
:004172DC 5B                      pop ebx
:004172DD C9                      leave
:004172DE C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0040A099   , :0040B561   
|
:004172E1 55                      push ebp
:004172E2 8BEC                    mov ebp, esp
:004172E4 83EC08                  sub esp, 00000008
:004172E7 53                      push ebx
:004172E8 56                      push esi
:004172E9 57                      push edi
:004172EA 894DF8                  mov dword ptr [ebp-08], ecx
:004172ED 8B4508                  mov eax, dword ptr [ebp+08]
:004172F0 8945FC                  mov dword ptr [ebp-04], eax
:004172F3 8B45F8                  mov eax, dword ptr [ebp-08]
:004172F6 668B00                  mov ax, word ptr [eax]
:004172F9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004172FC 668901                  mov word ptr [ecx], ax
:004172FF 8345FC02                add dword ptr [ebp-04], 00000002
:00417303 8B45F8                  mov eax, dword ptr [ebp-08]
:00417306 668B4002                mov ax, word ptr [eax+02]
:0041730A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041730D 668901                  mov word ptr [ecx], ax
:00417310 8345FC02                add dword ptr [ebp-04], 00000002
:00417314 8B45F8                  mov eax, dword ptr [ebp-08]
:00417317 668B4004                mov ax, word ptr [eax+04]
:0041731B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041731E 668901                  mov word ptr [ecx], ax
:00417321 8345FC02                add dword ptr [ebp-04], 00000002
:00417325 8B45F8                  mov eax, dword ptr [ebp-08]
:00417328 668B4006                mov ax, word ptr [eax+06]
:0041732C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041732F 668901                  mov word ptr [ecx], ax
:00417332 8345FC02                add dword ptr [ebp-04], 00000002
:00417336 8B45F8                  mov eax, dword ptr [ebp-08]
:00417339 668B4008                mov ax, word ptr [eax+08]
:0041733D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00417340 668901                  mov word ptr [ecx], ax
:00417343 8345FC02                add dword ptr [ebp-04], 00000002
:00417347 8B45F8                  mov eax, dword ptr [ebp-08]
:0041734A 668B400A                mov ax, word ptr [eax+0A]
:0041734E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00417351 668901                  mov word ptr [ecx], ax
:00417354 8345FC02                add dword ptr [ebp-04], 00000002
:00417358 8B45F8                  mov eax, dword ptr [ebp-08]
:0041735B 668B400C                mov ax, word ptr [eax+0C]
:0041735F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00417362 668901                  mov word ptr [ecx], ax
:00417365 8345FC02                add dword ptr [ebp-04], 00000002
:00417369 8B45F8                  mov eax, dword ptr [ebp-08]
:0041736C 668B400E                mov ax, word ptr [eax+0E]
:00417370 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00417373 668901                  mov word ptr [ecx], ax
:00417376 8345FC02                add dword ptr [ebp-04], 00000002
:0041737A 8B45F8                  mov eax, dword ptr [ebp-08]
:0041737D 668B4016                mov ax, word ptr [eax+16]
:00417381 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00417384 668901                  mov word ptr [ecx], ax
:00417387 8345FC02                add dword ptr [ebp-04], 00000002
:0041738B 8B45F8                  mov eax, dword ptr [ebp-08]
:0041738E 668B4018                mov ax, word ptr [eax+18]
:00417392 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00417395 668901                  mov word ptr [ecx], ax
:00417398 8345FC02                add dword ptr [ebp-04], 00000002
:0041739C 8B45F8                  mov eax, dword ptr [ebp-08]
:0041739F 668B401A                mov ax, word ptr [eax+1A]
:004173A3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004173A6 668901                  mov word ptr [ecx], ax
:004173A9 8345FC02                add dword ptr [ebp-04], 00000002
:004173AD 8B45F8                  mov eax, dword ptr [ebp-08]
:004173B0 668B401C                mov ax, word ptr [eax+1C]
:004173B4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004173B7 668901                  mov word ptr [ecx], ax
:004173BA 8345FC02                add dword ptr [ebp-04], 00000002
:004173BE 8B45F8                  mov eax, dword ptr [ebp-08]
:004173C1 668B4028                mov ax, word ptr [eax+28]
:004173C5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004173C8 668901                  mov word ptr [ecx], ax
:004173CB 8345FC02                add dword ptr [ebp-04], 00000002
:004173CF 8B45F8                  mov eax, dword ptr [ebp-08]
:004173D2 668B402C                mov ax, word ptr [eax+2C]
:004173D6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004173D9 668901                  mov word ptr [ecx], ax
:004173DC 8345FC02                add dword ptr [ebp-04], 00000002
:004173E0 8B45F8                  mov eax, dword ptr [ebp-08]
:004173E3 668B402E                mov ax, word ptr [eax+2E]
:004173E7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004173EA 668901                  mov word ptr [ecx], ax
:004173ED 8345FC02                add dword ptr [ebp-04], 00000002
:004173F1 8B45F8                  mov eax, dword ptr [ebp-08]
:004173F4 668B4030                mov ax, word ptr [eax+30]
:004173F8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004173FB 668901                  mov word ptr [ecx], ax
:004173FE 8345FC02                add dword ptr [ebp-04], 00000002
:00417402 8B45F8                  mov eax, dword ptr [ebp-08]
:00417405 668B4036                mov ax, word ptr [eax+36]
:00417409 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041740C 668901                  mov word ptr [ecx], ax
:0041740F 8345FC02                add dword ptr [ebp-04], 00000002
:00417413 8B45F8                  mov eax, dword ptr [ebp-08]
:00417416 668B4038                mov ax, word ptr [eax+38]
:0041741A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041741D 668901                  mov word ptr [ecx], ax
:00417420 8345FC02                add dword ptr [ebp-04], 00000002
:00417424 8B45FC                  mov eax, dword ptr [ebp-04]
:00417427 E900000000              jmp 0041742C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417427(U)
|
:0041742C 5F                      pop edi
:0041742D 5E                      pop esi
:0041742E 5B                      pop ebx
:0041742F C9                      leave
:00417430 C20400                  ret 0004



* Referenced by a CALL at Address:
|:00417782   
|
:00417433 55                      push ebp
:00417434 8BEC                    mov ebp, esp
:00417436 83EC0C                  sub esp, 0000000C
:00417439 53                      push ebx
:0041743A 56                      push esi
:0041743B 57                      push edi
:0041743C 6A00                    push 00000000
:0041743E 6A00                    push 00000000
:00417440 6A01                    push 00000001
:00417442 6A02                    push 00000002
:00417444 6A02                    push 00000002
:00417446 6A00                    push 00000000
:00417448 6A5B                    push 0000005B
:0041744A 6A36                    push 00000036
:0041744C 6800020000              push 00000200
:00417451 E86EDCFFFF              call 004150C4
:00417456 83C424                  add esp, 00000024
:00417459 E888A0FFFF              call 004114E6
:0041745E 8945F4                  mov dword ptr [ebp-0C], eax
:00417461 B808A64600              mov eax, 0046A608
:00417466 83C038                  add eax, 00000038
:00417469 8945FC                  mov dword ptr [ebp-04], eax
:0041746C 66C745F80400            mov [ebp-08], 0004
:00417472 E908000000              jmp 0041747F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041750A(U)
|
:00417477 66FF45F8                inc [ebp-08]
:0041747B 8345FC0E                add dword ptr [ebp-04], 0000000E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417472(U)
|
:0041747F 8B45F8                  mov eax, dword ptr [ebp-08]
:00417482 25FFFF0000              and eax, 0000FFFF
:00417487 83F808                  cmp eax, 00000008
:0041748A 0F8D7F000000            jnl 0041750F
:00417490 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00417493 E848080000              call 00417CE0
:00417498 0FB7C0                  movzx eax, ax
:0041749B F6C480                  test ah, 80
:0041749E 0F8466000000            je 0041750A
:004174A4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004174A7 E8040D0000              call 004181B0
:004174AC 50                      push eax
:004174AD 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004174B0 E86B0F0000              call 00418420
:004174B5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004174B8 E8130D0000              call 004181D0
:004174BD 50                      push eax
:004174BE 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004174C1 E88A0F0000              call 00418450
:004174C6 8B45F8                  mov eax, dword ptr [ebp-08]
:004174C9 50                      push eax
:004174CA E84AD0FFFF              call 00414519
:004174CF 83C404                  add esp, 00000004
:004174D2 0FB7C0                  movzx eax, ax
:004174D5 85C0                    test eax, eax
:004174D7 0F8528000000            jne 00417505
:004174DD 6A03                    push 00000003
:004174DF 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004174E2 E8090D0000              call 004181F0
:004174E7 E8C4010200              call 004376B0
:004174EC 66A384674600            mov word ptr [00466784], ax
:004174F2 6A00                    push 00000000
:004174F4 E874010200              call 0043766D
:004174F9 83C404                  add esp, 00000004
:004174FC 66C705786746000100      mov word ptr [00466778], 0001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004174D7(C)
|
:00417505 E905000000              jmp 0041750F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041749E(C)
|
:0041750A E968FFFFFF              jmp 00417477

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041748A(C), :00417505(U)
|
:0041750F 8B45F8                  mov eax, dword ptr [ebp-08]
:00417512 25FFFF0000              and eax, 0000FFFF
:00417517 83F808                  cmp eax, 00000008
:0041751A 0F8500000000            jne 00417520

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041751A(C)
|
:00417520 E900000000              jmp 00417525

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417520(U)
|
:00417525 5F                      pop edi
:00417526 5E                      pop esi
:00417527 5B                      pop ebx
:00417528 C9                      leave
:00417529 C3                      ret



* Referenced by a CALL at Address:
|:00417854   
|
:0041752A 55                      push ebp
:0041752B 8BEC                    mov ebp, esp
:0041752D 83EC30                  sub esp, 00000030
:00417530 53                      push ebx
:00417531 56                      push esi
:00417532 57                      push edi
:00417533 C745F400AA4600          mov [ebp-0C], 0046AA00
:0041753A 66C705846746000100      mov word ptr [00466784], 0001
:00417543 66C705786746000000      mov word ptr [00466778], 0000
:0041754C 66C745D40000            mov [ebp-2C], 0000
:00417552 33C0                    xor eax, eax
:00417554 A04CF94600              mov al, byte ptr [0046F94C]
:00417559 83F801                  cmp eax, 00000001
:0041755C 0F8501020000            jne 00417763
:00417562 6A04                    push 00000004
:00417564 6A00                    push 00000000
:00417566 6A60                    push 00000060
:00417568 B9A0E44600              mov ecx, 0046E4A0
:0041756D E8AE010300              call 00447720
:00417572 8945FC                  mov dword ptr [ebp-04], eax
:00417575 6A00                    push 00000000
:00417577 E8439FFFFF              call 004114BF
:0041757C 83C404                  add esp, 00000004
:0041757F 8945EC                  mov dword ptr [ebp-14], eax
:00417582 66C745D80000            mov [ebp-28], 0000
:00417588 E90C000000              jmp 00417599

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004175B8(U)
|
:0041758D 66FF45D8                inc [ebp-28]
:00417591 8345EC3E                add dword ptr [ebp-14], 0000003E
:00417595 8345FC24                add dword ptr [ebp-04], 00000024

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417588(U)
|
:00417599 8B45D8                  mov eax, dword ptr [ebp-28]
:0041759C 25FFFF0000              and eax, 0000FFFF
:004175A1 3D80000000              cmp eax, 00000080
:004175A6 0F8D11000000            jnl 004175BD
:004175AC 8B45FC                  mov eax, dword ptr [ebp-04]
:004175AF 50                      push eax
:004175B0 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004175B3 E8DEFBFFFF              call 00417196
:004175B8 E9D0FFFFFF              jmp 0041758D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004175A6(C)
|
:004175BD 6A04                    push 00000004
:004175BF 6A00                    push 00000000
:004175C1 6A60                    push 00000060
:004175C3 B9A0E44600              mov ecx, 0046E4A0
:004175C8 E853010300              call 00447720
:004175CD 8945FC                  mov dword ptr [ebp-04], eax
:004175D0 6A00                    push 00000000
:004175D2 E8E89EFFFF              call 004114BF
:004175D7 83C404                  add esp, 00000004
:004175DA 8945EC                  mov dword ptr [ebp-14], eax
:004175DD 66C745D80000            mov [ebp-28], 0000
:004175E3 E90C000000              jmp 004175F4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041768D(U), :0041773C(U)
|
:004175E8 66FF45D8                inc [ebp-28]
:004175EC 8345EC3E                add dword ptr [ebp-14], 0000003E
:004175F0 8345FC24                add dword ptr [ebp-04], 00000024

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004175E3(U)
|
:004175F4 8B45D8                  mov eax, dword ptr [ebp-28]
:004175F7 25FFFF0000              and eax, 0000FFFF
:004175FC 3D80000000              cmp eax, 00000080
:00417601 0F8D3A010000            jnl 00417741
:00417607 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041760A E851050000              call 00417B60
:0041760F 668945DC                mov word ptr [ebp-24], ax
:00417613 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00417616 E8B5050000              call 00417BD0
:0041761B F645DD80                test [ebp-23], 80
:0041761F 0F8417010000            je 0041773C
:00417625 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00417628 E8230C0000              call 00418250
:0041762D 668945E4                mov word ptr [ebp-1C], ax
:00417631 8B45E4                  mov eax, dword ptr [ebp-1C]
:00417634 50                      push eax
:00417635 E84A9AFFFF              call 00411084
:0041763A 83C404                  add esp, 00000004
:0041763D 668945E0                mov word ptr [ebp-20], ax
:00417641 8B45E0                  mov eax, dword ptr [ebp-20]
:00417644 25FFFF0000              and eax, 0000FFFF
:00417649 3D00020000              cmp eax, 00000200
:0041764E 0F8413000000            je 00417667
:00417654 8B45E0                  mov eax, dword ptr [ebp-20]
:00417657 25FFFF0000              and eax, 0000FFFF
:0041765C 3D00040000              cmp eax, 00000400
:00417661 0F85D5000000            jne 0041773C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041764E(C)
|
:00417667 8B45E4                  mov eax, dword ptr [ebp-1C]
:0041766A 25FFFF0000              and eax, 0000FFFF
:0041766F 3DFE030000              cmp eax, 000003FE
:00417674 0F8413000000            je 0041768D
:0041767A 8B45E4                  mov eax, dword ptr [ebp-1C]
:0041767D 25FFFF0000              and eax, 0000FFFF
:00417682 3DFD030000              cmp eax, 000003FD
:00417687 0F8505000000            jne 00417692

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417674(C)
|
:0041768D E956FFFFFF              jmp 004175E8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417687(C)
|
:00417692 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00417695 E856100000              call 004186F0
:0041769A 668945F8                mov word ptr [ebp-08], ax
:0041769E 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004176A1 E88A100000              call 00418730
:004176A6 50                      push eax
:004176A7 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004176AA E8B10E0000              call 00418560
:004176AF 50                      push eax
:004176B0 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004176B3 E858100000              call 00418710
:004176B8 50                      push eax
:004176B9 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004176BC E84F0A0000              call 00418110
:004176C1 50                      push eax
:004176C2 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004176C5 E8260A0000              call 004180F0
:004176CA 50                      push eax
:004176CB 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004176CE E8AD090000              call 00418080
:004176D3 50                      push eax
:004176D4 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004176D7 E884090000              call 00418060
:004176DC 50                      push eax
:004176DD 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004176E0 E85B090000              call 00418040
:004176E5 50                      push eax
:004176E6 8B45E4                  mov eax, dword ptr [ebp-1C]
:004176E9 50                      push eax
:004176EA E8D5D9FFFF              call 004150C4
:004176EF 83C424                  add esp, 00000024
:004176F2 668945E8                mov word ptr [ebp-18], ax
:004176F6 8B45E8                  mov eax, dword ptr [ebp-18]
:004176F9 50                      push eax
:004176FA E8C09DFFFF              call 004114BF
:004176FF 83C404                  add esp, 00000004
:00417702 8945F0                  mov dword ptr [ebp-10], eax
:00417705 8B45E0                  mov eax, dword ptr [ebp-20]
:00417708 25FFFF0000              and eax, 0000FFFF
:0041770D 3D00040000              cmp eax, 00000400
:00417712 0F8524000000            jne 0041773C
:00417718 8B45F8                  mov eax, dword ptr [ebp-08]
:0041771B 50                      push eax
:0041771C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0041771F E80C0C0000              call 00418330
:00417724 F745D4FFFF0000          test [ebp-2C], 0000FFFF
:0041772B 0F850B000000            jne 0041773C
:00417731 E895DEFFFF              call 004155CB
:00417736 66C745D40100            mov [ebp-2C], 0001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041761F(C), :00417661(C), :00417712(C), :0041772B(C)
|
:0041773C E9A7FEFFFF              jmp 004175E8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417601(C)
|
:00417741 6A01                    push 00000001
:00417743 E8B8AAFFFF              call 00412200
:00417748 83C404                  add esp, 00000004
:0041774B C6054CF9460000          mov byte ptr [0046F94C], 00
:00417752 6A01                    push 00000001
:00417754 B900AA4600              mov ecx, 0046AA00
:00417759 E8B2A2FEFF              call 00401A10
:0041775E E929000000              jmp 0041778C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041755C(C)
|
:00417763 6A01                    push 00000001
:00417765 E896AAFFFF              call 00412200
:0041776A 83C404                  add esp, 00000004
:0041776D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00417770 E81B0F0000              call 00418690
:00417775 33C9                    xor ecx, ecx
:00417777 8AC8                    mov cl, al
:00417779 83F901                  cmp ecx, 00000001
:0041777C 0F850A000000            jne 0041778C
:00417782 E8ACFCFFFF              call 00417433
:00417787 E83BDFFFFF              call 004156C7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041775E(U), :0041777C(C)
|
:0041778C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041778F E8BCA0FEFF              call 00401850
:00417794 33C9                    xor ecx, ecx
:00417796 8AC8                    mov cl, al
:00417798 83E10F                  and ecx, 0000000F
:0041779B 894DD0                  mov dword ptr [ebp-30], ecx
:0041779E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004177A1 E8DA85FFFF              call 0040FD80
:004177A6 33C9                    xor ecx, ecx
:004177A8 8AC8                    mov cl, al
:004177AA 8B45D0                  mov eax, dword ptr [ebp-30]
:004177AD C1E00C                  shl eax, 0C
:004177B0 0BC8                    or ecx, eax
:004177B2 51                      push ecx
:004177B3 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004177B6 E875A1FEFF              call 00401930
:004177BB 33C9                    xor ecx, ecx
:004177BD 8AC8                    mov cl, al
:004177BF 51                      push ecx
:004177C0 B9B0C44600              mov ecx, 0046C4B0
:004177C5 E873820100              call 0042FA3D
:004177CA E900000000              jmp 004177CF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004177CA(U)
|
:004177CF 5F                      pop edi
:004177D0 5E                      pop esi
:004177D1 5B                      pop ebx
:004177D2 C9                      leave
:004177D3 C3                      ret



* Referenced by a CALL at Addresses:
|:0042562C   , :00425643   
|
:004177D4 55                      push ebp
:004177D5 8BEC                    mov ebp, esp
:004177D7 83EC14                  sub esp, 00000014
:004177DA 53                      push ebx
:004177DB 56                      push esi
:004177DC 57                      push edi
:004177DD C745FC00AA4600          mov [ebp-04], 0046AA00
:004177E4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004177E7 E864A0FEFF              call 00401850
:004177EC 33C9                    xor ecx, ecx
:004177EE 8AC8                    mov cl, al
:004177F0 80E10F                  and cl, 0F
:004177F3 884DF0                  mov byte ptr [ebp-10], cl
:004177F6 33C0                    xor eax, eax
:004177F8 8A45F0                  mov al, byte ptr [ebp-10]
:004177FB 8945EC                  mov dword ptr [ebp-14], eax
:004177FE E990000000              jmp 00417893

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417897(C)
|
:00417803 68027F0000              push 00007F02
:00417808 6A00                    push 00000000

* Reference To: USER32.LoadCursorA, Ord:0167h
                                  |
:0041780A FF15B4744700            Call dword ptr [004774B4]
:00417810 50                      push eax

* Reference To: USER32.SetCursor, Ord:01D8h
                                  |
:00417811 FF157C744700            Call dword ptr [0047747C]
:00417817 8945F8                  mov dword ptr [ebp-08], eax
:0041781A C705B816460000000000    mov dword ptr [004616B8], 00000000
:00417824 66C70518F545000000      mov word ptr [0045F518], 0000
:0041782D 66C705806746000000      mov word ptr [00466780], 0000
:00417836 E8FFD1FFFF              call 00414A3A
:0041783B E8A9A3FFFF              call 00411BE9
:00417840 E800D1FFFF              call 00414945
:00417845 E8F4B6FFFF              call 00412F3E
:0041784A E81DD2FFFF              call 00414A6C
:0041784F E8BBD0FFFF              call 0041490F
:00417854 E8D1FCFFFF              call 0041752A
:00417859 E8A0F40000              call 00426CFE
:0041785E 6A01                    push 00000001
:00417860 E8B7F30000              call 00426C1C
:00417865 83C404                  add esp, 00000004
:00417868 E8AA99FEFF              call 00401217
:0041786D E879C0FFFF              call 004138EB
:00417872 8B45F8                  mov eax, dword ptr [ebp-08]
:00417875 50                      push eax

* Reference To: USER32.SetCursor, Ord:01D8h
                                  |
:00417876 FF157C744700            Call dword ptr [0047747C]
:0041787C E8C1F4FFFF              call 00416D42
:00417881 668945F4                mov word ptr [ebp-0C], ax
:00417885 668B45F4                mov ax, word ptr [ebp-0C]
:00417889 E91F000000              jmp 004178AD
:0041788E E90F000000              jmp 004178A2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004177FE(U)
|
:00417893 837DEC02                cmp dword ptr [ebp-14], 00000002
:00417897 0F8466FFFFFF            je 00417803
:0041789D E900000000              jmp 004178A2

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041788E(U), :0041789D(U)
|
:004178A2 66A178534500            mov ax, word ptr [00455378]
:004178A8 E900000000              jmp 004178AD

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00417889(U), :004178A8(U)
|
:004178AD 5F                      pop edi
:004178AE 5E                      pop esi
:004178AF 5B                      pop ebx
:004178B0 C9                      leave
:004178B1 C3                      ret


:004178B2 CC                      int 03
:004178B3 CC                      int 03
:004178B4 CC                      int 03
:004178B5 CC                      int 03
:004178B6 CC                      int 03
:004178B7 CC                      int 03
:004178B8 CC                      int 03
:004178B9 CC                      int 03
:004178BA CC                      int 03
:004178BB CC                      int 03
:004178BC CC                      int 03
:004178BD CC                      int 03
:004178BE CC                      int 03
:004178BF CC                      int 03
:004178C0 55                      push ebp
:004178C1 8BEC                    mov ebp, esp
:004178C3 83EC04                  sub esp, 00000004
:004178C6 53                      push ebx
:004178C7 56                      push esi
:004178C8 57                      push edi
:004178C9 894DFC                  mov dword ptr [ebp-04], ecx
:004178CC 8B45FC                  mov eax, dword ptr [ebp-04]
:004178CF 66C7000000              mov word ptr [eax], 0000
:004178D4 E900000000              jmp 004178D9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004178D4(U)
|
:004178D9 8B45FC                  mov eax, dword ptr [ebp-04]
:004178DC 5F                      pop edi
:004178DD 5E                      pop esi
:004178DE 5B                      pop ebx
:004178DF C9                      leave
:004178E0 C3                      ret


:004178E1 CC                      int 03
:004178E2 CC                      int 03
:004178E3 CC                      int 03
:004178E4 CC                      int 03
:004178E5 CC                      int 03
:004178E6 CC                      int 03
:004178E7 CC                      int 03
:004178E8 CC                      int 03
:004178E9 CC                      int 03
:004178EA CC                      int 03
:004178EB CC                      int 03
:004178EC CC                      int 03
:004178ED CC                      int 03
:004178EE CC                      int 03
:004178EF CC                      int 03
:004178F0 55                      push ebp
:004178F1 8BEC                    mov ebp, esp
:004178F3 83EC04                  sub esp, 00000004
:004178F6 53                      push ebx
:004178F7 56                      push esi
:004178F8 57                      push edi
:004178F9 894DFC                  mov dword ptr [ebp-04], ecx
:004178FC E900000000              jmp 00417901

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004178FC(U)
|
:00417901 5F                      pop edi
:00417902 5E                      pop esi
:00417903 5B                      pop ebx
:00417904 C9                      leave
:00417905 C3                      ret


:00417906 CC                      int 03
:00417907 CC                      int 03
:00417908 CC                      int 03
:00417909 CC                      int 03
:0041790A CC                      int 03
:0041790B CC                      int 03
:0041790C CC                      int 03
:0041790D CC                      int 03
:0041790E CC                      int 03
:0041790F CC                      int 03

* Referenced by a CALL at Address:
|:00410F47   
|
:00417910 55                      push ebp
:00417911 8BEC                    mov ebp, esp
:00417913 6AFF                    push FFFFFFFF
:00417915 686C794100              push 0041796C
:0041791A 64A100000000            mov eax, dword ptr fs:[00000000]
:00417920 50                      push eax
:00417921 64892500000000          mov dword ptr fs:[00000000], esp
:00417928 83EC04                  sub esp, 00000004
:0041792B 53                      push ebx
:0041792C 56                      push esi
:0041792D 57                      push edi
:0041792E 894DF0                  mov dword ptr [ebp-10], ecx
:00417931 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00417934 E8D763FFFF              call 0040DD10
:00417939 C745FC00000000          mov [ebp-04], 00000000
:00417940 8B45F0                  mov eax, dword ptr [ebp-10]
:00417943 C6400600                mov [eax+06], 00
:00417947 8B45F0                  mov eax, dword ptr [ebp-10]
:0041794A 66C7000006              mov word ptr [eax], 0600
:0041794F E900000000              jmp 00417954

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041794F(U)
|
:00417954 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0041795B 8B45F0                  mov eax, dword ptr [ebp-10]
:0041795E E913000000              jmp 00417976
:00417963 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00417966 E8D563FFFF              call 0040DD40
:0041796B C3                      ret


:0041796C B8C0C14400              mov eax, 0044C1C0
:00417971 E94A070300              jmp 004480C0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041795E(U)
|
:00417976 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00417979 64890D00000000          mov dword ptr fs:[00000000], ecx
:00417980 5F                      pop edi
:00417981 5E                      pop esi
:00417982 5B                      pop ebx
:00417983 C9                      leave
:00417984 C3                      ret


:00417985 CC                      int 03
:00417986 CC                      int 03
:00417987 CC                      int 03
:00417988 CC                      int 03
:00417989 CC                      int 03
:0041798A CC                      int 03
:0041798B CC                      int 03
:0041798C CC                      int 03
:0041798D CC                      int 03
:0041798E CC                      int 03
:0041798F CC                      int 03

* Referenced by a CALL at Address:
|:00410F7E   
|
:00417990 55                      push ebp
:00417991 8BEC                    mov ebp, esp
:00417993 6AFF                    push FFFFFFFF
:00417995 68D7794100              push 004179D7
:0041799A 64A100000000            mov eax, dword ptr fs:[00000000]
:004179A0 50                      push eax
:004179A1 64892500000000          mov dword ptr fs:[00000000], esp
:004179A8 83EC04                  sub esp, 00000004
:004179AB 53                      push ebx
:004179AC 56                      push esi
:004179AD 57                      push edi
:004179AE 894DF0                  mov dword ptr [ebp-10], ecx
:004179B1 C745FC00000000          mov [ebp-04], 00000000
:004179B8 E900000000              jmp 004179BD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004179B8(U)
|
:004179BD C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:004179C4 E805000000              call 004179CE
:004179C9 E913000000              jmp 004179E1

* Referenced by a CALL at Address:
|:004179C4   
|
:004179CE 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004179D1 E86A63FFFF              call 0040DD40
:004179D6 C3                      ret


:004179D7 B8E8C14400              mov eax, 0044C1E8
:004179DC E9DF060300              jmp 004480C0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004179C9(U)
|
:004179E1 8B45F4                  mov eax, dword ptr [ebp-0C]
:004179E4 64A300000000            mov dword ptr fs:[00000000], eax
:004179EA 5F                      pop edi
:004179EB 5E                      pop esi
:004179EC 5B                      pop ebx
:004179ED C9                      leave
:004179EE C3                      ret


:004179EF CC                      int 03
:004179F0 55                      push ebp
:004179F1 8BEC                    mov ebp, esp
:004179F3 83EC04                  sub esp, 00000004
:004179F6 53                      push ebx
:004179F7 56                      push esi
:004179F8 57                      push edi
:004179F9 894DFC                  mov dword ptr [ebp-04], ecx
:004179FC 8B45FC                  mov eax, dword ptr [ebp-04]
:004179FF C7401000000000          mov [eax+10], 00000000
:00417A06 8B45FC                  mov eax, dword ptr [ebp-04]
:00417A09 66C740140000            mov [eax+14], 0000
:00417A0F 8B45FC                  mov eax, dword ptr [ebp-04]
:00417A12 66C740040000            mov [eax+04], 0000
:00417A18 8B45FC                  mov eax, dword ptr [ebp-04]
:00417A1B 66C740060000            mov [eax+06], 0000
:00417A21 8B45FC                  mov eax, dword ptr [ebp-04]
:00417A24 66C740080000            mov [eax+08], 0000
:00417A2A 8B45FC                  mov eax, dword ptr [ebp-04]
:00417A2D 66C7401E0000            mov [eax+1E], 0000
:00417A33 8B45FC                  mov eax, dword ptr [ebp-04]
:00417A36 66C740200000            mov [eax+20], 0000
:00417A3C 8B45FC                  mov eax, dword ptr [ebp-04]
:00417A3F 66C740220000            mov [eax+22], 0000
:00417A45 8B45FC                  mov eax, dword ptr [ebp-04]
:00417A48 66C740240000            mov [eax+24], 0000
:00417A4E 8B45FC                  mov eax, dword ptr [ebp-04]
:00417A51 66C740260000            mov [eax+26], 0000
:00417A57 8B45FC                  mov eax, dword ptr [ebp-04]
:00417A5A 66C7401A0000            mov [eax+1A], 0000
:00417A60 8B45FC                  mov eax, dword ptr [ebp-04]
:00417A63 66C740280000            mov [eax+28], 0000
:00417A69 8B45FC                  mov eax, dword ptr [ebp-04]
:00417A6C 66C7402A0000            mov [eax+2A], 0000
:00417A72 8B45FC                  mov eax, dword ptr [ebp-04]
:00417A75 66C7402C0000            mov [eax+2C], 0000
:00417A7B 6A00                    push 00000000
:00417A7D 6A00                    push 00000000
:00417A7F E89195FFFF              call 00411015
:00417A84 83C408                  add esp, 00000008
:00417A87 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00417A8A 894132                  mov dword ptr [ecx+32], eax
:00417A8D 8B45FC                  mov eax, dword ptr [ebp-04]
:00417A90 66C7402E0000            mov [eax+2E], 0000
:00417A96 8B45FC                  mov eax, dword ptr [ebp-04]
:00417A99 66C740300400            mov [eax+30], 0004
:00417A9F 8B45FC                  mov eax, dword ptr [ebp-04]
:00417AA2 66C7403A0000            mov [eax+3A], 0000
:00417AA8 8B45FC                  mov eax, dword ptr [ebp-04]
:00417AAB 66C7403C0000            mov [eax+3C], 0000
:00417AB1 8B45FC                  mov eax, dword ptr [ebp-04]
:00417AB4 66C740360000            mov [eax+36], 0000
:00417ABA 8B45FC                  mov eax, dword ptr [ebp-04]
:00417ABD 66C7400A0200            mov [eax+0A], 0002
:00417AC3 8B45FC                  mov eax, dword ptr [ebp-04]
:00417AC6 66C7400C0200            mov [eax+0C], 0002
:00417ACC 8B45FC                  mov eax, dword ptr [ebp-04]
:00417ACF 66C7400E0100            mov [eax+0E], 0001
:00417AD5 8B45FC                  mov eax, dword ptr [ebp-04]
:00417AD8 66C7000000              mov word ptr [eax], 0000
:00417ADD 8B45FC                  mov eax, dword ptr [ebp-04]
:00417AE0 66C740020000            mov [eax+02], 0000
:00417AE6 E900000000              jmp 00417AEB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417AE6(U)
|
:00417AEB 8B45FC                  mov eax, dword ptr [ebp-04]
:00417AEE 5F                      pop edi
:00417AEF 5E                      pop esi
:00417AF0 5B                      pop ebx
:00417AF1 C9                      leave
:00417AF2 C3                      ret


:00417AF3 CC                      int 03
:00417AF4 CC                      int 03
:00417AF5 CC                      int 03
:00417AF6 CC                      int 03
:00417AF7 CC                      int 03
:00417AF8 CC                      int 03
:00417AF9 CC                      int 03
:00417AFA CC                      int 03
:00417AFB CC                      int 03
:00417AFC CC                      int 03
:00417AFD CC                      int 03
:00417AFE CC                      int 03
:00417AFF CC                      int 03
:00417B00 55                      push ebp
:00417B01 8BEC                    mov ebp, esp
:00417B03 83EC04                  sub esp, 00000004
:00417B06 53                      push ebx
:00417B07 56                      push esi
:00417B08 57                      push edi
:00417B09 894DFC                  mov dword ptr [ebp-04], ecx
:00417B0C E900000000              jmp 00417B11

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417B0C(U)
|
:00417B11 5F                      pop edi
:00417B12 5E                      pop esi
:00417B13 5B                      pop ebx
:00417B14 C9                      leave
:00417B15 C3                      ret


:00417B16 CC                      int 03
:00417B17 CC                      int 03
:00417B18 CC                      int 03
:00417B19 CC                      int 03
:00417B1A CC                      int 03
:00417B1B CC                      int 03
:00417B1C CC                      int 03
:00417B1D CC                      int 03
:00417B1E CC                      int 03
:00417B1F CC                      int 03

* Referenced by a CALL at Addresses:
|:004111B0   , :00437ADD   
|
:00417B20 55                      push ebp
:00417B21 8BEC                    mov ebp, esp
:00417B23 83EC04                  sub esp, 00000004
:00417B26 53                      push ebx
:00417B27 56                      push esi
:00417B28 57                      push edi
:00417B29 894DFC                  mov dword ptr [ebp-04], ecx
:00417B2C 8B45FC                  mov eax, dword ptr [ebp-04]
:00417B2F 83C006                  add eax, 00000006
:00417B32 E900000000              jmp 00417B37

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417B32(U)
|
:00417B37 5F                      pop edi
:00417B38 5E                      pop esi
:00417B39 5B                      pop ebx
:00417B3A C9                      leave
:00417B3B C3                      ret


:00417B3C CC                      int 03
:00417B3D CC                      int 03
:00417B3E CC                      int 03
:00417B3F CC                      int 03

* Referenced by a CALL at Address:
|:004111E3   
|
:00417B40 55                      push ebp
:00417B41 8BEC                    mov ebp, esp
:00417B43 83EC04                  sub esp, 00000004
:00417B46 53                      push ebx
:00417B47 56                      push esi
:00417B48 57                      push edi
:00417B49 894DFC                  mov dword ptr [ebp-04], ecx
:00417B4C 8B45FC                  mov eax, dword ptr [ebp-04]
:00417B4F 83C006                  add eax, 00000006
:00417B52 E900000000              jmp 00417B57

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417B52(U)
|
:00417B57 5F                      pop edi
:00417B58 5E                      pop esi
:00417B59 5B                      pop ebx
:00417B5A C9                      leave
:00417B5B C3                      ret


:00417B5C CC                      int 03
:00417B5D CC                      int 03
:00417B5E CC                      int 03
:00417B5F CC                      int 03

* Referenced by a CALL at Addresses:
|:0041183F   , :00411D8B   , :004132AB   , :004144A5   , :00414BA8   
|:00415042   , :0041567F   , :00415F03   , :00416544   , :00416931   
|:0041760A   
|
:00417B60 55                      push ebp
:00417B61 8BEC                    mov ebp, esp
:00417B63 83EC04                  sub esp, 00000004
:00417B66 53                      push ebx
:00417B67 56                      push esi
:00417B68 57                      push edi
:00417B69 894DFC                  mov dword ptr [ebp-04], ecx
:00417B6C 8B45FC                  mov eax, dword ptr [ebp-04]
:00417B6F 668B4028                mov ax, word ptr [eax+28]
:00417B73 E900000000              jmp 00417B78

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417B73(U)
|
:00417B78 5F                      pop edi
:00417B79 5E                      pop esi
:00417B7A 5B                      pop ebx
:00417B7B C9                      leave
:00417B7C C3                      ret


:00417B7D CC                      int 03
:00417B7E CC                      int 03
:00417B7F CC                      int 03

* Referenced by a CALL at Addresses:
|:0041186E   , :00411E7E   , :00411E9A   , :004126CF   
|
:00417B80 55                      push ebp
:00417B81 8BEC                    mov ebp, esp
:00417B83 83EC04                  sub esp, 00000004
:00417B86 53                      push ebx
:00417B87 56                      push esi
:00417B88 57                      push edi
:00417B89 894DFC                  mov dword ptr [ebp-04], ecx
:00417B8C 8B4508                  mov eax, dword ptr [ebp+08]
:00417B8F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00417B92 894110                  mov dword ptr [ecx+10], eax
:00417B95 E900000000              jmp 00417B9A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417B95(U)
|
:00417B9A 5F                      pop edi
:00417B9B 5E                      pop esi
:00417B9C 5B                      pop ebx
:00417B9D C9                      leave
:00417B9E C20400                  ret 0004


:00417BA1 CC                      int 03
:00417BA2 CC                      int 03
:00417BA3 CC                      int 03
:00417BA4 CC                      int 03
:00417BA5 CC                      int 03
:00417BA6 CC                      int 03
:00417BA7 CC                      int 03
:00417BA8 CC                      int 03
:00417BA9 CC                      int 03
:00417BAA CC                      int 03
:00417BAB CC                      int 03
:00417BAC CC                      int 03
:00417BAD CC                      int 03
:00417BAE CC                      int 03
:00417BAF CC                      int 03

* Referenced by a CALL at Address:
|:00411853   
|
:00417BB0 55                      push ebp
:00417BB1 8BEC                    mov ebp, esp
:00417BB3 83EC04                  sub esp, 00000004
:00417BB6 53                      push ebx
:00417BB7 56                      push esi
:00417BB8 57                      push edi
:00417BB9 894DFC                  mov dword ptr [ebp-04], ecx
:00417BBC 8B45FC                  mov eax, dword ptr [ebp-04]
:00417BBF 8B4010                  mov eax, dword ptr [eax+10]
:00417BC2 E900000000              jmp 00417BC7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417BC2(U)
|
:00417BC7 5F                      pop edi
:00417BC8 5E                      pop esi
:00417BC9 5B                      pop ebx
:00417BCA C9                      leave
:00417BCB C3                      ret


:00417BCC CC                      int 03
:00417BCD CC                      int 03
:00417BCE CC                      int 03
:00417BCF CC                      int 03

* Referenced by a CALL at Addresses:
|:00411DDA   , :004126BB   , :00414C9D   , :00417616   
|
:00417BD0 55                      push ebp
:00417BD1 8BEC                    mov ebp, esp
:00417BD3 83EC04                  sub esp, 00000004
:00417BD6 53                      push ebx
:00417BD7 56                      push esi
:00417BD8 57                      push edi
:00417BD9 894DFC                  mov dword ptr [ebp-04], ecx
:00417BDC 8B45FC                  mov eax, dword ptr [ebp-04]
:00417BDF 66C740280000            mov [eax+28], 0000
:00417BE5 E900000000              jmp 00417BEA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417BE5(U)
|
:00417BEA 5F                      pop edi
:00417BEB 5E                      pop esi
:00417BEC 5B                      pop ebx
:00417BED C9                      leave
:00417BEE C3                      ret


:00417BEF CC                      int 03

* Referenced by a CALL at Address:
|:00411DD2   
|
:00417BF0 55                      push ebp
:00417BF1 8BEC                    mov ebp, esp
:00417BF3 83EC04                  sub esp, 00000004
:00417BF6 53                      push ebx
:00417BF7 56                      push esi
:00417BF8 57                      push edi
:00417BF9 894DFC                  mov dword ptr [ebp-04], ecx
:00417BFC 668B4508                mov ax, word ptr [ebp+08]
:00417C00 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00417C03 66894138                mov word ptr [ecx+38], ax
:00417C07 E900000000              jmp 00417C0C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417C07(U)
|
:00417C0C 5F                      pop edi
:00417C0D 5E                      pop esi
:00417C0E 5B                      pop ebx
:00417C0F C9                      leave
:00417C10 C20400                  ret 0004


:00417C13 CC                      int 03
:00417C14 CC                      int 03
:00417C15 CC                      int 03
:00417C16 CC                      int 03
:00417C17 CC                      int 03
:00417C18 CC                      int 03
:00417C19 CC                      int 03
:00417C1A CC                      int 03
:00417C1B CC                      int 03
:00417C1C CC                      int 03
:00417C1D CC                      int 03
:00417C1E CC                      int 03
:00417C1F CC                      int 03

* Referenced by a CALL at Addresses:
|:00411DF6   , :00414F5A   , :004158C9   , :00415C62   , :00415F6A   
|
:00417C20 55                      push ebp
:00417C21 8BEC                    mov ebp, esp
:00417C23 83EC04                  sub esp, 00000004
:00417C26 53                      push ebx
:00417C27 56                      push esi
:00417C28 57                      push edi
:00417C29 894DFC                  mov dword ptr [ebp-04], ecx
:00417C2C 668B4508                mov ax, word ptr [ebp+08]
:00417C30 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00417C33 66894136                mov word ptr [ecx+36], ax
:00417C37 E900000000              jmp 00417C3C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417C37(U)
|
:00417C3C 5F                      pop edi
:00417C3D 5E                      pop esi
:00417C3E 5B                      pop ebx
:00417C3F C9                      leave
:00417C40 C20400                  ret 0004


:00417C43 CC                      int 03
:00417C44 CC                      int 03
:00417C45 CC                      int 03
:00417C46 CC                      int 03
:00417C47 CC                      int 03
:00417C48 CC                      int 03
:00417C49 CC                      int 03
:00417C4A CC                      int 03
:00417C4B CC                      int 03
:00417C4C CC                      int 03
:00417C4D CC                      int 03
:00417C4E CC                      int 03
:00417C4F CC                      int 03

* Referenced by a CALL at Addresses:
|:00411DEC   , :00414727   , :00414F77   , :004158BF   , :00416068   
|:00416B7A   
|
:00417C50 55                      push ebp
:00417C51 8BEC                    mov ebp, esp
:00417C53 83EC04                  sub esp, 00000004
:00417C56 53                      push ebx
:00417C57 56                      push esi
:00417C58 57                      push edi
:00417C59 894DFC                  mov dword ptr [ebp-04], ecx
:00417C5C 8B45FC                  mov eax, dword ptr [ebp-04]
:00417C5F 33C9                    xor ecx, ecx
:00417C61 668B4828                mov cx, word ptr [eax+28]
:00417C65 8B450C                  mov eax, dword ptr [ebp+0C]
:00417C68 25FFFF0000              and eax, 0000FFFF
:00417C6D F7D0                    not eax
:00417C6F 23C8                    and ecx, eax
:00417C71 8B45FC                  mov eax, dword ptr [ebp-04]
:00417C74 66894828                mov word ptr [eax+28], cx
:00417C78 8B450C                  mov eax, dword ptr [ebp+0C]
:00417C7B 25FFFF0000              and eax, 0000FFFF
:00417C80 8B4D08                  mov ecx, dword ptr [ebp+08]
:00417C83 81E1FFFF0000            and ecx, 0000FFFF
:00417C89 23C1                    and eax, ecx
:00417C8B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00417C8E 33D2                    xor edx, edx
:00417C90 668B5128                mov dx, word ptr [ecx+28]
:00417C94 0BC2                    or eax, edx
:00417C96 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00417C99 66894128                mov word ptr [ecx+28], ax
:00417C9D E900000000              jmp 00417CA2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417C9D(U)
|
:00417CA2 5F                      pop edi
:00417CA3 5E                      pop esi
:00417CA4 5B                      pop ebx
:00417CA5 C9                      leave
:00417CA6 C20800                  ret 0008


:00417CA9 CC                      int 03
:00417CAA CC                      int 03
:00417CAB CC                      int 03
:00417CAC CC                      int 03
:00417CAD CC                      int 03
:00417CAE CC                      int 03
:00417CAF CC                      int 03

* Referenced by a CALL at Address:
|:00411E02   
|
:00417CB0 55                      push ebp
:00417CB1 8BEC                    mov ebp, esp
:00417CB3 83EC04                  sub esp, 00000004
:00417CB6 53                      push ebx
:00417CB7 56                      push esi
:00417CB8 57                      push edi
:00417CB9 894DFC                  mov dword ptr [ebp-04], ecx
:00417CBC 668B4508                mov ax, word ptr [ebp+08]
:00417CC0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00417CC3 66894114                mov word ptr [ecx+14], ax
:00417CC7 E900000000              jmp 00417CCC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417CC7(U)
|
:00417CCC 5F                      pop edi
:00417CCD 5E                      pop esi
:00417CCE 5B                      pop ebx
:00417CCF C9                      leave
:00417CD0 C20400                  ret 0004


:00417CD3 CC                      int 03
:00417CD4 CC                      int 03
:00417CD5 CC                      int 03
:00417CD6 CC                      int 03
:00417CD7 CC                      int 03
:00417CD8 CC                      int 03
:00417CD9 CC                      int 03
:00417CDA CC                      int 03
:00417CDB CC                      int 03
:00417CDC CC                      int 03
:00417CDD CC                      int 03
:00417CDE CC                      int 03
:00417CDF CC                      int 03

* Referenced by a CALL at Addresses:
|:0041238D   , :00412566   , :00416BB7   , :00417493   
|
:00417CE0 55                      push ebp
:00417CE1 8BEC                    mov ebp, esp
:00417CE3 83EC04                  sub esp, 00000004
:00417CE6 53                      push ebx
:00417CE7 56                      push esi
:00417CE8 57                      push edi
:00417CE9 894DFC                  mov dword ptr [ebp-04], ecx
:00417CEC 8B45FC                  mov eax, dword ptr [ebp-04]
:00417CEF 668B00                  mov ax, word ptr [eax]
:00417CF2 E900000000              jmp 00417CF7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417CF2(U)
|
:00417CF7 5F                      pop edi
:00417CF8 5E                      pop esi
:00417CF9 5B                      pop ebx
:00417CFA C9                      leave
:00417CFB C3                      ret


:00417CFC CC                      int 03
:00417CFD CC                      int 03
:00417CFE CC                      int 03
:00417CFF CC                      int 03

* Referenced by a CALL at Address:
|:004123AB   
|
:00417D00 55                      push ebp
:00417D01 8BEC                    mov ebp, esp
:00417D03 83EC04                  sub esp, 00000004
:00417D06 53                      push ebx
:00417D07 56                      push esi
:00417D08 57                      push edi
:00417D09 894DFC                  mov dword ptr [ebp-04], ecx
:00417D0C 8B45FC                  mov eax, dword ptr [ebp-04]
:00417D0F 33C9                    xor ecx, ecx
:00417D11 668B08                  mov cx, word ptr [eax]
:00417D14 8B450C                  mov eax, dword ptr [ebp+0C]
:00417D17 25FFFF0000              and eax, 0000FFFF
:00417D1C F7D0                    not eax
:00417D1E 23C8                    and ecx, eax
:00417D20 8B45FC                  mov eax, dword ptr [ebp-04]
:00417D23 668908                  mov word ptr [eax], cx
:00417D26 8B450C                  mov eax, dword ptr [ebp+0C]
:00417D29 25FFFF0000              and eax, 0000FFFF
:00417D2E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00417D31 81E1FFFF0000            and ecx, 0000FFFF
:00417D37 23C1                    and eax, ecx
:00417D39 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00417D3C 33D2                    xor edx, edx
:00417D3E 668B11                  mov dx, word ptr [ecx]
:00417D41 0BC2                    or eax, edx
:00417D43 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00417D46 668901                  mov word ptr [ecx], ax
:00417D49 E900000000              jmp 00417D4E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417D49(U)
|
:00417D4E 5F                      pop edi
:00417D4F 5E                      pop esi
:00417D50 5B                      pop ebx
:00417D51 C9                      leave
:00417D52 C20800                  ret 0008


:00417D55 CC                      int 03
:00417D56 CC                      int 03
:00417D57 CC                      int 03
:00417D58 CC                      int 03
:00417D59 CC                      int 03
:00417D5A CC                      int 03
:00417D5B CC                      int 03
:00417D5C CC                      int 03
:00417D5D CC                      int 03
:00417D5E CC                      int 03
:00417D5F CC                      int 03

* Referenced by a CALL at Address:
|:004123B7   
|
:00417D60 55                      push ebp
:00417D61 8BEC                    mov ebp, esp
:00417D63 83EC04                  sub esp, 00000004
:00417D66 53                      push ebx
:00417D67 56                      push esi
:00417D68 57                      push edi
:00417D69 894DFC                  mov dword ptr [ebp-04], ecx
:00417D6C 668B4508                mov ax, word ptr [ebp+08]
:00417D70 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00417D73 66894102                mov word ptr [ecx+02], ax
:00417D77 E900000000              jmp 00417D7C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417D77(U)
|
:00417D7C 5F                      pop edi
:00417D7D 5E                      pop esi
:00417D7E 5B                      pop ebx
:00417D7F C9                      leave
:00417D80 C20400                  ret 0004


:00417D83 CC                      int 03
:00417D84 CC                      int 03
:00417D85 CC                      int 03
:00417D86 CC                      int 03
:00417D87 CC                      int 03
:00417D88 CC                      int 03
:00417D89 CC                      int 03
:00417D8A CC                      int 03
:00417D8B CC                      int 03
:00417D8C CC                      int 03
:00417D8D CC                      int 03
:00417D8E CC                      int 03
:00417D8F CC                      int 03

* Referenced by a CALL at Address:
|:004123C3   
|
:00417D90 55                      push ebp
:00417D91 8BEC                    mov ebp, esp
:00417D93 83EC04                  sub esp, 00000004
:00417D96 53                      push ebx
:00417D97 56                      push esi
:00417D98 57                      push edi
:00417D99 894DFC                  mov dword ptr [ebp-04], ecx
:00417D9C 668B4508                mov ax, word ptr [ebp+08]
:00417DA0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00417DA3 66894104                mov word ptr [ecx+04], ax
:00417DA7 E900000000              jmp 00417DAC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417DA7(U)
|
:00417DAC 5F                      pop edi
:00417DAD 5E                      pop esi
:00417DAE 5B                      pop ebx
:00417DAF C9                      leave
:00417DB0 C20400                  ret 0004


:00417DB3 CC                      int 03
:00417DB4 CC                      int 03
:00417DB5 CC                      int 03
:00417DB6 CC                      int 03
:00417DB7 CC                      int 03
:00417DB8 CC                      int 03
:00417DB9 CC                      int 03
:00417DBA CC                      int 03
:00417DBB CC                      int 03
:00417DBC CC                      int 03
:00417DBD CC                      int 03
:00417DBE CC                      int 03
:00417DBF CC                      int 03

* Referenced by a CALL at Address:
|:00412420   
|
:00417DC0 55                      push ebp
:00417DC1 8BEC                    mov ebp, esp
:00417DC3 83EC04                  sub esp, 00000004
:00417DC6 53                      push ebx
:00417DC7 56                      push esi
:00417DC8 57                      push edi
:00417DC9 894DFC                  mov dword ptr [ebp-04], ecx
:00417DCC 668B4508                mov ax, word ptr [ebp+08]
:00417DD0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00417DD3 66894106                mov word ptr [ecx+06], ax
:00417DD7 E900000000              jmp 00417DDC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417DD7(U)
|
:00417DDC 5F                      pop edi
:00417DDD 5E                      pop esi
:00417DDE 5B                      pop ebx
:00417DDF C9                      leave
:00417DE0 C20400                  ret 0004


:00417DE3 CC                      int 03
:00417DE4 CC                      int 03
:00417DE5 CC                      int 03
:00417DE6 CC                      int 03
:00417DE7 CC                      int 03
:00417DE8 CC                      int 03
:00417DE9 CC                      int 03
:00417DEA CC                      int 03
:00417DEB CC                      int 03
:00417DEC CC                      int 03
:00417DED CC                      int 03
:00417DEE CC                      int 03
:00417DEF CC                      int 03

* Referenced by a CALL at Address:
|:0041242C   
|
:00417DF0 55                      push ebp
:00417DF1 8BEC                    mov ebp, esp
:00417DF3 83EC04                  sub esp, 00000004
:00417DF6 53                      push ebx
:00417DF7 56                      push esi
:00417DF8 57                      push edi
:00417DF9 894DFC                  mov dword ptr [ebp-04], ecx
:00417DFC 668B4508                mov ax, word ptr [ebp+08]
:00417E00 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00417E03 66894108                mov word ptr [ecx+08], ax
:00417E07 E900000000              jmp 00417E0C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417E07(U)
|
:00417E0C 5F                      pop edi
:00417E0D 5E                      pop esi
:00417E0E 5B                      pop ebx
:00417E0F C9                      leave
:00417E10 C20400                  ret 0004


:00417E13 CC                      int 03
:00417E14 CC                      int 03
:00417E15 CC                      int 03
:00417E16 CC                      int 03
:00417E17 CC                      int 03
:00417E18 CC                      int 03
:00417E19 CC                      int 03
:00417E1A CC                      int 03
:00417E1B CC                      int 03
:00417E1C CC                      int 03
:00417E1D CC                      int 03
:00417E1E CC                      int 03
:00417E1F CC                      int 03

* Referenced by a CALL at Address:
|:00412436   
|
:00417E20 55                      push ebp
:00417E21 8BEC                    mov ebp, esp
:00417E23 83EC04                  sub esp, 00000004
:00417E26 53                      push ebx
:00417E27 56                      push esi
:00417E28 57                      push edi
:00417E29 894DFC                  mov dword ptr [ebp-04], ecx
:00417E2C 668B4508                mov ax, word ptr [ebp+08]
:00417E30 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00417E33 6689410A                mov word ptr [ecx+0A], ax
:00417E37 E900000000              jmp 00417E3C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417E37(U)
|
:00417E3C 5F                      pop edi
:00417E3D 5E                      pop esi
:00417E3E 5B                      pop ebx
:00417E3F C9                      leave
:00417E40 C20400                  ret 0004


:00417E43 CC                      int 03
:00417E44 CC                      int 03
:00417E45 CC                      int 03
:00417E46 CC                      int 03
:00417E47 CC                      int 03
:00417E48 CC                      int 03
:00417E49 CC                      int 03
:00417E4A CC                      int 03
:00417E4B CC                      int 03
:00417E4C CC                      int 03
:00417E4D CC                      int 03
:00417E4E CC                      int 03
:00417E4F CC                      int 03

* Referenced by a CALL at Address:
|:00412440   
|
:00417E50 55                      push ebp
:00417E51 8BEC                    mov ebp, esp
:00417E53 83EC04                  sub esp, 00000004
:00417E56 53                      push ebx
:00417E57 56                      push esi
:00417E58 57                      push edi
:00417E59 894DFC                  mov dword ptr [ebp-04], ecx
:00417E5C 668B4508                mov ax, word ptr [ebp+08]
:00417E60 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00417E63 6689410C                mov word ptr [ecx+0C], ax
:00417E67 E900000000              jmp 00417E6C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417E67(U)
|
:00417E6C 5F                      pop edi
:00417E6D 5E                      pop esi
:00417E6E 5B                      pop ebx
:00417E6F C9                      leave
:00417E70 C20400                  ret 0004


:00417E73 CC                      int 03
:00417E74 CC                      int 03
:00417E75 CC                      int 03
:00417E76 CC                      int 03
:00417E77 CC                      int 03
:00417E78 CC                      int 03
:00417E79 CC                      int 03
:00417E7A CC                      int 03
:00417E7B CC                      int 03
:00417E7C CC                      int 03
:00417E7D CC                      int 03
:00417E7E CC                      int 03
:00417E7F CC                      int 03

* Referenced by a CALL at Addresses:
|:004126C5   , :00414D72   , :00414EAE   , :00415C35   , :00415C58   
|:00415D78   
|
:00417E80 55                      push ebp
:00417E81 8BEC                    mov ebp, esp
:00417E83 83EC04                  sub esp, 00000004
:00417E86 53                      push ebx
:00417E87 56                      push esi
:00417E88 57                      push edi
:00417E89 894DFC                  mov dword ptr [ebp-04], ecx
:00417E8C 668B4508                mov ax, word ptr [ebp+08]
:00417E90 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00417E93 6689412E                mov word ptr [ecx+2E], ax
:00417E97 E900000000              jmp 00417E9C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417E97(U)
|
:00417E9C 5F                      pop edi
:00417E9D 5E                      pop esi
:00417E9E 5B                      pop ebx
:00417E9F C9                      leave
:00417EA0 C20400                  ret 0004


:00417EA3 CC                      int 03
:00417EA4 CC                      int 03
:00417EA5 CC                      int 03
:00417EA6 CC                      int 03
:00417EA7 CC                      int 03
:00417EA8 CC                      int 03
:00417EA9 CC                      int 03
:00417EAA CC                      int 03
:00417EAB CC                      int 03
:00417EAC CC                      int 03
:00417EAD CC                      int 03
:00417EAE CC                      int 03
:00417EAF CC                      int 03

* Referenced by a CALL at Addresses:
|:00412AA7   , :00412C4E   , :00414CD3   
|
:00417EB0 55                      push ebp
:00417EB1 8BEC                    mov ebp, esp
:00417EB3 83EC04                  sub esp, 00000004
:00417EB6 53                      push ebx
:00417EB7 56                      push esi
:00417EB8 57                      push edi
:00417EB9 894DFC                  mov dword ptr [ebp-04], ecx
:00417EBC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00417EBF E81C000000              call 00417EE0
:00417EC4 0FB7C0                  movzx eax, ax
:00417EC7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00417ECA 8B4910                  mov ecx, dword ptr [ecx+10]
:00417ECD 8B0481                  mov eax, dword ptr [ecx+4*eax]
:00417ED0 E900000000              jmp 00417ED5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417ED0(U)
|
:00417ED5 5F                      pop edi
:00417ED6 5E                      pop esi
:00417ED7 5B                      pop ebx
:00417ED8 C9                      leave
:00417ED9 C3                      ret


:00417EDA CC                      int 03
:00417EDB CC                      int 03
:00417EDC CC                      int 03
:00417EDD CC                      int 03
:00417EDE CC                      int 03
:00417EDF CC                      int 03

* Referenced by a CALL at Addresses:
|:00417EBF   , :00417F2F   
|
:00417EE0 55                      push ebp
:00417EE1 8BEC                    mov ebp, esp
:00417EE3 83EC04                  sub esp, 00000004
:00417EE6 53                      push ebx
:00417EE7 56                      push esi
:00417EE8 57                      push edi
:00417EE9 894DFC                  mov dword ptr [ebp-04], ecx
:00417EEC 8B45FC                  mov eax, dword ptr [ebp-04]
:00417EEF 33C9                    xor ecx, ecx
:00417EF1 668B482E                mov cx, word ptr [eax+2E]
:00417EF5 8B45FC                  mov eax, dword ptr [ebp-04]
:00417EF8 33D2                    xor edx, edx
:00417EFA 668B502A                mov dx, word ptr [eax+2A]
:00417EFE 8D04D500000000          lea eax, dword ptr [8*edx+00000000]
:00417F05 8D0448                  lea eax, dword ptr [eax+2*ecx]
:00417F08 E900000000              jmp 00417F0D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417F08(U)
|
:00417F0D 5F                      pop edi
:00417F0E 5E                      pop esi
:00417F0F 5B                      pop ebx
:00417F10 C9                      leave
:00417F11 C3                      ret


:00417F12 CC                      int 03
:00417F13 CC                      int 03
:00417F14 CC                      int 03
:00417F15 CC                      int 03
:00417F16 CC                      int 03
:00417F17 CC                      int 03
:00417F18 CC                      int 03
:00417F19 CC                      int 03
:00417F1A CC                      int 03
:00417F1B CC                      int 03
:00417F1C CC                      int 03
:00417F1D CC                      int 03
:00417F1E CC                      int 03
:00417F1F CC                      int 03

* Referenced by a CALL at Addresses:
|:00412A51   , :00412BF8   , :0041306D   , :0041699C   
|
:00417F20 55                      push ebp
:00417F21 8BEC                    mov ebp, esp
:00417F23 83EC04                  sub esp, 00000004
:00417F26 53                      push ebx
:00417F27 56                      push esi
:00417F28 57                      push edi
:00417F29 894DFC                  mov dword ptr [ebp-04], ecx
:00417F2C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00417F2F E8ACFFFFFF              call 00417EE0
:00417F34 50                      push eax
:00417F35 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00417F38 E813000000              call 00417F50
:00417F3D E900000000              jmp 00417F42

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417F3D(U)
|
:00417F42 5F                      pop edi
:00417F43 5E                      pop esi
:00417F44 5B                      pop ebx
:00417F45 C9                      leave
:00417F46 C3                      ret


:00417F47 CC                      int 03
:00417F48 CC                      int 03
:00417F49 CC                      int 03
:00417F4A CC                      int 03
:00417F4B CC                      int 03
:00417F4C CC                      int 03
:00417F4D CC                      int 03
:00417F4E CC                      int 03
:00417F4F CC                      int 03

* Referenced by a CALL at Address:
|:00417F38   
|
:00417F50 55                      push ebp
:00417F51 8BEC                    mov ebp, esp
:00417F53 83EC08                  sub esp, 00000008
:00417F56 53                      push ebx
:00417F57 56                      push esi
:00417F58 57                      push edi
:00417F59 894DF8                  mov dword ptr [ebp-08], ecx
:00417F5C 8B4508                  mov eax, dword ptr [ebp+08]
:00417F5F 50                      push eax
:00417F60 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00417F63 E838000000              call 00417FA0
:00417F68 8945FC                  mov dword ptr [ebp-04], eax
:00417F6B F645FF80                test [ebp-01], 80
:00417F6F 0F8507000000            jne 00417F7C
:00417F75 C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417F6F(C)
|
:00417F7C 8165FCFFFFFF3F          and dword ptr [ebp-04], 3FFFFFFF
:00417F83 8B45F8                  mov eax, dword ptr [ebp-08]
:00417F86 8B4010                  mov eax, dword ptr [eax+10]
:00417F89 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00417F8C 8D840800020000          lea eax, dword ptr [eax+ecx+00000200]
:00417F93 E900000000              jmp 00417F98

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417F93(U)
|
:00417F98 5F                      pop edi
:00417F99 5E                      pop esi
:00417F9A 5B                      pop ebx
:00417F9B C9                      leave
:00417F9C C20400                  ret 0004


:00417F9F CC                      int 03

* Referenced by a CALL at Address:
|:00417F63   
|
:00417FA0 55                      push ebp
:00417FA1 8BEC                    mov ebp, esp
:00417FA3 83EC04                  sub esp, 00000004
:00417FA6 53                      push ebx
:00417FA7 56                      push esi
:00417FA8 57                      push edi
:00417FA9 894DFC                  mov dword ptr [ebp-04], ecx
:00417FAC 8B4508                  mov eax, dword ptr [ebp+08]
:00417FAF 25FFFF0000              and eax, 0000FFFF
:00417FB4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00417FB7 8B4910                  mov ecx, dword ptr [ecx+10]
:00417FBA 8B0481                  mov eax, dword ptr [ecx+4*eax]
:00417FBD E900000000              jmp 00417FC2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417FBD(U)
|
:00417FC2 5F                      pop edi
:00417FC3 5E                      pop esi
:00417FC4 5B                      pop ebx
:00417FC5 C9                      leave
:00417FC6 C20400                  ret 0004


:00417FC9 CC                      int 03
:00417FCA CC                      int 03
:00417FCB CC                      int 03
:00417FCC CC                      int 03
:00417FCD CC                      int 03
:00417FCE CC                      int 03
:00417FCF CC                      int 03

* Referenced by a CALL at Addresses:
|:00412A8F   , :00412C36   
|
:00417FD0 55                      push ebp
:00417FD1 8BEC                    mov ebp, esp
:00417FD3 83EC04                  sub esp, 00000004
:00417FD6 53                      push ebx
:00417FD7 56                      push esi
:00417FD8 57                      push edi
:00417FD9 894DFC                  mov dword ptr [ebp-04], ecx
:00417FDC 8B45FC                  mov eax, dword ptr [ebp-04]
:00417FDF 668B401E                mov ax, word ptr [eax+1E]
:00417FE3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00417FE6 66894122                mov word ptr [ecx+22], ax
:00417FEA 8B45FC                  mov eax, dword ptr [ebp-04]
:00417FED 668B4020                mov ax, word ptr [eax+20]
:00417FF1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00417FF4 66894124                mov word ptr [ecx+24], ax
:00417FF8 E900000000              jmp 00417FFD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417FF8(U)
|
:00417FFD 5F                      pop edi
:00417FFE 5E                      pop esi
:00417FFF 5B                      pop ebx
:00418000 C9                      leave
:00418001 C3                      ret


:00418002 CC                      int 03
:00418003 CC                      int 03
:00418004 CC                      int 03
:00418005 CC                      int 03
:00418006 CC                      int 03
:00418007 CC                      int 03
:00418008 CC                      int 03
:00418009 CC                      int 03
:0041800A CC                      int 03
:0041800B CC                      int 03
:0041800C CC                      int 03
:0041800D CC                      int 03
:0041800E CC                      int 03
:0041800F CC                      int 03

* Referenced by a CALL at Addresses:
|:00412A9F   , :00412C46   , :00414F32   
|
:00418010 55                      push ebp
:00418011 8BEC                    mov ebp, esp
:00418013 83EC04                  sub esp, 00000004
:00418016 53                      push ebx
:00418017 56                      push esi
:00418018 57                      push edi
:00418019 894DFC                  mov dword ptr [ebp-04], ecx
:0041801C 668B4508                mov ax, word ptr [ebp+08]
:00418020 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00418023 6689411E                mov word ptr [ecx+1E], ax
:00418027 668B450C                mov ax, word ptr [ebp+0C]
:0041802B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041802E 66894120                mov word ptr [ecx+20], ax
:00418032 E900000000              jmp 00418037

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418032(U)
|
:00418037 5F                      pop edi
:00418038 5E                      pop esi
:00418039 5B                      pop ebx
:0041803A C9                      leave
:0041803B C20800                  ret 0008


:0041803E CC                      int 03
:0041803F CC                      int 03

* Referenced by a CALL at Addresses:
|:00412E9B   , :00413125   , :00413193   , :004142D0   , :00414609   
|:0041469D   , :004146C1   , :00415056   , :004153CE   , :00415C0A   
|:00415C1C   , :004176E0   
|
:00418040 55                      push ebp
:00418041 8BEC                    mov ebp, esp
:00418043 83EC04                  sub esp, 00000004
:00418046 53                      push ebx
:00418047 56                      push esi
:00418048 57                      push edi
:00418049 894DFC                  mov dword ptr [ebp-04], ecx
:0041804C 8B45FC                  mov eax, dword ptr [ebp-04]
:0041804F 668B4004                mov ax, word ptr [eax+04]
:00418053 E900000000              jmp 00418058

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418053(U)
|
:00418058 5F                      pop edi
:00418059 5E                      pop esi
:0041805A 5B                      pop ebx
:0041805B C9                      leave
:0041805C C3                      ret


:0041805D CC                      int 03
:0041805E CC                      int 03
:0041805F CC                      int 03

* Referenced by a CALL at Addresses:
|:00412EA7   , :00413111   , :0041317F   , :004142DC   , :00414600   
|:00414694   , :004146B8   , :00415071   , :004153C5   , :00415C01   
|:00415C13   , :004176D7   
|
:00418060 55                      push ebp
:00418061 8BEC                    mov ebp, esp
:00418063 83EC04                  sub esp, 00000004
:00418066 53                      push ebx
:00418067 56                      push esi
:00418068 57                      push edi
:00418069 894DFC                  mov dword ptr [ebp-04], ecx
:0041806C 8B45FC                  mov eax, dword ptr [ebp-04]
:0041806F 668B4006                mov ax, word ptr [eax+06]
:00418073 E900000000              jmp 00418078

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418073(U)
|
:00418078 5F                      pop edi
:00418079 5E                      pop esi
:0041807A 5B                      pop ebx
:0041807B C9                      leave
:0041807C C3                      ret


:0041807D CC                      int 03
:0041807E CC                      int 03
:0041807F CC                      int 03

* Referenced by a CALL at Addresses:
|:00412EB3   , :004130B3   , :004176CE   
|
:00418080 55                      push ebp
:00418081 8BEC                    mov ebp, esp
:00418083 83EC04                  sub esp, 00000004
:00418086 53                      push ebx
:00418087 56                      push esi
:00418088 57                      push edi
:00418089 894DFC                  mov dword ptr [ebp-04], ecx
:0041808C 8B45FC                  mov eax, dword ptr [ebp-04]
:0041808F 668B4008                mov ax, word ptr [eax+08]
:00418093 E900000000              jmp 00418098

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418093(U)
|
:00418098 5F                      pop edi
:00418099 5E                      pop esi
:0041809A 5B                      pop ebx
:0041809B C9                      leave
:0041809C C3                      ret


:0041809D CC                      int 03
:0041809E CC                      int 03
:0041809F CC                      int 03

* Referenced by a CALL at Address:
|:004130CA   
|
:004180A0 55                      push ebp
:004180A1 8BEC                    mov ebp, esp
:004180A3 83EC04                  sub esp, 00000004
:004180A6 53                      push ebx
:004180A7 56                      push esi
:004180A8 57                      push edi
:004180A9 894DFC                  mov dword ptr [ebp-04], ecx
:004180AC 668B4508                mov ax, word ptr [ebp+08]
:004180B0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004180B3 66894126                mov word ptr [ecx+26], ax
:004180B7 E900000000              jmp 004180BC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004180B7(U)
|
:004180BC 5F                      pop edi
:004180BD 5E                      pop esi
:004180BE 5B                      pop ebx
:004180BF C9                      leave
:004180C0 C20400                  ret 0004


:004180C3 CC                      int 03
:004180C4 CC                      int 03
:004180C5 CC                      int 03
:004180C6 CC                      int 03
:004180C7 CC                      int 03
:004180C8 CC                      int 03
:004180C9 CC                      int 03
:004180CA CC                      int 03
:004180CB CC                      int 03
:004180CC CC                      int 03
:004180CD CC                      int 03
:004180CE CC                      int 03
:004180CF CC                      int 03

* Referenced by a CALL at Addresses:
|:004131EF   , :004131FA   
|
:004180D0 55                      push ebp
:004180D1 8BEC                    mov ebp, esp
:004180D3 83EC04                  sub esp, 00000004
:004180D6 53                      push ebx
:004180D7 56                      push esi
:004180D8 57                      push edi
:004180D9 894DFC                  mov dword ptr [ebp-04], ecx
:004180DC 8B45FC                  mov eax, dword ptr [ebp-04]
:004180DF 668B4026                mov ax, word ptr [eax+26]
:004180E3 E900000000              jmp 004180E8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004180E3(U)
|
:004180E8 5F                      pop edi
:004180E9 5E                      pop esi
:004180EA 5B                      pop ebx
:004180EB C9                      leave
:004180EC C3                      ret


:004180ED CC                      int 03
:004180EE CC                      int 03
:004180EF CC                      int 03

* Referenced by a CALL at Addresses:
|:0041434E   , :004145F7   , :004146AF   , :004153BC   , :004176C5   
|
:004180F0 55                      push ebp
:004180F1 8BEC                    mov ebp, esp
:004180F3 83EC04                  sub esp, 00000004
:004180F6 53                      push ebx
:004180F7 56                      push esi
:004180F8 57                      push edi
:004180F9 894DFC                  mov dword ptr [ebp-04], ecx
:004180FC 8B45FC                  mov eax, dword ptr [ebp-04]
:004180FF 668B400A                mov ax, word ptr [eax+0A]
:00418103 E900000000              jmp 00418108

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418103(U)
|
:00418108 5F                      pop edi
:00418109 5E                      pop esi
:0041810A 5B                      pop ebx
:0041810B C9                      leave
:0041810C C3                      ret


:0041810D CC                      int 03
:0041810E CC                      int 03
:0041810F CC                      int 03

* Referenced by a CALL at Addresses:
|:0041435A   , :004145EE   , :004146A6   , :004153B3   , :004176BC   
|
:00418110 55                      push ebp
:00418111 8BEC                    mov ebp, esp
:00418113 83EC04                  sub esp, 00000004
:00418116 53                      push ebx
:00418117 56                      push esi
:00418118 57                      push edi
:00418119 894DFC                  mov dword ptr [ebp-04], ecx
:0041811C 8B45FC                  mov eax, dword ptr [ebp-04]
:0041811F 668B400C                mov ax, word ptr [eax+0C]
:00418123 E900000000              jmp 00418128

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418123(U)
|
:00418128 5F                      pop edi
:00418129 5E                      pop esi
:0041812A 5B                      pop ebx
:0041812B C9                      leave
:0041812C C3                      ret


:0041812D CC                      int 03
:0041812E CC                      int 03
:0041812F CC                      int 03

* Referenced by a CALL at Addresses:
|:00414311   , :00414F67   , :00415901   
|
:00418130 55                      push ebp
:00418131 8BEC                    mov ebp, esp
:00418133 83EC04                  sub esp, 00000004
:00418136 53                      push ebx
:00418137 56                      push esi
:00418138 57                      push edi
:00418139 894DFC                  mov dword ptr [ebp-04], ecx
:0041813C 668B4508                mov ax, word ptr [ebp+08]
:00418140 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00418143 6689413A                mov word ptr [ecx+3A], ax
:00418147 E900000000              jmp 0041814C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418147(U)
|
:0041814C 5F                      pop edi
:0041814D 5E                      pop esi
:0041814E 5B                      pop ebx
:0041814F C9                      leave
:00418150 C20400                  ret 0004


:00418153 CC                      int 03
:00418154 CC                      int 03
:00418155 CC                      int 03
:00418156 CC                      int 03
:00418157 CC                      int 03
:00418158 CC                      int 03
:00418159 CC                      int 03
:0041815A CC                      int 03
:0041815B CC                      int 03
:0041815C CC                      int 03
:0041815D CC                      int 03
:0041815E CC                      int 03
:0041815F CC                      int 03

* Referenced by a CALL at Address:
|:0041432C   
|
:00418160 55                      push ebp
:00418161 8BEC                    mov ebp, esp
:00418163 83EC04                  sub esp, 00000004
:00418166 53                      push ebx
:00418167 56                      push esi
:00418168 57                      push edi
:00418169 894DFC                  mov dword ptr [ebp-04], ecx
:0041816C 668B4508                mov ax, word ptr [ebp+08]
:00418170 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00418173 6689413C                mov word ptr [ecx+3C], ax
:00418177 E900000000              jmp 0041817C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418177(U)
|
:0041817C 5F                      pop edi
:0041817D 5E                      pop esi
:0041817E 5B                      pop ebx
:0041817F C9                      leave
:00418180 C20400                  ret 0004


:00418183 CC                      int 03
:00418184 CC                      int 03
:00418185 CC                      int 03
:00418186 CC                      int 03
:00418187 CC                      int 03
:00418188 CC                      int 03
:00418189 CC                      int 03
:0041818A CC                      int 03
:0041818B CC                      int 03
:0041818C CC                      int 03
:0041818D CC                      int 03
:0041818E CC                      int 03
:0041818F CC                      int 03

* Referenced by a CALL at Addresses:
|:004144E9   , :004148BA   , :00415305   , :0041538B   , :00415B41   
|:00415F72   
|
:00418190 55                      push ebp
:00418191 8BEC                    mov ebp, esp
:00418193 83EC04                  sub esp, 00000004
:00418196 53                      push ebx
:00418197 56                      push esi
:00418198 57                      push edi
:00418199 894DFC                  mov dword ptr [ebp-04], ecx
:0041819C 8B45FC                  mov eax, dword ptr [ebp-04]
:0041819F 668B4030                mov ax, word ptr [eax+30]
:004181A3 E900000000              jmp 004181A8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004181A3(U)
|
:004181A8 5F                      pop edi
:004181A9 5E                      pop esi
:004181AA 5B                      pop ebx
:004181AB C9                      leave
:004181AC C3                      ret


:004181AD CC                      int 03
:004181AE CC                      int 03
:004181AF CC                      int 03

* Referenced by a CALL at Addresses:
|:004145AC   , :004174A7   
|
:004181B0 55                      push ebp
:004181B1 8BEC                    mov ebp, esp
:004181B3 83EC04                  sub esp, 00000004
:004181B6 53                      push ebx
:004181B7 56                      push esi
:004181B8 57                      push edi
:004181B9 894DFC                  mov dword ptr [ebp-04], ecx
:004181BC 8B45FC                  mov eax, dword ptr [ebp-04]
:004181BF 668B4002                mov ax, word ptr [eax+02]
:004181C3 E900000000              jmp 004181C8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004181C3(U)
|
:004181C8 5F                      pop edi
:004181C9 5E                      pop esi
:004181CA 5B                      pop ebx
:004181CB C9                      leave
:004181CC C3                      ret


:004181CD CC                      int 03
:004181CE CC                      int 03
:004181CF CC                      int 03

* Referenced by a CALL at Addresses:
|:004145C8   , :004174B8   
|
:004181D0 55                      push ebp
:004181D1 8BEC                    mov ebp, esp
:004181D3 83EC04                  sub esp, 00000004
:004181D6 53                      push ebx
:004181D7 56                      push esi
:004181D8 57                      push edi
:004181D9 894DFC                  mov dword ptr [ebp-04], ecx
:004181DC 8B45FC                  mov eax, dword ptr [ebp-04]
:004181DF 668B4004                mov ax, word ptr [eax+04]
:004181E3 E900000000              jmp 004181E8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004181E3(U)
|
:004181E8 5F                      pop edi
:004181E9 5E                      pop esi
:004181EA 5B                      pop ebx
:004181EB C9                      leave
:004181EC C3                      ret


:004181ED CC                      int 03
:004181EE CC                      int 03
:004181EF CC                      int 03

* Referenced by a CALL at Addresses:
|:0041465D   , :00414715   , :00414742   , :00414F50   , :00415423   
|:004158E3   , :00415D35   , :004174E2   
|
:004181F0 55                      push ebp
:004181F1 8BEC                    mov ebp, esp
:004181F3 83EC04                  sub esp, 00000004
:004181F6 53                      push ebx
:004181F7 56                      push esi
:004181F8 57                      push edi
:004181F9 894DFC                  mov dword ptr [ebp-04], ecx
:004181FC 668B4508                mov ax, word ptr [ebp+08]
:00418200 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00418203 66894130                mov word ptr [ecx+30], ax
:00418207 E900000000              jmp 0041820C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418207(U)
|
:0041820C 5F                      pop edi
:0041820D 5E                      pop esi
:0041820E 5B                      pop ebx
:0041820F C9                      leave
:00418210 C20400                  ret 0004


:00418213 CC                      int 03
:00418214 CC                      int 03
:00418215 CC                      int 03
:00418216 CC                      int 03
:00418217 CC                      int 03
:00418218 CC                      int 03
:00418219 CC                      int 03
:0041821A CC                      int 03
:0041821B CC                      int 03
:0041821C CC                      int 03
:0041821D CC                      int 03
:0041821E CC                      int 03
:0041821F CC                      int 03

* Referenced by a CALL at Address:
|:00414738   
|
:00418220 55                      push ebp
:00418221 8BEC                    mov ebp, esp
:00418223 83EC04                  sub esp, 00000004
:00418226 53                      push ebx
:00418227 56                      push esi
:00418228 57                      push edi
:00418229 894DFC                  mov dword ptr [ebp-04], ecx
:0041822C 668B4508                mov ax, word ptr [ebp+08]
:00418230 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00418233 6689411C                mov word ptr [ecx+1C], ax
:00418237 E900000000              jmp 0041823C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418237(U)
|
:0041823C 5F                      pop edi
:0041823D 5E                      pop esi
:0041823E 5B                      pop ebx
:0041823F C9                      leave
:00418240 C20400                  ret 0004


:00418243 CC                      int 03
:00418244 CC                      int 03
:00418245 CC                      int 03
:00418246 CC                      int 03
:00418247 CC                      int 03
:00418248 CC                      int 03
:00418249 CC                      int 03
:0041824A CC                      int 03
:0041824B CC                      int 03
:0041824C CC                      int 03
:0041824D CC                      int 03
:0041824E CC                      int 03
:0041824F CC                      int 03

* Referenced by a CALL at Addresses:
|:0041472F   , :00414BBC   , :00415693   , :00416576   , :00416595   
|:0041663B   , :0041693D   , :00416A1B   , :00417628   
|
:00418250 55                      push ebp
:00418251 8BEC                    mov ebp, esp
:00418253 83EC04                  sub esp, 00000004
:00418256 53                      push ebx
:00418257 56                      push esi
:00418258 57                      push edi
:00418259 894DFC                  mov dword ptr [ebp-04], ecx
:0041825C 8B45FC                  mov eax, dword ptr [ebp-04]
:0041825F 668B4038                mov ax, word ptr [eax+38]
:00418263 E900000000              jmp 00418268

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418263(U)
|
:00418268 5F                      pop edi
:00418269 5E                      pop esi
:0041826A 5B                      pop ebx
:0041826B C9                      leave
:0041826C C3                      ret


:0041826D CC                      int 03
:0041826E CC                      int 03
:0041826F CC                      int 03

* Referenced by a CALL at Addresses:
|:00414D45   , :00414EC2   
|
:00418270 55                      push ebp
:00418271 8BEC                    mov ebp, esp
:00418273 83EC04                  sub esp, 00000004
:00418276 53                      push ebx
:00418277 56                      push esi
:00418278 57                      push edi
:00418279 894DFC                  mov dword ptr [ebp-04], ecx
:0041827C 668B4508                mov ax, word ptr [ebp+08]
:00418280 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00418283 6689411A                mov word ptr [ecx+1A], ax
:00418287 E900000000              jmp 0041828C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418287(U)
|
:0041828C 5F                      pop edi
:0041828D 5E                      pop esi
:0041828E 5B                      pop ebx
:0041828F C9                      leave
:00418290 C20400                  ret 0004


:00418293 CC                      int 03
:00418294 CC                      int 03
:00418295 CC                      int 03
:00418296 CC                      int 03
:00418297 CC                      int 03
:00418298 CC                      int 03
:00418299 CC                      int 03
:0041829A CC                      int 03
:0041829B CC                      int 03
:0041829C CC                      int 03
:0041829D CC                      int 03
:0041829E CC                      int 03
:0041829F CC                      int 03

* Referenced by a CALL at Addresses:
|:00414D3B   , :00414F83   
|
:004182A0 55                      push ebp
:004182A1 8BEC                    mov ebp, esp
:004182A3 83EC04                  sub esp, 00000004
:004182A6 53                      push ebx
:004182A7 56                      push esi
:004182A8 57                      push edi
:004182A9 894DFC                  mov dword ptr [ebp-04], ecx
:004182AC 668B4508                mov ax, word ptr [ebp+08]
:004182B0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004182B3 6689412C                mov word ptr [ecx+2C], ax
:004182B7 E900000000              jmp 004182BC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004182B7(U)
|
:004182BC 5F                      pop edi
:004182BD 5E                      pop esi
:004182BE 5B                      pop ebx
:004182BF C9                      leave
:004182C0 C20400                  ret 0004


:004182C3 CC                      int 03
:004182C4 CC                      int 03
:004182C5 CC                      int 03
:004182C6 CC                      int 03
:004182C7 CC                      int 03
:004182C8 CC                      int 03
:004182C9 CC                      int 03
:004182CA CC                      int 03
:004182CB CC                      int 03
:004182CC CC                      int 03
:004182CD CC                      int 03
:004182CE CC                      int 03
:004182CF CC                      int 03

* Referenced by a CALL at Address:
|:00414EB8   
|
:004182D0 55                      push ebp
:004182D1 8BEC                    mov ebp, esp
:004182D3 83EC04                  sub esp, 00000004
:004182D6 53                      push ebx
:004182D7 56                      push esi
:004182D8 57                      push edi
:004182D9 894DFC                  mov dword ptr [ebp-04], ecx
:004182DC 668B4508                mov ax, word ptr [ebp+08]
:004182E0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004182E3 66894116                mov word ptr [ecx+16], ax
:004182E7 E900000000              jmp 004182EC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004182E7(U)
|
:004182EC 5F                      pop edi
:004182ED 5E                      pop esi
:004182EE 5B                      pop ebx
:004182EF C9                      leave
:004182F0 C20400                  ret 0004


:004182F3 CC                      int 03
:004182F4 CC                      int 03
:004182F5 CC                      int 03
:004182F6 CC                      int 03
:004182F7 CC                      int 03
:004182F8 CC                      int 03
:004182F9 CC                      int 03
:004182FA CC                      int 03
:004182FB CC                      int 03
:004182FC CC                      int 03
:004182FD CC                      int 03
:004182FE CC                      int 03
:004182FF CC                      int 03

* Referenced by a CALL at Address:
|:00414EA2   
|
:00418300 55                      push ebp
:00418301 8BEC                    mov ebp, esp
:00418303 83EC04                  sub esp, 00000004
:00418306 53                      push ebx
:00418307 56                      push esi
:00418308 57                      push edi
:00418309 894DFC                  mov dword ptr [ebp-04], ecx
:0041830C 668B4508                mov ax, word ptr [ebp+08]
:00418310 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00418313 66894118                mov word ptr [ecx+18], ax
:00418317 E900000000              jmp 0041831C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418317(U)
|
:0041831C 5F                      pop edi
:0041831D 5E                      pop esi
:0041831E 5B                      pop ebx
:0041831F C9                      leave
:00418320 C20400                  ret 0004


:00418323 CC                      int 03
:00418324 CC                      int 03
:00418325 CC                      int 03
:00418326 CC                      int 03
:00418327 CC                      int 03
:00418328 CC                      int 03
:00418329 CC                      int 03
:0041832A CC                      int 03
:0041832B CC                      int 03
:0041832C CC                      int 03
:0041832D CC                      int 03
:0041832E CC                      int 03
:0041832F CC                      int 03

* Referenced by a CALL at Addresses:
|:00414ECE   , :0041771F   
|
:00418330 55                      push ebp
:00418331 8BEC                    mov ebp, esp
:00418333 83EC04                  sub esp, 00000004
:00418336 53                      push ebx
:00418337 56                      push esi
:00418338 57                      push edi
:00418339 894DFC                  mov dword ptr [ebp-04], ecx
:0041833C 668B4508                mov ax, word ptr [ebp+08]
:00418340 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00418343 668901                  mov word ptr [ecx], ax
:00418346 E900000000              jmp 0041834B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418346(U)
|
:0041834B 5F                      pop edi
:0041834C 5E                      pop esi
:0041834D 5B                      pop ebx
:0041834E C9                      leave
:0041834F C20400                  ret 0004


:00418352 CC                      int 03
:00418353 CC                      int 03
:00418354 CC                      int 03
:00418355 CC                      int 03
:00418356 CC                      int 03
:00418357 CC                      int 03
:00418358 CC                      int 03
:00418359 CC                      int 03
:0041835A CC                      int 03
:0041835B CC                      int 03
:0041835C CC                      int 03
:0041835D CC                      int 03
:0041835E CC                      int 03
:0041835F CC                      int 03

* Referenced by a CALL at Address:
|:00414ED8   
|
:00418360 55                      push ebp
:00418361 8BEC                    mov ebp, esp
:00418363 83EC04                  sub esp, 00000004
:00418366 53                      push ebx
:00418367 56                      push esi
:00418368 57                      push edi
:00418369 894DFC                  mov dword ptr [ebp-04], ecx
:0041836C 668B4508                mov ax, word ptr [ebp+08]
:00418370 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00418373 66894102                mov word ptr [ecx+02], ax
:00418377 E900000000              jmp 0041837C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418377(U)
|
:0041837C 5F                      pop edi
:0041837D 5E                      pop esi
:0041837E 5B                      pop ebx
:0041837F C9                      leave
:00418380 C20400                  ret 0004


:00418383 CC                      int 03
:00418384 CC                      int 03
:00418385 CC                      int 03
:00418386 CC                      int 03
:00418387 CC                      int 03
:00418388 CC                      int 03
:00418389 CC                      int 03
:0041838A CC                      int 03
:0041838B CC                      int 03
:0041838C CC                      int 03
:0041838D CC                      int 03
:0041838E CC                      int 03
:0041838F CC                      int 03

* Referenced by a CALL at Address:
|:00414F08   
|
:00418390 55                      push ebp
:00418391 8BEC                    mov ebp, esp
:00418393 83EC04                  sub esp, 00000004
:00418396 53                      push ebx
:00418397 56                      push esi
:00418398 57                      push edi
:00418399 894DFC                  mov dword ptr [ebp-04], ecx
:0041839C 668B4508                mov ax, word ptr [ebp+08]
:004183A0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004183A3 6689410A                mov word ptr [ecx+0A], ax
:004183A7 E900000000              jmp 004183AC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004183A7(U)
|
:004183AC 5F                      pop edi
:004183AD 5E                      pop esi
:004183AE 5B                      pop ebx
:004183AF C9                      leave
:004183B0 C20400                  ret 0004


:004183B3 CC                      int 03
:004183B4 CC                      int 03
:004183B5 CC                      int 03
:004183B6 CC                      int 03
:004183B7 CC                      int 03
:004183B8 CC                      int 03
:004183B9 CC                      int 03
:004183BA CC                      int 03
:004183BB CC                      int 03
:004183BC CC                      int 03
:004183BD CC                      int 03
:004183BE CC                      int 03
:004183BF CC                      int 03

* Referenced by a CALL at Address:
|:00414F14   
|
:004183C0 55                      push ebp
:004183C1 8BEC                    mov ebp, esp
:004183C3 83EC04                  sub esp, 00000004
:004183C6 53                      push ebx
:004183C7 56                      push esi
:004183C8 57                      push edi
:004183C9 894DFC                  mov dword ptr [ebp-04], ecx
:004183CC 668B4508                mov ax, word ptr [ebp+08]
:004183D0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004183D3 6689410C                mov word ptr [ecx+0C], ax
:004183D7 E900000000              jmp 004183DC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004183D7(U)
|
:004183DC 5F                      pop edi
:004183DD 5E                      pop esi
:004183DE 5B                      pop ebx
:004183DF C9                      leave
:004183E0 C20400                  ret 0004


:004183E3 CC                      int 03
:004183E4 CC                      int 03
:004183E5 CC                      int 03
:004183E6 CC                      int 03
:004183E7 CC                      int 03
:004183E8 CC                      int 03
:004183E9 CC                      int 03
:004183EA CC                      int 03
:004183EB CC                      int 03
:004183EC CC                      int 03
:004183ED CC                      int 03
:004183EE CC                      int 03
:004183EF CC                      int 03

* Referenced by a CALL at Address:
|:00414F20   
|
:004183F0 55                      push ebp
:004183F1 8BEC                    mov ebp, esp
:004183F3 83EC04                  sub esp, 00000004
:004183F6 53                      push ebx
:004183F7 56                      push esi
:004183F8 57                      push edi
:004183F9 894DFC                  mov dword ptr [ebp-04], ecx
:004183FC 668B4508                mov ax, word ptr [ebp+08]
:00418400 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00418403 6689410E                mov word ptr [ecx+0E], ax
:00418407 E900000000              jmp 0041840C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418407(U)
|
:0041840C 5F                      pop edi
:0041840D 5E                      pop esi
:0041840E 5B                      pop ebx
:0041840F C9                      leave
:00418410 C20400                  ret 0004


:00418413 CC                      int 03
:00418414 CC                      int 03
:00418415 CC                      int 03
:00418416 CC                      int 03
:00418417 CC                      int 03
:00418418 CC                      int 03
:00418419 CC                      int 03
:0041841A CC                      int 03
:0041841B CC                      int 03
:0041841C CC                      int 03
:0041841D CC                      int 03
:0041841E CC                      int 03
:0041841F CC                      int 03

* Referenced by a CALL at Addresses:
|:00414EE4   , :004174B0   
|
:00418420 55                      push ebp
:00418421 8BEC                    mov ebp, esp
:00418423 83EC04                  sub esp, 00000004
:00418426 53                      push ebx
:00418427 56                      push esi
:00418428 57                      push edi
:00418429 894DFC                  mov dword ptr [ebp-04], ecx
:0041842C 668B4508                mov ax, word ptr [ebp+08]
:00418430 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00418433 66894104                mov word ptr [ecx+04], ax
:00418437 E900000000              jmp 0041843C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418437(U)
|
:0041843C 5F                      pop edi
:0041843D 5E                      pop esi
:0041843E 5B                      pop ebx
:0041843F C9                      leave
:00418440 C20400                  ret 0004


:00418443 CC                      int 03
:00418444 CC                      int 03
:00418445 CC                      int 03
:00418446 CC                      int 03
:00418447 CC                      int 03
:00418448 CC                      int 03
:00418449 CC                      int 03
:0041844A CC                      int 03
:0041844B CC                      int 03
:0041844C CC                      int 03
:0041844D CC                      int 03
:0041844E CC                      int 03
:0041844F CC                      int 03

* Referenced by a CALL at Addresses:
|:00414EF0   , :004174C1   
|
:00418450 55                      push ebp
:00418451 8BEC                    mov ebp, esp
:00418453 83EC04                  sub esp, 00000004
:00418456 53                      push ebx
:00418457 56                      push esi
:00418458 57                      push edi
:00418459 894DFC                  mov dword ptr [ebp-04], ecx
:0041845C 668B4508                mov ax, word ptr [ebp+08]
:00418460 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00418463 66894106                mov word ptr [ecx+06], ax
:00418467 E900000000              jmp 0041846C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418467(U)
|
:0041846C 5F                      pop edi
:0041846D 5E                      pop esi
:0041846E 5B                      pop ebx
:0041846F C9                      leave
:00418470 C20400                  ret 0004


:00418473 CC                      int 03
:00418474 CC                      int 03
:00418475 CC                      int 03
:00418476 CC                      int 03
:00418477 CC                      int 03
:00418478 CC                      int 03
:00418479 CC                      int 03
:0041847A CC                      int 03
:0041847B CC                      int 03
:0041847C CC                      int 03
:0041847D CC                      int 03
:0041847E CC                      int 03
:0041847F CC                      int 03

* Referenced by a CALL at Address:
|:00414EFC   
|
:00418480 55                      push ebp
:00418481 8BEC                    mov ebp, esp
:00418483 83EC04                  sub esp, 00000004
:00418486 53                      push ebx
:00418487 56                      push esi
:00418488 57                      push edi
:00418489 894DFC                  mov dword ptr [ebp-04], ecx
:0041848C 668B4508                mov ax, word ptr [ebp+08]
:00418490 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00418493 66894108                mov word ptr [ecx+08], ax
:00418497 E900000000              jmp 0041849C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418497(U)
|
:0041849C 5F                      pop edi
:0041849D 5E                      pop esi
:0041849E 5B                      pop ebx
:0041849F C9                      leave
:004184A0 C20400                  ret 0004


:004184A3 CC                      int 03
:004184A4 CC                      int 03
:004184A5 CC                      int 03
:004184A6 CC                      int 03
:004184A7 CC                      int 03
:004184A8 CC                      int 03
:004184A9 CC                      int 03
:004184AA CC                      int 03
:004184AB CC                      int 03
:004184AC CC                      int 03
:004184AD CC                      int 03
:004184AE CC                      int 03
:004184AF CC                      int 03

* Referenced by a CALL at Address:
|:00414F44   
|
:004184B0 55                      push ebp
:004184B1 8BEC                    mov ebp, esp
:004184B3 83EC04                  sub esp, 00000004
:004184B6 53                      push ebx
:004184B7 56                      push esi
:004184B8 57                      push edi
:004184B9 894DFC                  mov dword ptr [ebp-04], ecx
:004184BC 668B4508                mov ax, word ptr [ebp+08]
:004184C0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004184C3 66894122                mov word ptr [ecx+22], ax
:004184C7 668B450C                mov ax, word ptr [ebp+0C]
:004184CB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004184CE 66894124                mov word ptr [ecx+24], ax
:004184D2 E900000000              jmp 004184D7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004184D2(U)
|
:004184D7 5F                      pop edi
:004184D8 5E                      pop esi
:004184D9 5B                      pop ebx
:004184DA C9                      leave
:004184DB C20800                  ret 0008


:004184DE CC                      int 03
:004184DF CC                      int 03

* Referenced by a CALL at Addresses:
|:00415161   , :00416088   
|
:004184E0 55                      push ebp
:004184E1 8BEC                    mov ebp, esp
:004184E3 83EC04                  sub esp, 00000004
:004184E6 53                      push ebx
:004184E7 56                      push esi
:004184E8 57                      push edi
:004184E9 894DFC                  mov dword ptr [ebp-04], ecx
:004184EC 8B45FC                  mov eax, dword ptr [ebp-04]
:004184EF 33C9                    xor ecx, ecx
:004184F1 668B08                  mov cx, word ptr [eax]
:004184F4 8BC1                    mov eax, ecx
:004184F6 E900000000              jmp 004184FB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004184F6(U)
|
:004184FB 5F                      pop edi
:004184FC 5E                      pop esi
:004184FD 5B                      pop ebx
:004184FE C9                      leave
:004184FF C3                      ret



* Referenced by a CALL at Address:
|:00415154   
|
:00418500 55                      push ebp
:00418501 8BEC                    mov ebp, esp
:00418503 83EC04                  sub esp, 00000004
:00418506 53                      push ebx
:00418507 56                      push esi
:00418508 57                      push edi
:00418509 894DFC                  mov dword ptr [ebp-04], ecx
:0041850C 8B45FC                  mov eax, dword ptr [ebp-04]
:0041850F 8A4005                  mov al, byte ptr [eax+05]
:00418512 E900000000              jmp 00418517

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418512(U)
|
:00418517 5F                      pop edi
:00418518 5E                      pop esi
:00418519 5B                      pop ebx
:0041851A C9                      leave
:0041851B C3                      ret


:0041851C CC                      int 03
:0041851D CC                      int 03
:0041851E CC                      int 03
:0041851F CC                      int 03

* Referenced by a CALL at Address:
|:004158EB   
|
:00418520 55                      push ebp
:00418521 8BEC                    mov ebp, esp
:00418523 83EC04                  sub esp, 00000004
:00418526 53                      push ebx
:00418527 56                      push esi
:00418528 57                      push edi
:00418529 894DFC                  mov dword ptr [ebp-04], ecx
:0041852C 8B45FC                  mov eax, dword ptr [ebp-04]
:0041852F 668B403A                mov ax, word ptr [eax+3A]
:00418533 E900000000              jmp 00418538

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418533(U)
|
:00418538 5F                      pop edi
:00418539 5E                      pop esi
:0041853A 5B                      pop ebx
:0041853B C9                      leave
:0041853C C3                      ret


:0041853D CC                      int 03
:0041853E CC                      int 03
:0041853F CC                      int 03

* Referenced by a CALL at Address:
|:00415BB7   
|
:00418540 55                      push ebp
:00418541 8BEC                    mov ebp, esp
:00418543 83EC04                  sub esp, 00000004
:00418546 53                      push ebx
:00418547 56                      push esi
:00418548 57                      push edi
:00418549 894DFC                  mov dword ptr [ebp-04], ecx
:0041854C 8B45FC                  mov eax, dword ptr [ebp-04]
:0041854F 668B401C                mov ax, word ptr [eax+1C]
:00418553 E900000000              jmp 00418558

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418553(U)
|
:00418558 5F                      pop edi
:00418559 5E                      pop esi
:0041855A 5B                      pop ebx
:0041855B C9                      leave
:0041855C C3                      ret


:0041855D CC                      int 03
:0041855E CC                      int 03
:0041855F CC                      int 03

* Referenced by a CALL at Addresses:
|:00415C3D   , :004176AA   
|
:00418560 55                      push ebp
:00418561 8BEC                    mov ebp, esp
:00418563 83EC04                  sub esp, 00000004
:00418566 53                      push ebx
:00418567 56                      push esi
:00418568 57                      push edi
:00418569 894DFC                  mov dword ptr [ebp-04], ecx
:0041856C 8B45FC                  mov eax, dword ptr [ebp-04]
:0041856F 668B402E                mov ax, word ptr [eax+2E]
:00418573 E900000000              jmp 00418578

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418573(U)
|
:00418578 5F                      pop edi
:00418579 5E                      pop esi
:0041857A 5B                      pop ebx
:0041857B C9                      leave
:0041857C C3                      ret


:0041857D CC                      int 03
:0041857E CC                      int 03
:0041857F CC                      int 03

* Referenced by a CALL at Addresses:
|:004160CA   , :00416969   
|
:00418580 55                      push ebp
:00418581 8BEC                    mov ebp, esp
:00418583 83EC04                  sub esp, 00000004
:00418586 53                      push ebx
:00418587 56                      push esi
:00418588 57                      push edi
:00418589 894DFC                  mov dword ptr [ebp-04], ecx
:0041858C 8B45FC                  mov eax, dword ptr [ebp-04]
:0041858F 668B401E                mov ax, word ptr [eax+1E]
:00418593 8B4D08                  mov ecx, dword ptr [ebp+08]
:00418596 668901                  mov word ptr [ecx], ax
:00418599 8B45FC                  mov eax, dword ptr [ebp-04]
:0041859C 668B4020                mov ax, word ptr [eax+20]
:004185A0 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004185A3 668901                  mov word ptr [ecx], ax
:004185A6 E900000000              jmp 004185AB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004185A6(U)
|
:004185AB 5F                      pop edi
:004185AC 5E                      pop esi
:004185AD 5B                      pop ebx
:004185AE C9                      leave
:004185AF C20800                  ret 0008


:004185B2 CC                      int 03
:004185B3 CC                      int 03
:004185B4 CC                      int 03
:004185B5 CC                      int 03
:004185B6 CC                      int 03
:004185B7 CC                      int 03
:004185B8 CC                      int 03
:004185B9 CC                      int 03
:004185BA CC                      int 03
:004185BB CC                      int 03
:004185BC CC                      int 03
:004185BD CC                      int 03
:004185BE CC                      int 03
:004185BF CC                      int 03

* Referenced by a CALL at Addresses:
|:004163C5   , :0041F076   , :00435DCB   , :004415E1   
|
:004185C0 55                      push ebp
:004185C1 8BEC                    mov ebp, esp
:004185C3 83EC04                  sub esp, 00000004
:004185C6 53                      push ebx
:004185C7 56                      push esi
:004185C8 57                      push edi
:004185C9 894DFC                  mov dword ptr [ebp-04], ecx
:004185CC 8B4508                  mov eax, dword ptr [ebp+08]
:004185CF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004185D2 8901                    mov dword ptr [ecx], eax
:004185D4 E900000000              jmp 004185D9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004185D4(U)
|
:004185D9 5F                      pop edi
:004185DA 5E                      pop esi
:004185DB 5B                      pop ebx
:004185DC C9                      leave
:004185DD C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00416472   , :004164B3   , :0042B1B0   , :0044158D   
|
:004185E0 55                      push ebp
:004185E1 8BEC                    mov ebp, esp
:004185E3 83EC04                  sub esp, 00000004
:004185E6 53                      push ebx
:004185E7 56                      push esi
:004185E8 57                      push edi
:004185E9 894DFC                  mov dword ptr [ebp-04], ecx
:004185EC 8A4508                  mov al, byte ptr [ebp+08]
:004185EF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004185F2 884125                  mov byte ptr [ecx+25], al
:004185F5 E900000000              jmp 004185FA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004185F5(U)
|
:004185FA 5F                      pop edi
:004185FB 5E                      pop esi
:004185FC 5B                      pop ebx
:004185FD C9                      leave
:004185FE C20400                  ret 0004


:00418601 CC                      int 03
:00418602 CC                      int 03
:00418603 CC                      int 03
:00418604 CC                      int 03
:00418605 CC                      int 03
:00418606 CC                      int 03
:00418607 CC                      int 03
:00418608 CC                      int 03
:00418609 CC                      int 03
:0041860A CC                      int 03
:0041860B CC                      int 03
:0041860C CC                      int 03
:0041860D CC                      int 03
:0041860E CC                      int 03
:0041860F CC                      int 03

* Referenced by a CALL at Address:
|:00416BCB   
|
:00418610 55                      push ebp
:00418611 8BEC                    mov ebp, esp
:00418613 83EC04                  sub esp, 00000004
:00418616 53                      push ebx
:00418617 56                      push esi
:00418618 57                      push edi
:00418619 894DFC                  mov dword ptr [ebp-04], ecx
:0041861C 8B45FC                  mov eax, dword ptr [ebp-04]
:0041861F 668B4006                mov ax, word ptr [eax+06]
:00418623 E900000000              jmp 00418628

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418623(U)
|
:00418628 5F                      pop edi
:00418629 5E                      pop esi
:0041862A 5B                      pop ebx
:0041862B C9                      leave
:0041862C C3                      ret


:0041862D CC                      int 03
:0041862E CC                      int 03
:0041862F CC                      int 03

* Referenced by a CALL at Address:
|:00416BD7   
|
:00418630 55                      push ebp
:00418631 8BEC                    mov ebp, esp
:00418633 83EC04                  sub esp, 00000004
:00418636 53                      push ebx
:00418637 56                      push esi
:00418638 57                      push edi
:00418639 894DFC                  mov dword ptr [ebp-04], ecx
:0041863C 8B45FC                  mov eax, dword ptr [ebp-04]
:0041863F 668B4008                mov ax, word ptr [eax+08]
:00418643 E900000000              jmp 00418648

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418643(U)
|
:00418648 5F                      pop edi
:00418649 5E                      pop esi
:0041864A 5B                      pop ebx
:0041864B C9                      leave
:0041864C C3                      ret


:0041864D CC                      int 03
:0041864E CC                      int 03
:0041864F CC                      int 03

* Referenced by a CALL at Address:
|:00416BF3   
|
:00418650 55                      push ebp
:00418651 8BEC                    mov ebp, esp
:00418653 83EC04                  sub esp, 00000004
:00418656 53                      push ebx
:00418657 56                      push esi
:00418658 57                      push edi
:00418659 894DFC                  mov dword ptr [ebp-04], ecx
:0041865C 8B45FC                  mov eax, dword ptr [ebp-04]
:0041865F 668B400A                mov ax, word ptr [eax+0A]
:00418663 E900000000              jmp 00418668

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418663(U)
|
:00418668 5F                      pop edi
:00418669 5E                      pop esi
:0041866A 5B                      pop ebx
:0041866B C9                      leave
:0041866C C3                      ret


:0041866D CC                      int 03
:0041866E CC                      int 03
:0041866F CC                      int 03

* Referenced by a CALL at Address:
|:00416C20   
|
:00418670 55                      push ebp
:00418671 8BEC                    mov ebp, esp
:00418673 83EC04                  sub esp, 00000004
:00418676 53                      push ebx
:00418677 56                      push esi
:00418678 57                      push edi
:00418679 894DFC                  mov dword ptr [ebp-04], ecx
:0041867C 8B45FC                  mov eax, dword ptr [ebp-04]
:0041867F 668B400C                mov ax, word ptr [eax+0C]
:00418683 E900000000              jmp 00418688

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418683(U)
|
:00418688 5F                      pop edi
:00418689 5E                      pop esi
:0041868A 5B                      pop ebx
:0041868B C9                      leave
:0041868C C3                      ret


:0041868D CC                      int 03
:0041868E CC                      int 03
:0041868F CC                      int 03

* Referenced by a CALL at Addresses:
|:00416D55   , :00417770   
|
:00418690 55                      push ebp
:00418691 8BEC                    mov ebp, esp
:00418693 83EC04                  sub esp, 00000004
:00418696 53                      push ebx
:00418697 56                      push esi
:00418698 57                      push edi
:00418699 894DFC                  mov dword ptr [ebp-04], ecx
:0041869C 8B45FC                  mov eax, dword ptr [ebp-04]
:0041869F 8A4007                  mov al, byte ptr [eax+07]
:004186A2 E900000000              jmp 004186A7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004186A2(U)
|
:004186A7 5F                      pop edi
:004186A8 5E                      pop esi
:004186A9 5B                      pop ebx
:004186AA C9                      leave
:004186AB C3                      ret


:004186AC CC                      int 03
:004186AD CC                      int 03
:004186AE CC                      int 03
:004186AF CC                      int 03

* Referenced by a CALL at Addresses:
|:00416E30   , :0041DABA   , :004373D3   , :004373FA   , :0043759A   
|:0043760E   , :00437706   , :0043ACD3   , :0043ADB8   , :0043E445   
|:00442D58   
|
:004186B0 55                      push ebp
:004186B1 8BEC                    mov ebp, esp
:004186B3 83EC04                  sub esp, 00000004
:004186B6 53                      push ebx
:004186B7 56                      push esi
:004186B8 57                      push edi
:004186B9 894DFC                  mov dword ptr [ebp-04], ecx
:004186BC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004186BF E858EC0100              call 0043731C
:004186C4 85C0                    test eax, eax
:004186C6 0F850A000000            jne 004186D6
:004186CC B801000000              mov eax, 00000001
:004186D1 E902000000              jmp 004186D8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004186C6(C)
|
:004186D6 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004186D1(U)
|
:004186D8 E900000000              jmp 004186DD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004186D8(U)
|
:004186DD 5F                      pop edi
:004186DE 5E                      pop esi
:004186DF 5B                      pop ebx
:004186E0 C9                      leave
:004186E1 C3                      ret


:004186E2 CC                      int 03
:004186E3 CC                      int 03
:004186E4 CC                      int 03
:004186E5 CC                      int 03
:004186E6 CC                      int 03
:004186E7 CC                      int 03
:004186E8 CC                      int 03
:004186E9 CC                      int 03
:004186EA CC                      int 03
:004186EB CC                      int 03
:004186EC CC                      int 03
:004186ED CC                      int 03
:004186EE CC                      int 03
:004186EF CC                      int 03

* Referenced by a CALL at Address:
|:00417695   
|
:004186F0 55                      push ebp
:004186F1 8BEC                    mov ebp, esp
:004186F3 83EC04                  sub esp, 00000004
:004186F6 53                      push ebx
:004186F7 56                      push esi
:004186F8 57                      push edi
:004186F9 894DFC                  mov dword ptr [ebp-04], ecx
:004186FC 8B45FC                  mov eax, dword ptr [ebp-04]
:004186FF 668B00                  mov ax, word ptr [eax]
:00418702 E900000000              jmp 00418707

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418702(U)
|
:00418707 5F                      pop edi
:00418708 5E                      pop esi
:00418709 5B                      pop ebx
:0041870A C9                      leave
:0041870B C3                      ret


:0041870C CC                      int 03
:0041870D CC                      int 03
:0041870E CC                      int 03
:0041870F CC                      int 03

* Referenced by a CALL at Address:
|:004176B3   
|
:00418710 55                      push ebp
:00418711 8BEC                    mov ebp, esp
:00418713 83EC04                  sub esp, 00000004
:00418716 53                      push ebx
:00418717 56                      push esi
:00418718 57                      push edi
:00418719 894DFC                  mov dword ptr [ebp-04], ecx
:0041871C 8B45FC                  mov eax, dword ptr [ebp-04]
:0041871F 668B400E                mov ax, word ptr [eax+0E]
:00418723 E900000000              jmp 00418728

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418723(U)
|
:00418728 5F                      pop edi
:00418729 5E                      pop esi
:0041872A 5B                      pop ebx
:0041872B C9                      leave
:0041872C C3                      ret


:0041872D CC                      int 03
:0041872E CC                      int 03
:0041872F CC                      int 03

* Referenced by a CALL at Address:
|:004176A1   
|
:00418730 55                      push ebp
:00418731 8BEC                    mov ebp, esp
:00418733 83EC04                  sub esp, 00000004
:00418736 53                      push ebx
:00418737 56                      push esi
:00418738 57                      push edi
:00418739 894DFC                  mov dword ptr [ebp-04], ecx
:0041873C 8B45FC                  mov eax, dword ptr [ebp-04]
:0041873F 668B402C                mov ax, word ptr [eax+2C]
:00418743 E900000000              jmp 00418748

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418743(U)
|
:00418748 5F                      pop edi
:00418749 5E                      pop esi
:0041874A 5B                      pop ebx
:0041874B C9                      leave
:0041874C C3                      ret


:0041874D CC                      int 03
:0041874E CC                      int 03
:0041874F CC                      int 03
:00418750 55                      push ebp
:00418751 8BEC                    mov ebp, esp
:00418753 53                      push ebx
:00418754 56                      push esi
:00418755 57                      push edi
:00418756 E80A000000              call 00418765
:0041875B E900000000              jmp 00418760

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041875B(U)
|
:00418760 5F                      pop edi
:00418761 5E                      pop esi
:00418762 5B                      pop ebx
:00418763 C9                      leave
:00418764 C3                      ret



* Referenced by a CALL at Address:
|:00418756   
|
:00418765 55                      push ebp
:00418766 8BEC                    mov ebp, esp
:00418768 53                      push ebx
:00418769 56                      push esi
:0041876A 57                      push edi
:0041876B B990A64600              mov ecx, 0046A690
:00418770 E899060000              call 00418E0E
:00418775 E900000000              jmp 0041877A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418775(U)
|
:0041877A 5F                      pop edi
:0041877B 5E                      pop esi
:0041877C 5B                      pop ebx
:0041877D C9                      leave
:0041877E C3                      ret


:0041877F 55                      push ebp
:00418780 8BEC                    mov ebp, esp
:00418782 53                      push ebx
:00418783 56                      push esi
:00418784 57                      push edi
:00418785 E80A000000              call 00418794
:0041878A E900000000              jmp 0041878F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041878A(U)
|
:0041878F 5F                      pop edi
:00418790 5E                      pop esi
:00418791 5B                      pop ebx
:00418792 C9                      leave
:00418793 C3                      ret



* Referenced by a CALL at Address:
|:00418785   
|
:00418794 55                      push ebp
:00418795 8BEC                    mov ebp, esp
:00418797 53                      push ebx
:00418798 56                      push esi
:00418799 57                      push edi
:0041879A B994A64600              mov ecx, 0046A694
:0041879F E82C090000              call 004190D0
:004187A4 E900000000              jmp 004187A9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004187A4(U)
|
:004187A9 5F                      pop edi
:004187AA 5E                      pop esi
:004187AB 5B                      pop ebx
:004187AC C9                      leave
:004187AD C3                      ret


:004187AE 55                      push ebp
:004187AF 8BEC                    mov ebp, esp
:004187B1 53                      push ebx
:004187B2 56                      push esi
:004187B3 57                      push edi
:004187B4 E80A000000              call 004187C3
:004187B9 E900000000              jmp 004187BE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004187B9(U)
|
:004187BE 5F                      pop edi
:004187BF 5E                      pop esi
:004187C0 5B                      pop ebx
:004187C1 C9                      leave
:004187C2 C3                      ret



* Referenced by a CALL at Address:
|:004187B4   
|
:004187C3 55                      push ebp
:004187C4 8BEC                    mov ebp, esp
:004187C6 53                      push ebx
:004187C7 56                      push esi
:004187C8 57                      push edi
:004187C9 E8B4EF0200              call 00447782
:004187CE A38CA64600              mov dword ptr [0046A68C], eax
:004187D3 E900000000              jmp 004187D8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004187D3(U)
|
:004187D8 5F                      pop edi
:004187D9 5E                      pop esi
:004187DA 5B                      pop ebx
:004187DB C9                      leave
:004187DC C3                      ret



* Referenced by a CALL at Address:
|:00418C18   
|
:004187DD 55                      push ebp
:004187DE 8BEC                    mov ebp, esp
:004187E0 83EC14                  sub esp, 00000014
:004187E3 53                      push ebx
:004187E4 56                      push esi
:004187E5 57                      push edi
:004187E6 833DFCF7440000          cmp dword ptr [0044F7FC], 00000000
:004187ED 0F8407000000            je 004187FA
:004187F3 33C0                    xor eax, eax
:004187F5 E93E000000              jmp 00418838

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004187ED(C)
|

* Possible StringData Ref from Data Obj ->"cdaudio"
                                  |
:004187FA C745F49CFB4400          mov [ebp-0C], 0044FB9C
:00418801 8D45EC                  lea eax, dword ptr [ebp-14]
:00418804 50                      push eax
:00418805 6800200000              push 00002000
:0041880A 6803080000              push 00000803
:0041880F 6A00                    push 00000000

* Reference To: WINMM.mciSendCommandA, Ord:002Fh
                                  |
:00418811 FF15BC744700            Call dword ptr [004774BC]
:00418817 85C0                    test eax, eax
:00418819 0F8407000000            je 00418826
:0041881F 33C0                    xor eax, eax
:00418821 E912000000              jmp 00418838

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418819(C)
|
:00418826 8B45F0                  mov eax, dword ptr [ebp-10]
:00418829 A3FCF74400              mov dword ptr [0044F7FC], eax
:0041882E B801000000              mov eax, 00000001
:00418833 E900000000              jmp 00418838

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004187F5(U), :00418821(U), :00418833(U)
|
:00418838 5F                      pop edi
:00418839 5E                      pop esi
:0041883A 5B                      pop ebx
:0041883B C9                      leave
:0041883C C3                      ret



* Referenced by a CALL at Addresses:
|:00418C39   , :00418DF6   
|
:0041883D 55                      push ebp
:0041883E 8BEC                    mov ebp, esp
:00418840 83EC04                  sub esp, 00000004
:00418843 53                      push ebx
:00418844 56                      push esi
:00418845 57                      push edi
:00418846 833DFCF7440000          cmp dword ptr [0044F7FC], 00000000
:0041884D 0F8507000000            jne 0041885A
:00418853 33C0                    xor eax, eax
:00418855 E951000000              jmp 004188AB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041884D(C)
|
:0041885A 6A00                    push 00000000
:0041885C 6A02                    push 00000002
:0041885E 6804080000              push 00000804
:00418863 A1FCF74400              mov eax, dword ptr [0044F7FC]
:00418868 50                      push eax

* Reference To: WINMM.mciSendCommandA, Ord:002Fh
                                  |
:00418869 FF15BC744700            Call dword ptr [004774BC]
:0041886F 8945FC                  mov dword ptr [ebp-04], eax
:00418872 837DFC00                cmp dword ptr [ebp-04], 00000000
:00418876 0F8407000000            je 00418883
:0041887C 33C0                    xor eax, eax
:0041887E E928000000              jmp 004188AB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418876(C)
|
:00418883 C705FCF7440000000000    mov dword ptr [0044F7FC], 00000000
:0041888D C70504F8440000000000    mov dword ptr [0044F804], 00000000
:00418897 C705F8F7440000000000    mov dword ptr [0044F7F8], 00000000
:004188A1 B801000000              mov eax, 00000001
:004188A6 E900000000              jmp 004188AB

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00418855(U), :0041887E(U), :004188A6(U)
|
:004188AB 5F                      pop edi
:004188AC 5E                      pop esi
:004188AD 5B                      pop ebx
:004188AE C9                      leave
:004188AF C3                      ret



* Referenced by a CALL at Address:
|:00418C2C   
|
:004188B0 55                      push ebp
:004188B1 8BEC                    mov ebp, esp
:004188B3 83EC10                  sub esp, 00000010
:004188B6 53                      push ebx
:004188B7 56                      push esi
:004188B8 57                      push edi
:004188B9 833DFCF7440000          cmp dword ptr [0044F7FC], 00000000
:004188C0 0F8507000000            jne 004188CD
:004188C6 33C0                    xor eax, eax
:004188C8 E938000000              jmp 00418905

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004188C0(C)
|
:004188CD C745F805000000          mov [ebp-08], 00000005
:004188D4 8D45F0                  lea eax, dword ptr [ebp-10]
:004188D7 50                      push eax
:004188D8 6800010000              push 00000100
:004188DD 6814080000              push 00000814
:004188E2 A1FCF74400              mov eax, dword ptr [0044F7FC]
:004188E7 50                      push eax

* Reference To: WINMM.mciSendCommandA, Ord:002Fh
                                  |
:004188E8 FF15BC744700            Call dword ptr [004774BC]
:004188EE 85C0                    test eax, eax
:004188F0 0F8407000000            je 004188FD
:004188F6 33C0                    xor eax, eax
:004188F8 E908000000              jmp 00418905

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004188F0(C)
|
:004188FD 8B45F4                  mov eax, dword ptr [ebp-0C]
:00418900 E900000000              jmp 00418905

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004188C8(U), :004188F8(U), :00418900(U)
|
:00418905 5F                      pop edi
:00418906 5E                      pop esi
:00418907 5B                      pop ebx
:00418908 C9                      leave
:00418909 C3                      ret



* Referenced by a CALL at Addresses:
|:00418A16   , :00418C45   
|
:0041890A 55                      push ebp
:0041890B 8BEC                    mov ebp, esp
:0041890D 83EC10                  sub esp, 00000010
:00418910 53                      push ebx
:00418911 56                      push esi
:00418912 57                      push edi
:00418913 833DFCF7440000          cmp dword ptr [0044F7FC], 00000000
:0041891A 0F8507000000            jne 00418927
:00418920 32C0                    xor al, al
:00418922 E938000000              jmp 0041895F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041891A(C)
|
:00418927 C745F803000000          mov [ebp-08], 00000003
:0041892E 8D45F0                  lea eax, dword ptr [ebp-10]
:00418931 50                      push eax
:00418932 6800010000              push 00000100
:00418937 6814080000              push 00000814
:0041893C A1FCF74400              mov eax, dword ptr [0044F7FC]
:00418941 50                      push eax

* Reference To: WINMM.mciSendCommandA, Ord:002Fh
                                  |
:00418942 FF15BC744700            Call dword ptr [004774BC]
:00418948 85C0                    test eax, eax
:0041894A 0F8407000000            je 00418957
:00418950 32C0                    xor al, al
:00418952 E908000000              jmp 0041895F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041894A(C)
|
:00418957 8A45F4                  mov al, byte ptr [ebp-0C]
:0041895A E900000000              jmp 0041895F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00418922(U), :00418952(U), :0041895A(U)
|
:0041895F 5F                      pop edi
:00418960 5E                      pop esi
:00418961 5B                      pop ebx
:00418962 C9                      leave
:00418963 C3                      ret



* Referenced by a CALL at Addresses:
|:00418B06   , :00418B80   , :00418BDE   , :00418F2F   
|
:00418964 55                      push ebp
:00418965 8BEC                    mov ebp, esp
:00418967 83EC10                  sub esp, 00000010
:0041896A 53                      push ebx
:0041896B 56                      push esi
:0041896C 57                      push edi
:0041896D 833DFCF7440000          cmp dword ptr [0044F7FC], 00000000
:00418974 0F8507000000            jne 00418981
:0041897A 33C0                    xor eax, eax
:0041897C E94E000000              jmp 004189CF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418974(C)
|
:00418981 C745F804000000          mov [ebp-08], 00000004
:00418988 8D45F0                  lea eax, dword ptr [ebp-10]
:0041898B 50                      push eax
:0041898C 6800010000              push 00000100
:00418991 6814080000              push 00000814
:00418996 A1FCF74400              mov eax, dword ptr [0044F7FC]
:0041899B 50                      push eax

* Reference To: WINMM.mciSendCommandA, Ord:002Fh
                                  |
:0041899C FF15BC744700            Call dword ptr [004774BC]
:004189A2 85C0                    test eax, eax
:004189A4 0F8407000000            je 004189B1
:004189AA 33C0                    xor eax, eax
:004189AC E91E000000              jmp 004189CF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004189A4(C)
|
:004189B1 817DF40E020000          cmp dword ptr [ebp-0C], 0000020E
:004189B8 0F850A000000            jne 004189C8
:004189BE B801000000              mov eax, 00000001
:004189C3 E902000000              jmp 004189CA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004189B8(C)
|
:004189C8 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004189C3(U)
|
:004189CA E900000000              jmp 004189CF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041897C(U), :004189AC(U), :004189CA(U)
|
:004189CF 5F                      pop edi
:004189D0 5E                      pop esi
:004189D1 5B                      pop ebx
:004189D2 C9                      leave
:004189D3 C3                      ret



* Referenced by a CALL at Addresses:
|:00418AD3   , :00418C9F   
|
:004189D4 55                      push ebp
:004189D5 8BEC                    mov ebp, esp
:004189D7 83EC1C                  sub esp, 0000001C
:004189DA 53                      push ebx
:004189DB 56                      push esi
:004189DC 57                      push edi
:004189DD 8B4514                  mov eax, dword ptr [ebp+14]
:004189E0 C60000                  mov byte ptr [eax], 00
:004189E3 8B4514                  mov eax, dword ptr [ebp+14]
:004189E6 8A00                    mov al, byte ptr [eax]
:004189E8 8B4D10                  mov ecx, dword ptr [ebp+10]
:004189EB 8801                    mov byte ptr [ecx], al
:004189ED 8B4510                  mov eax, dword ptr [ebp+10]
:004189F0 8A00                    mov al, byte ptr [eax]
:004189F2 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004189F5 8801                    mov byte ptr [ecx], al
:004189F7 833DFCF7440000          cmp dword ptr [0044F7FC], 00000000
:004189FE 0F8505000000            jne 00418A09
:00418A04 E9AC000000              jmp 00418AB5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004189FE(C)
|
:00418A09 33C0                    xor eax, eax
:00418A0B 8A4508                  mov al, byte ptr [ebp+08]
:00418A0E 85C0                    test eax, eax
:00418A10 0F8416000000            je 00418A2C
:00418A16 E8EFFEFFFF              call 0041890A
:00418A1B 33C9                    xor ecx, ecx
:00418A1D 8AC8                    mov cl, al
:00418A1F 33C0                    xor eax, eax
:00418A21 8A4508                  mov al, byte ptr [ebp+08]
:00418A24 3BC8                    cmp ecx, eax
:00418A26 0F8D05000000            jnl 00418A31

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418A10(C)
|
:00418A2C E984000000              jmp 00418AB5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418A26(C)
|
:00418A31 C745F802000000          mov [ebp-08], 00000002
:00418A38 8D45F4                  lea eax, dword ptr [ebp-0C]
:00418A3B 50                      push eax
:00418A3C 6800040000              push 00000400
:00418A41 680D080000              push 0000080D
:00418A46 A1FCF74400              mov eax, dword ptr [0044F7FC]
:00418A4B 50                      push eax

* Reference To: WINMM.mciSendCommandA, Ord:002Fh
                                  |
:00418A4C FF15BC744700            Call dword ptr [004774BC]
:00418A52 85C0                    test eax, eax
:00418A54 0F8405000000            je 00418A5F
:00418A5A E956000000              jmp 00418AB5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418A54(C)
|
:00418A5F C745EC01000000          mov [ebp-14], 00000001
:00418A66 33C0                    xor eax, eax
:00418A68 8A4508                  mov al, byte ptr [ebp+08]
:00418A6B 8945F0                  mov dword ptr [ebp-10], eax
:00418A6E 8D45E4                  lea eax, dword ptr [ebp-1C]
:00418A71 50                      push eax
:00418A72 6810010000              push 00000110
:00418A77 6814080000              push 00000814
:00418A7C A1FCF74400              mov eax, dword ptr [0044F7FC]
:00418A81 50                      push eax

* Reference To: WINMM.mciSendCommandA, Ord:002Fh
                                  |
:00418A82 FF15BC744700            Call dword ptr [004774BC]
:00418A88 85C0                    test eax, eax
:00418A8A 0F8405000000            je 00418A95
:00418A90 E920000000              jmp 00418AB5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418A8A(C)
|
:00418A95 8A45E8                  mov al, byte ptr [ebp-18]
:00418A98 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00418A9B 8801                    mov byte ptr [ecx], al
:00418A9D 8B45E8                  mov eax, dword ptr [ebp-18]
:00418AA0 8B4D10                  mov ecx, dword ptr [ebp+10]
:00418AA3 8821                    mov byte ptr [ecx], ah
:00418AA5 8B45E8                  mov eax, dword ptr [ebp-18]
:00418AA8 C1E810                  shr eax, 10
:00418AAB 8B4D14                  mov ecx, dword ptr [ebp+14]
:00418AAE 8801                    mov byte ptr [ecx], al
:00418AB0 E900000000              jmp 00418AB5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00418A04(U), :00418A2C(U), :00418A5A(U), :00418A90(U), :00418AB0(U)
|
:00418AB5 5F                      pop edi
:00418AB6 5E                      pop esi
:00418AB7 5B                      pop ebx
:00418AB8 C9                      leave
:00418AB9 C3                      ret


:00418ABA 55                      push ebp
:00418ABB 8BEC                    mov ebp, esp
:00418ABD 83EC0C                  sub esp, 0000000C
:00418AC0 53                      push ebx
:00418AC1 56                      push esi
:00418AC2 57                      push edi
:00418AC3 8D45F4                  lea eax, dword ptr [ebp-0C]
:00418AC6 50                      push eax
:00418AC7 8D45F8                  lea eax, dword ptr [ebp-08]
:00418ACA 50                      push eax
:00418ACB 8D45FC                  lea eax, dword ptr [ebp-04]
:00418ACE 50                      push eax
:00418ACF 8B4508                  mov eax, dword ptr [ebp+08]
:00418AD2 50                      push eax
:00418AD3 E8FCFEFFFF              call 004189D4
:00418AD8 83C410                  add esp, 00000010
:00418ADB 33C9                    xor ecx, ecx
:00418ADD 8A4DFC                  mov cl, byte ptr [ebp-04]
:00418AE0 C1E102                  shl ecx, 02
:00418AE3 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:00418AE6 8D0C89                  lea ecx, dword ptr [ecx+4*ecx]
:00418AE9 33D2                    xor edx, edx
:00418AEB 8A55F8                  mov dl, byte ptr [ebp-08]
:00418AEE 03CA                    add ecx, edx
:00418AF0 668BC1                  mov ax, cx
:00418AF3 E900000000              jmp 00418AF8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418AF3(U)
|
:00418AF8 5F                      pop edi
:00418AF9 5E                      pop esi
:00418AFA 5B                      pop ebx
:00418AFB C9                      leave
:00418AFC C3                      ret


:00418AFD 55                      push ebp
:00418AFE 8BEC                    mov ebp, esp
:00418B00 83EC18                  sub esp, 00000018
:00418B03 53                      push ebx
:00418B04 56                      push esi
:00418B05 57                      push edi
:00418B06 E859FEFFFF              call 00418964
:00418B0B 85C0                    test eax, eax
:00418B0D 0F8508000000            jne 00418B1B
:00418B13 6633C0                  xor ax, ax
:00418B16 E95A000000              jmp 00418B75

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418B0D(C)
|
:00418B1B C745F002000000          mov [ebp-10], 00000002
:00418B22 8D45E8                  lea eax, dword ptr [ebp-18]
:00418B25 50                      push eax
:00418B26 6800010000              push 00000100
:00418B2B 6814080000              push 00000814
:00418B30 A1FCF74400              mov eax, dword ptr [0044F7FC]
:00418B35 50                      push eax

* Reference To: WINMM.mciSendCommandA, Ord:002Fh
                                  |
:00418B36 FF15BC744700            Call dword ptr [004774BC]
:00418B3C 85C0                    test eax, eax
:00418B3E 0F8408000000            je 00418B4C
:00418B44 6633C0                  xor ax, ax
:00418B47 E929000000              jmp 00418B75

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418B3E(C)
|
:00418B4C 8B45EC                  mov eax, dword ptr [ebp-14]
:00418B4F 8865FC                  mov byte ptr [ebp-04], ah
:00418B52 8B45EC                  mov eax, dword ptr [ebp-14]
:00418B55 C1E810                  shr eax, 10
:00418B58 8845F8                  mov byte ptr [ebp-08], al
:00418B5B 33C0                    xor eax, eax
:00418B5D 8A45FC                  mov al, byte ptr [ebp-04]
:00418B60 C1E002                  shl eax, 02
:00418B63 8D0440                  lea eax, dword ptr [eax+2*eax]
:00418B66 8D0480                  lea eax, dword ptr [eax+4*eax]
:00418B69 33C9                    xor ecx, ecx
:00418B6B 8A4DF8                  mov cl, byte ptr [ebp-08]
:00418B6E 03C1                    add eax, ecx
:00418B70 E900000000              jmp 00418B75

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00418B16(U), :00418B47(U), :00418B70(U)
|
:00418B75 5F                      pop edi
:00418B76 5E                      pop esi
:00418B77 5B                      pop ebx
:00418B78 C9                      leave
:00418B79 C3                      ret



* Referenced by a CALL at Addresses:
|:00418CD0   , :00418D62   , :00418EFC   
|
:00418B7A 55                      push ebp
:00418B7B 8BEC                    mov ebp, esp
:00418B7D 53                      push ebx
:00418B7E 56                      push esi
:00418B7F 57                      push edi
:00418B80 E8DFFDFFFF              call 00418964
:00418B85 85C0                    test eax, eax
:00418B87 0F8507000000            jne 00418B94
:00418B8D 33C0                    xor eax, eax
:00418B8F E933000000              jmp 00418BC7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418B87(C)
|
:00418B94 6A00                    push 00000000
:00418B96 6A02                    push 00000002
:00418B98 6808080000              push 00000808
:00418B9D A1FCF74400              mov eax, dword ptr [0044F7FC]
:00418BA2 50                      push eax

* Reference To: WINMM.mciSendCommandA, Ord:002Fh
                                  |
:00418BA3 FF15BC744700            Call dword ptr [004774BC]
:00418BA9 C70504F8440000000000    mov dword ptr [0044F804], 00000000
:00418BB3 C705F8F7440000000000    mov dword ptr [0044F7F8], 00000000
:00418BBD B801000000              mov eax, 00000001
:00418BC2 E900000000              jmp 00418BC7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00418B8F(U), :00418BC2(U)
|
:00418BC7 5F                      pop edi
:00418BC8 5E                      pop esi
:00418BC9 5B                      pop ebx
:00418BCA C9                      leave
:00418BCB C3                      ret



* Referenced by a CALL at Addresses:
|:00418DDD   , :00418EA6   
|
:00418BCC 55                      push ebp
:00418BCD 8BEC                    mov ebp, esp
:00418BCF 83EC38                  sub esp, 00000038
:00418BD2 53                      push ebx
:00418BD3 56                      push esi
:00418BD4 57                      push edi
:00418BD5 8B4508                  mov eax, dword ptr [ebp+08]
:00418BD8 83C002                  add eax, 00000002
:00418BDB 8845DC                  mov byte ptr [ebp-24], al
:00418BDE E881FDFFFF              call 00418964
:00418BE3 85C0                    test eax, eax
:00418BE5 0F8420000000            je 00418C0B
:00418BEB 33C0                    xor eax, eax
:00418BED A000F84400              mov al, byte ptr [0044F800]
:00418BF2 33C9                    xor ecx, ecx
:00418BF4 8A4DDC                  mov cl, byte ptr [ebp-24]
:00418BF7 3BC1                    cmp eax, ecx
:00418BF9 0F8507000000            jne 00418C06
:00418BFF 33C0                    xor eax, eax
:00418C01 E98C010000              jmp 00418D92

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418BF9(C)
|
:00418C06 E921000000              jmp 00418C2C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418BE5(C)
|
:00418C0B 833DFCF7440000          cmp dword ptr [0044F7FC], 00000000
:00418C12 0F8514000000            jne 00418C2C
:00418C18 E8C0FBFFFF              call 004187DD
:00418C1D 85C0                    test eax, eax
:00418C1F 0F8507000000            jne 00418C2C
:00418C25 33C0                    xor eax, eax
:00418C27 E966010000              jmp 00418D92

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00418C06(U), :00418C12(C), :00418C1F(C)
|
:00418C2C E87FFCFFFF              call 004188B0
:00418C31 85C0                    test eax, eax
:00418C33 0F850C000000            jne 00418C45
:00418C39 E8FFFBFFFF              call 0041883D
:00418C3E 33C0                    xor eax, eax
:00418C40 E94D010000              jmp 00418D92

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418C33(C)
|
:00418C45 E8C0FCFFFF              call 0041890A
:00418C4A 33C9                    xor ecx, ecx
:00418C4C 8AC8                    mov cl, al
:00418C4E 894DC8                  mov dword ptr [ebp-38], ecx
:00418C51 33C0                    xor eax, eax
:00418C53 8A45DC                  mov al, byte ptr [ebp-24]
:00418C56 85C0                    test eax, eax
:00418C58 0F840E000000            je 00418C6C
:00418C5E 33C0                    xor eax, eax
:00418C60 8A45DC                  mov al, byte ptr [ebp-24]
:00418C63 3B45C8                  cmp eax, dword ptr [ebp-38]
:00418C66 0F8604000000            jbe 00418C70

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418C58(C)
|
:00418C6C C645DC02                mov [ebp-24], 02

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418C66(C)
|
:00418C70 33C0                    xor eax, eax
:00418C72 8A45DC                  mov al, byte ptr [ebp-24]
:00418C75 83F811                  cmp eax, 00000011
:00418C78 0F8511000000            jne 00418C8F
:00418C7E C645F802                mov [ebp-08], 02
:00418C82 C645E019                mov [ebp-20], 19
:00418C86 C645D807                mov [ebp-28], 07
:00418C8A E918000000              jmp 00418CA7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418C78(C)
|
:00418C8F 8D45D8                  lea eax, dword ptr [ebp-28]
:00418C92 50                      push eax
:00418C93 8D45E0                  lea eax, dword ptr [ebp-20]
:00418C96 50                      push eax
:00418C97 8D45F8                  lea eax, dword ptr [ebp-08]
:00418C9A 50                      push eax
:00418C9B 8B45DC                  mov eax, dword ptr [ebp-24]
:00418C9E 50                      push eax
:00418C9F E830FDFFFF              call 004189D4
:00418CA4 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418C8A(U)
|
:00418CA7 C745D00A000000          mov [ebp-30], 0000000A
:00418CAE 8D45CC                  lea eax, dword ptr [ebp-34]
:00418CB1 50                      push eax
:00418CB2 6800040000              push 00000400
:00418CB7 680D080000              push 0000080D
:00418CBC A1FCF74400              mov eax, dword ptr [0044F7FC]
:00418CC1 50                      push eax

* Reference To: WINMM.mciSendCommandA, Ord:002Fh
                                  |
:00418CC2 FF15BC744700            Call dword ptr [004774BC]
:00418CC8 85C0                    test eax, eax
:00418CCA 0F840C000000            je 00418CDC
:00418CD0 E8A5FEFFFF              call 00418B7A
:00418CD5 33C0                    xor eax, eax
:00418CD7 E9B6000000              jmp 00418D92

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418CCA(C)
|
:00418CDC C745F000000000          mov [ebp-10], 00000000
:00418CE3 8B45F0                  mov eax, dword ptr [ebp-10]
:00418CE6 8945F4                  mov dword ptr [ebp-0C], eax
:00418CE9 8B45F4                  mov eax, dword ptr [ebp-0C]
:00418CEC 8945FC                  mov dword ptr [ebp-04], eax
:00418CEF 33C0                    xor eax, eax
:00418CF1 8A45F0                  mov al, byte ptr [ebp-10]
:00418CF4 C1E008                  shl eax, 08
:00418CF7 33C9                    xor ecx, ecx
:00418CF9 8A4DF4                  mov cl, byte ptr [ebp-0C]
:00418CFC 0BC1                    or eax, ecx
:00418CFE C1E010                  shl eax, 10
:00418D01 33C9                    xor ecx, ecx
:00418D03 8A4DFC                  mov cl, byte ptr [ebp-04]
:00418D06 C1E108                  shl ecx, 08
:00418D09 33D2                    xor edx, edx
:00418D0B 8A55DC                  mov dl, byte ptr [ebp-24]
:00418D0E 0BCA                    or ecx, edx
:00418D10 0BC1                    or eax, ecx
:00418D12 8945E8                  mov dword ptr [ebp-18], eax
:00418D15 33C0                    xor eax, eax
:00418D17 8A45D8                  mov al, byte ptr [ebp-28]
:00418D1A C1E008                  shl eax, 08
:00418D1D 33C9                    xor ecx, ecx
:00418D1F 8A4DE0                  mov cl, byte ptr [ebp-20]
:00418D22 0BC1                    or eax, ecx
:00418D24 C1E010                  shl eax, 10
:00418D27 33C9                    xor ecx, ecx
:00418D29 8A4DF8                  mov cl, byte ptr [ebp-08]
:00418D2C C1E108                  shl ecx, 08
:00418D2F 33D2                    xor edx, edx
:00418D31 8A55DC                  mov dl, byte ptr [ebp-24]
:00418D34 0BCA                    or ecx, edx
:00418D36 0BC1                    or eax, ecx
:00418D38 8945EC                  mov dword ptr [ebp-14], eax
:00418D3B A198D44500              mov eax, dword ptr [0045D498]
:00418D40 8945E4                  mov dword ptr [ebp-1C], eax
:00418D43 8D45E4                  lea eax, dword ptr [ebp-1C]
:00418D46 50                      push eax
:00418D47 6A0D                    push 0000000D
:00418D49 6806080000              push 00000806
:00418D4E A1FCF74400              mov eax, dword ptr [0044F7FC]
:00418D53 50                      push eax

* Reference To: WINMM.mciSendCommandA, Ord:002Fh
                                  |
:00418D54 FF15BC744700            Call dword ptr [004774BC]
:00418D5A 85C0                    test eax, eax
:00418D5C 0F840C000000            je 00418D6E
:00418D62 E813FEFFFF              call 00418B7A
:00418D67 33C0                    xor eax, eax
:00418D69 E924000000              jmp 00418D92

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418D5C(C)
|
:00418D6E 8A45DC                  mov al, byte ptr [ebp-24]
:00418D71 A200F84400              mov byte ptr [0044F800], al
:00418D76 8B450C                  mov eax, dword ptr [ebp+0C]
:00418D79 A304F84400              mov dword ptr [0044F804], eax
:00418D7E C705F8F7440001000000    mov dword ptr [0044F7F8], 00000001
:00418D88 B801000000              mov eax, 00000001
:00418D8D E900000000              jmp 00418D92

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00418C01(U), :00418C27(U), :00418C40(U), :00418CD7(U), :00418D69(U)
|:00418D8D(U)
|
:00418D92 5F                      pop edi
:00418D93 5E                      pop esi
:00418D94 5B                      pop ebx
:00418D95 C9                      leave
:00418D96 C3                      ret



* Referenced by a CALL at Address:
|:0040E5FF   
|
:00418D97 55                      push ebp
:00418D98 8BEC                    mov ebp, esp
:00418D9A 53                      push ebx
:00418D9B 56                      push esi
:00418D9C 57                      push edi
:00418D9D 8B450C                  mov eax, dword ptr [ebp+0C]
:00418DA0 3905FCF74400            cmp dword ptr [0044F7FC], eax
:00418DA6 0F8556000000            jne 00418E02
:00418DAC 833DF8F7440000          cmp dword ptr [0044F7F8], 00000000
:00418DB3 0F843D000000            je 00418DF6
:00418DB9 837D0801                cmp dword ptr [ebp+08], 00000001
:00418DBD 0F8527000000            jne 00418DEA
:00418DC3 833D04F8440000          cmp dword ptr [0044F804], 00000000
:00418DCA 0F841A000000            je 00418DEA
:00418DD0 6A01                    push 00000001
:00418DD2 B990A64600              mov ecx, 0046A690
:00418DD7 E824030000              call 00419100
:00418DDC 50                      push eax
:00418DDD E8EAFDFFFF              call 00418BCC
:00418DE2 83C408                  add esp, 00000008
:00418DE5 E91F000000              jmp 00418E09

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00418DBD(C), :00418DCA(C)
|
:00418DEA 33C0                    xor eax, eax
:00418DEC E918000000              jmp 00418E09
:00418DF1 E90C000000              jmp 00418E02

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418DB3(C)
|
:00418DF6 E842FAFFFF              call 0041883D
:00418DFB 33C0                    xor eax, eax
:00418DFD E907000000              jmp 00418E09

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00418DA6(C), :00418DF1(U)
|
:00418E02 33C0                    xor eax, eax
:00418E04 E900000000              jmp 00418E09

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00418DE5(U), :00418DEC(U), :00418DFD(U), :00418E04(U)
|
:00418E09 5F                      pop edi
:00418E0A 5E                      pop esi
:00418E0B 5B                      pop ebx
:00418E0C C9                      leave
:00418E0D C3                      ret



* Referenced by a CALL at Address:
|:00418770   
|
:00418E0E 55                      push ebp
:00418E0F 8BEC                    mov ebp, esp
:00418E11 83EC04                  sub esp, 00000004
:00418E14 53                      push ebx
:00418E15 56                      push esi
:00418E16 57                      push edi
:00418E17 894DFC                  mov dword ptr [ebp-04], ecx
:00418E1A 8B45FC                  mov eax, dword ptr [ebp-04]
:00418E1D C700FFFF0000            mov dword ptr [eax], 0000FFFF
:00418E23 E900000000              jmp 00418E28

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418E23(U)
|
:00418E28 8B45FC                  mov eax, dword ptr [ebp-04]
:00418E2B 5F                      pop edi
:00418E2C 5E                      pop esi
:00418E2D 5B                      pop ebx
:00418E2E C9                      leave
:00418E2F C3                      ret



* Referenced by a CALL at Address:
|:00418EDF   
|
:00418E30 55                      push ebp
:00418E31 8BEC                    mov ebp, esp
:00418E33 83EC04                  sub esp, 00000004
:00418E36 53                      push ebx
:00418E37 56                      push esi
:00418E38 57                      push edi
:00418E39 894DFC                  mov dword ptr [ebp-04], ecx
:00418E3C 837D0813                cmp dword ptr [ebp+08], 00000013
:00418E40 0F8605000000            jbe 00418E4B
:00418E46 E978000000              jmp 00418EC3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418E40(C)
|
:00418E4B 33C0                    xor eax, eax
:00418E4D 8A4508                  mov al, byte ptr [ebp+08]
:00418E50 50                      push eax
:00418E51 B9D0A64600              mov ecx, 0046A6D0
:00418E56 E8C5020000              call 00419120
:00418E5B 8B4508                  mov eax, dword ptr [ebp+08]
:00418E5E 33C9                    xor ecx, ecx
:00418E60 8A8808F84400            mov cl, byte ptr [eax+0044F808]
:00418E66 894D08                  mov dword ptr [ebp+08], ecx
:00418E69 837D0810                cmp dword ptr [ebp+08], 00000010
:00418E6D 0F8605000000            jbe 00418E78
:00418E73 E94B000000              jmp 00418EC3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418E6D(C)
|
:00418E78 8B45FC                  mov eax, dword ptr [ebp-04]
:00418E7B 8B4D08                  mov ecx, dword ptr [ebp+08]
:00418E7E 3908                    cmp dword ptr [eax], ecx
:00418E80 0F8505000000            jne 00418E8B
:00418E86 E938000000              jmp 00418EC3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418E80(C)
|
:00418E8B B9D0A64600              mov ecx, 0046A6D0
:00418E90 E88B2BFFFF              call 0040BA20
:00418E95 F6C420                  test ah, 20
:00418E98 0F8420000000            je 00418EBE
:00418E9E 8B450C                  mov eax, dword ptr [ebp+0C]
:00418EA1 50                      push eax
:00418EA2 8B4508                  mov eax, dword ptr [ebp+08]
:00418EA5 50                      push eax
:00418EA6 E821FDFFFF              call 00418BCC
:00418EAB 83C408                  add esp, 00000008
:00418EAE 85C0                    test eax, eax
:00418EB0 0F8408000000            je 00418EBE
:00418EB6 8B4508                  mov eax, dword ptr [ebp+08]
:00418EB9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00418EBC 8901                    mov dword ptr [ecx], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00418E98(C), :00418EB0(C)
|
:00418EBE E900000000              jmp 00418EC3

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00418E46(U), :00418E73(U), :00418E86(U), :00418EBE(U)
|
:00418EC3 5F                      pop edi
:00418EC4 5E                      pop esi
:00418EC5 5B                      pop ebx
:00418EC6 C9                      leave
:00418EC7 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0040A3AF   , :0040B07E   , :0040B827   , :004101B3   , :004101C6   
|:0041035D   , :00427C7F   , :0042BDFC   , :0042FB63   , :00431DC8   
|:00439782   , :00442118   
|
:00418ECA 55                      push ebp
:00418ECB 8BEC                    mov ebp, esp
:00418ECD 83EC04                  sub esp, 00000004
:00418ED0 53                      push ebx
:00418ED1 56                      push esi
:00418ED2 57                      push edi
:00418ED3 894DFC                  mov dword ptr [ebp-04], ecx
:00418ED6 6A01                    push 00000001
:00418ED8 8B4508                  mov eax, dword ptr [ebp+08]
:00418EDB 50                      push eax
:00418EDC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00418EDF E84CFFFFFF              call 00418E30
:00418EE4 E900000000              jmp 00418EE9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418EE4(U)
|
:00418EE9 5F                      pop edi
:00418EEA 5E                      pop esi
:00418EEB 5B                      pop ebx
:00418EEC C9                      leave
:00418EED C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0040A38C   , :0040B05B   , :0040B68E   , :0040B746   , :00410324   
|:004250D0   , :004251B7   , :00425892   , :00425A05   , :00439680   
|:0044059A   , :004420FA   
|
:00418EF0 55                      push ebp
:00418EF1 8BEC                    mov ebp, esp
:00418EF3 83EC04                  sub esp, 00000004
:00418EF6 53                      push ebx
:00418EF7 56                      push esi
:00418EF8 57                      push edi
:00418EF9 894DFC                  mov dword ptr [ebp-04], ecx
:00418EFC E879FCFFFF              call 00418B7A
:00418F01 8B45FC                  mov eax, dword ptr [ebp-04]
:00418F04 C700FFFF0000            mov dword ptr [eax], 0000FFFF
:00418F0A E900000000              jmp 00418F0F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418F0A(U)
|
:00418F0F 5F                      pop edi
:00418F10 5E                      pop esi
:00418F11 5B                      pop ebx
:00418F12 C9                      leave
:00418F13 C3                      ret


:00418F14 55                      push ebp
:00418F15 8BEC                    mov ebp, esp
:00418F17 83EC04                  sub esp, 00000004
:00418F1A 53                      push ebx
:00418F1B 56                      push esi
:00418F1C 57                      push edi
:00418F1D 894DFC                  mov dword ptr [ebp-04], ecx
:00418F20 8B45FC                  mov eax, dword ptr [ebp-04]
:00418F23 8138FFFF0000            cmp dword ptr [eax], 0000FFFF
:00418F29 0F840A000000            je 00418F39
:00418F2F E830FAFFFF              call 00418964
:00418F34 E907000000              jmp 00418F40

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418F29(C)
|
:00418F39 33C0                    xor eax, eax
:00418F3B E900000000              jmp 00418F40

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00418F34(U), :00418F3B(U)
|
:00418F40 5F                      pop edi
:00418F41 5E                      pop esi
:00418F42 5B                      pop ebx
:00418F43 C9                      leave
:00418F44 C3                      ret



* Referenced by a CALL at Addresses:
|:00419039   , :0041905F   , :00419087   
|
:00418F45 55                      push ebp
:00418F46 8BEC                    mov ebp, esp
:00418F48 83EC10                  sub esp, 00000010
:00418F4B 53                      push ebx
:00418F4C 56                      push esi
:00418F4D 57                      push edi
:00418F4E 894DF0                  mov dword ptr [ebp-10], ecx
:00418F51 C645FC41                mov [ebp-04], 41
:00418F55 A18CA64600              mov eax, dword ptr [0046A68C]
:00418F5A 48                      dec eax
:00418F5B 0FBEC0                  movsx eax, al
:00418F5E 83C041                  add eax, 00000041
:00418F61 8845FC                  mov byte ptr [ebp-04], al
:00418F64 8A45FC                  mov al, byte ptr [ebp-04]
:00418F67 8B4D08                  mov ecx, dword ptr [ebp+08]
:00418F6A 8B0C8DE0FA4400          mov ecx, dword ptr [4*ecx+0044FAE0]
:00418F71 8801                    mov byte ptr [ecx], al
:00418F73 6A00                    push 00000000
:00418F75 6A00                    push 00000000

* Reference To: WINMM.sndPlaySoundA, Ord:008Dh
                                  |
:00418F77 FF15C0744700            Call dword ptr [004774C0]
:00418F7D 837D082E                cmp dword ptr [ebp+08], 0000002E
:00418F81 0F8205000000            jb 00418F8C
:00418F87 E991000000              jmp 0041901D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418F81(C)
|
:00418F8C 8B4508                  mov eax, dword ptr [ebp+08]
:00418F8F 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00418F92 8901                    mov dword ptr [ecx], eax
:00418F94 B9D0A64600              mov ecx, 0046A6D0
:00418F99 E8822AFFFF              call 0040BA20
:00418F9E F6C410                  test ah, 10
:00418FA1 0F8471000000            je 00419018
:00418FA7 C745F403000000          mov [ebp-0C], 00000003
:00418FAE 837D0C00                cmp dword ptr [ebp+0C], 00000000
:00418FB2 0F8507000000            jne 00418FBF
:00418FB8 C745F40B000000          mov [ebp-0C], 0000000B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418FB2(C)
|
:00418FBF 837D0C01                cmp dword ptr [ebp+0C], 00000001
:00418FC3 0F8F1A000000            jg 00418FE3
:00418FC9 8B45F4                  mov eax, dword ptr [ebp-0C]
:00418FCC 50                      push eax
:00418FCD 8B4508                  mov eax, dword ptr [ebp+08]
:00418FD0 8B0485E0FA4400          mov eax, dword ptr [4*eax+0044FAE0]
:00418FD7 50                      push eax

* Reference To: WINMM.sndPlaySoundA, Ord:008Dh
                                  |
:00418FD8 FF15C0744700            Call dword ptr [004774C0]
:00418FDE E93A000000              jmp 0041901D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418FC3(C)
|
:00418FE3 C745F800000000          mov [ebp-08], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419012(C)
|
:00418FEA 8B45F4                  mov eax, dword ptr [ebp-0C]
:00418FED 50                      push eax
:00418FEE 8B4508                  mov eax, dword ptr [ebp+08]
:00418FF1 8B0485E0FA4400          mov eax, dword ptr [4*eax+0044FAE0]
:00418FF8 50                      push eax

* Reference To: WINMM.sndPlaySoundA, Ord:008Dh
                                  |
:00418FF9 FF15C0744700            Call dword ptr [004774C0]
:00418FFF FF45F8                  inc [ebp-08]
:00419002 6A01                    push 00000001
:00419004 E8B2E50100              call 004375BB
:00419009 83C404                  add esp, 00000004
:0041900C 8B45F8                  mov eax, dword ptr [ebp-08]
:0041900F 39450C                  cmp dword ptr [ebp+0C], eax
:00419012 0F8FD2FFFFFF            jg 00418FEA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418FA1(C)
|
:00419018 E900000000              jmp 0041901D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00418F87(U), :00418FDE(U), :00419018(U)
|
:0041901D 5F                      pop edi
:0041901E 5E                      pop esi
:0041901F 5B                      pop ebx
:00419020 C9                      leave
:00419021 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:00403394   , :004034E4   , :00403EE7   , :00403FD7   , :00404008   
|:00404141   , :004041BE   , :00404254   , :00404976   , :004049BF   
|:00405006   , :004061C2   , :0040654A   , :0040672D   , :00406AB6   
|:00406EDE   , :00407052   , :004071C6   , :00407966   , :00407B5F   
|:00407C84   , :004083B1   , :0040841B   , :00408469   , :0040849B   
|:00408FFD   , :0040904B   , :0040B8DA   , :0040D24C   , :0040D43F   
|:0040F6D8   , :0040F6E9   , :0040FAE2   , :00410249   , :004147B1   
|:00414833   , :0041486E   , :00416AC5   , :0041A24C   , :0041DB0B   
|:0041DD6F   , :0041DE4C   , :0041DF66   , :004211AF   , :0042141E   
|:004219F2   , :00421AC2   , :00421ADD   , :004222F7   , :00422308   
|:00422319   , :0042232A   , :0042233B   , :00422B89   , :00422B9A   
|:004279C9   , :00428251   , :0042AA3D   , :0042BAAF   , :0042D04F   
|:0042DDE5   , :004350F8   , :004354F8   , :004355BA   , :004355FC   
|:00435657   , :00435711   , :00435777   , :00435820   , :00435FD7   
|:00435FE8   , :004361D8   , :00436212   , :00436273   , :00436320   
|:00436376   , :00436587   , :004365BE   , :004365DE   , :004366B6   
|:00436742   , :00436762   , :0043684A   , :004368AE   , :004368CE   
|:00436930   , :00436968   , :00436A7D   , :00436DE5   , :004389BD   
|:00438A0C   , :004395F8   , :0043969B   , :0043A28C   , :0043A361   
|:0043BD00   , :0043BD32   , :0043C5B9   , :0043C5E1   , :0043D0F0   
|:0043D136   , :0043D1A4   , :0043D1EA   , :0043D21A   , :0043D286   
|:0043E9EB   , :0043EAC5   , :0043FCF2   , :00441861   , :0044189E   
|:00441B85   , :00442155   , :00442200   , :0044237A   , :00443FF9   
|
:00419024 55                      push ebp
:00419025 8BEC                    mov ebp, esp
:00419027 83EC04                  sub esp, 00000004
:0041902A 53                      push ebx
:0041902B 56                      push esi
:0041902C 57                      push edi
:0041902D 894DFC                  mov dword ptr [ebp-04], ecx
:00419030 6A01                    push 00000001
:00419032 8B4508                  mov eax, dword ptr [ebp+08]
:00419035 50                      push eax
:00419036 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00419039 E807FFFFFF              call 00418F45
:0041903E E900000000              jmp 00419043

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041903E(U)
|
:00419043 5F                      pop edi
:00419044 5E                      pop esi
:00419045 5B                      pop ebx
:00419046 C9                      leave
:00419047 C20400                  ret 0004


:0041904A 55                      push ebp
:0041904B 8BEC                    mov ebp, esp
:0041904D 83EC04                  sub esp, 00000004
:00419050 53                      push ebx
:00419051 56                      push esi
:00419052 57                      push edi
:00419053 894DFC                  mov dword ptr [ebp-04], ecx
:00419056 6A00                    push 00000000
:00419058 8B4508                  mov eax, dword ptr [ebp+08]
:0041905B 50                      push eax
:0041905C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041905F E8E1FEFFFF              call 00418F45
:00419064 E900000000              jmp 00419069

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419064(U)
|
:00419069 5F                      pop edi
:0041906A 5E                      pop esi
:0041906B 5B                      pop ebx
:0041906C C9                      leave
:0041906D C20400                  ret 0004



* Referenced by a CALL at Address:
|:00431C57   
|
:00419070 55                      push ebp
:00419071 8BEC                    mov ebp, esp
:00419073 83EC04                  sub esp, 00000004
:00419076 53                      push ebx
:00419077 56                      push esi
:00419078 57                      push edi
:00419079 894DFC                  mov dword ptr [ebp-04], ecx
:0041907C 8B450C                  mov eax, dword ptr [ebp+0C]
:0041907F 50                      push eax
:00419080 8B4508                  mov eax, dword ptr [ebp+08]
:00419083 50                      push eax
:00419084 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00419087 E8B9FEFFFF              call 00418F45
:0041908C E900000000              jmp 00419091

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041908C(U)
|
:00419091 5F                      pop edi
:00419092 5E                      pop esi
:00419093 5B                      pop ebx
:00419094 C9                      leave
:00419095 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:00403FB2   , :00404026   , :004041A3   , :004042EE   , :004049AE   
|:00409033   , :0040A396   , :0040B065   , :0040B698   , :0040B750   
|:00423F13   , :004251C1   , :00425888   
|
:00419098 55                      push ebp
:00419099 8BEC                    mov ebp, esp
:0041909B 83EC04                  sub esp, 00000004
:0041909E 53                      push ebx
:0041909F 56                      push esi
:004190A0 57                      push edi
:004190A1 894DFC                  mov dword ptr [ebp-04], ecx
:004190A4 6A00                    push 00000000
:004190A6 6A00                    push 00000000

* Reference To: WINMM.sndPlaySoundA, Ord:008Dh
                                  |
:004190A8 FF15C0744700            Call dword ptr [004774C0]
:004190AE 8B45FC                  mov eax, dword ptr [ebp-04]
:004190B1 C700FFFF0000            mov dword ptr [eax], 0000FFFF
:004190B7 E900000000              jmp 004190BC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004190B7(U)
|
:004190BC 5F                      pop edi
:004190BD 5E                      pop esi
:004190BE 5B                      pop ebx
:004190BF C9                      leave
:004190C0 C3                      ret


:004190C1 CC                      int 03
:004190C2 CC                      int 03
:004190C3 CC                      int 03
:004190C4 CC                      int 03
:004190C5 CC                      int 03
:004190C6 CC                      int 03
:004190C7 CC                      int 03
:004190C8 CC                      int 03
:004190C9 CC                      int 03
:004190CA CC                      int 03
:004190CB CC                      int 03
:004190CC CC                      int 03
:004190CD CC                      int 03
:004190CE CC                      int 03
:004190CF CC                      int 03

* Referenced by a CALL at Address:
|:0041879F   
|
:004190D0 55                      push ebp
:004190D1 8BEC                    mov ebp, esp
:004190D3 83EC04                  sub esp, 00000004
:004190D6 53                      push ebx
:004190D7 56                      push esi
:004190D8 57                      push edi
:004190D9 894DFC                  mov dword ptr [ebp-04], ecx
:004190DC 8B45FC                  mov eax, dword ptr [ebp-04]
:004190DF C700FFFF0000            mov dword ptr [eax], 0000FFFF
:004190E5 E900000000              jmp 004190EA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004190E5(U)
|
:004190EA 8B45FC                  mov eax, dword ptr [ebp-04]
:004190ED 5F                      pop edi
:004190EE 5E                      pop esi
:004190EF 5B                      pop ebx
:004190F0 C9                      leave
:004190F1 C3                      ret


:004190F2 CC                      int 03
:004190F3 CC                      int 03
:004190F4 CC                      int 03
:004190F5 CC                      int 03
:004190F6 CC                      int 03
:004190F7 CC                      int 03
:004190F8 CC                      int 03
:004190F9 CC                      int 03
:004190FA CC                      int 03
:004190FB CC                      int 03
:004190FC CC                      int 03
:004190FD CC                      int 03
:004190FE CC                      int 03
:004190FF CC                      int 03

* Referenced by a CALL at Address:
|:00418DD7   
|
:00419100 55                      push ebp
:00419101 8BEC                    mov ebp, esp
:00419103 83EC04                  sub esp, 00000004
:00419106 53                      push ebx
:00419107 56                      push esi
:00419108 57                      push edi
:00419109 894DFC                  mov dword ptr [ebp-04], ecx
:0041910C 8B45FC                  mov eax, dword ptr [ebp-04]
:0041910F 8B00                    mov eax, dword ptr [eax]
:00419111 E900000000              jmp 00419116

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419111(U)
|
:00419116 5F                      pop edi
:00419117 5E                      pop esi
:00419118 5B                      pop ebx
:00419119 C9                      leave
:0041911A C3                      ret


:0041911B CC                      int 03
:0041911C CC                      int 03
:0041911D CC                      int 03
:0041911E CC                      int 03
:0041911F CC                      int 03

* Referenced by a CALL at Address:
|:00418E56   
|
:00419120 55                      push ebp
:00419121 8BEC                    mov ebp, esp
:00419123 83EC04                  sub esp, 00000004
:00419126 53                      push ebx
:00419127 56                      push esi
:00419128 57                      push edi
:00419129 894DFC                  mov dword ptr [ebp-04], ecx
:0041912C 8A4508                  mov al, byte ptr [ebp+08]
:0041912F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00419132 884112                  mov byte ptr [ecx+12], al
:00419135 E900000000              jmp 0041913A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419135(U)
|
:0041913A 5F                      pop edi
:0041913B 5E                      pop esi
:0041913C 5B                      pop ebx
:0041913D C9                      leave
:0041913E C20400                  ret 0004


:00419141 CC                      int 03
:00419142 CC                      int 03
:00419143 CC                      int 03
:00419144 CC                      int 03
:00419145 CC                      int 03
:00419146 CC                      int 03
:00419147 CC                      int 03
:00419148 CC                      int 03
:00419149 CC                      int 03
:0041914A CC                      int 03
:0041914B CC                      int 03
:0041914C CC                      int 03
:0041914D CC                      int 03
:0041914E CC                      int 03
:0041914F CC                      int 03
:00419150 55                      push ebp
:00419151 8BEC                    mov ebp, esp
:00419153 53                      push ebx
:00419154 56                      push esi
:00419155 57                      push edi
:00419156 E80A000000              call 00419165
:0041915B E900000000              jmp 00419160

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041915B(U)
|
:00419160 5F                      pop edi
:00419161 5E                      pop esi
:00419162 5B                      pop ebx
:00419163 C9                      leave
:00419164 C3                      ret



* Referenced by a CALL at Address:
|:00419156   
|
:00419165 55                      push ebp
:00419166 8BEC                    mov ebp, esp
:00419168 53                      push ebx
:00419169 56                      push esi
:0041916A 57                      push edi
:0041916B B9B0A64600              mov ecx, 0046A6B0
:00419170 E8FB86FEFF              call 00401870
:00419175 E900000000              jmp 0041917A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419175(U)
|
:0041917A 5F                      pop edi
:0041917B 5E                      pop esi
:0041917C 5B                      pop ebx
:0041917D C9                      leave
:0041917E C3                      ret


:0041917F 55                      push ebp
:00419180 8BEC                    mov ebp, esp
:00419182 53                      push ebx
:00419183 56                      push esi
:00419184 57                      push edi
:00419185 E80A000000              call 00419194
:0041918A E900000000              jmp 0041918F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041918A(U)
|
:0041918F 5F                      pop edi
:00419190 5E                      pop esi
:00419191 5B                      pop ebx
:00419192 C9                      leave
:00419193 C3                      ret



* Referenced by a CALL at Address:
|:00419185   
|
:00419194 55                      push ebp
:00419195 8BEC                    mov ebp, esp
:00419197 53                      push ebx
:00419198 56                      push esi
:00419199 57                      push edi
:0041919A B998A64600              mov ecx, 0046A698
:0041919F E8CC86FEFF              call 00401870
:004191A4 E900000000              jmp 004191A9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004191A4(U)
|
:004191A9 5F                      pop edi
:004191AA 5E                      pop esi
:004191AB 5B                      pop ebx
:004191AC C9                      leave
:004191AD C3                      ret



* Referenced by a CALL at Addresses:
|:0041A0F5   , :0042A70D   , :00442698   
|
:004191AE 55                      push ebp
:004191AF 8BEC                    mov ebp, esp
:004191B1 83EC08                  sub esp, 00000008
:004191B4 53                      push ebx
:004191B5 56                      push esi
:004191B6 57                      push edi
:004191B7 8B4508                  mov eax, dword ptr [ebp+08]
:004191BA 50                      push eax
:004191BB E81A040000              call 004195DA
:004191C0 83C404                  add esp, 00000004
:004191C3 8845FC                  mov byte ptr [ebp-04], al
:004191C6 33C0                    xor eax, eax
:004191C8 8A45FC                  mov al, byte ptr [ebp-04]
:004191CB 83F807                  cmp eax, 00000007
:004191CE 0F8438000000            je 0041920C
:004191D4 33C0                    xor eax, eax
:004191D6 8A45FC                  mov al, byte ptr [ebp-04]
:004191D9 83F808                  cmp eax, 00000008
:004191DC 0F842A000000            je 0041920C
:004191E2 33C0                    xor eax, eax
:004191E4 8A45FC                  mov al, byte ptr [ebp-04]
:004191E7 83F809                  cmp eax, 00000009
:004191EA 0F841C000000            je 0041920C
:004191F0 33C0                    xor eax, eax
:004191F2 8A45FC                  mov al, byte ptr [ebp-04]
:004191F5 83F80C                  cmp eax, 0000000C
:004191F8 0F840E000000            je 0041920C
:004191FE 33C0                    xor eax, eax
:00419200 8A45FC                  mov al, byte ptr [ebp-04]
:00419203 83F80D                  cmp eax, 0000000D
:00419206 0F850C000000            jne 00419218

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004191CE(C), :004191DC(C), :004191EA(C), :004191F8(C)
|
:0041920C C745F801000000          mov [ebp-08], 00000001
:00419213 E907000000              jmp 0041921F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419206(C)
|
:00419218 C745F800000000          mov [ebp-08], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419213(U)
|
:0041921F 8B45F8                  mov eax, dword ptr [ebp-08]
:00419222 E900000000              jmp 00419227

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419222(U)
|
:00419227 5F                      pop edi
:00419228 5E                      pop esi
:00419229 5B                      pop ebx
:0041922A C9                      leave
:0041922B C3                      ret



* Referenced by a CALL at Addresses:
|:0041AB6D   , :0041B290   , :0041B42F   
|
:0041922C 55                      push ebp
:0041922D 8BEC                    mov ebp, esp
:0041922F 83EC0C                  sub esp, 0000000C
:00419232 53                      push ebx
:00419233 56                      push esi
:00419234 57                      push edi
:00419235 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00419238 E83386FEFF              call 00401870
:0041923D C645F800                mov [ebp-08], 00
:00419241 E903000000              jmp 00419249

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004192CC(U)
|
:00419246 FE45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419241(U)
|
:00419249 33C0                    xor eax, eax
:0041924B 8A45F8                  mov al, byte ptr [ebp-08]
:0041924E 83F804                  cmp eax, 00000004
:00419251 0F8D7A000000            jnl 004192D1
:00419257 8B45F8                  mov eax, dword ptr [ebp-08]
:0041925A 50                      push eax
:0041925B 8B4508                  mov eax, dword ptr [ebp+08]
:0041925E 50                      push eax
:0041925F E8F1030000              call 00419655
:00419264 83C408                  add esp, 00000008
:00419267 50                      push eax
:00419268 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0041926B E82086FEFF              call 00401890
:00419270 33C0                    xor eax, eax
:00419272 8A45FC                  mov al, byte ptr [ebp-04]
:00419275 3DFF000000              cmp eax, 000000FF
:0041927A 0F844C000000            je 004192CC
:00419280 8D45FC                  lea eax, dword ptr [ebp-04]
:00419283 50                      push eax
:00419284 E8B4020000              call 0041953D
:00419289 83C404                  add esp, 00000004
:0041928C 8845F4                  mov byte ptr [ebp-0C], al
:0041928F 33C0                    xor eax, eax
:00419291 8A45F4                  mov al, byte ptr [ebp-0C]
:00419294 3DFF000000              cmp eax, 000000FF
:00419299 0F842D000000            je 004192CC
:0041929F 33C0                    xor eax, eax
:004192A1 8A45F4                  mov al, byte ptr [ebp-0C]
:004192A4 8BC8                    mov ecx, eax
:004192A6 8D0440                  lea eax, dword ptr [eax+2*eax]
:004192A9 C1E003                  shl eax, 03
:004192AC 2BC1                    sub eax, ecx
:004192AE 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004192B4 E867FFFEFF              call 00409220
:004192B9 3B450C                  cmp eax, dword ptr [ebp+0C]
:004192BC 0F840A000000            je 004192CC
:004192C2 B801000000              mov eax, 00000001
:004192C7 E90C000000              jmp 004192D8

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041927A(C), :00419299(C), :004192BC(C)
|
:004192CC E975FFFFFF              jmp 00419246

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419251(C)
|
:004192D1 33C0                    xor eax, eax
:004192D3 E900000000              jmp 004192D8

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004192C7(U), :004192D3(U)
|
:004192D8 5F                      pop edi
:004192D9 5E                      pop esi
:004192DA 5B                      pop ebx
:004192DB C9                      leave
:004192DC C3                      ret



* Referenced by a CALL at Addresses:
|:00404EB1   , :0041B68A   , :0041DA3A   
|
:004192DD 55                      push ebp
:004192DE 8BEC                    mov ebp, esp
:004192E0 83EC14                  sub esp, 00000014
:004192E3 53                      push ebx
:004192E4 56                      push esi
:004192E5 57                      push edi
:004192E6 6A10                    push 00000010
:004192E8 33C0                    xor eax, eax
:004192EA 8A4508                  mov al, byte ptr [ebp+08]
:004192ED 8BC8                    mov ecx, eax
:004192EF 8D0440                  lea eax, dword ptr [eax+2*eax]
:004192F2 C1E003                  shl eax, 03
:004192F5 2BC1                    sub eax, ecx
:004192F7 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004192FD E85E00FFFF              call 00409360
:00419302 8945F8                  mov dword ptr [ebp-08], eax
:00419305 6A10                    push 00000010
:00419307 33C0                    xor eax, eax
:00419309 8A450C                  mov al, byte ptr [ebp+0C]
:0041930C 8BC8                    mov ecx, eax
:0041930E 8D0440                  lea eax, dword ptr [eax+2*eax]
:00419311 C1E003                  shl eax, 03
:00419314 2BC1                    sub eax, ecx
:00419316 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041931C E83F00FFFF              call 00409360
:00419321 8945F4                  mov dword ptr [ebp-0C], eax
:00419324 33C0                    xor eax, eax
:00419326 8A4508                  mov al, byte ptr [ebp+08]
:00419329 8BC8                    mov ecx, eax
:0041932B 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041932E C1E003                  shl eax, 03
:00419331 2BC1                    sub eax, ecx
:00419333 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00419339 E8C2FEFEFF              call 00409200
:0041933E 668B00                  mov ax, word ptr [eax]
:00419341 668945F0                mov word ptr [ebp-10], ax
:00419345 33C0                    xor eax, eax
:00419347 8A450C                  mov al, byte ptr [ebp+0C]
:0041934A 8BC8                    mov ecx, eax
:0041934C 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041934F C1E003                  shl eax, 03
:00419352 2BC1                    sub eax, ecx
:00419354 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041935A E8A1FEFEFF              call 00409200
:0041935F 668B00                  mov ax, word ptr [eax]
:00419362 668945EC                mov word ptr [ebp-14], ax
:00419366 33C0                    xor eax, eax
:00419368 8A4508                  mov al, byte ptr [ebp+08]
:0041936B 8BC8                    mov ecx, eax
:0041936D 8D0440                  lea eax, dword ptr [eax+2*eax]
:00419370 C1E003                  shl eax, 03
:00419373 2BC1                    sub eax, ecx
:00419375 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041937B E820FFFEFF              call 004092A0
:00419380 50                      push eax
:00419381 E8CA8D0000              call 00422150
:00419386 83C404                  add esp, 00000004
:00419389 33C9                    xor ecx, ecx
:0041938B 8AC8                    mov cl, al
:0041938D 33C0                    xor eax, eax
:0041938F 8A81E8FB4400            mov al, byte ptr [ecx+0044FBE8]
:00419395 8945FC                  mov dword ptr [ebp-04], eax
:00419398 33C0                    xor eax, eax
:0041939A 8A45F0                  mov al, byte ptr [ebp-10]
:0041939D 0345FC                  add eax, dword ptr [ebp-04]
:004193A0 33C9                    xor ecx, ecx
:004193A2 8A4DEC                  mov cl, byte ptr [ebp-14]
:004193A5 3BC1                    cmp eax, ecx
:004193A7 0F8D4B000000            jnl 004193F8
:004193AD 6A01                    push 00000001
:004193AF 33C0                    xor eax, eax
:004193B1 8A4508                  mov al, byte ptr [ebp+08]
:004193B4 8BC8                    mov ecx, eax
:004193B6 8D0440                  lea eax, dword ptr [eax+2*eax]
:004193B9 C1E003                  shl eax, 03
:004193BC 2BC1                    sub eax, ecx
:004193BE 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004193C4 E8574E0000              call 0041E220
:004193C9 6A03                    push 00000003
:004193CB 33C0                    xor eax, eax
:004193CD 8A450C                  mov al, byte ptr [ebp+0C]
:004193D0 8BC8                    mov ecx, eax
:004193D2 8D0440                  lea eax, dword ptr [eax+2*eax]
:004193D5 C1E003                  shl eax, 03
:004193D8 2BC1                    sub eax, ecx
:004193DA 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004193E0 E83B4E0000              call 0041E220
:004193E5 C745F801000000          mov [ebp-08], 00000001
:004193EC C745F400000000          mov [ebp-0C], 00000000
:004193F3 E9FF000000              jmp 004194F7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004193A7(C)
|
:004193F8 33C0                    xor eax, eax
:004193FA 8A45F0                  mov al, byte ptr [ebp-10]
:004193FD 2B45FC                  sub eax, dword ptr [ebp-04]
:00419400 33C9                    xor ecx, ecx
:00419402 8A4DEC                  mov cl, byte ptr [ebp-14]
:00419405 3BC1                    cmp eax, ecx
:00419407 0F8E4B000000            jle 00419458
:0041940D 6A03                    push 00000003
:0041940F 33C0                    xor eax, eax
:00419411 8A4508                  mov al, byte ptr [ebp+08]
:00419414 8BC8                    mov ecx, eax
:00419416 8D0440                  lea eax, dword ptr [eax+2*eax]
:00419419 C1E003                  shl eax, 03
:0041941C 2BC1                    sub eax, ecx
:0041941E 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00419424 E8F74D0000              call 0041E220
:00419429 6A01                    push 00000001
:0041942B 33C0                    xor eax, eax
:0041942D 8A450C                  mov al, byte ptr [ebp+0C]
:00419430 8BC8                    mov ecx, eax
:00419432 8D0440                  lea eax, dword ptr [eax+2*eax]
:00419435 C1E003                  shl eax, 03
:00419438 2BC1                    sub eax, ecx
:0041943A 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00419440 E8DB4D0000              call 0041E220
:00419445 C745F800000000          mov [ebp-08], 00000000
:0041944C C745F401000000          mov [ebp-0C], 00000001
:00419453 E99F000000              jmp 004194F7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419407(C)
|
:00419458 33C0                    xor eax, eax
:0041945A 8A45F1                  mov al, byte ptr [ebp-0F]
:0041945D 0345FC                  add eax, dword ptr [ebp-04]
:00419460 33C9                    xor ecx, ecx
:00419462 8A4DED                  mov cl, byte ptr [ebp-13]
:00419465 3BC1                    cmp eax, ecx
:00419467 0F8D3D000000            jnl 004194AA
:0041946D 6A02                    push 00000002
:0041946F 33C0                    xor eax, eax
:00419471 8A4508                  mov al, byte ptr [ebp+08]
:00419474 8BC8                    mov ecx, eax
:00419476 8D0440                  lea eax, dword ptr [eax+2*eax]
:00419479 C1E003                  shl eax, 03
:0041947C 2BC1                    sub eax, ecx
:0041947E 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00419484 E8974D0000              call 0041E220
:00419489 6A00                    push 00000000
:0041948B 33C0                    xor eax, eax
:0041948D 8A450C                  mov al, byte ptr [ebp+0C]
:00419490 8BC8                    mov ecx, eax
:00419492 8D0440                  lea eax, dword ptr [eax+2*eax]
:00419495 C1E003                  shl eax, 03
:00419498 2BC1                    sub eax, ecx
:0041949A 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004194A0 E87B4D0000              call 0041E220
:004194A5 E94D000000              jmp 004194F7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419467(C)
|
:004194AA 33C0                    xor eax, eax
:004194AC 8A45F1                  mov al, byte ptr [ebp-0F]
:004194AF 2B45FC                  sub eax, dword ptr [ebp-04]
:004194B2 33C9                    xor ecx, ecx
:004194B4 8A4DED                  mov cl, byte ptr [ebp-13]
:004194B7 3BC1                    cmp eax, ecx
:004194B9 0F8E38000000            jle 004194F7
:004194BF 6A00                    push 00000000
:004194C1 33C0                    xor eax, eax
:004194C3 8A4508                  mov al, byte ptr [ebp+08]
:004194C6 8BC8                    mov ecx, eax
:004194C8 8D0440                  lea eax, dword ptr [eax+2*eax]
:004194CB C1E003                  shl eax, 03
:004194CE 2BC1                    sub eax, ecx
:004194D0 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004194D6 E8454D0000              call 0041E220
:004194DB 6A02                    push 00000002
:004194DD 33C0                    xor eax, eax
:004194DF 8A450C                  mov al, byte ptr [ebp+0C]
:004194E2 8BC8                    mov ecx, eax
:004194E4 8D0440                  lea eax, dword ptr [eax+2*eax]
:004194E7 C1E003                  shl eax, 03
:004194EA 2BC1                    sub eax, ecx
:004194EC 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004194F2 E8294D0000              call 0041E220

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004193F3(U), :00419453(U), :004194A5(U), :004194B9(C)
|
:004194F7 8B45F8                  mov eax, dword ptr [ebp-08]
:004194FA 50                      push eax
:004194FB 33C0                    xor eax, eax
:004194FD 8A4508                  mov al, byte ptr [ebp+08]
:00419500 8BC8                    mov ecx, eax
:00419502 8D0440                  lea eax, dword ptr [eax+2*eax]
:00419505 C1E003                  shl eax, 03
:00419508 2BC1                    sub eax, ecx
:0041950A 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00419510 E85D210100              call 0042B672
:00419515 8B45F4                  mov eax, dword ptr [ebp-0C]
:00419518 50                      push eax
:00419519 33C0                    xor eax, eax
:0041951B 8A450C                  mov al, byte ptr [ebp+0C]
:0041951E 8BC8                    mov ecx, eax
:00419520 8D0440                  lea eax, dword ptr [eax+2*eax]
:00419523 C1E003                  shl eax, 03
:00419526 2BC1                    sub eax, ecx
:00419528 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041952E E83F210100              call 0042B672
:00419533 E900000000              jmp 00419538

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419533(U)
|
:00419538 5F                      pop edi
:00419539 5E                      pop esi
:0041953A 5B                      pop ebx
:0041953B C9                      leave
:0041953C C3                      ret



* Referenced by a CALL at Addresses:
|:004046B5   , :00404820   , :00405785   , :00405B4F   , :00405F21   
|:00406311   , :00407408   , :00407758   , :00419284   , :00419DBE   
|:0041AA9A   , :0041AC9E   , :0041AE16   , :0041D196   , :0041D4B9   
|:0041D5A0   , :0041D636   , :0041D6DD   , :0041D78A   , :0041D834   
|:0041D8CC   , :0041DCD4   , :0041DD11   , :00427B37   , :00427F4B   
|:0042801A   , :0042895B   , :00428CD4   , :0042A040   , :0042A86E   
|:0042C38C   , :0042C6E1   , :0042D05E   , :0042D208   , :0043B6A8   
|:0043B6F8   , :0043BDEA   , :0043D082   , :00442DAB   
|
:0041953D 55                      push ebp
:0041953E 8BEC                    mov ebp, esp
:00419540 83EC04                  sub esp, 00000004
:00419543 53                      push ebx
:00419544 56                      push esi
:00419545 57                      push edi
:00419546 8B4508                  mov eax, dword ptr [ebp+08]
:00419549 33C9                    xor ecx, ecx
:0041954B 8A08                    mov cl, byte ptr [eax]
:0041954D 33C0                    xor eax, eax
:0041954F A0C8FC4600              mov al, byte ptr [0046FCC8]
:00419554 3BC8                    cmp ecx, eax
:00419556 0F8D72000000            jnl 004195CE
:0041955C 8B4508                  mov eax, dword ptr [ebp+08]
:0041955F 33C9                    xor ecx, ecx
:00419561 8A4801                  mov cl, byte ptr [eax+01]
:00419564 33C0                    xor eax, eax
:00419566 A0C9FC4600              mov al, byte ptr [0046FCC9]
:0041956B 3BC8                    cmp ecx, eax
:0041956D 0F8D5B000000            jnl 004195CE
:00419573 8B4508                  mov eax, dword ptr [ebp+08]
:00419576 33DB                    xor ebx, ebx
:00419578 8A5801                  mov bl, byte ptr [eax+01]
:0041957B 33C0                    xor eax, eax
:0041957D A0C8FC4600              mov al, byte ptr [0046FCC8]
:00419582 0FAFD8                  imul ebx, eax
:00419585 8B4508                  mov eax, dword ptr [ebp+08]
:00419588 33C9                    xor ecx, ecx
:0041958A 8A08                    mov cl, byte ptr [eax]
:0041958C 03D9                    add ebx, ecx
:0041958E 6A04                    push 00000004
:00419590 6A00                    push 00000000
:00419592 6880250000              push 00002580
:00419597 B950F94600              mov ecx, 0046F950
:0041959C E87FE10200              call 00447720
:004195A1 8A0C03                  mov cl, byte ptr [ebx+eax]
:004195A4 884DFC                  mov byte ptr [ebp-04], cl
:004195A7 33C9                    xor ecx, ecx
:004195A9 8A4DFC                  mov cl, byte ptr [ebp-04]
:004195AC 83F92D                  cmp ecx, 0000002D
:004195AF 0F8D0D000000            jnl 004195C2
:004195B5 8A45FC                  mov al, byte ptr [ebp-04]
:004195B8 E918000000              jmp 004195D5
:004195BD E907000000              jmp 004195C9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004195AF(C)
|
:004195C2 B0FF                    mov al, FF
:004195C4 E90C000000              jmp 004195D5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004195BD(U)
|
:004195C9 E907000000              jmp 004195D5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00419556(C), :0041956D(C)
|
:004195CE B0FF                    mov al, FF
:004195D0 E900000000              jmp 004195D5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004195B8(U), :004195C4(U), :004195C9(U), :004195D0(U)
|
:004195D5 5F                      pop edi
:004195D6 5E                      pop esi
:004195D7 5B                      pop ebx
:004195D8 C9                      leave
:004195D9 C3                      ret



* Referenced by a CALL at Addresses:
|:004044FD   , :00404694   , :004047FF   , :004191BB   , :0041ABEA   
|:0041AD9B   , :0041B140   , :0041B361   , :0041BFFF   , :0041D079   
|:0042A05C   , :0042A351   , :0042A6F4   , :0043E2A5   , :0043E679   
|
:004195DA 55                      push ebp
:004195DB 8BEC                    mov ebp, esp
:004195DD 53                      push ebx
:004195DE 56                      push esi
:004195DF 57                      push edi
:004195E0 8B4508                  mov eax, dword ptr [ebp+08]
:004195E3 33C9                    xor ecx, ecx
:004195E5 8A08                    mov cl, byte ptr [eax]
:004195E7 33C0                    xor eax, eax
:004195E9 A0C8FC4600              mov al, byte ptr [0046FCC8]
:004195EE 3BC8                    cmp ecx, eax
:004195F0 0F8D53000000            jnl 00419649
:004195F6 8B4508                  mov eax, dword ptr [ebp+08]
:004195F9 33C9                    xor ecx, ecx
:004195FB 8A4801                  mov cl, byte ptr [eax+01]
:004195FE 33C0                    xor eax, eax
:00419600 A0C9FC4600              mov al, byte ptr [0046FCC9]
:00419605 3BC8                    cmp ecx, eax
:00419607 0F8D3C000000            jnl 00419649
:0041960D 8B4508                  mov eax, dword ptr [ebp+08]
:00419610 33DB                    xor ebx, ebx
:00419612 8A5801                  mov bl, byte ptr [eax+01]
:00419615 33C0                    xor eax, eax
:00419617 A0C8FC4600              mov al, byte ptr [0046FCC8]
:0041961C 0FAFD8                  imul ebx, eax
:0041961F 8B4508                  mov eax, dword ptr [ebp+08]
:00419622 33C9                    xor ecx, ecx
:00419624 8A08                    mov cl, byte ptr [eax]
:00419626 03D9                    add ebx, ecx
:00419628 6A04                    push 00000004
:0041962A 6A00                    push 00000000
:0041962C 6A00                    push 00000000
:0041962E B950F94600              mov ecx, 0046F950
:00419633 E8E8E00200              call 00447720
:00419638 8A8403C0210000          mov al, byte ptr [ebx+eax+000021C0]
:0041963F E90C000000              jmp 00419650
:00419644 E907000000              jmp 00419650

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004195F0(C), :00419607(C)
|
:00419649 B0FF                    mov al, FF
:0041964B E900000000              jmp 00419650

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041963F(U), :00419644(U), :0041964B(U)
|
:00419650 5F                      pop edi
:00419651 5E                      pop esi
:00419652 5B                      pop ebx
:00419653 C9                      leave
:00419654 C3                      ret



* Referenced by a CALL at Addresses:
|:0040466F   , :004047D8   , :0040575B   , :00405B25   , :00405EF7   
|:004062E7   , :004073E5   , :00407735   , :0041925F   , :004198B0   
|:0041A293   , :0041AB44   , :0041AC45   , :0041AEE0   , :0041B2C6   
|:0041D494   , :0041D58B   , :0041D621   , :0041D6C8   , :0041D775   
|:0041D81F   , :0041D8B7   , :0041E007   , :0042A0E2   , :0042A84B   
|:0042C367   , :0042C6CC   , :0042D1BF   
|
:00419655 55                      push ebp
:00419656 8BEC                    mov ebp, esp
:00419658 53                      push ebx
:00419659 56                      push esi
:0041965A 57                      push edi
:0041965B 33C0                    xor eax, eax
:0041965D A0A0A64600              mov al, byte ptr [0046A6A0]
:00419662 A801                    test al, 01
:00419664 0F8525000000            jne 0041968F
:0041966A 33C0                    xor eax, eax
:0041966C A0A0A64600              mov al, byte ptr [0046A6A0]
:00419671 0C01                    or al, 01
:00419673 A2A0A64600              mov byte ptr [0046A6A0], al
:00419678 B9B4A64600              mov ecx, 0046A6B4
:0041967D E8EE81FEFF              call 00401870
:00419682 6817974100              push 00419717
:00419687 E854E60200              call 00447CE0
:0041968C 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419664(C)
|
:0041968F 8B4508                  mov eax, dword ptr [ebp+08]
:00419692 50                      push eax
:00419693 B9B4A64600              mov ecx, 0046A6B4
:00419698 E8F381FEFF              call 00401890
:0041969D 33C0                    xor eax, eax
:0041969F 8A450C                  mov al, byte ptr [ebp+0C]
:004196A2 8B04C5F0FB4400          mov eax, dword ptr [8*eax+0044FBF0]
:004196A9 33C9                    xor ecx, ecx
:004196AB 8A0DB4A64600            mov cl, byte ptr [0046A6B4]
:004196B1 03C1                    add eax, ecx
:004196B3 A2B4A64600              mov byte ptr [0046A6B4], al
:004196B8 33C0                    xor eax, eax
:004196BA 8A450C                  mov al, byte ptr [ebp+0C]
:004196BD 8B04C5F4FB4400          mov eax, dword ptr [8*eax+0044FBF4]
:004196C4 33C9                    xor ecx, ecx
:004196C6 8A0DB5A64600            mov cl, byte ptr [0046A6B5]
:004196CC 03C1                    add eax, ecx
:004196CE A2B5A64600              mov byte ptr [0046A6B5], al
:004196D3 33C0                    xor eax, eax
:004196D5 A0B4A64600              mov al, byte ptr [0046A6B4]
:004196DA 33C9                    xor ecx, ecx
:004196DC 8A0DC8FC4600            mov cl, byte ptr [0046FCC8]
:004196E2 3BC1                    cmp eax, ecx
:004196E4 0F8D17000000            jnl 00419701
:004196EA 33C0                    xor eax, eax
:004196EC A0B5A64600              mov al, byte ptr [0046A6B5]
:004196F1 33C9                    xor ecx, ecx
:004196F3 8A0DC9FC4600            mov cl, byte ptr [0046FCC9]
:004196F9 3BC1                    cmp eax, ecx
:004196FB 0F8C07000000            jl 00419708

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004196E4(C)
|
:00419701 C605B4A64600FF          mov byte ptr [0046A6B4], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004196FB(C)
|
:00419708 B8B4A64600              mov eax, 0046A6B4
:0041970D E900000000              jmp 00419712

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041970D(U)
|
:00419712 5F                      pop edi
:00419713 5E                      pop esi
:00419714 5B                      pop ebx
:00419715 C9                      leave
:00419716 C3                      ret


:00419717 55                      push ebp
:00419718 8BEC                    mov ebp, esp
:0041971A 53                      push ebx
:0041971B 56                      push esi
:0041971C 57                      push edi
:0041971D E900000000              jmp 00419722

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041971D(U)
|
:00419722 5F                      pop edi
:00419723 5E                      pop esi
:00419724 5B                      pop ebx
:00419725 C9                      leave
:00419726 C3                      ret



* Referenced by a CALL at Addresses:
|:00427F7A   , :0042804D   , :004281B6   , :0042B929   , :0042B95B   
|:0042BA0C   , :0042BA3C   , :0042BA96   
|
:00419727 55                      push ebp
:00419728 8BEC                    mov ebp, esp
:0041972A 83EC04                  sub esp, 00000004
:0041972D 53                      push ebx
:0041972E 56                      push esi
:0041972F 57                      push edi
:00419730 33C0                    xor eax, eax
:00419732 8A450C                  mov al, byte ptr [ebp+0C]
:00419735 83F82F                  cmp eax, 0000002F
:00419738 0F8C04000000            jl 00419742
:0041973E C6450CFF                mov [ebp+0C], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419738(C)
|
:00419742 33C0                    xor eax, eax
:00419744 8A450C                  mov al, byte ptr [ebp+0C]
:00419747 83F82D                  cmp eax, 0000002D
:0041974A 0F8D3B000000            jnl 0041978B
:00419750 33C0                    xor eax, eax
:00419752 8A450C                  mov al, byte ptr [ebp+0C]
:00419755 3DFF000000              cmp eax, 000000FF
:0041975A 0F842B000000            je 0041978B
:00419760 33C0                    xor eax, eax
:00419762 8A450C                  mov al, byte ptr [ebp+0C]
:00419765 8BC8                    mov ecx, eax
:00419767 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041976A C1E003                  shl eax, 03
:0041976D 2BC1                    sub eax, ecx
:0041976F 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00419775 E8B600FFFF              call 00409830
:0041977A 33C9                    xor ecx, ecx
:0041977C 8AC8                    mov cl, al
:0041977E 83F904                  cmp ecx, 00000004
:00419781 0F8504000000            jne 0041978B
:00419787 C6450CFF                mov [ebp+0C], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041974A(C), :0041975A(C), :00419781(C)
|
:0041978B 6A04                    push 00000004
:0041978D 6A00                    push 00000000
:0041978F 6A00                    push 00000000
:00419791 B950F94600              mov ecx, 0046F950
:00419796 E885DF0200              call 00447720
:0041979B 8945FC                  mov dword ptr [ebp-04], eax
:0041979E 8A450C                  mov al, byte ptr [ebp+0C]
:004197A1 8B4D08                  mov ecx, dword ptr [ebp+08]
:004197A4 33D2                    xor edx, edx
:004197A6 8A5101                  mov dl, byte ptr [ecx+01]
:004197A9 33C9                    xor ecx, ecx
:004197AB 8A0DC8FC4600            mov cl, byte ptr [0046FCC8]
:004197B1 0FAFD1                  imul edx, ecx
:004197B4 8B4D08                  mov ecx, dword ptr [ebp+08]
:004197B7 33DB                    xor ebx, ebx
:004197B9 8A19                    mov bl, byte ptr [ecx]
:004197BB 03D3                    add edx, ebx
:004197BD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004197C0 88840A80250000          mov byte ptr [edx+ecx+00002580], al
:004197C7 E900000000              jmp 004197CC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004197C7(U)
|
:004197CC 5F                      pop edi
:004197CD 5E                      pop esi
:004197CE 5B                      pop ebx
:004197CF C9                      leave
:004197D0 C3                      ret



* Referenced by a CALL at Addresses:
|:00402ED8   , :00408E78   , :0041A03D   , :0041A350   , :0041A783   
|:0041B5F0   , :0041BEC5   , :0042493D   , :0043CF7E   
|
:004197D1 55                      push ebp
:004197D2 8BEC                    mov ebp, esp
:004197D4 83EC18                  sub esp, 00000018
:004197D7 53                      push ebx
:004197D8 56                      push esi
:004197D9 57                      push edi
:004197DA 894DE8                  mov dword ptr [ebp-18], ecx
:004197DD C645FCFF                mov [ebp-04], FF
:004197E1 68FF000000              push 000000FF
:004197E6 68FF000000              push 000000FF
:004197EB 8D4DF4                  lea ecx, dword ptr [ebp-0C]
:004197EE E85D4A0000              call 0041E250
:004197F3 33C0                    xor eax, eax
:004197F5 8A4514                  mov al, byte ptr [ebp+14]
:004197F8 85C0                    test eax, eax
:004197FA 0F850A000000            jne 0041980A
:00419800 C705A8A6460008494500    mov dword ptr [0046A6A8], 00454908

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004197FA(C)
|
:0041980A 33C0                    xor eax, eax
:0041980C 8A450C                  mov al, byte ptr [ebp+0C]
:0041980F 3DFF000000              cmp eax, 000000FF
:00419814 0F8507000000            jne 00419821
:0041981A B0FF                    mov al, FF
:0041981C E995040000              jmp 00419CB6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419814(C)
|
:00419821 33C0                    xor eax, eax
:00419823 8A450C                  mov al, byte ptr [ebp+0C]
:00419826 2580000000              and eax, 00000080
:0041982B 8945EC                  mov dword ptr [ebp-14], eax
:0041982E 33C0                    xor eax, eax
:00419830 8A450C                  mov al, byte ptr [ebp+0C]
:00419833 247F                    and al, 7F
:00419835 88450C                  mov byte ptr [ebp+0C], al
:00419838 837DEC00                cmp dword ptr [ebp-14], 00000000
:0041983C 0F8403000000            je 00419845
:00419842 FE450C                  inc [ebp+0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041983C(C)
|
:00419845 33C0                    xor eax, eax
:00419847 8A4510                  mov al, byte ptr [ebp+10]
:0041984A A801                    test al, 01
:0041984C 0F8424000000            je 00419876
:00419852 8B4514                  mov eax, dword ptr [ebp+14]
:00419855 50                      push eax
:00419856 8B4510                  mov eax, dword ptr [ebp+10]
:00419859 50                      push eax
:0041985A 8B45E8                  mov eax, dword ptr [ebp-18]
:0041985D 8A4004                  mov al, byte ptr [eax+04]
:00419860 50                      push eax
:00419861 8B4508                  mov eax, dword ptr [ebp+08]
:00419864 8A4001                  mov al, byte ptr [eax+01]
:00419867 50                      push eax
:00419868 8B4508                  mov eax, dword ptr [ebp+08]
:0041986B 8A00                    mov al, byte ptr [eax]
:0041986D 50                      push eax
:0041986E E84A040000              call 00419CBD
:00419873 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041984C(C)
|
:00419876 33C0                    xor eax, eax
:00419878 8A450C                  mov al, byte ptr [ebp+0C]
:0041987B 83F801                  cmp eax, 00000001
:0041987E 0F8E0A000000            jle 0041988E
:00419884 837DEC00                cmp dword ptr [ebp-14], 00000000
:00419888 0F8467000000            je 004198F5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041987E(C)
|
:0041988E C645F000                mov [ebp-10], 00
:00419892 E903000000              jmp 0041989A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004198F0(U)
|
:00419897 FE45F0                  inc [ebp-10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419892(U)
|
:0041989A 33C0                    xor eax, eax
:0041989C 8A45F0                  mov al, byte ptr [ebp-10]
:0041989F 83F804                  cmp eax, 00000004
:004198A2 0F8D4D000000            jnl 004198F5
:004198A8 8B45F0                  mov eax, dword ptr [ebp-10]
:004198AB 50                      push eax
:004198AC 8B4508                  mov eax, dword ptr [ebp+08]
:004198AF 50                      push eax
:004198B0 E8A0FDFFFF              call 00419655
:004198B5 83C408                  add esp, 00000008
:004198B8 50                      push eax
:004198B9 8D4DF4                  lea ecx, dword ptr [ebp-0C]
:004198BC E8CF7FFEFF              call 00401890
:004198C1 33C0                    xor eax, eax
:004198C3 8A45F4                  mov al, byte ptr [ebp-0C]
:004198C6 3DFF000000              cmp eax, 000000FF
:004198CB 0F841F000000            je 004198F0
:004198D1 8B4514                  mov eax, dword ptr [ebp+14]
:004198D4 50                      push eax
:004198D5 8B4510                  mov eax, dword ptr [ebp+10]
:004198D8 50                      push eax
:004198D9 8B45E8                  mov eax, dword ptr [ebp-18]
:004198DC 8A4004                  mov al, byte ptr [eax+04]
:004198DF 50                      push eax
:004198E0 8B45F5                  mov eax, dword ptr [ebp-0B]
:004198E3 50                      push eax
:004198E4 8B45F4                  mov eax, dword ptr [ebp-0C]
:004198E7 50                      push eax
:004198E8 E8D0030000              call 00419CBD
:004198ED 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004198CB(C)
|
:004198F0 E9A2FFFFFF              jmp 00419897

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00419888(C), :004198A2(C)
|
:004198F5 33C0                    xor eax, eax
:004198F7 8A450C                  mov al, byte ptr [ebp+0C]
:004198FA 83F801                  cmp eax, 00000001
:004198FD 0F840A000000            je 0041990D
:00419903 837DEC00                cmp dword ptr [ebp-14], 00000000
:00419907 0F8471000000            je 0041997E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004198FD(C)
|
:0041990D 33C0                    xor eax, eax
:0041990F 8A450C                  mov al, byte ptr [ebp+0C]
:00419912 83F804                  cmp eax, 00000004
:00419915 0F8463000000            je 0041997E
:0041991B C645F000                mov [ebp-10], 00
:0041991F E903000000              jmp 00419927

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419979(U)
|
:00419924 FE45F0                  inc [ebp-10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041991F(U)
|
:00419927 33C0                    xor eax, eax
:00419929 8A45F0                  mov al, byte ptr [ebp-10]
:0041992C 83F804                  cmp eax, 00000004
:0041992F 0F8D49000000            jnl 0041997E
:00419935 8B4514                  mov eax, dword ptr [ebp+14]
:00419938 50                      push eax
:00419939 8B4510                  mov eax, dword ptr [ebp+10]
:0041993C 50                      push eax
:0041993D 8B45E8                  mov eax, dword ptr [ebp-18]
:00419940 8A4004                  mov al, byte ptr [eax+04]
:00419943 50                      push eax
:00419944 33C0                    xor eax, eax
:00419946 8A45F0                  mov al, byte ptr [ebp-10]
:00419949 8B04C5ACFB4400          mov eax, dword ptr [8*eax+0044FBAC]
:00419950 8B4D08                  mov ecx, dword ptr [ebp+08]
:00419953 33D2                    xor edx, edx
:00419955 8A5101                  mov dl, byte ptr [ecx+01]
:00419958 03C2                    add eax, edx
:0041995A 50                      push eax
:0041995B 33C0                    xor eax, eax
:0041995D 8A45F0                  mov al, byte ptr [ebp-10]
:00419960 8B04C5A8FB4400          mov eax, dword ptr [8*eax+0044FBA8]
:00419967 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041996A 33D2                    xor edx, edx
:0041996C 8A11                    mov dl, byte ptr [ecx]
:0041996E 03C2                    add eax, edx
:00419970 50                      push eax
:00419971 E847030000              call 00419CBD
:00419976 83C414                  add esp, 00000014
:00419979 E9A6FFFFFF              jmp 00419924

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00419907(C), :00419915(C), :0041992F(C)
|
:0041997E 33C0                    xor eax, eax
:00419980 8A450C                  mov al, byte ptr [ebp+0C]
:00419983 83F802                  cmp eax, 00000002
:00419986 0F8565000000            jne 004199F1
:0041998C C645F000                mov [ebp-10], 00
:00419990 E903000000              jmp 00419998

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004199EC(U)
|
:00419995 FE45F0                  inc [ebp-10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419990(U)
|
:00419998 33C0                    xor eax, eax
:0041999A 8A45F0                  mov al, byte ptr [ebp-10]
:0041999D 83F804                  cmp eax, 00000004
:004199A0 0F8D4B000000            jnl 004199F1
:004199A6 8B4514                  mov eax, dword ptr [ebp+14]
:004199A9 50                      push eax
:004199AA 8B4510                  mov eax, dword ptr [ebp+10]
:004199AD 50                      push eax
:004199AE 8B45E8                  mov eax, dword ptr [ebp-18]
:004199B1 8A4004                  mov al, byte ptr [eax+04]
:004199B4 50                      push eax
:004199B5 33C0                    xor eax, eax
:004199B7 8A45F0                  mov al, byte ptr [ebp-10]
:004199BA 8B04C5CCFB4400          mov eax, dword ptr [8*eax+0044FBCC]
:004199C1 8B4D08                  mov ecx, dword ptr [ebp+08]
:004199C4 33D2                    xor edx, edx
:004199C6 8A5101                  mov dl, byte ptr [ecx+01]
:004199C9 8D0442                  lea eax, dword ptr [edx+2*eax]
:004199CC 50                      push eax
:004199CD 33C0                    xor eax, eax
:004199CF 8A45F0                  mov al, byte ptr [ebp-10]
:004199D2 8B04C5C8FB4400          mov eax, dword ptr [8*eax+0044FBC8]
:004199D9 8B4D08                  mov ecx, dword ptr [ebp+08]
:004199DC 33D2                    xor edx, edx
:004199DE 8A11                    mov dl, byte ptr [ecx]
:004199E0 8D0442                  lea eax, dword ptr [edx+2*eax]
:004199E3 50                      push eax
:004199E4 E8D4020000              call 00419CBD
:004199E9 83C414                  add esp, 00000014
:004199EC E9A4FFFFFF              jmp 00419995

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00419986(C), :004199A0(C)
|
:004199F1 33C0                    xor eax, eax
:004199F3 8A450C                  mov al, byte ptr [ebp+0C]
:004199F6 83F803                  cmp eax, 00000003
:004199F9 0F850A010000            jne 00419B09
:004199FF C645F000                mov [ebp-10], 00
:00419A03 E903000000              jmp 00419A0B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419A7F(U)
|
:00419A08 FE45F0                  inc [ebp-10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419A03(U)
|
:00419A0B 33C0                    xor eax, eax
:00419A0D 8A45F0                  mov al, byte ptr [ebp-10]
:00419A10 83F803                  cmp eax, 00000003
:00419A13 0F8D6B000000            jnl 00419A84
:00419A19 8B4514                  mov eax, dword ptr [ebp+14]
:00419A1C 50                      push eax
:00419A1D 8B4510                  mov eax, dword ptr [ebp+10]
:00419A20 50                      push eax
:00419A21 8B45E8                  mov eax, dword ptr [ebp-18]
:00419A24 8A4004                  mov al, byte ptr [eax+04]
:00419A27 50                      push eax
:00419A28 8B4508                  mov eax, dword ptr [ebp+08]
:00419A2B 33C9                    xor ecx, ecx
:00419A2D 8A4801                  mov cl, byte ptr [eax+01]
:00419A30 83E902                  sub ecx, 00000002
:00419A33 51                      push ecx
:00419A34 8B4508                  mov eax, dword ptr [ebp+08]
:00419A37 33C9                    xor ecx, ecx
:00419A39 8A08                    mov cl, byte ptr [eax]
:00419A3B 49                      dec ecx
:00419A3C 33C0                    xor eax, eax
:00419A3E 8A45F0                  mov al, byte ptr [ebp-10]
:00419A41 03C8                    add ecx, eax
:00419A43 51                      push ecx
:00419A44 E874020000              call 00419CBD
:00419A49 83C414                  add esp, 00000014
:00419A4C 8B4514                  mov eax, dword ptr [ebp+14]
:00419A4F 50                      push eax
:00419A50 8B4510                  mov eax, dword ptr [ebp+10]
:00419A53 50                      push eax
:00419A54 8B45E8                  mov eax, dword ptr [ebp-18]
:00419A57 8A4004                  mov al, byte ptr [eax+04]
:00419A5A 50                      push eax
:00419A5B 8B4508                  mov eax, dword ptr [ebp+08]
:00419A5E 33C9                    xor ecx, ecx
:00419A60 8A4801                  mov cl, byte ptr [eax+01]
:00419A63 83C102                  add ecx, 00000002
:00419A66 51                      push ecx
:00419A67 8B4508                  mov eax, dword ptr [ebp+08]
:00419A6A 33C9                    xor ecx, ecx
:00419A6C 8A08                    mov cl, byte ptr [eax]
:00419A6E 49                      dec ecx
:00419A6F 33C0                    xor eax, eax
:00419A71 8A45F0                  mov al, byte ptr [ebp-10]
:00419A74 03C8                    add ecx, eax
:00419A76 51                      push ecx
:00419A77 E841020000              call 00419CBD
:00419A7C 83C414                  add esp, 00000014
:00419A7F E984FFFFFF              jmp 00419A08

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419A13(C)
|
:00419A84 C645F000                mov [ebp-10], 00
:00419A88 E903000000              jmp 00419A90

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419B04(U)
|
:00419A8D FE45F0                  inc [ebp-10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419A88(U)
|
:00419A90 33C0                    xor eax, eax
:00419A92 8A45F0                  mov al, byte ptr [ebp-10]
:00419A95 83F803                  cmp eax, 00000003
:00419A98 0F8D6B000000            jnl 00419B09
:00419A9E 8B4514                  mov eax, dword ptr [ebp+14]
:00419AA1 50                      push eax
:00419AA2 8B4510                  mov eax, dword ptr [ebp+10]
:00419AA5 50                      push eax
:00419AA6 8B45E8                  mov eax, dword ptr [ebp-18]
:00419AA9 8A4004                  mov al, byte ptr [eax+04]
:00419AAC 50                      push eax
:00419AAD 8B4508                  mov eax, dword ptr [ebp+08]
:00419AB0 33C9                    xor ecx, ecx
:00419AB2 8A4801                  mov cl, byte ptr [eax+01]
:00419AB5 49                      dec ecx
:00419AB6 33C0                    xor eax, eax
:00419AB8 8A45F0                  mov al, byte ptr [ebp-10]
:00419ABB 03C8                    add ecx, eax
:00419ABD 51                      push ecx
:00419ABE 8B4508                  mov eax, dword ptr [ebp+08]
:00419AC1 33C9                    xor ecx, ecx
:00419AC3 8A08                    mov cl, byte ptr [eax]
:00419AC5 83C102                  add ecx, 00000002
:00419AC8 51                      push ecx
:00419AC9 E8EF010000              call 00419CBD
:00419ACE 83C414                  add esp, 00000014
:00419AD1 8B4514                  mov eax, dword ptr [ebp+14]
:00419AD4 50                      push eax
:00419AD5 8B4510                  mov eax, dword ptr [ebp+10]
:00419AD8 50                      push eax
:00419AD9 8B45E8                  mov eax, dword ptr [ebp-18]
:00419ADC 8A4004                  mov al, byte ptr [eax+04]
:00419ADF 50                      push eax
:00419AE0 8B4508                  mov eax, dword ptr [ebp+08]
:00419AE3 33C9                    xor ecx, ecx
:00419AE5 8A4801                  mov cl, byte ptr [eax+01]
:00419AE8 49                      dec ecx
:00419AE9 33C0                    xor eax, eax
:00419AEB 8A45F0                  mov al, byte ptr [ebp-10]
:00419AEE 03C8                    add ecx, eax
:00419AF0 51                      push ecx
:00419AF1 8B4508                  mov eax, dword ptr [ebp+08]
:00419AF4 33C9                    xor ecx, ecx
:00419AF6 8A08                    mov cl, byte ptr [eax]
:00419AF8 83E902                  sub ecx, 00000002
:00419AFB 51                      push ecx
:00419AFC E8BC010000              call 00419CBD
:00419B01 83C414                  add esp, 00000014
:00419B04 E984FFFFFF              jmp 00419A8D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004199F9(C), :00419A98(C)
|
:00419B09 33C0                    xor eax, eax
:00419B0B 8A450C                  mov al, byte ptr [ebp+0C]
:00419B0E 83F804                  cmp eax, 00000004
:00419B11 0F851C010000            jne 00419C33
:00419B17 837DEC00                cmp dword ptr [ebp-14], 00000000
:00419B1B 0F8512010000            jne 00419C33
:00419B21 C645F000                mov [ebp-10], 00
:00419B25 E903000000              jmp 00419B2D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419BA5(U)
|
:00419B2A FE45F0                  inc [ebp-10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419B25(U)
|
:00419B2D 33C0                    xor eax, eax
:00419B2F 8A45F0                  mov al, byte ptr [ebp-10]
:00419B32 83F805                  cmp eax, 00000005
:00419B35 0F8D6F000000            jnl 00419BAA
:00419B3B 8B4514                  mov eax, dword ptr [ebp+14]
:00419B3E 50                      push eax
:00419B3F 8B4510                  mov eax, dword ptr [ebp+10]
:00419B42 50                      push eax
:00419B43 8B45E8                  mov eax, dword ptr [ebp-18]
:00419B46 8A4004                  mov al, byte ptr [eax+04]
:00419B49 50                      push eax
:00419B4A 8B4508                  mov eax, dword ptr [ebp+08]
:00419B4D 33C9                    xor ecx, ecx
:00419B4F 8A4801                  mov cl, byte ptr [eax+01]
:00419B52 83E903                  sub ecx, 00000003
:00419B55 51                      push ecx
:00419B56 8B4508                  mov eax, dword ptr [ebp+08]
:00419B59 33C9                    xor ecx, ecx
:00419B5B 8A08                    mov cl, byte ptr [eax]
:00419B5D 83E902                  sub ecx, 00000002
:00419B60 33C0                    xor eax, eax
:00419B62 8A45F0                  mov al, byte ptr [ebp-10]
:00419B65 03C8                    add ecx, eax
:00419B67 51                      push ecx
:00419B68 E850010000              call 00419CBD
:00419B6D 83C414                  add esp, 00000014
:00419B70 8B4514                  mov eax, dword ptr [ebp+14]
:00419B73 50                      push eax
:00419B74 8B4510                  mov eax, dword ptr [ebp+10]
:00419B77 50                      push eax
:00419B78 8B45E8                  mov eax, dword ptr [ebp-18]
:00419B7B 8A4004                  mov al, byte ptr [eax+04]
:00419B7E 50                      push eax
:00419B7F 8B4508                  mov eax, dword ptr [ebp+08]
:00419B82 33C9                    xor ecx, ecx
:00419B84 8A4801                  mov cl, byte ptr [eax+01]
:00419B87 83C103                  add ecx, 00000003
:00419B8A 51                      push ecx
:00419B8B 8B4508                  mov eax, dword ptr [ebp+08]
:00419B8E 33C9                    xor ecx, ecx
:00419B90 8A08                    mov cl, byte ptr [eax]
:00419B92 83E902                  sub ecx, 00000002
:00419B95 33C0                    xor eax, eax
:00419B97 8A45F0                  mov al, byte ptr [ebp-10]
:00419B9A 03C8                    add ecx, eax
:00419B9C 51                      push ecx
:00419B9D E81B010000              call 00419CBD
:00419BA2 83C414                  add esp, 00000014
:00419BA5 E980FFFFFF              jmp 00419B2A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419B35(C)
|
:00419BAA C645F000                mov [ebp-10], 00
:00419BAE E903000000              jmp 00419BB6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419C2E(U)
|
:00419BB3 FE45F0                  inc [ebp-10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419BAE(U)
|
:00419BB6 33C0                    xor eax, eax
:00419BB8 8A45F0                  mov al, byte ptr [ebp-10]
:00419BBB 83F805                  cmp eax, 00000005
:00419BBE 0F8D6F000000            jnl 00419C33
:00419BC4 8B4514                  mov eax, dword ptr [ebp+14]
:00419BC7 50                      push eax
:00419BC8 8B4510                  mov eax, dword ptr [ebp+10]
:00419BCB 50                      push eax
:00419BCC 8B45E8                  mov eax, dword ptr [ebp-18]
:00419BCF 8A4004                  mov al, byte ptr [eax+04]
:00419BD2 50                      push eax
:00419BD3 8B4508                  mov eax, dword ptr [ebp+08]
:00419BD6 33C9                    xor ecx, ecx
:00419BD8 8A4801                  mov cl, byte ptr [eax+01]
:00419BDB 83E902                  sub ecx, 00000002
:00419BDE 33C0                    xor eax, eax
:00419BE0 8A45F0                  mov al, byte ptr [ebp-10]
:00419BE3 03C8                    add ecx, eax
:00419BE5 51                      push ecx
:00419BE6 8B4508                  mov eax, dword ptr [ebp+08]
:00419BE9 33C9                    xor ecx, ecx
:00419BEB 8A08                    mov cl, byte ptr [eax]
:00419BED 83E903                  sub ecx, 00000003
:00419BF0 51                      push ecx
:00419BF1 E8C7000000              call 00419CBD
:00419BF6 83C414                  add esp, 00000014
:00419BF9 8B4514                  mov eax, dword ptr [ebp+14]
:00419BFC 50                      push eax
:00419BFD 8B4510                  mov eax, dword ptr [ebp+10]
:00419C00 50                      push eax
:00419C01 8B45E8                  mov eax, dword ptr [ebp-18]
:00419C04 8A4004                  mov al, byte ptr [eax+04]
:00419C07 50                      push eax
:00419C08 8B4508                  mov eax, dword ptr [ebp+08]
:00419C0B 33C9                    xor ecx, ecx
:00419C0D 8A4801                  mov cl, byte ptr [eax+01]
:00419C10 83E902                  sub ecx, 00000002
:00419C13 33C0                    xor eax, eax
:00419C15 8A45F0                  mov al, byte ptr [ebp-10]
:00419C18 03C8                    add ecx, eax
:00419C1A 51                      push ecx
:00419C1B 8B4508                  mov eax, dword ptr [ebp+08]
:00419C1E 33C9                    xor ecx, ecx
:00419C20 8A08                    mov cl, byte ptr [eax]
:00419C22 83C103                  add ecx, 00000003
:00419C25 51                      push ecx
:00419C26 E892000000              call 00419CBD
:00419C2B 83C414                  add esp, 00000014
:00419C2E E980FFFFFF              jmp 00419BB3

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00419B11(C), :00419B1B(C), :00419BBE(C)
|
:00419C33 33C0                    xor eax, eax
:00419C35 8A4514                  mov al, byte ptr [ebp+14]
:00419C38 85C0                    test eax, eax
:00419C3A 0F8407000000            je 00419C47
:00419C40 B0FF                    mov al, FF
:00419C42 E96F000000              jmp 00419CB6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419C3A(C)
|
:00419C47 A1A8A64600              mov eax, dword ptr [0046A6A8]
:00419C4C C600FF                  mov byte ptr [eax], FF
:00419C4F FF05A8A64600            inc dword ptr [0046A6A8]
:00419C55 C745F808494500          mov [ebp-08], 00454908
:00419C5C E903000000              jmp 00419C64

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419CA9(U)
|
:00419C61 FF45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419C5C(U)
|
:00419C64 8B45F8                  mov eax, dword ptr [ebp-08]
:00419C67 33C9                    xor ecx, ecx
:00419C69 8A08                    mov cl, byte ptr [eax]
:00419C6B 81F9FF000000            cmp ecx, 000000FF
:00419C71 0F8437000000            je 00419CAE
:00419C77 8B45F8                  mov eax, dword ptr [ebp-08]
:00419C7A 8A00                    mov al, byte ptr [eax]
:00419C7C 8845FC                  mov byte ptr [ebp-04], al
:00419C7F 33C0                    xor eax, eax
:00419C81 8A45FC                  mov al, byte ptr [ebp-04]
:00419C84 3DFF000000              cmp eax, 000000FF
:00419C89 0F841A000000            je 00419CA9
:00419C8F 33C0                    xor eax, eax
:00419C91 8A45FC                  mov al, byte ptr [ebp-04]
:00419C94 33C9                    xor ecx, ecx
:00419C96 8A0DBCA64600            mov cl, byte ptr [0046A6BC]
:00419C9C 3BC1                    cmp eax, ecx
:00419C9E 0F8505000000            jne 00419CA9
:00419CA4 E905000000              jmp 00419CAE

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00419C89(C), :00419C9E(C)
|
:00419CA9 E9B3FFFFFF              jmp 00419C61

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00419C71(C), :00419CA4(U)
|
:00419CAE 8A45FC                  mov al, byte ptr [ebp-04]
:00419CB1 E900000000              jmp 00419CB6

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041981C(U), :00419C42(U), :00419CB1(U)
|
:00419CB6 5F                      pop edi
:00419CB7 5E                      pop esi
:00419CB8 5B                      pop ebx
:00419CB9 C9                      leave
:00419CBA C21000                  ret 0010



* Referenced by a CALL at Addresses:
|:0041986E   , :004198E8   , :00419971   , :004199E4   , :00419A44   
|:00419A77   , :00419AC9   , :00419AFC   , :00419B68   , :00419B9D   
|:00419BF1   , :00419C26   
|
:00419CBD 55                      push ebp
:00419CBE 8BEC                    mov ebp, esp
:00419CC0 83EC1C                  sub esp, 0000001C
:00419CC3 53                      push ebx
:00419CC4 56                      push esi
:00419CC5 57                      push edi
:00419CC6 33C0                    xor eax, eax
:00419CC8 A0C8FC4600              mov al, byte ptr [0046FCC8]
:00419CCD 33C9                    xor ecx, ecx
:00419CCF 8A4D08                  mov cl, byte ptr [ebp+08]
:00419CD2 3BC1                    cmp eax, ecx
:00419CD4 0F8EC9010000            jle 00419EA3
:00419CDA 33C0                    xor eax, eax
:00419CDC A0C9FC4600              mov al, byte ptr [0046FCC9]
:00419CE1 33C9                    xor ecx, ecx
:00419CE3 8A4D0C                  mov cl, byte ptr [ebp+0C]
:00419CE6 3BC1                    cmp eax, ecx
:00419CE8 0F8EB5010000            jle 00419EA3
:00419CEE 33C0                    xor eax, eax
:00419CF0 8A4514                  mov al, byte ptr [ebp+14]
:00419CF3 A880                    test al, 80
:00419CF5 0F856A000000            jne 00419D65
:00419CFB 6A04                    push 00000004
:00419CFD 6A00                    push 00000000
:00419CFF 6A00                    push 00000000
:00419D01 B950F94600              mov ecx, 0046F950
:00419D06 E815DA0200              call 00447720
:00419D0B 8945EC                  mov dword ptr [ebp-14], eax
:00419D0E 8A4510                  mov al, byte ptr [ebp+10]
:00419D11 33C9                    xor ecx, ecx
:00419D13 8A0DC8FC4600            mov cl, byte ptr [0046FCC8]
:00419D19 33D2                    xor edx, edx
:00419D1B 8A550C                  mov dl, byte ptr [ebp+0C]
:00419D1E 0FAFCA                  imul ecx, edx
:00419D21 33D2                    xor edx, edx
:00419D23 8A5508                  mov dl, byte ptr [ebp+08]
:00419D26 03CA                    add ecx, edx
:00419D28 8B55EC                  mov edx, dword ptr [ebp-14]
:00419D2B 888411E82C0000          mov byte ptr [ecx+edx+00002CE8], al
:00419D32 6A04                    push 00000004
:00419D34 6A00                    push 00000000
:00419D36 6A00                    push 00000000
:00419D38 B918E54600              mov ecx, 0046E518
:00419D3D E8DED90200              call 00447720
:00419D42 8945E8                  mov dword ptr [ebp-18], eax
:00419D45 8A4510                  mov al, byte ptr [ebp+10]
:00419D48 33C9                    xor ecx, ecx
:00419D4A 8A0DC8FC4600            mov cl, byte ptr [0046FCC8]
:00419D50 33D2                    xor edx, edx
:00419D52 8A550C                  mov dl, byte ptr [ebp+0C]
:00419D55 0FAFCA                  imul ecx, edx
:00419D58 33D2                    xor edx, edx
:00419D5A 8A5508                  mov dl, byte ptr [ebp+08]
:00419D5D 03CA                    add ecx, edx
:00419D5F 8B55E8                  mov edx, dword ptr [ebp-18]
:00419D62 880411                  mov byte ptr [ecx+edx], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419CF5(C)
|
:00419D65 33C0                    xor eax, eax
:00419D67 8A4518                  mov al, byte ptr [ebp+18]
:00419D6A 85C0                    test eax, eax
:00419D6C 0F8438000000            je 00419DAA
:00419D72 6A04                    push 00000004
:00419D74 6A00                    push 00000000
:00419D76 6880070000              push 00000780
:00419D7B B918E54600              mov ecx, 0046E518
:00419D80 E89BD90200              call 00447720
:00419D85 8945E4                  mov dword ptr [ebp-1C], eax
:00419D88 33C0                    xor eax, eax
:00419D8A A0C8FC4600              mov al, byte ptr [0046FCC8]
:00419D8F 33C9                    xor ecx, ecx
:00419D91 8A4D0C                  mov cl, byte ptr [ebp+0C]
:00419D94 0FAFC1                  imul eax, ecx
:00419D97 33C9                    xor ecx, ecx
:00419D99 8A4D08                  mov cl, byte ptr [ebp+08]
:00419D9C 03C1                    add eax, ecx
:00419D9E 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00419DA1 C6040801                mov byte ptr [eax+ecx], 01
:00419DA5 E9FE000000              jmp 00419EA8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419D6C(C)
|
:00419DAA 8B450C                  mov eax, dword ptr [ebp+0C]
:00419DAD 50                      push eax
:00419DAE 8B4508                  mov eax, dword ptr [ebp+08]
:00419DB1 50                      push eax
:00419DB2 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00419DB5 E896440000              call 0041E250
:00419DBA 8D45FC                  lea eax, dword ptr [ebp-04]
:00419DBD 50                      push eax
:00419DBE E87AF7FFFF              call 0041953D
:00419DC3 83C404                  add esp, 00000004
:00419DC6 8845F8                  mov byte ptr [ebp-08], al
:00419DC9 33C0                    xor eax, eax
:00419DCB 8A45F8                  mov al, byte ptr [ebp-08]
:00419DCE 3DFF000000              cmp eax, 000000FF
:00419DD3 0F84CA000000            je 00419EA3
:00419DD9 33C0                    xor eax, eax
:00419DDB 8A4510                  mov al, byte ptr [ebp+10]
:00419DDE 8BC8                    mov ecx, eax
:00419DE0 8D0440                  lea eax, dword ptr [eax+2*eax]
:00419DE3 C1E003                  shl eax, 03
:00419DE6 2BC1                    sub eax, ecx
:00419DE8 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00419DEE E82DF4FEFF              call 00409220
:00419DF3 8945F0                  mov dword ptr [ebp-10], eax
:00419DF6 33C0                    xor eax, eax
:00419DF8 8A45F8                  mov al, byte ptr [ebp-08]
:00419DFB 8BC8                    mov ecx, eax
:00419DFD 8D0440                  lea eax, dword ptr [eax+2*eax]
:00419E00 C1E003                  shl eax, 03
:00419E03 2BC1                    sub eax, ecx
:00419E05 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00419E0B E810F4FEFF              call 00409220
:00419E10 8945F4                  mov dword ptr [ebp-0C], eax
:00419E13 33C0                    xor eax, eax
:00419E15 8A4514                  mov al, byte ptr [ebp+14]
:00419E18 A801                    test al, 01
:00419E1A 0F8444000000            je 00419E64
:00419E20 8B45F0                  mov eax, dword ptr [ebp-10]
:00419E23 3945F4                  cmp dword ptr [ebp-0C], eax
:00419E26 0F8533000000            jne 00419E5F
:00419E2C 33C0                    xor eax, eax
:00419E2E 8A45F8                  mov al, byte ptr [ebp-08]
:00419E31 8BC8                    mov ecx, eax
:00419E33 8D0440                  lea eax, dword ptr [eax+2*eax]
:00419E36 C1E003                  shl eax, 03
:00419E39 2BC1                    sub eax, ecx
:00419E3B 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00419E41 E840400100              call 0042DE86
:00419E46 85C0                    test eax, eax
:00419E48 0F8411000000            je 00419E5F
:00419E4E 8A45F8                  mov al, byte ptr [ebp-08]
:00419E51 8B0DA8A64600            mov ecx, dword ptr [0046A6A8]
:00419E57 8801                    mov byte ptr [ecx], al
:00419E59 FF05A8A64600            inc dword ptr [0046A6A8]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00419E26(C), :00419E48(C)
|
:00419E5F E93F000000              jmp 00419EA3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419E1A(C)
|
:00419E64 8B45F0                  mov eax, dword ptr [ebp-10]
:00419E67 3945F4                  cmp dword ptr [ebp-0C], eax
:00419E6A 0F8433000000            je 00419EA3
:00419E70 33C0                    xor eax, eax
:00419E72 8A45F8                  mov al, byte ptr [ebp-08]
:00419E75 8BC8                    mov ecx, eax
:00419E77 8D0440                  lea eax, dword ptr [eax+2*eax]
:00419E7A C1E003                  shl eax, 03
:00419E7D 2BC1                    sub eax, ecx
:00419E7F 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00419E85 E8FC3F0100              call 0042DE86
:00419E8A 85C0                    test eax, eax
:00419E8C 0F8411000000            je 00419EA3
:00419E92 8A45F8                  mov al, byte ptr [ebp-08]
:00419E95 8B0DA8A64600            mov ecx, dword ptr [0046A6A8]
:00419E9B 8801                    mov byte ptr [ecx], al
:00419E9D FF05A8A64600            inc dword ptr [0046A6A8]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00419CD4(C), :00419CE8(C), :00419DD3(C), :00419E5F(U), :00419E6A(C)
|:00419E8C(C)
|
:00419EA3 E900000000              jmp 00419EA8

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00419DA5(U), :00419EA3(U)
|
:00419EA8 5F                      pop edi
:00419EA9 5E                      pop esi
:00419EAA 5B                      pop ebx
:00419EAB C9                      leave
:00419EAC C3                      ret



* Referenced by a CALL at Addresses:
|:0041A07D   , :00442733   
|
:00419EAD 55                      push ebp
:00419EAE 8BEC                    mov ebp, esp
:00419EB0 83EC0C                  sub esp, 0000000C
:00419EB3 53                      push ebx
:00419EB4 56                      push esi
:00419EB5 57                      push edi
:00419EB6 894DF4                  mov dword ptr [ebp-0C], ecx
:00419EB9 8B45F4                  mov eax, dword ptr [ebp-0C]
:00419EBC 8B00                    mov eax, dword ptr [eax]
:00419EBE 8D0440                  lea eax, dword ptr [eax+2*eax]
:00419EC1 03C0                    add eax, eax
:00419EC3 8D04C0                  lea eax, dword ptr [eax+8*eax]
:00419EC6 05E8564500              add eax, 004556E8
:00419ECB 8945F8                  mov dword ptr [ebp-08], eax
:00419ECE 8B45F4                  mov eax, dword ptr [ebp-0C]
:00419ED1 83780F00                cmp dword ptr [eax+0F], 00000000
:00419ED5 0F8507000000            jne 00419EE2
:00419EDB 33C0                    xor eax, eax
:00419EDD E95E000000              jmp 00419F40

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419ED5(C)
|
:00419EE2 8B45F4                  mov eax, dword ptr [ebp-0C]
:00419EE5 8138EB000000            cmp dword ptr [eax], 000000EB
:00419EEB 0F8619000000            jbe 00419F0A
:00419EF1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00419EF4 E897F8FEFF              call 00409790
:00419EF9 B905000000              mov ecx, 00000005
:00419EFE 2BD2                    sub edx, edx
:00419F00 F7F1                    div ecx
:00419F02 8945FC                  mov dword ptr [ebp-04], eax
:00419F05 E916000000              jmp 00419F20

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419EEB(C)
|
:00419F0A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00419F0D E87EF8FEFF              call 00409790
:00419F12 B905000000              mov ecx, 00000005
:00419F17 2BD2                    sub edx, edx
:00419F19 F7F1                    div ecx
:00419F1B 03C0                    add eax, eax
:00419F1D 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419F05(U)
|
:00419F20 8B45F4                  mov eax, dword ptr [ebp-0C]
:00419F23 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00419F26 39480F                  cmp dword ptr [eax+0F], ecx
:00419F29 0F870A000000            ja 00419F39
:00419F2F B801000000              mov eax, 00000001
:00419F34 E902000000              jmp 00419F3B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419F29(C)
|
:00419F39 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419F34(U)
|
:00419F3B E900000000              jmp 00419F40

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00419EDD(U), :00419F3B(U)
|
:00419F40 5F                      pop edi
:00419F41 5E                      pop esi
:00419F42 5B                      pop ebx
:00419F43 C9                      leave
:00419F44 C3                      ret



* Referenced by a CALL at Address:
|:0041B7DE   
|
:00419F45 55                      push ebp
:00419F46 8BEC                    mov ebp, esp
:00419F48 83EC20                  sub esp, 00000020
:00419F4B 53                      push ebx
:00419F4C 56                      push esi
:00419F4D 57                      push edi
:00419F4E 894DE0                  mov dword ptr [ebp-20], ecx
:00419F51 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00419F54 E815040100              call 0042A36E
:00419F59 8845FC                  mov byte ptr [ebp-04], al
:00419F5C C605C4A6460000          mov byte ptr [0046A6C4], 00
:00419F63 68FF000000              push 000000FF
:00419F68 33C0                    xor eax, eax
:00419F6A A0C8FC4600              mov al, byte ptr [0046FCC8]
:00419F6F 33C9                    xor ecx, ecx
:00419F71 8A0DC9FC4600            mov cl, byte ptr [0046FCC9]
:00419F77 0FAFC1                  imul eax, ecx
:00419F7A 50                      push eax
:00419F7B B918E54600              mov ecx, 0046E518
:00419F80 E85BF1FEFF              call 004090E0
:00419F85 50                      push eax
:00419F86 E8D8D40200              call 00447463
:00419F8B 83C40C                  add esp, 0000000C
:00419F8E C645F800                mov [ebp-08], 00
:00419F92 E903000000              jmp 00419F9A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A042(U)
|
:00419F97 FE45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419F92(U)
|
:00419F9A 33C0                    xor eax, eax
:00419F9C 8A45F8                  mov al, byte ptr [ebp-08]
:00419F9F 83F82D                  cmp eax, 0000002D
:00419FA2 0F8D9F000000            jnl 0041A047
:00419FA8 33C0                    xor eax, eax
:00419FAA 8A45F8                  mov al, byte ptr [ebp-08]
:00419FAD 8BC8                    mov ecx, eax
:00419FAF 8D0440                  lea eax, dword ptr [eax+2*eax]
:00419FB2 C1E003                  shl eax, 03
:00419FB5 2BC1                    sub eax, ecx
:00419FB7 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00419FBD E85EF2FEFF              call 00409220
:00419FC2 8BD8                    mov ebx, eax
:00419FC4 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00419FC7 E854F2FEFF              call 00409220
:00419FCC 3BD8                    cmp ebx, eax
:00419FCE 0F846E000000            je 0041A042
:00419FD4 33C0                    xor eax, eax
:00419FD6 8A45F8                  mov al, byte ptr [ebp-08]
:00419FD9 8BC8                    mov ecx, eax
:00419FDB 8D0440                  lea eax, dword ptr [eax+2*eax]
:00419FDE C1E003                  shl eax, 03
:00419FE1 2BC1                    sub eax, ecx
:00419FE3 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00419FE9 E842F8FEFF              call 00409830
:00419FEE 33C9                    xor ecx, ecx
:00419FF0 8AC8                    mov cl, al
:00419FF2 83F902                  cmp ecx, 00000002
:00419FF5 0F8547000000            jne 0041A042
:00419FFB 33C0                    xor eax, eax
:00419FFD 8A45F8                  mov al, byte ptr [ebp-08]
:0041A000 8BC8                    mov ecx, eax
:0041A002 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041A005 C1E003                  shl eax, 03
:0041A008 2BC1                    sub eax, ecx
:0041A00A 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041A010 E8EBF1FEFF              call 00409200
:0041A015 668B00                  mov ax, word ptr [eax]
:0041A018 668945F4                mov word ptr [ebp-0C], ax
:0041A01C 6A00                    push 00000000
:0041A01E 6A00                    push 00000000
:0041A020 8B45FC                  mov eax, dword ptr [ebp-04]
:0041A023 50                      push eax
:0041A024 8D45F4                  lea eax, dword ptr [ebp-0C]
:0041A027 50                      push eax
:0041A028 33C0                    xor eax, eax
:0041A02A 8A45F8                  mov al, byte ptr [ebp-08]
:0041A02D 8BC8                    mov ecx, eax
:0041A02F 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041A032 C1E003                  shl eax, 03
:0041A035 2BC1                    sub eax, ecx
:0041A037 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041A03D E88FF7FFFF              call 004197D1

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00419FCE(C), :00419FF5(C)
|
:0041A042 E950FFFFFF              jmp 00419F97

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419FA2(C)
|
:0041A047 6A00                    push 00000000
:0041A049 33C0                    xor eax, eax
:0041A04B A0C8FC4600              mov al, byte ptr [0046FCC8]
:0041A050 33C9                    xor ecx, ecx
:0041A052 8A0DC9FC4600            mov cl, byte ptr [0046FCC9]
:0041A058 0FAFC1                  imul eax, ecx
:0041A05B 50                      push eax
:0041A05C 6A04                    push 00000004
:0041A05E 6A00                    push 00000000
:0041A060 6A00                    push 00000000
:0041A062 B918E54600              mov ecx, 0046E518
:0041A067 E8B4D60200              call 00447720
:0041A06C 05C0030000              add eax, 000003C0
:0041A071 50                      push eax
:0041A072 E8ECD30200              call 00447463
:0041A077 83C40C                  add esp, 0000000C
:0041A07A 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0041A07D E82BFEFFFF              call 00419EAD
:0041A082 85C0                    test eax, eax
:0041A084 0F84DB000000            je 0041A165
:0041A08A 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0041A08D E83EF3FEFF              call 004093D0
:0041A092 33C9                    xor ecx, ecx
:0041A094 8AC8                    mov cl, al
:0041A096 83F902                  cmp ecx, 00000002
:0041A099 0F84C6000000            je 0041A165
:0041A09F 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041A0A2 E8C977FEFF              call 00401870
:0041A0A7 C745EC00000000          mov [ebp-14], 00000000
:0041A0AE E903000000              jmp 0041A0B6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A152(U)
|
:0041A0B3 FF45EC                  inc [ebp-14]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A0AE(U)
|
:0041A0B6 33C0                    xor eax, eax
:0041A0B8 A0C9FC4600              mov al, byte ptr [0046FCC9]
:0041A0BD 3B45EC                  cmp eax, dword ptr [ebp-14]
:0041A0C0 0F8691000000            jbe 0041A157
:0041A0C6 C745E800000000          mov [ebp-18], 00000000
:0041A0CD E903000000              jmp 0041A0D5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A14D(U)
|
:0041A0D2 FF45E8                  inc [ebp-18]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A0CD(U)
|
:0041A0D5 33C0                    xor eax, eax
:0041A0D7 A0C8FC4600              mov al, byte ptr [0046FCC8]
:0041A0DC 3B45E8                  cmp eax, dword ptr [ebp-18]
:0041A0DF 0F866D000000            jbe 0041A152
:0041A0E5 8A45E8                  mov al, byte ptr [ebp-18]
:0041A0E8 8845F0                  mov byte ptr [ebp-10], al
:0041A0EB 8A45EC                  mov al, byte ptr [ebp-14]
:0041A0EE 8845F1                  mov byte ptr [ebp-0F], al
:0041A0F1 8D45F0                  lea eax, dword ptr [ebp-10]
:0041A0F4 50                      push eax
:0041A0F5 E8B4F0FFFF              call 004191AE
:0041A0FA 83C404                  add esp, 00000004
:0041A0FD 85C0                    test eax, eax
:0041A0FF 0F8448000000            je 0041A14D
:0041A105 6A04                    push 00000004
:0041A107 6A00                    push 00000000
:0041A109 6A00                    push 00000000
:0041A10B B918E54600              mov ecx, 0046E518
:0041A110 E80BD60200              call 00447720
:0041A115 8945E4                  mov dword ptr [ebp-1C], eax
:0041A118 33C0                    xor eax, eax
:0041A11A A0C8FC4600              mov al, byte ptr [0046FCC8]
:0041A11F 0FAF45EC                imul eax, dword ptr [ebp-14]
:0041A123 0345E8                  add eax, dword ptr [ebp-18]
:0041A126 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0041A129 33D2                    xor edx, edx
:0041A12B 8A9408C0030000          mov dl, byte ptr [eax+ecx+000003C0]
:0041A132 83C232                  add edx, 00000032
:0041A135 33C0                    xor eax, eax
:0041A137 A0C8FC4600              mov al, byte ptr [0046FCC8]
:0041A13C 0FAF45EC                imul eax, dword ptr [ebp-14]
:0041A140 0345E8                  add eax, dword ptr [ebp-18]
:0041A143 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0041A146 889408C0030000          mov byte ptr [eax+ecx+000003C0], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A0FF(C)
|
:0041A14D E980FFFFFF              jmp 0041A0D2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A0DF(C)
|
:0041A152 E95CFFFFFF              jmp 0041A0B3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A0C0(C)
|
:0041A157 33C0                    xor eax, eax
:0041A159 A0C4A64600              mov al, byte ptr [0046A6C4]
:0041A15E 0C01                    or al, 01
:0041A160 A2C4A64600              mov byte ptr [0046A6C4], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041A084(C), :0041A099(C)
|
:0041A165 C605C0A6460000          mov byte ptr [0046A6C0], 00
:0041A16C C605BCA64600FF          mov byte ptr [0046A6BC], FF
:0041A173 C605B0A64600FF          mov byte ptr [0046A6B0], FF
:0041A17A C605C8A64600FF          mov byte ptr [0046A6C8], FF
:0041A181 E900000000              jmp 0041A186

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A181(U)
|
:0041A186 5F                      pop edi
:0041A187 5E                      pop esi
:0041A188 5B                      pop ebx
:0041A189 C9                      leave
:0041A18A C20400                  ret 0004


:0041A18D 55                      push ebp
:0041A18E 8BEC                    mov ebp, esp
:0041A190 83EC18                  sub esp, 00000018
:0041A193 53                      push ebx
:0041A194 56                      push esi
:0041A195 57                      push edi
:0041A196 894DE8                  mov dword ptr [ebp-18], ecx
:0041A199 8D4DF8                  lea ecx, dword ptr [ebp-08]
:0041A19C E8CF76FEFF              call 00401870
:0041A1A1 C645EC00                mov [ebp-14], 00
:0041A1A5 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0041A1A8 E883F6FEFF              call 00409830
:0041A1AD 33C9                    xor ecx, ecx
:0041A1AF 8AC8                    mov cl, al
:0041A1B1 83F902                  cmp ecx, 00000002
:0041A1B4 0F852E000000            jne 0041A1E8
:0041A1BA 33C0                    xor eax, eax
:0041A1BC A0B0A64600              mov al, byte ptr [0046A6B0]
:0041A1C1 3DFF000000              cmp eax, 000000FF
:0041A1C6 0F841C000000            je 0041A1E8
:0041A1CC 8B45E8                  mov eax, dword ptr [ebp-18]
:0041A1CF 83C005                  add eax, 00000005
:0041A1D2 50                      push eax
:0041A1D3 68B0A64600              push 0046A6B0
:0041A1D8 E8A3400000              call 0041E280
:0041A1DD 83C408                  add esp, 00000008
:0041A1E0 85C0                    test eax, eax
:0041A1E2 0F8405000000            je 0041A1ED

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041A1B4(C), :0041A1C6(C)
|
:0041A1E8 E926010000              jmp 0041A313

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A1E2(C)
|
:0041A1ED 6A00                    push 00000000
:0041A1EF 68FF000000              push 000000FF
:0041A1F4 68B0A64600              push 0046A6B0
:0041A1F9 8B45E8                  mov eax, dword ptr [ebp-18]
:0041A1FC 83C005                  add eax, 00000005
:0041A1FF 50                      push eax
:0041A200 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0041A203 E83B080000              call 0041AA43
:0041A208 8945FC                  mov dword ptr [ebp-04], eax
:0041A20B 8B45FC                  mov eax, dword ptr [ebp-04]
:0041A20E 33C9                    xor ecx, ecx
:0041A210 8A08                    mov cl, byte ptr [eax]
:0041A212 81F9FF000000            cmp ecx, 000000FF
:0041A218 0F8505000000            jne 0041A223
:0041A21E E9F0000000              jmp 0041A313

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A218(C)
|
:0041A223 6A00                    push 00000000
:0041A225 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0041A228 E83E260100              call 0042C86B
:0041A22D 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0041A230 E80E170100              call 0042B943
:0041A235 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0041A238 E8493C0100              call 0042DE86
:0041A23D 85C0                    test eax, eax
:0041A23F 0F850C000000            jne 0041A251
:0041A245 6A0B                    push 0000000B
:0041A247 B994A64600              mov ecx, 0046A694
:0041A24C E8D3EDFFFF              call 00419024

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A23F(C)
|
:0041A251 C745F400000000          mov [ebp-0C], 00000000
:0041A258 E903000000              jmp 0041A260

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041A2B4(U), :0041A2F7(U)
|
:0041A25D FF45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A258(U)
|
:0041A260 8B45E8                  mov eax, dword ptr [ebp-18]
:0041A263 83C005                  add eax, 00000005
:0041A266 50                      push eax
:0041A267 68B0A64600              push 0046A6B0
:0041A26C E80F400000              call 0041E280
:0041A271 83C408                  add esp, 00000008
:0041A274 85C0                    test eax, eax
:0041A276 0F8580000000            jne 0041A2FC
:0041A27C 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041A27F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041A282 8A0408                  mov al, byte ptr [eax+ecx]
:0041A285 8845F0                  mov byte ptr [ebp-10], al
:0041A288 8B45F0                  mov eax, dword ptr [ebp-10]
:0041A28B 50                      push eax
:0041A28C 8B45E8                  mov eax, dword ptr [ebp-18]
:0041A28F 83C005                  add eax, 00000005
:0041A292 50                      push eax
:0041A293 E8BDF3FFFF              call 00419655
:0041A298 83C408                  add esp, 00000008
:0041A29B 50                      push eax
:0041A29C 8D4DF8                  lea ecx, dword ptr [ebp-08]
:0041A29F E8EC75FEFF              call 00401890
:0041A2A4 33C0                    xor eax, eax
:0041A2A6 8A45F8                  mov al, byte ptr [ebp-08]
:0041A2A9 3DFF000000              cmp eax, 000000FF
:0041A2AE 0F8505000000            jne 0041A2B9
:0041A2B4 E9A4FFFFFF              jmp 0041A25D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A2AE(C)
|
:0041A2B9 8B45F0                  mov eax, dword ptr [ebp-10]
:0041A2BC 50                      push eax
:0041A2BD 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0041A2C0 E8222A0100              call 0042CCE7
:0041A2C5 8D45F8                  lea eax, dword ptr [ebp-08]
:0041A2C8 50                      push eax
:0041A2C9 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0041A2CC 83C105                  add ecx, 00000005
:0041A2CF E8BC75FEFF              call 00401890
:0041A2D4 6A04                    push 00000004
:0041A2D6 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0041A2D9 E882F0FEFF              call 00409360
:0041A2DE 85C0                    test eax, eax
:0041A2E0 0F8511000000            jne 0041A2F7
:0041A2E6 33C0                    xor eax, eax
:0041A2E8 8A45EC                  mov al, byte ptr [ebp-14]
:0041A2EB 83F864                  cmp eax, 00000064
:0041A2EE 0F8C03000000            jl 0041A2F7
:0041A2F4 FE45EC                  inc [ebp-14]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041A2E0(C), :0041A2EE(C)
|
:0041A2F7 E961FFFFFF              jmp 0041A25D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A276(C)
|
:0041A2FC 6A40                    push 00000040
:0041A2FE 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0041A301 E8BE3A0100              call 0042DDC4
:0041A306 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0041A309 E801160100              call 0042B90F
:0041A30E E900000000              jmp 0041A313

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041A1E8(U), :0041A21E(U), :0041A30E(U)
|
:0041A313 5F                      pop edi
:0041A314 5E                      pop esi
:0041A315 5B                      pop ebx
:0041A316 C9                      leave
:0041A317 C3                      ret



* Referenced by a CALL at Address:
|:0041D24E   
|
:0041A318 55                      push ebp
:0041A319 8BEC                    mov ebp, esp
:0041A31B 83EC14                  sub esp, 00000014
:0041A31E 53                      push ebx
:0041A31F 56                      push esi
:0041A320 57                      push edi
:0041A321 894DEC                  mov dword ptr [ebp-14], ecx
:0041A324 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041A327 E842000100              call 0042A36E
:0041A32C 8845F4                  mov byte ptr [ebp-0C], al
:0041A32F C645F800                mov [ebp-08], 00
:0041A333 C645FC00                mov [ebp-04], 00
:0041A337 C6059CA64600FF          mov byte ptr [0046A69C], FF
:0041A33E 6A00                    push 00000000
:0041A340 6880000000              push 00000080
:0041A345 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041A348 50                      push eax
:0041A349 8B4508                  mov eax, dword ptr [ebp+08]
:0041A34C 50                      push eax
:0041A34D 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041A350 E87CF4FFFF              call 004197D1
:0041A355 33C9                    xor ecx, ecx
:0041A357 8AC8                    mov cl, al
:0041A359 81F9FF000000            cmp ecx, 000000FF
:0041A35F 0F8471000000            je 0041A3D6
:0041A365 C745F008494500          mov [ebp-10], 00454908
:0041A36C E903000000              jmp 0041A374

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A3D1(U)
|
:0041A371 FF45F0                  inc [ebp-10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A36C(U)
|
:0041A374 8B45F0                  mov eax, dword ptr [ebp-10]
:0041A377 33C9                    xor ecx, ecx
:0041A379 8A08                    mov cl, byte ptr [eax]
:0041A37B 81F9FF000000            cmp ecx, 000000FF
:0041A381 0F844F000000            je 0041A3D6
:0041A387 8B45F0                  mov eax, dword ptr [ebp-10]
:0041A38A 33C9                    xor ecx, ecx
:0041A38C 8A08                    mov cl, byte ptr [eax]
:0041A38E 83F92D                  cmp ecx, 0000002D
:0041A391 0F8D3F000000            jnl 0041A3D6
:0041A397 8B4508                  mov eax, dword ptr [ebp+08]
:0041A39A 668B00                  mov ax, word ptr [eax]
:0041A39D 50                      push eax
:0041A39E 8B45F0                  mov eax, dword ptr [ebp-10]
:0041A3A1 8A00                    mov al, byte ptr [eax]
:0041A3A3 50                      push eax
:0041A3A4 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041A3A7 E839000000              call 0041A3E5
:0041A3AC 8845F8                  mov byte ptr [ebp-08], al
:0041A3AF 33C0                    xor eax, eax
:0041A3B1 8A45FC                  mov al, byte ptr [ebp-04]
:0041A3B4 33C9                    xor ecx, ecx
:0041A3B6 8A4DF8                  mov cl, byte ptr [ebp-08]
:0041A3B9 3BC1                    cmp eax, ecx
:0041A3BB 0F8D10000000            jnl 0041A3D1
:0041A3C1 8A45F8                  mov al, byte ptr [ebp-08]
:0041A3C4 8845FC                  mov byte ptr [ebp-04], al
:0041A3C7 8B45F0                  mov eax, dword ptr [ebp-10]
:0041A3CA 8A00                    mov al, byte ptr [eax]
:0041A3CC A29CA64600              mov byte ptr [0046A69C], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A3BB(C)
|
:0041A3D1 E99BFFFFFF              jmp 0041A371

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041A35F(C), :0041A381(C), :0041A391(C)
|
:0041A3D6 8A45FC                  mov al, byte ptr [ebp-04]
:0041A3D9 E900000000              jmp 0041A3DE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A3D9(U)
|
:0041A3DE 5F                      pop edi
:0041A3DF 5E                      pop esi
:0041A3E0 5B                      pop ebx
:0041A3E1 C9                      leave
:0041A3E2 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0041A3A7   
|
:0041A3E5 55                      push ebp
:0041A3E6 8BEC                    mov ebp, esp
:0041A3E8 83EC30                  sub esp, 00000030
:0041A3EB 53                      push ebx
:0041A3EC 56                      push esi
:0041A3ED 57                      push edi
:0041A3EE 894DD0                  mov dword ptr [ebp-30], ecx
:0041A3F1 33C0                    xor eax, eax
:0041A3F3 8A4508                  mov al, byte ptr [ebp+08]
:0041A3F6 8BC8                    mov ecx, eax
:0041A3F8 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041A3FB C1E003                  shl eax, 03
:0041A3FE 2BC1                    sub eax, ecx
:0041A400 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041A406 E825EDFEFF              call 00409130
:0041A40B 8945F8                  mov dword ptr [ebp-08], eax
:0041A40E C745FC00000000          mov [ebp-04], 00000000
:0041A415 33C0                    xor eax, eax
:0041A417 8A4508                  mov al, byte ptr [ebp+08]
:0041A41A 3DFF000000              cmp eax, 000000FF
:0041A41F 0F84A9010000            je 0041A5CE
:0041A425 33C0                    xor eax, eax
:0041A427 8A4508                  mov al, byte ptr [ebp+08]
:0041A42A 83F82D                  cmp eax, 0000002D
:0041A42D 0F8D9B010000            jnl 0041A5CE
:0041A433 33C0                    xor eax, eax
:0041A435 8A4508                  mov al, byte ptr [ebp+08]
:0041A438 8BC8                    mov ecx, eax
:0041A43A 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041A43D C1E003                  shl eax, 03
:0041A440 2BC1                    sub eax, ecx
:0041A442 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041A448 E8D3EDFEFF              call 00409220
:0041A44D 8BD8                    mov ebx, eax
:0041A44F 8B4DD0                  mov ecx, dword ptr [ebp-30]
:0041A452 E8C9EDFEFF              call 00409220
:0041A457 3BD8                    cmp ebx, eax
:0041A459 0F846F010000            je 0041A5CE
:0041A45F 8B45F8                  mov eax, dword ptr [ebp-08]
:0041A462 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041A465 03C0                    add eax, eax
:0041A467 8D04C0                  lea eax, dword ptr [eax+8*eax]
:0041A46A 05E8564500              add eax, 004556E8
:0041A46F 8945F0                  mov dword ptr [ebp-10], eax
:0041A472 6A00                    push 00000000
:0041A474 8B45F0                  mov eax, dword ptr [ebp-10]
:0041A477 50                      push eax
:0041A478 8B4DD0                  mov ecx, dword ptr [ebp-30]
:0041A47B E82D000100              call 0042A4AD
:0041A480 8945F4                  mov dword ptr [ebp-0C], eax
:0041A483 33C0                    xor eax, eax
:0041A485 8A4508                  mov al, byte ptr [ebp+08]
:0041A488 8BC8                    mov ecx, eax
:0041A48A 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041A48D C1E003                  shl eax, 03
:0041A490 2BC1                    sub eax, ecx
:0041A492 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041A498 E813F3FEFF              call 004097B0
:0041A49D 3B45F4                  cmp eax, dword ptr [ebp-0C]
:0041A4A0 0F8724000000            ja 0041A4CA
:0041A4A6 C745FC4B000000          mov [ebp-04], 0000004B
:0041A4AD 8B4508                  mov eax, dword ptr [ebp+08]
:0041A4B0 50                      push eax
:0041A4B1 E830050000              call 0041A9E6
:0041A4B6 83C404                  add esp, 00000004
:0041A4B9 85C0                    test eax, eax
:0041A4BB 0F8404000000            je 0041A4C5
:0041A4C1 8345FC05                add dword ptr [ebp-04], 00000005

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A4BB(C)
|
:0041A4C5 E904010000              jmp 0041A5CE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A4A0(C)
|
:0041A4CA 8B5DF4                  mov ebx, dword ptr [ebp-0C]
:0041A4CD 8D1C9B                  lea ebx, dword ptr [ebx+4*ebx]
:0041A4D0 03DB                    add ebx, ebx
:0041A4D2 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0041A4D5 E8B6F2FEFF              call 00409790
:0041A4DA 8BC8                    mov ecx, eax
:0041A4DC 8BC3                    mov eax, ebx
:0041A4DE 2BD2                    sub edx, edx
:0041A4E0 F7F1                    div ecx
:0041A4E2 83F801                  cmp eax, 00000001
:0041A4E5 0F8224000000            jb 0041A50F
:0041A4EB C745FC10000000          mov [ebp-04], 00000010
:0041A4F2 8B4508                  mov eax, dword ptr [ebp+08]
:0041A4F5 50                      push eax
:0041A4F6 E8EB040000              call 0041A9E6
:0041A4FB 83C404                  add esp, 00000004
:0041A4FE 85C0                    test eax, eax
:0041A500 0F8404000000            je 0041A50A
:0041A506 8345FC04                add dword ptr [ebp-04], 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A500(C)
|
:0041A50A E9BF000000              jmp 0041A5CE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A4E5(C)
|
:0041A50F 33C0                    xor eax, eax
:0041A511 8A4508                  mov al, byte ptr [ebp+08]
:0041A514 8BC8                    mov ecx, eax
:0041A516 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041A519 C1E003                  shl eax, 03
:0041A51C 2BC1                    sub eax, ecx
:0041A51E 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041A524 E887F2FEFF              call 004097B0
:0041A529 8D1C8500000000          lea ebx, dword ptr [4*eax+00000000]
:0041A530 8D1C9B                  lea ebx, dword ptr [ebx+4*ebx]
:0041A533 8D1C9B                  lea ebx, dword ptr [ebx+4*ebx]
:0041A536 8B45F8                  mov eax, dword ptr [ebp-08]
:0041A539 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041A53C 03C0                    add eax, eax
:0041A53E 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:0041A545 E846F2FEFF              call 00409790
:0041A54A 8BC8                    mov ecx, eax
:0041A54C 8BC3                    mov eax, ebx
:0041A54E 2BD2                    sub edx, edx
:0041A550 F7F1                    div ecx
:0041A552 83F828                  cmp eax, 00000028
:0041A555 0F870C000000            ja 0041A567
:0041A55B C745FC10000000          mov [ebp-04], 00000010
:0041A562 E967000000              jmp 0041A5CE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A555(C)
|
:0041A567 8B4DD0                  mov ecx, dword ptr [ebp-30]
:0041A56A E861EEFEFF              call 004093D0
:0041A56F 33C9                    xor ecx, ecx
:0041A571 8AC8                    mov cl, al
:0041A573 83F901                  cmp ecx, 00000001
:0041A576 0F854B000000            jne 0041A5C7
:0041A57C 8B4DD0                  mov ecx, dword ptr [ebp-30]
:0041A57F E81CEDFEFF              call 004092A0
:0041A584 33C9                    xor ecx, ecx
:0041A586 8AC8                    mov cl, al
:0041A588 83F91B                  cmp ecx, 0000001B
:0041A58B 0F8436000000            je 0041A5C7
:0041A591 8B4DD0                  mov ecx, dword ptr [ebp-30]
:0041A594 E807EDFEFF              call 004092A0
:0041A599 33C9                    xor ecx, ecx
:0041A59B 8AC8                    mov cl, al
:0041A59D 83F91C                  cmp ecx, 0000001C
:0041A5A0 0F8421000000            je 0041A5C7
:0041A5A6 8B4DD0                  mov ecx, dword ptr [ebp-30]
:0041A5A9 E8F2ECFEFF              call 004092A0
:0041A5AE 33C9                    xor ecx, ecx
:0041A5B0 8AC8                    mov cl, al
:0041A5B2 83F91D                  cmp ecx, 0000001D
:0041A5B5 0F840C000000            je 0041A5C7
:0041A5BB C745FC0A000000          mov [ebp-04], 0000000A
:0041A5C2 E907000000              jmp 0041A5CE

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041A576(C), :0041A58B(C), :0041A5A0(C), :0041A5B5(C)
|
:0041A5C7 C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041A41F(C), :0041A42D(C), :0041A459(C), :0041A4C5(U), :0041A50A(U)
|:0041A562(U), :0041A5C2(U)
|
:0041A5CE B9D0A64600              mov ecx, 0046A6D0
:0041A5D3 E8D814FFFF              call 0040BAB0
:0041A5D8 83F802                  cmp eax, 00000002
:0041A5DB 0F8528000000            jne 0041A609
:0041A5E1 6A10                    push 00000010
:0041A5E3 33C0                    xor eax, eax
:0041A5E5 8A4508                  mov al, byte ptr [ebp+08]
:0041A5E8 8BC8                    mov ecx, eax
:0041A5EA 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041A5ED C1E003                  shl eax, 03
:0041A5F0 2BC1                    sub eax, ecx
:0041A5F2 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041A5F8 E853EBFEFF              call 00409150
:0041A5FD 85C0                    test eax, eax
:0041A5FF 0F8404000000            je 0041A609
:0041A605 8345FC08                add dword ptr [ebp-04], 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041A5DB(C), :0041A5FF(C)
|
:0041A609 837DFC00                cmp dword ptr [ebp-04], 00000000
:0041A60D 0F8635000000            jbe 0041A648
:0041A613 817DF8EC000000          cmp dword ptr [ebp-08], 000000EC
:0041A61A 0F8328000000            jnb 0041A648
:0041A620 33C0                    xor eax, eax
:0041A622 8A4508                  mov al, byte ptr [ebp+08]
:0041A625 85C0                    test eax, eax
:0041A627 0F840E000000            je 0041A63B
:0041A62D 33C0                    xor eax, eax
:0041A62F 8A4508                  mov al, byte ptr [ebp+08]
:0041A632 83F80F                  cmp eax, 0000000F
:0041A635 0F8509000000            jne 0041A644

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A627(C)
|
:0041A63B 8345FC0A                add dword ptr [ebp-04], 0000000A
:0041A63F E904000000              jmp 0041A648

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A635(C)
|
:0041A644 8345FC06                add dword ptr [ebp-04], 00000006

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041A60D(C), :0041A61A(C), :0041A63F(U)
|
:0041A648 837DFC4B                cmp dword ptr [ebp-04], 0000004B
:0041A64C 0F831E000000            jnb 0041A670
:0041A652 8B45D0                  mov eax, dword ptr [ebp-30]
:0041A655 8A4004                  mov al, byte ptr [eax+04]
:0041A658 50                      push eax
:0041A659 E8DC020000              call 0041A93A
:0041A65E 83C404                  add esp, 00000004
:0041A661 85C0                    test eax, eax
:0041A663 0F8407000000            je 0041A670
:0041A669 33C0                    xor eax, eax
:0041A66B E95A010000              jmp 0041A7CA

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041A64C(C), :0041A663(C)
|
:0041A670 8B45D0                  mov eax, dword ptr [ebp-30]
:0041A673 8A4004                  mov al, byte ptr [eax+04]
:0041A676 50                      push eax
:0041A677 E86A030000              call 0041A9E6
:0041A67C 83C404                  add esp, 00000004
:0041A67F 85C0                    test eax, eax
:0041A681 0F845A000000            je 0041A6E1
:0041A687 8D45DC                  lea eax, dword ptr [ebp-24]
:0041A68A 8945E8                  mov dword ptr [ebp-18], eax
:0041A68D 8B4DD0                  mov ecx, dword ptr [ebp-30]
:0041A690 E80BECFEFF              call 004092A0
:0041A695 33C9                    xor ecx, ecx
:0041A697 8AC8                    mov cl, al
:0041A699 83F924                  cmp ecx, 00000024
:0041A69C 0F8509000000            jne 0041A6AB
:0041A6A2 C645EC08                mov [ebp-14], 08
:0041A6A6 E904000000              jmp 0041A6AF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A69C(C)
|
:0041A6AB C645EC04                mov [ebp-14], 04

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A6A6(U)
|
:0041A6AF 8D45DC                  lea eax, dword ptr [ebp-24]
:0041A6B2 50                      push eax
:0041A6B3 8B45EC                  mov eax, dword ptr [ebp-14]
:0041A6B6 50                      push eax
:0041A6B7 6A01                    push 00000001
:0041A6B9 8B45D0                  mov eax, dword ptr [ebp-30]
:0041A6BC 668B4005                mov ax, word ptr [eax+05]
:0041A6C0 50                      push eax
:0041A6C1 8B4DD0                  mov ecx, dword ptr [ebp-30]
:0041A6C4 E85E2D0000              call 0041D427
:0041A6C9 8945E8                  mov dword ptr [ebp-18], eax
:0041A6CC 6A00                    push 00000000
:0041A6CE 8B45FC                  mov eax, dword ptr [ebp-04]
:0041A6D1 50                      push eax
:0041A6D2 8B45E8                  mov eax, dword ptr [ebp-18]
:0041A6D5 50                      push eax
:0041A6D6 E8F6000000              call 0041A7D1
:0041A6DB 83C40C                  add esp, 0000000C
:0041A6DE 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A681(C)
|
:0041A6E1 B9D0A64600              mov ecx, 0046A6D0
:0041A6E6 E8C513FFFF              call 0040BAB0
:0041A6EB 83F802                  cmp eax, 00000002
:0041A6EE 0F85CE000000            jne 0041A7C2
:0041A6F4 837DFC00                cmp dword ptr [ebp-04], 00000000
:0041A6F8 0F86C4000000            jbe 0041A7C2
:0041A6FE 33C0                    xor eax, eax
:0041A700 8A4508                  mov al, byte ptr [ebp+08]
:0041A703 8BC8                    mov ecx, eax
:0041A705 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041A708 C1E003                  shl eax, 03
:0041A70B 2BC1                    sub eax, ecx
:0041A70D 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041A713 E8E8EAFEFF              call 00409200
:0041A718 668B00                  mov ax, word ptr [eax]
:0041A71B 668945D8                mov word ptr [ebp-28], ax
:0041A71F 33C0                    xor eax, eax
:0041A721 8A4508                  mov al, byte ptr [ebp+08]
:0041A724 8BC8                    mov ecx, eax
:0041A726 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041A729 C1E003                  shl eax, 03
:0041A72C 2BC1                    sub eax, ecx
:0041A72E 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041A734 E835FC0000              call 0042A36E
:0041A739 8845D4                  mov byte ptr [ebp-2C], al
:0041A73C 6A00                    push 00000000
:0041A73E 68C0030000              push 000003C0
:0041A743 6A04                    push 00000004
:0041A745 6A00                    push 00000000
:0041A747 6880070000              push 00000780
:0041A74C B918E54600              mov ecx, 0046E518
:0041A751 E8CACF0200              call 00447720
:0041A756 50                      push eax
:0041A757 E807CD0200              call 00447463
:0041A75C 83C40C                  add esp, 0000000C
:0041A75F 6A01                    push 00000001
:0041A761 6880000000              push 00000080
:0041A766 8B45D4                  mov eax, dword ptr [ebp-2C]
:0041A769 50                      push eax
:0041A76A 8D45D8                  lea eax, dword ptr [ebp-28]
:0041A76D 50                      push eax
:0041A76E 33C0                    xor eax, eax
:0041A770 8A4508                  mov al, byte ptr [ebp+08]
:0041A773 8BC8                    mov ecx, eax
:0041A775 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041A778 C1E003                  shl eax, 03
:0041A77B 2BC1                    sub eax, ecx
:0041A77D 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041A783 E849F0FFFF              call 004197D1
:0041A788 33DB                    xor ebx, ebx
:0041A78A 8A5D0D                  mov bl, byte ptr [ebp+0D]
:0041A78D 33C0                    xor eax, eax
:0041A78F A0C8FC4600              mov al, byte ptr [0046FCC8]
:0041A794 0FAFD8                  imul ebx, eax
:0041A797 33C0                    xor eax, eax
:0041A799 8A450C                  mov al, byte ptr [ebp+0C]
:0041A79C 03D8                    add ebx, eax
:0041A79E 6A04                    push 00000004
:0041A7A0 6A00                    push 00000000
:0041A7A2 6880070000              push 00000780
:0041A7A7 B918E54600              mov ecx, 0046E518
:0041A7AC E86FCF0200              call 00447720
:0041A7B1 33C9                    xor ecx, ecx
:0041A7B3 8A0C03                  mov cl, byte ptr [ebx+eax]
:0041A7B6 83F901                  cmp ecx, 00000001
:0041A7B9 0F8503000000            jne 0041A7C2
:0041A7BF FF4DFC                  dec [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041A6EE(C), :0041A6F8(C), :0041A7B9(C)
|
:0041A7C2 8B45FC                  mov eax, dword ptr [ebp-04]
:0041A7C5 E900000000              jmp 0041A7CA

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041A66B(U), :0041A7C5(U)
|
:0041A7CA 5F                      pop edi
:0041A7CB 5E                      pop esi
:0041A7CC 5B                      pop ebx
:0041A7CD C9                      leave
:0041A7CE C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0041A6D6   , :0041C29C   , :0041C3C7   , :0041C474   , :0041C555   
|:0041C5C0   , :0041C8C4   , :0041CABE   
|
:0041A7D1 55                      push ebp
:0041A7D2 8BEC                    mov ebp, esp
:0041A7D4 83EC08                  sub esp, 00000008
:0041A7D7 53                      push ebx
:0041A7D8 56                      push esi
:0041A7D9 57                      push edi
:0041A7DA C745FC00000000          mov [ebp-04], 00000000
:0041A7E1 8B4508                  mov eax, dword ptr [ebp+08]
:0041A7E4 33C9                    xor ecx, ecx
:0041A7E6 8A08                    mov cl, byte ptr [eax]
:0041A7E8 81F9FF000000            cmp ecx, 000000FF
:0041A7EE 0F8509000000            jne 0041A7FD
:0041A7F4 836DFC04                sub dword ptr [ebp-04], 00000004
:0041A7F8 E91D010000              jmp 0041A91A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A7EE(C)
|
:0041A7FD 8B4508                  mov eax, dword ptr [ebp+08]
:0041A800 33C9                    xor ecx, ecx
:0041A802 8A08                    mov cl, byte ptr [eax]
:0041A804 81F9FF000000            cmp ecx, 000000FF
:0041A80A 0F840A010000            je 0041A91A
:0041A810 33C0                    xor eax, eax
:0041A812 8A4510                  mov al, byte ptr [ebp+10]
:0041A815 8945F8                  mov dword ptr [ebp-08], eax
:0041A818 E9D1000000              jmp 0041A8EE
:0041A81D 8345FC0A                add dword ptr [ebp-04], 0000000A
:0041A821 E9EC000000              jmp 0041A912
:0041A826 8B4508                  mov eax, dword ptr [ebp+08]
:0041A829 33C9                    xor ecx, ecx
:0041A82B 8A08                    mov cl, byte ptr [eax]
:0041A82D 8BC1                    mov eax, ecx
:0041A82F 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:0041A832 C1E103                  shl ecx, 03
:0041A835 2BC8                    sub ecx, eax
:0041A837 8D8998C04600            lea ecx, dword ptr [ecx+0046C098]
:0041A83D E8EEE8FEFF              call 00409130
:0041A842 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041A845 03C0                    add eax, eax
:0041A847 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:0041A84E E83DEFFEFF              call 00409790
:0041A853 8BD8                    mov ebx, eax
:0041A855 8B4508                  mov eax, dword ptr [ebp+08]
:0041A858 33C9                    xor ecx, ecx
:0041A85A 8A08                    mov cl, byte ptr [eax]
:0041A85C 8BC1                    mov eax, ecx
:0041A85E 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:0041A861 C1E103                  shl ecx, 03
:0041A864 2BC8                    sub ecx, eax
:0041A866 8D8998C04600            lea ecx, dword ptr [ecx+0046C098]
:0041A86C E83FEFFEFF              call 004097B0
:0041A871 3BD8                    cmp ebx, eax
:0041A873 0F8404000000            je 0041A87D
:0041A879 8345FC0A                add dword ptr [ebp-04], 0000000A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A873(C)
|
:0041A87D E990000000              jmp 0041A912
:0041A882 8B4508                  mov eax, dword ptr [ebp+08]
:0041A885 33C9                    xor ecx, ecx
:0041A887 8A08                    mov cl, byte ptr [eax]
:0041A889 8BC1                    mov eax, ecx
:0041A88B 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:0041A88E C1E103                  shl ecx, 03
:0041A891 2BC8                    sub ecx, eax
:0041A893 8D8998C04600            lea ecx, dword ptr [ecx+0046C098]
:0041A899 E832EEFEFF              call 004096D0
:0041A89E 33C9                    xor ecx, ecx
:0041A8A0 8AC8                    mov cl, al
:0041A8A2 85C9                    test ecx, ecx
:0041A8A4 0F8404000000            je 0041A8AE
:0041A8AA 8345FC0A                add dword ptr [ebp-04], 0000000A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A8A4(C)
|
:0041A8AE E95F000000              jmp 0041A912
:0041A8B3 8B4508                  mov eax, dword ptr [ebp+08]
:0041A8B6 33C9                    xor ecx, ecx
:0041A8B8 8A08                    mov cl, byte ptr [eax]
:0041A8BA 8BC1                    mov eax, ecx
:0041A8BC 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:0041A8BF C1E103                  shl ecx, 03
:0041A8C2 2BC8                    sub ecx, eax
:0041A8C4 8D8998C04600            lea ecx, dword ptr [ecx+0046C098]
:0041A8CA E861EEFEFF              call 00409730
:0041A8CF 33C9                    xor ecx, ecx
:0041A8D1 8AC8                    mov cl, al
:0041A8D3 85C9                    test ecx, ecx
:0041A8D5 0F8504000000            jne 0041A8DF
:0041A8DB 8345FC0A                add dword ptr [ebp-04], 0000000A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A8D5(C)
|
:0041A8DF E92E000000              jmp 0041A912
:0041A8E4 E929000000              jmp 0041A912
:0041A8E9 E924000000              jmp 0041A912

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A818(U)
|
:0041A8EE 837DF803                cmp dword ptr [ebp-08], 00000003
:0041A8F2 0F871A000000            ja 0041A912
:0041A8F8 8B45F8                  mov eax, dword ptr [ebp-08]
:0041A8FB FF248502A94100          jmp dword ptr [4*eax+0041A902]

:0041A902 1DA84100                DWORD 0041A81D
:0041A906 26A84100                DWORD 0041A826
:0041A90A 82A84100                DWORD 0041A882
:0041A90E B3A84100                DWORD 0041A8B3



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041A821(U), :0041A87D(U), :0041A8AE(U), :0041A8DF(U), :0041A8E4(U)
|:0041A8E9(U), :0041A8F2(C)
|
:0041A912 FF4508                  inc [ebp+08]
:0041A915 E9E3FEFFFF              jmp 0041A7FD

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041A7F8(U), :0041A80A(C)
|
:0041A91A 8B45FC                  mov eax, dword ptr [ebp-04]
:0041A91D 03450C                  add eax, dword ptr [ebp+0C]
:0041A920 85C0                    test eax, eax
:0041A922 0F8F02000000            jg 0041A92A
:0041A928 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A922(C)
|
:0041A92A 8945FC                  mov dword ptr [ebp-04], eax
:0041A92D 8B45FC                  mov eax, dword ptr [ebp-04]
:0041A930 E900000000              jmp 0041A935

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A930(U)
|
:0041A935 5F                      pop edi
:0041A936 5E                      pop esi
:0041A937 5B                      pop ebx
:0041A938 C9                      leave
:0041A939 C3                      ret



* Referenced by a CALL at Addresses:
|:0041A659   , :0041C62B   , :0041C9D5   
|
:0041A93A 55                      push ebp
:0041A93B 8BEC                    mov ebp, esp
:0041A93D 83EC0C                  sub esp, 0000000C
:0041A940 53                      push ebx
:0041A941 56                      push esi
:0041A942 57                      push edi
:0041A943 33C0                    xor eax, eax
:0041A945 8A4508                  mov al, byte ptr [ebp+08]
:0041A948 8BC8                    mov ecx, eax
:0041A94A 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041A94D C1E003                  shl eax, 03
:0041A950 2BC1                    sub eax, ecx
:0041A952 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041A958 E8D3E7FEFF              call 00409130
:0041A95D 8945F8                  mov dword ptr [ebp-08], eax
:0041A960 33C0                    xor eax, eax
:0041A962 8A4508                  mov al, byte ptr [ebp+08]
:0041A965 8BC8                    mov ecx, eax
:0041A967 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041A96A C1E003                  shl eax, 03
:0041A96D 2BC1                    sub eax, ecx
:0041A96F 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041A975 E826E9FEFF              call 004092A0
:0041A97A 8845FC                  mov byte ptr [ebp-04], al
:0041A97D C745F400000000          mov [ebp-0C], 00000000
:0041A984 8B45F8                  mov eax, dword ptr [ebp-08]
:0041A987 50                      push eax
:0041A988 E82F19FFFF              call 0040C2BC
:0041A98D 83C404                  add esp, 00000004
:0041A990 33C9                    xor ecx, ecx
:0041A992 8AC8                    mov cl, al
:0041A994 83F906                  cmp ecx, 00000006
:0041A997 0F8435000000            je 0041A9D2
:0041A99D 8B45F8                  mov eax, dword ptr [ebp-08]
:0041A9A0 50                      push eax
:0041A9A1 E81619FFFF              call 0040C2BC
:0041A9A6 83C404                  add esp, 00000004
:0041A9A9 33C9                    xor ecx, ecx
:0041A9AB 8AC8                    mov cl, al
:0041A9AD 83F90A                  cmp ecx, 0000000A
:0041A9B0 0F841C000000            je 0041A9D2
:0041A9B6 33C0                    xor eax, eax
:0041A9B8 8A45FC                  mov al, byte ptr [ebp-04]
:0041A9BB 83F81D                  cmp eax, 0000001D
:0041A9BE 0F840E000000            je 0041A9D2
:0041A9C4 33C0                    xor eax, eax
:0041A9C6 8A45FC                  mov al, byte ptr [ebp-04]
:0041A9C9 83F826                  cmp eax, 00000026
:0041A9CC 0F8507000000            jne 0041A9D9

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041A997(C), :0041A9B0(C), :0041A9BE(C)
|
:0041A9D2 C745F401000000          mov [ebp-0C], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A9CC(C)
|
:0041A9D9 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041A9DC E900000000              jmp 0041A9E1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A9DC(U)
|
:0041A9E1 5F                      pop edi
:0041A9E2 5E                      pop esi
:0041A9E3 5B                      pop ebx
:0041A9E4 C9                      leave
:0041A9E5 C3                      ret



* Referenced by a CALL at Addresses:
|:0041A4B1   , :0041A4F6   , :0041A677   
|
:0041A9E6 55                      push ebp
:0041A9E7 8BEC                    mov ebp, esp
:0041A9E9 83EC08                  sub esp, 00000008
:0041A9EC 53                      push ebx
:0041A9ED 56                      push esi
:0041A9EE 57                      push edi
:0041A9EF 33C0                    xor eax, eax
:0041A9F1 8A4508                  mov al, byte ptr [ebp+08]
:0041A9F4 8BC8                    mov ecx, eax
:0041A9F6 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041A9F9 C1E003                  shl eax, 03
:0041A9FC 2BC1                    sub eax, ecx
:0041A9FE 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041AA04 E897E8FEFF              call 004092A0
:0041AA09 8845FC                  mov byte ptr [ebp-04], al
:0041AA0C C745F800000000          mov [ebp-08], 00000000
:0041AA13 33C0                    xor eax, eax
:0041AA15 8A45FC                  mov al, byte ptr [ebp-04]
:0041AA18 83F825                  cmp eax, 00000025
:0041AA1B 0F840E000000            je 0041AA2F
:0041AA21 33C0                    xor eax, eax
:0041AA23 8A45FC                  mov al, byte ptr [ebp-04]
:0041AA26 83F824                  cmp eax, 00000024
:0041AA29 0F8507000000            jne 0041AA36

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041AA1B(C)
|
:0041AA2F C745F801000000          mov [ebp-08], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041AA29(C)
|
:0041AA36 8B45F8                  mov eax, dword ptr [ebp-08]
:0041AA39 E900000000              jmp 0041AA3E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041AA39(U)
|
:0041AA3E 5F                      pop edi
:0041AA3F 5E                      pop esi
:0041AA40 5B                      pop ebx
:0041AA41 C9                      leave
:0041AA42 C3                      ret



* Referenced by a CALL at Addresses:
|:0041A203   , :0041B8CF   , :0041B91F   , :0041BB51   , :0041BBA1   
|:0041DFAE   , :0041E1C9   
|
:0041AA43 55                      push ebp
:0041AA44 8BEC                    mov ebp, esp
:0041AA46 83EC50                  sub esp, 00000050
:0041AA49 53                      push ebx
:0041AA4A 56                      push esi
:0041AA4B 57                      push edi
:0041AA4C 894DB0                  mov dword ptr [ebp-50], ecx
:0041AA4F 8D4DE0                  lea ecx, dword ptr [ebp-20]
:0041AA52 E8196EFEFF              call 00401870
:0041AA57 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041AA5A E8116EFEFF              call 00401870
:0041AA5F C745D801000000          mov [ebp-28], 00000001
:0041AA66 6A04                    push 00000004
:0041AA68 8B4DB0                  mov ecx, dword ptr [ebp-50]
:0041AA6B E8F0E8FEFF              call 00409360
:0041AA70 8945E8                  mov dword ptr [ebp-18], eax
:0041AA73 8B4DB0                  mov ecx, dword ptr [ebp-50]
:0041AA76 E8A5E7FEFF              call 00409220
:0041AA7B 8945FC                  mov dword ptr [ebp-04], eax
:0041AA7E 6A04                    push 00000004
:0041AA80 6A00                    push 00000000
:0041AA82 6A00                    push 00000000
:0041AA84 B950F94600              mov ecx, 0046F950
:0041AA89 E892CC0200              call 00447720
:0041AA8E 05A8300000              add eax, 000030A8
:0041AA93 8945DC                  mov dword ptr [ebp-24], eax
:0041AA96 8B4508                  mov eax, dword ptr [ebp+08]
:0041AA99 50                      push eax
:0041AA9A E89EEAFFFF              call 0041953D
:0041AA9F 83C404                  add esp, 00000004
:0041AAA2 8845F8                  mov byte ptr [ebp-08], al
:0041AAA5 8B450C                  mov eax, dword ptr [ebp+0C]
:0041AAA8 50                      push eax
:0041AAA9 8D4DE0                  lea ecx, dword ptr [ebp-20]
:0041AAAC E8DF6DFEFF              call 00401890
:0041AAB1 8A4510                  mov al, byte ptr [ebp+10]
:0041AAB4 8845F4                  mov byte ptr [ebp-0C], al
:0041AAB7 C745E400000000          mov [ebp-1C], 00000000
:0041AABE E903000000              jmp 0041AAC6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041AC7D(U)
|
:0041AAC3 FF45E4                  inc [ebp-1C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041AABE(U)
|
:0041AAC6 8B4508                  mov eax, dword ptr [ebp+08]
:0041AAC9 50                      push eax
:0041AACA 8D45E0                  lea eax, dword ptr [ebp-20]
:0041AACD 50                      push eax
:0041AACE E8AD370000              call 0041E280
:0041AAD3 83C408                  add esp, 00000008
:0041AAD6 85C0                    test eax, eax
:0041AAD8 0F85A4010000            jne 0041AC82
:0041AADE 837DD800                cmp dword ptr [ebp-28], 00000000
:0041AAE2 0F849A010000            je 0041AC82
:0041AAE8 33DB                    xor ebx, ebx
:0041AAEA 8A5DE1                  mov bl, byte ptr [ebp-1F]
:0041AAED 33C0                    xor eax, eax
:0041AAEF A0C8FC4600              mov al, byte ptr [0046FCC8]
:0041AAF4 0FAFD8                  imul ebx, eax
:0041AAF7 33C0                    xor eax, eax
:0041AAF9 8A45E0                  mov al, byte ptr [ebp-20]
:0041AAFC 03D8                    add ebx, eax
:0041AAFE 6A04                    push 00000004
:0041AB00 6A00                    push 00000000
:0041AB02 6A00                    push 00000000
:0041AB04 B950F94600              mov ecx, 0046F950
:0041AB09 E812CC0200              call 00447720
:0041AB0E 8A8403E82C0000          mov al, byte ptr [ebx+eax+00002CE8]
:0041AB15 8845D4                  mov byte ptr [ebp-2C], al
:0041AB18 C645CCFF                mov [ebp-34], FF
:0041AB1C 8A45D4                  mov al, byte ptr [ebp-2C]
:0041AB1F 8845C4                  mov byte ptr [ebp-3C], al
:0041AB22 C645C800                mov [ebp-38], 00
:0041AB26 E903000000              jmp 0041AB2E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041AB9F(U), :0041AC28(U)
|
:0041AB2B FE45C8                  inc [ebp-38]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041AB26(U)
|
:0041AB2E 33C0                    xor eax, eax
:0041AB30 8A45C8                  mov al, byte ptr [ebp-38]
:0041AB33 83F804                  cmp eax, 00000004
:0041AB36 0F8DF1000000            jnl 0041AC2D
:0041AB3C 8B45C8                  mov eax, dword ptr [ebp-38]
:0041AB3F 50                      push eax
:0041AB40 8D45E0                  lea eax, dword ptr [ebp-20]
:0041AB43 50                      push eax
:0041AB44 E80CEBFFFF              call 00419655
:0041AB49 83C408                  add esp, 00000008
:0041AB4C 50                      push eax
:0041AB4D 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041AB50 E83B6DFEFF              call 00401890
:0041AB55 33C0                    xor eax, eax
:0041AB57 8A45F0                  mov al, byte ptr [ebp-10]
:0041AB5A 3DFF000000              cmp eax, 000000FF
:0041AB5F 0F843A000000            je 0041AB9F
:0041AB65 8B45FC                  mov eax, dword ptr [ebp-04]
:0041AB68 50                      push eax
:0041AB69 8D45F0                  lea eax, dword ptr [ebp-10]
:0041AB6C 50                      push eax
:0041AB6D E8BAE6FFFF              call 0041922C
:0041AB72 83C408                  add esp, 00000008
:0041AB75 85C0                    test eax, eax
:0041AB77 0F8427000000            je 0041ABA4
:0041AB7D 8B4508                  mov eax, dword ptr [ebp+08]
:0041AB80 50                      push eax
:0041AB81 8D45F0                  lea eax, dword ptr [ebp-10]
:0041AB84 50                      push eax
:0041AB85 E8F6360000              call 0041E280
:0041AB8A 83C408                  add esp, 00000008
:0041AB8D 85C0                    test eax, eax
:0041AB8F 0F850F000000            jne 0041ABA4
:0041AB95 837DE800                cmp dword ptr [ebp-18], 00000000
:0041AB99 0F8505000000            jne 0041ABA4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041AB5F(C)
|
:0041AB9F E987FFFFFF              jmp 0041AB2B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041AB77(C), :0041AB8F(C), :0041AB99(C)
|
:0041ABA4 33DB                    xor ebx, ebx
:0041ABA6 8A5DF1                  mov bl, byte ptr [ebp-0F]
:0041ABA9 33C0                    xor eax, eax
:0041ABAB A0C8FC4600              mov al, byte ptr [0046FCC8]
:0041ABB0 0FAFD8                  imul ebx, eax
:0041ABB3 33C0                    xor eax, eax
:0041ABB5 8A45F0                  mov al, byte ptr [ebp-10]
:0041ABB8 03D8                    add ebx, eax
:0041ABBA 6A04                    push 00000004
:0041ABBC 6A00                    push 00000000
:0041ABBE 6A00                    push 00000000
:0041ABC0 B950F94600              mov ecx, 0046F950
:0041ABC5 E856CB0200              call 00447720
:0041ABCA 8A8403E82C0000          mov al, byte ptr [ebx+eax+00002CE8]
:0041ABD1 8845C0                  mov byte ptr [ebp-40], al
:0041ABD4 33C0                    xor eax, eax
:0041ABD6 8A45C0                  mov al, byte ptr [ebp-40]
:0041ABD9 33C9                    xor ecx, ecx
:0041ABDB 8A4DD4                  mov cl, byte ptr [ebp-2C]
:0041ABDE 3BC1                    cmp eax, ecx
:0041ABE0 0F8D42000000            jnl 0041AC28
:0041ABE6 8D45F0                  lea eax, dword ptr [ebp-10]
:0041ABE9 50                      push eax
:0041ABEA E8EBE9FFFF              call 004195DA
:0041ABEF 83C404                  add esp, 00000004
:0041ABF2 8845B8                  mov byte ptr [ebp-48], al
:0041ABF5 8B45B8                  mov eax, dword ptr [ebp-48]
:0041ABF8 50                      push eax
:0041ABF9 8B4DB0                  mov ecx, dword ptr [ebp-50]
:0041ABFC E8D8F60000              call 0042A2D9
:0041AC01 8845BC                  mov byte ptr [ebp-44], al
:0041AC04 33C0                    xor eax, eax
:0041AC06 8A45BC                  mov al, byte ptr [ebp-44]
:0041AC09 33C9                    xor ecx, ecx
:0041AC0B 8A4DF4                  mov cl, byte ptr [ebp-0C]
:0041AC0E 3BC1                    cmp eax, ecx
:0041AC10 0F8F12000000            jg 0041AC28
:0041AC16 8A45C0                  mov al, byte ptr [ebp-40]
:0041AC19 8845D4                  mov byte ptr [ebp-2C], al
:0041AC1C 8A45C8                  mov al, byte ptr [ebp-38]
:0041AC1F 8845CC                  mov byte ptr [ebp-34], al
:0041AC22 8A45BC                  mov al, byte ptr [ebp-44]
:0041AC25 8845D0                  mov byte ptr [ebp-30], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041ABE0(C), :0041AC10(C)
|
:0041AC28 E9FEFEFFFF              jmp 0041AB2B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041AB36(C)
|
:0041AC2D 33C0                    xor eax, eax
:0041AC2F 8A45CC                  mov al, byte ptr [ebp-34]
:0041AC32 3DFF000000              cmp eax, 000000FF
:0041AC37 0F8439000000            je 0041AC76
:0041AC3D 8B45CC                  mov eax, dword ptr [ebp-34]
:0041AC40 50                      push eax
:0041AC41 8D45E0                  lea eax, dword ptr [ebp-20]
:0041AC44 50                      push eax
:0041AC45 E80BEAFFFF              call 00419655
:0041AC4A 83C408                  add esp, 00000008
:0041AC4D 50                      push eax
:0041AC4E 8D4DE0                  lea ecx, dword ptr [ebp-20]
:0041AC51 E83A6CFEFF              call 00401890
:0041AC56 33C0                    xor eax, eax
:0041AC58 8A45F4                  mov al, byte ptr [ebp-0C]
:0041AC5B 33C9                    xor ecx, ecx
:0041AC5D 8A4DD0                  mov cl, byte ptr [ebp-30]
:0041AC60 2BC1                    sub eax, ecx
:0041AC62 8845F4                  mov byte ptr [ebp-0C], al
:0041AC65 8A45CC                  mov al, byte ptr [ebp-34]
:0041AC68 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0041AC6B 8B55DC                  mov edx, dword ptr [ebp-24]
:0041AC6E 880411                  mov byte ptr [ecx+edx], al
:0041AC71 E907000000              jmp 0041AC7D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041AC37(C)
|
:0041AC76 C745D800000000          mov [ebp-28], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041AC71(U)
|
:0041AC7D E941FEFFFF              jmp 0041AAC3

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041AAD8(C), :0041AAE2(C)
|
:0041AC82 837DD800                cmp dword ptr [ebp-28], 00000000
:0041AC86 0F8559000000            jne 0041ACE5
:0041AC8C 33C0                    xor eax, eax
:0041AC8E 8A4514                  mov al, byte ptr [ebp+14]
:0041AC91 83F801                  cmp eax, 00000001
:0041AC94 0F854B000000            jne 0041ACE5
:0041AC9A 8D45E0                  lea eax, dword ptr [ebp-20]
:0041AC9D 50                      push eax
:0041AC9E E89AE8FFFF              call 0041953D
:0041ACA3 83C404                  add esp, 00000004
:0041ACA6 33C9                    xor ecx, ecx
:0041ACA8 8AC8                    mov cl, al
:0041ACAA 81F9FF000000            cmp ecx, 000000FF
:0041ACB0 0F841A000000            je 0041ACD0
:0041ACB6 8B45B0                  mov eax, dword ptr [ebp-50]
:0041ACB9 8A4004                  mov al, byte ptr [eax+04]
:0041ACBC 50                      push eax
:0041ACBD 6A14                    push 00000014
:0041ACBF 8D45E0                  lea eax, dword ptr [ebp-20]
:0041ACC2 50                      push eax
:0041ACC3 E8BC000000              call 0041AD84
:0041ACC8 83C40C                  add esp, 0000000C
:0041ACCB E915000000              jmp 0041ACE5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041ACB0(C)
|
:0041ACD0 8B45B0                  mov eax, dword ptr [ebp-50]
:0041ACD3 8A4004                  mov al, byte ptr [eax+04]
:0041ACD6 50                      push eax
:0041ACD7 6A0A                    push 0000000A
:0041ACD9 8D45E0                  lea eax, dword ptr [ebp-20]
:0041ACDC 50                      push eax
:0041ACDD E8A2000000              call 0041AD84
:0041ACE2 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041AC86(C), :0041AC94(C), :0041ACCB(U)
|
:0041ACE5 FF4DE4                  dec [ebp-1C]
:0041ACE8 0F8881000000            js 0041AD6F
:0041ACEE C645B400                mov [ebp-4C], 00
:0041ACF2 E906000000              jmp 0041ACFD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041AD65(U)
|
:0041ACF7 FE45B4                  inc [ebp-4C]
:0041ACFA FF4DE4                  dec [ebp-1C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041ACF2(U)
|
:0041ACFD 837DE400                cmp dword ptr [ebp-1C], 00000000
:0041AD01 0F8C63000000            jl 0041AD6A
:0041AD07 33C0                    xor eax, eax
:0041AD09 8A45B4                  mov al, byte ptr [ebp-4C]
:0041AD0C 3B45E4                  cmp eax, dword ptr [ebp-1C]
:0041AD0F 0F8F55000000            jg 0041AD6A
:0041AD15 33C0                    xor eax, eax
:0041AD17 8A45B4                  mov al, byte ptr [ebp-4C]
:0041AD1A 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0041AD1D 8A0408                  mov al, byte ptr [eax+ecx]
:0041AD20 8845EC                  mov byte ptr [ebp-14], al
:0041AD23 8B45E4                  mov eax, dword ptr [ebp-1C]
:0041AD26 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0041AD29 33D2                    xor edx, edx
:0041AD2B 8A1408                  mov dl, byte ptr [eax+ecx]
:0041AD2E 8D4202                  lea eax, dword ptr [edx+02]
:0041AD31 99                      cdq
:0041AD32 33C2                    xor eax, edx
:0041AD34 2BC2                    sub eax, edx
:0041AD36 83E003                  and eax, 00000003
:0041AD39 33C2                    xor eax, edx
:0041AD3B 2BC2                    sub eax, edx
:0041AD3D 33C9                    xor ecx, ecx
:0041AD3F 8A4DB4                  mov cl, byte ptr [ebp-4C]
:0041AD42 8B55DC                  mov edx, dword ptr [ebp-24]
:0041AD45 880411                  mov byte ptr [ecx+edx], al
:0041AD48 33C0                    xor eax, eax
:0041AD4A 8A45EC                  mov al, byte ptr [ebp-14]
:0041AD4D 83C002                  add eax, 00000002
:0041AD50 99                      cdq
:0041AD51 33C2                    xor eax, edx
:0041AD53 2BC2                    sub eax, edx
:0041AD55 83E003                  and eax, 00000003
:0041AD58 33C2                    xor eax, edx
:0041AD5A 2BC2                    sub eax, edx
:0041AD5C 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0041AD5F 8B55DC                  mov edx, dword ptr [ebp-24]
:0041AD62 880411                  mov byte ptr [ecx+edx], al
:0041AD65 E98DFFFFFF              jmp 0041ACF7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041AD01(C), :0041AD0F(C)
|
:0041AD6A E906000000              jmp 0041AD75

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041ACE8(C)
|
:0041AD6F 8B45DC                  mov eax, dword ptr [ebp-24]
:0041AD72 C600FF                  mov byte ptr [eax], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041AD6A(U)
|
:0041AD75 8B45DC                  mov eax, dword ptr [ebp-24]
:0041AD78 E900000000              jmp 0041AD7D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041AD78(U)
|
:0041AD7D 5F                      pop edi
:0041AD7E 5E                      pop esi
:0041AD7F 5B                      pop ebx
:0041AD80 C9                      leave
:0041AD81 C21000                  ret 0010



* Referenced by a CALL at Addresses:
|:0041ACC3   , :0041ACDD   , :0041AF18   , :0041AF32   , :0041B850   
|:0041BA97   , :0041BAD2   
|
:0041AD84 55                      push ebp
:0041AD85 8BEC                    mov ebp, esp
:0041AD87 83EC10                  sub esp, 00000010
:0041AD8A 53                      push ebx
:0041AD8B 56                      push esi
:0041AD8C 57                      push edi
:0041AD8D 837D0C09                cmp dword ptr [ebp+0C], 00000009
:0041AD91 0F8CA8010000            jl 0041AF3F
:0041AD97 8B4508                  mov eax, dword ptr [ebp+08]
:0041AD9A 50                      push eax
:0041AD9B E83AE8FFFF              call 004195DA
:0041ADA0 83C404                  add esp, 00000004
:0041ADA3 8845FC                  mov byte ptr [ebp-04], al
:0041ADA6 8B4508                  mov eax, dword ptr [ebp+08]
:0041ADA9 33DB                    xor ebx, ebx
:0041ADAB 8A5801                  mov bl, byte ptr [eax+01]
:0041ADAE 33C0                    xor eax, eax
:0041ADB0 A0C8FC4600              mov al, byte ptr [0046FCC8]
:0041ADB5 0FAFD8                  imul ebx, eax
:0041ADB8 8B4508                  mov eax, dword ptr [ebp+08]
:0041ADBB 33C9                    xor ecx, ecx
:0041ADBD 8A08                    mov cl, byte ptr [eax]
:0041ADBF 03D9                    add ebx, ecx
:0041ADC1 6A04                    push 00000004
:0041ADC3 6A00                    push 00000000
:0041ADC5 68C0030000              push 000003C0
:0041ADCA B918E54600              mov ecx, 0046E518
:0041ADCF E84CC90200              call 00447720
:0041ADD4 03D8                    add ebx, eax
:0041ADD6 895DF8                  mov dword ptr [ebp-08], ebx
:0041ADD9 33C0                    xor eax, eax
:0041ADDB 8A4510                  mov al, byte ptr [ebp+10]
:0041ADDE 8BC8                    mov ecx, eax
:0041ADE0 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041ADE3 C1E003                  shl eax, 03
:0041ADE6 2BC1                    sub eax, ecx
:0041ADE8 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041ADEE E82EF50000              call 0042A321
:0041ADF3 33C9                    xor ecx, ecx
:0041ADF5 8AC8                    mov cl, al
:0041ADF7 81F9FF000000            cmp ecx, 000000FF
:0041ADFD 0F846D000000            je 0041AE70
:0041AE03 8B45F8                  mov eax, dword ptr [ebp-08]
:0041AE06 33C9                    xor ecx, ecx
:0041AE08 8A08                    mov cl, byte ptr [eax]
:0041AE0A 85C9                    test ecx, ecx
:0041AE0C 0F855E000000            jne 0041AE70
:0041AE12 8B4508                  mov eax, dword ptr [ebp+08]
:0041AE15 50                      push eax
:0041AE16 E822E7FFFF              call 0041953D
:0041AE1B 83C404                  add esp, 00000004
:0041AE1E 33C9                    xor ecx, ecx
:0041AE20 8AC8                    mov cl, al
:0041AE22 81F9FF000000            cmp ecx, 000000FF
:0041AE28 0F842F000000            je 0041AE5D
:0041AE2E 33C0                    xor eax, eax
:0041AE30 8A4510                  mov al, byte ptr [ebp+10]
:0041AE33 8BC8                    mov ecx, eax
:0041AE35 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041AE38 C1E003                  shl eax, 03
:0041AE3B 2BC1                    sub eax, ecx
:0041AE3D 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041AE43 E8B8E3FEFF              call 00409200
:0041AE48 50                      push eax
:0041AE49 8B4508                  mov eax, dword ptr [ebp+08]
:0041AE4C 50                      push eax
:0041AE4D E82E340000              call 0041E280
:0041AE52 83C408                  add esp, 00000008
:0041AE55 85C0                    test eax, eax
:0041AE57 0F8413000000            je 0041AE70

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041AE28(C)
|
:0041AE5D 8B45F8                  mov eax, dword ptr [ebp-08]
:0041AE60 33C9                    xor ecx, ecx
:0041AE62 8A08                    mov cl, byte ptr [eax]
:0041AE64 33C0                    xor eax, eax
:0041AE66 8A450C                  mov al, byte ptr [ebp+0C]
:0041AE69 03C8                    add ecx, eax
:0041AE6B 8B45F8                  mov eax, dword ptr [ebp-08]
:0041AE6E 8808                    mov byte ptr [eax], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041ADFD(C), :0041AE0C(C), :0041AE57(C)
|
:0041AE70 33C0                    xor eax, eax
:0041AE72 8A4510                  mov al, byte ptr [ebp+10]
:0041AE75 8BC8                    mov ecx, eax
:0041AE77 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041AE7A C1E003                  shl eax, 03
:0041AE7D 2BC1                    sub eax, ecx
:0041AE7F 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041AE85 E816E4FEFF              call 004092A0
:0041AE8A 33C9                    xor ecx, ecx
:0041AE8C 8AC8                    mov cl, al
:0041AE8E 83F90C                  cmp ecx, 0000000C
:0041AE91 0F8C27000000            jl 0041AEBE
:0041AE97 33C0                    xor eax, eax
:0041AE99 8A4510                  mov al, byte ptr [ebp+10]
:0041AE9C 8BC8                    mov ecx, eax
:0041AE9E 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041AEA1 C1E003                  shl eax, 03
:0041AEA4 2BC1                    sub eax, ecx
:0041AEA6 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041AEAC E8EFE3FEFF              call 004092A0
:0041AEB1 33C9                    xor ecx, ecx
:0041AEB3 8AC8                    mov cl, al
:0041AEB5 83F90E                  cmp ecx, 0000000E
:0041AEB8 0F8E81000000            jle 0041AF3F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041AE91(C)
|
:0041AEBE C645F400                mov [ebp-0C], 00
:0041AEC2 E903000000              jmp 0041AECA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041AF3A(U)
|
:0041AEC7 FE45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041AEC2(U)
|
:0041AECA 33C0                    xor eax, eax
:0041AECC 8A45F4                  mov al, byte ptr [ebp-0C]
:0041AECF 83F804                  cmp eax, 00000004
:0041AED2 0F8D67000000            jnl 0041AF3F
:0041AED8 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041AEDB 50                      push eax
:0041AEDC 8B4508                  mov eax, dword ptr [ebp+08]
:0041AEDF 50                      push eax
:0041AEE0 E870E7FFFF              call 00419655
:0041AEE5 83C408                  add esp, 00000008
:0041AEE8 668B00                  mov ax, word ptr [eax]
:0041AEEB 668945F0                mov word ptr [ebp-10], ax
:0041AEEF 33C0                    xor eax, eax
:0041AEF1 8A45F0                  mov al, byte ptr [ebp-10]
:0041AEF4 3DFF000000              cmp eax, 000000FF
:0041AEF9 0F843B000000            je 0041AF3A
:0041AEFF 837D0C0A                cmp dword ptr [ebp+0C], 0000000A
:0041AF03 0F8E1C000000            jle 0041AF25
:0041AF09 8B4510                  mov eax, dword ptr [ebp+10]
:0041AF0C 50                      push eax
:0041AF0D 8B450C                  mov eax, dword ptr [ebp+0C]
:0041AF10 83E80A                  sub eax, 0000000A
:0041AF13 50                      push eax
:0041AF14 8D45F0                  lea eax, dword ptr [ebp-10]
:0041AF17 50                      push eax
:0041AF18 E867FEFFFF              call 0041AD84
:0041AF1D 83C40C                  add esp, 0000000C
:0041AF20 E915000000              jmp 0041AF3A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041AF03(C)
|
:0041AF25 8B4510                  mov eax, dword ptr [ebp+10]
:0041AF28 50                      push eax
:0041AF29 8B450C                  mov eax, dword ptr [ebp+0C]
:0041AF2C 48                      dec eax
:0041AF2D 50                      push eax
:0041AF2E 8D45F0                  lea eax, dword ptr [ebp-10]
:0041AF31 50                      push eax
:0041AF32 E84DFEFFFF              call 0041AD84
:0041AF37 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041AEF9(C), :0041AF20(U)
|
:0041AF3A E988FFFFFF              jmp 0041AEC7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041AD91(C), :0041AEB8(C), :0041AED2(C)
|
:0041AF3F E900000000              jmp 0041AF44

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041AF3F(U)
|
:0041AF44 5F                      pop edi
:0041AF45 5E                      pop esi
:0041AF46 5B                      pop ebx
:0041AF47 C9                      leave
:0041AF48 C3                      ret



* Referenced by a CALL at Addresses:
|:0041B876   , :0041B8A6   , :0041B8F0   , :0041B940   , :0041BA59   
|:0041BABB   , :0041BAF8   , :0041BB28   , :0041BB72   , :0041BBC2   
|:0041BBE7   , :0041BC14   , :0041BC8F   , :0041BCC3   , :0041BD0E   
|:0041DC1B   , :0041E096   , :0041E0D4   , :0041E0FB   , :0041E156   
|:0041E186   , :0041E1EA   
|
:0041AF49 55                      push ebp
:0041AF4A 8BEC                    mov ebp, esp
:0041AF4C 83EC6C                  sub esp, 0000006C
:0041AF4F 53                      push ebx
:0041AF50 56                      push esi
:0041AF51 57                      push edi
:0041AF52 894D94                  mov dword ptr [ebp-6C], ecx
:0041AF55 6A04                    push 00000004
:0041AF57 6A00                    push 00000000
:0041AF59 6A00                    push 00000000
:0041AF5B B950F94600              mov ecx, 0046F950
:0041AF60 E8BBC70200              call 00447720
:0041AF65 05E82C0000              add eax, 00002CE8
:0041AF6A 8945C4                  mov dword ptr [ebp-3C], eax
:0041AF6D 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041AF70 E8FB68FEFF              call 00401870
:0041AF75 8D4DE0                  lea ecx, dword ptr [ebp-20]
:0041AF78 E8F368FEFF              call 00401870
:0041AF7D 8B4518                  mov eax, dword ptr [ebp+18]
:0041AF80 50                      push eax
:0041AF81 8B4514                  mov eax, dword ptr [ebp+14]
:0041AF84 50                      push eax
:0041AF85 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0041AF88 E8C3320000              call 0041E250
:0041AF8D 8B4D94                  mov ecx, dword ptr [ebp-6C]
:0041AF90 E88BE2FEFF              call 00409220
:0041AF95 8845D8                  mov byte ptr [ebp-28], al
:0041AF98 C645B8FF                mov [ebp-48], FF
:0041AF9C C645D4FF                mov [ebp-2C], FF
:0041AFA0 C645F8FF                mov [ebp-08], FF
:0041AFA4 C745B401000000          mov [ebp-4C], 00000001
:0041AFAB 6A04                    push 00000004
:0041AFAD 8B4D94                  mov ecx, dword ptr [ebp-6C]
:0041AFB0 E8ABE3FEFF              call 00409360
:0041AFB5 8945DC                  mov dword ptr [ebp-24], eax
:0041AFB8 8D45FC                  lea eax, dword ptr [ebp-04]
:0041AFBB 50                      push eax
:0041AFBC 8B4508                  mov eax, dword ptr [ebp+08]
:0041AFBF 50                      push eax
:0041AFC0 E8BB320000              call 0041E280
:0041AFC5 83C408                  add esp, 00000008
:0041AFC8 85C0                    test eax, eax
:0041AFCA 0F8407000000            je 0041AFD7
:0041AFD0 B0FF                    mov al, FF
:0041AFD2 E9BC050000              jmp 0041B593

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041AFCA(C)
|
:0041AFD7 68FF000000              push 000000FF
:0041AFDC 33C0                    xor eax, eax
:0041AFDE A0C8FC4600              mov al, byte ptr [0046FCC8]
:0041AFE3 33C9                    xor ecx, ecx
:0041AFE5 8A0DC9FC4600            mov cl, byte ptr [0046FCC9]
:0041AFEB 0FAFC1                  imul eax, ecx
:0041AFEE 50                      push eax
:0041AFEF 8B45C4                  mov eax, dword ptr [ebp-3C]
:0041AFF2 50                      push eax
:0041AFF3 E86BC40200              call 00447463
:0041AFF8 83C40C                  add esp, 0000000C
:0041AFFB 6A04                    push 00000004
:0041AFFD 6A00                    push 00000000
:0041AFFF 6A00                    push 00000000
:0041B001 B950F94600              mov ecx, 0046F950
:0041B006 E815C70200              call 00447720
:0041B00B 894598                  mov dword ptr [ebp-68], eax
:0041B00E 8B4598                  mov eax, dword ptr [ebp-68]
:0041B011 C680A8300000FF          mov byte ptr [eax+000030A8], FF
:0041B018 8B4508                  mov eax, dword ptr [ebp+08]
:0041B01B 33C9                    xor ecx, ecx
:0041B01D 8A4801                  mov cl, byte ptr [eax+01]
:0041B020 33C0                    xor eax, eax
:0041B022 A0C8FC4600              mov al, byte ptr [0046FCC8]
:0041B027 0FAFC8                  imul ecx, eax
:0041B02A 8B4508                  mov eax, dword ptr [ebp+08]
:0041B02D 33D2                    xor edx, edx
:0041B02F 8A10                    mov dl, byte ptr [eax]
:0041B031 03CA                    add ecx, edx
:0041B033 8B45C4                  mov eax, dword ptr [ebp-3C]
:0041B036 C6040100                mov byte ptr [ecx+eax], 00
:0041B03A 33C0                    xor eax, eax
:0041B03C 8A4510                  mov al, byte ptr [ebp+10]
:0041B03F A804                    test al, 04
:0041B041 0F84F5000000            je 0041B13C
:0041B047 C605C0A6460000          mov byte ptr [0046A6C0], 00
:0041B04E C605BCA64600FF          mov byte ptr [0046A6BC], FF
:0041B055 C605B0A64600FF          mov byte ptr [0046A6B0], FF
:0041B05C C605C8A64600FF          mov byte ptr [0046A6C8], FF
:0041B063 8B4594                  mov eax, dword ptr [ebp-6C]
:0041B066 8B00                    mov eax, dword ptr [eax]
:0041B068 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041B06B 03C0                    add eax, eax
:0041B06D 8D04C0                  lea eax, dword ptr [eax+8*eax]
:0041B070 05E8564500              add eax, 004556E8
:0041B075 8945AC                  mov dword ptr [ebp-54], eax
:0041B078 B808494500              mov eax, 00454908
:0041B07D 83C064                  add eax, 00000064
:0041B080 8945B0                  mov dword ptr [ebp-50], eax
:0041B083 C645A800                mov [ebp-58], 00
:0041B087 E903000000              jmp 0041B08F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B11B(U)
|
:0041B08C FE45A8                  inc [ebp-58]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B087(U)
|
:0041B08F 33C0                    xor eax, eax
:0041B091 8A45A8                  mov al, byte ptr [ebp-58]
:0041B094 83F830                  cmp eax, 00000030
:0041B097 0F8D83000000            jnl 0041B120
:0041B09D 8B4DAC                  mov ecx, dword ptr [ebp-54]
:0041B0A0 E82BE2FEFF              call 004092D0
:0041B0A5 33C9                    xor ecx, ecx
:0041B0A7 8AC8                    mov cl, al
:0041B0A9 33C0                    xor eax, eax
:0041B0AB 8A45A8                  mov al, byte ptr [ebp-58]
:0041B0AE 8D0480                  lea eax, dword ptr [eax+4*eax]
:0041B0B1 33D2                    xor edx, edx
:0041B0B3 8A94C118D34400          mov dl, byte ptr [ecx+8*eax+0044D318]
:0041B0BA 85D2                    test edx, edx
:0041B0BC 0F8459000000            je 0041B11B
:0041B0C2 8B4DAC                  mov ecx, dword ptr [ebp-54]
:0041B0C5 E806E2FEFF              call 004092D0
:0041B0CA 33C9                    xor ecx, ecx
:0041B0CC 8AC8                    mov cl, al
:0041B0CE 33C0                    xor eax, eax
:0041B0D0 8A45A8                  mov al, byte ptr [ebp-58]
:0041B0D3 8D0480                  lea eax, dword ptr [eax+4*eax]
:0041B0D6 33DB                    xor ebx, ebx
:0041B0D8 8A9CC118D34400          mov bl, byte ptr [ecx+8*eax+0044D318]
:0041B0DF 8B4DAC                  mov ecx, dword ptr [ebp-54]
:0041B0E2 E899E1FEFF              call 00409280
:0041B0E7 33C9                    xor ecx, ecx
:0041B0E9 8AC8                    mov cl, al
:0041B0EB 3BD9                    cmp ebx, ecx
:0041B0ED 0F8F28000000            jg 0041B11B
:0041B0F3 33C0                    xor eax, eax
:0041B0F5 8A45A8                  mov al, byte ptr [ebp-58]
:0041B0F8 33C9                    xor ecx, ecx
:0041B0FA 8A88E0D24400            mov cl, byte ptr [eax+0044D2E0]
:0041B100 8B4594                  mov eax, dword ptr [ebp-6C]
:0041B103 33D2                    xor edx, edx
:0041B105 8A5013                  mov dl, byte ptr [eax+13]
:0041B108 3BCA                    cmp ecx, edx
:0041B10A 0F8F0B000000            jg 0041B11B
:0041B110 8A45A8                  mov al, byte ptr [ebp-58]
:0041B113 8B4DB0                  mov ecx, dword ptr [ebp-50]
:0041B116 8801                    mov byte ptr [ecx], al
:0041B118 FF45B0                  inc [ebp-50]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041B0BC(C), :0041B0ED(C), :0041B10A(C)
|
:0041B11B E96CFFFFFF              jmp 0041B08C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B097(C)
|
:0041B120 8B45B0                  mov eax, dword ptr [ebp-50]
:0041B123 C600FF                  mov byte ptr [eax], FF
:0041B126 837DDC00                cmp dword ptr [ebp-24], 00000000
:0041B12A 0F850C000000            jne 0041B13C
:0041B130 8B4508                  mov eax, dword ptr [ebp+08]
:0041B133 50                      push eax
:0041B134 8B4D94                  mov ecx, dword ptr [ebp-6C]
:0041B137 E80C200000              call 0041D148

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041B041(C), :0041B12A(C)
|
:0041B13C 8B4508                  mov eax, dword ptr [ebp+08]
:0041B13F 50                      push eax
:0041B140 E895E4FFFF              call 004195DA
:0041B145 83C404                  add esp, 00000004
:0041B148 8845EC                  mov byte ptr [ebp-14], al
:0041B14B 8B45EC                  mov eax, dword ptr [ebp-14]
:0041B14E 50                      push eax
:0041B14F 8B4D94                  mov ecx, dword ptr [ebp-6C]
:0041B152 E882F10000              call 0042A2D9
:0041B157 33C9                    xor ecx, ecx
:0041B159 8AC8                    mov cl, al
:0041B15B 81F9FF000000            cmp ecx, 000000FF
:0041B161 0F8507000000            jne 0041B16E
:0041B167 B0FF                    mov al, FF
:0041B169 E925040000              jmp 0041B593

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B161(C)
|
:0041B16E C645E400                mov [ebp-1C], 00
:0041B172 E906000000              jmp 0041B17D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B587(U)
|
:0041B177 8A45B8                  mov al, byte ptr [ebp-48]
:0041B17A 8845E4                  mov byte ptr [ebp-1C], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B172(U)
|
:0041B17D 837DB400                cmp dword ptr [ebp-4C], 00000000
:0041B181 0F8405040000            je 0041B58C
:0041B187 33C0                    xor eax, eax
:0041B189 8A450C                  mov al, byte ptr [ebp+0C]
:0041B18C 33C9                    xor ecx, ecx
:0041B18E 8A4DE4                  mov cl, byte ptr [ebp-1C]
:0041B191 3BC1                    cmp eax, ecx
:0041B193 0F8EF3030000            jle 0041B58C
:0041B199 C745B400000000          mov [ebp-4C], 00000000
:0041B1A0 C645B8FF                mov [ebp-48], FF
:0041B1A4 C645D4FF                mov [ebp-2C], FF
:0041B1A8 C745CC00000000          mov [ebp-34], 00000000
:0041B1AF E903000000              jmp 0041B1B7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B582(U)
|
:0041B1B4 FF45CC                  inc [ebp-34]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B1AF(U)
|
:0041B1B7 33C0                    xor eax, eax
:0041B1B9 A0C9FC4600              mov al, byte ptr [0046FCC9]
:0041B1BE 3B45CC                  cmp eax, dword ptr [ebp-34]
:0041B1C1 0F86C0030000            jbe 0041B587
:0041B1C7 C745D000000000          mov [ebp-30], 00000000
:0041B1CE E903000000              jmp 0041B1D6

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041B249(U), :0041B2A0(U), :0041B539(U)
|
:0041B1D3 FF45D0                  inc [ebp-30]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B1CE(U)
|
:0041B1D6 33C0                    xor eax, eax
:0041B1D8 A0C8FC4600              mov al, byte ptr [0046FCC8]
:0041B1DD 3B45D0                  cmp eax, dword ptr [ebp-30]
:0041B1E0 0F8658030000            jbe 0041B53E
:0041B1E6 33C0                    xor eax, eax
:0041B1E8 A0C8FC4600              mov al, byte ptr [0046FCC8]
:0041B1ED 0FAF45CC                imul eax, dword ptr [ebp-34]
:0041B1F1 0345D0                  add eax, dword ptr [ebp-30]
:0041B1F4 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:0041B1F7 8A0408                  mov al, byte ptr [eax+ecx]
:0041B1FA 8845A4                  mov byte ptr [ebp-5C], al
:0041B1FD 33C0                    xor eax, eax
:0041B1FF 8A45A4                  mov al, byte ptr [ebp-5C]
:0041B202 33C9                    xor ecx, ecx
:0041B204 8A4DE4                  mov cl, byte ptr [ebp-1C]
:0041B207 3BC1                    cmp eax, ecx
:0041B209 0F8E28000000            jle 0041B237
:0041B20F 33C0                    xor eax, eax
:0041B211 8A45A4                  mov al, byte ptr [ebp-5C]
:0041B214 3DFF000000              cmp eax, 000000FF
:0041B219 0F8418000000            je 0041B237
:0041B21F 33C0                    xor eax, eax
:0041B221 8A45A4                  mov al, byte ptr [ebp-5C]
:0041B224 33C9                    xor ecx, ecx
:0041B226 8A4DD4                  mov cl, byte ptr [ebp-2C]
:0041B229 3BC1                    cmp eax, ecx
:0041B22B 0F8D06000000            jnl 0041B237
:0041B231 8A45A4                  mov al, byte ptr [ebp-5C]
:0041B234 8845D4                  mov byte ptr [ebp-2C], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041B209(C), :0041B219(C), :0041B22B(C)
|
:0041B237 33C0                    xor eax, eax
:0041B239 8A45A4                  mov al, byte ptr [ebp-5C]
:0041B23C 33C9                    xor ecx, ecx
:0041B23E 8A4DE4                  mov cl, byte ptr [ebp-1C]
:0041B241 3BC1                    cmp eax, ecx
:0041B243 0F8405000000            je 0041B24E
:0041B249 E985FFFFFF              jmp 0041B1D3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B243(C)
|
:0041B24E 8A45D0                  mov al, byte ptr [ebp-30]
:0041B251 8845F0                  mov byte ptr [ebp-10], al
:0041B254 8A45CC                  mov al, byte ptr [ebp-34]
:0041B257 8845F1                  mov byte ptr [ebp-0F], al
:0041B25A 8D45F0                  lea eax, dword ptr [ebp-10]
:0041B25D 50                      push eax
:0041B25E 8B4508                  mov eax, dword ptr [ebp+08]
:0041B261 50                      push eax
:0041B262 E819300000              call 0041E280
:0041B267 83C408                  add esp, 00000008
:0041B26A 85C0                    test eax, eax
:0041B26C 0F8533000000            jne 0041B2A5
:0041B272 837D1C00                cmp dword ptr [ebp+1C], 00000000
:0041B276 0F8429000000            je 0041B2A5
:0041B27C 837DDC00                cmp dword ptr [ebp-24], 00000000
:0041B280 0F851F000000            jne 0041B2A5
:0041B286 33C0                    xor eax, eax
:0041B288 8A45D8                  mov al, byte ptr [ebp-28]
:0041B28B 50                      push eax
:0041B28C 8D45F0                  lea eax, dword ptr [ebp-10]
:0041B28F 50                      push eax
:0041B290 E897DFFFFF              call 0041922C
:0041B295 83C408                  add esp, 00000008
:0041B298 85C0                    test eax, eax
:0041B29A 0F8405000000            je 0041B2A5
:0041B2A0 E92EFFFFFF              jmp 0041B1D3

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041B26C(C), :0041B276(C), :0041B280(C), :0041B29A(C)
|
:0041B2A5 C745C800000000          mov [ebp-38], 00000000
:0041B2AC E903000000              jmp 0041B2B4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041B2E7(U), :0041B3E0(U), :0041B534(U)
|
:0041B2B1 FF45C8                  inc [ebp-38]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B2AC(U)
|
:0041B2B4 837DC804                cmp dword ptr [ebp-38], 00000004
:0041B2B8 0F837B020000            jnb 0041B539
:0041B2BE 8B45C8                  mov eax, dword ptr [ebp-38]
:0041B2C1 50                      push eax
:0041B2C2 8D45F0                  lea eax, dword ptr [ebp-10]
:0041B2C5 50                      push eax
:0041B2C6 E88AE3FFFF              call 00419655
:0041B2CB 83C408                  add esp, 00000008
:0041B2CE 50                      push eax
:0041B2CF 8D4DE0                  lea ecx, dword ptr [ebp-20]
:0041B2D2 E8B965FEFF              call 00401890
:0041B2D7 33C0                    xor eax, eax
:0041B2D9 8A45E0                  mov al, byte ptr [ebp-20]
:0041B2DC 3DFF000000              cmp eax, 000000FF
:0041B2E1 0F8505000000            jne 0041B2EC
:0041B2E7 E9C5FFFFFF              jmp 0041B2B1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B2E1(C)
|
:0041B2EC 33C0                    xor eax, eax
:0041B2EE A0C8FC4600              mov al, byte ptr [0046FCC8]
:0041B2F3 33C9                    xor ecx, ecx
:0041B2F5 8A4DE1                  mov cl, byte ptr [ebp-1F]
:0041B2F8 0FAFC1                  imul eax, ecx
:0041B2FB 33C9                    xor ecx, ecx
:0041B2FD 8A4DE0                  mov cl, byte ptr [ebp-20]
:0041B300 03C1                    add eax, ecx
:0041B302 8945C0                  mov dword ptr [ebp-40], eax
:0041B305 8B45C0                  mov eax, dword ptr [ebp-40]
:0041B308 0345C4                  add eax, dword ptr [ebp-3C]
:0041B30B 8945F4                  mov dword ptr [ebp-0C], eax
:0041B30E 6A04                    push 00000004
:0041B310 6A00                    push 00000000
:0041B312 6A00                    push 00000000
:0041B314 B950F94600              mov ecx, 0046F950
:0041B319 E802C40200              call 00447720
:0041B31E 8B4DC0                  mov ecx, dword ptr [ebp-40]
:0041B321 03C8                    add ecx, eax
:0041B323 81C180250000            add ecx, 00002580
:0041B329 894DE8                  mov dword ptr [ebp-18], ecx
:0041B32C 6A04                    push 00000004
:0041B32E 6A00                    push 00000000
:0041B330 6A00                    push 00000000
:0041B332 B918E54600              mov ecx, 0046E518
:0041B337 E8E4C30200              call 00447720
:0041B33C 8B4DC0                  mov ecx, dword ptr [ebp-40]
:0041B33F 03C8                    add ecx, eax
:0041B341 81C1C0030000            add ecx, 000003C0
:0041B347 894DBC                  mov dword ptr [ebp-44], ecx
:0041B34A 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041B34D 33C9                    xor ecx, ecx
:0041B34F 8A08                    mov cl, byte ptr [eax]
:0041B351 81F9FF000000            cmp ecx, 000000FF
:0041B357 0F85D7010000            jne 0041B534
:0041B35D 8D45E0                  lea eax, dword ptr [ebp-20]
:0041B360 50                      push eax
:0041B361 E874E2FFFF              call 004195DA
:0041B366 83C404                  add esp, 00000004
:0041B369 8845A0                  mov byte ptr [ebp-60], al
:0041B36C 8B45A0                  mov eax, dword ptr [ebp-60]
:0041B36F 50                      push eax
:0041B370 8B4D94                  mov ecx, dword ptr [ebp-6C]
:0041B373 E861EF0000              call 0042A2D9
:0041B378 88459C                  mov byte ptr [ebp-64], al
:0041B37B 33C0                    xor eax, eax
:0041B37D 8A459C                  mov al, byte ptr [ebp-64]
:0041B380 3DFF000000              cmp eax, 000000FF
:0041B385 0F8455000000            je 0041B3E0
:0041B38B 33C0                    xor eax, eax
:0041B38D 8A45A4                  mov al, byte ptr [ebp-5C]
:0041B390 33C9                    xor ecx, ecx
:0041B392 8A4D9C                  mov cl, byte ptr [ebp-64]
:0041B395 03C1                    add eax, ecx
:0041B397 33C9                    xor ecx, ecx
:0041B399 8A4D0C                  mov cl, byte ptr [ebp+0C]
:0041B39C 3BC1                    cmp eax, ecx
:0041B39E 0F8F3C000000            jg 0041B3E0
:0041B3A4 8B45E8                  mov eax, dword ptr [ebp-18]
:0041B3A7 33C9                    xor ecx, ecx
:0041B3A9 8A08                    mov cl, byte ptr [eax]
:0041B3AB 81F9FF000000            cmp ecx, 000000FF
:0041B3B1 0F842E000000            je 0041B3E5
:0041B3B7 8B45E8                  mov eax, dword ptr [ebp-18]
:0041B3BA 33C9                    xor ecx, ecx
:0041B3BC 8A08                    mov cl, byte ptr [eax]
:0041B3BE 8BC1                    mov eax, ecx
:0041B3C0 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:0041B3C3 C1E103                  shl ecx, 03
:0041B3C6 2BC8                    sub ecx, eax
:0041B3C8 8D8998C04600            lea ecx, dword ptr [ecx+0046C098]
:0041B3CE E84DDEFEFF              call 00409220
:0041B3D3 33C9                    xor ecx, ecx
:0041B3D5 8A4DD8                  mov cl, byte ptr [ebp-28]
:0041B3D8 3BC1                    cmp eax, ecx
:0041B3DA 0F8405000000            je 0041B3E5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041B385(C), :0041B39E(C)
|
:0041B3E0 E9CCFEFFFF              jmp 0041B2B1

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041B3B1(C), :0041B3DA(C)
|
:0041B3E5 33C0                    xor eax, eax
:0041B3E7 8A45A4                  mov al, byte ptr [ebp-5C]
:0041B3EA 33C9                    xor ecx, ecx
:0041B3EC 8A4D9C                  mov cl, byte ptr [ebp-64]
:0041B3EF 03C1                    add eax, ecx
:0041B3F1 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041B3F4 8801                    mov byte ptr [ecx], al
:0041B3F6 C745B401000000          mov [ebp-4C], 00000001
:0041B3FD 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041B400 33C9                    xor ecx, ecx
:0041B402 8A08                    mov cl, byte ptr [eax]
:0041B404 33C0                    xor eax, eax
:0041B406 8A45B8                  mov al, byte ptr [ebp-48]
:0041B409 3BC8                    cmp ecx, eax
:0041B40B 0F8D5B000000            jnl 0041B46C
:0041B411 837D1C00                cmp dword ptr [ebp+1C], 00000000
:0041B415 0F8449000000            je 0041B464
:0041B41B 837DDC00                cmp dword ptr [ebp-24], 00000000
:0041B41F 0F853F000000            jne 0041B464
:0041B425 33C0                    xor eax, eax
:0041B427 8A45D8                  mov al, byte ptr [ebp-28]
:0041B42A 50                      push eax
:0041B42B 8D45E0                  lea eax, dword ptr [ebp-20]
:0041B42E 50                      push eax
:0041B42F E8F8DDFFFF              call 0041922C
:0041B434 83C408                  add esp, 00000008
:0041B437 85C0                    test eax, eax
:0041B439 0F8520000000            jne 0041B45F
:0041B43F 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041B442 8A00                    mov al, byte ptr [eax]
:0041B444 8845B8                  mov byte ptr [ebp-48], al
:0041B447 33C0                    xor eax, eax
:0041B449 8A45D4                  mov al, byte ptr [ebp-2C]
:0041B44C 33C9                    xor ecx, ecx
:0041B44E 8A4DB8                  mov cl, byte ptr [ebp-48]
:0041B451 3BC1                    cmp eax, ecx
:0041B453 0F8D06000000            jnl 0041B45F
:0041B459 8A45D4                  mov al, byte ptr [ebp-2C]
:0041B45C 8845B8                  mov byte ptr [ebp-48], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041B439(C), :0041B453(C)
|
:0041B45F E908000000              jmp 0041B46C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041B415(C), :0041B41F(C)
|
:0041B464 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041B467 8A00                    mov al, byte ptr [eax]
:0041B469 8845B8                  mov byte ptr [ebp-48], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041B40B(C), :0041B45F(U)
|
:0041B46C 33C0                    xor eax, eax
:0041B46E 8A4510                  mov al, byte ptr [ebp+10]
:0041B471 A808                    test al, 08
:0041B473 0F8476000000            je 0041B4EF
:0041B479 6A04                    push 00000004
:0041B47B 6A00                    push 00000000
:0041B47D 6A00                    push 00000000
:0041B47F B918E54600              mov ecx, 0046E518
:0041B484 E897C20200              call 00447720
:0041B489 8B4DC0                  mov ecx, dword ptr [ebp-40]
:0041B48C 33D2                    xor edx, edx
:0041B48E 8A1401                  mov dl, byte ptr [ecx+eax]
:0041B491 81FAFF000000            cmp edx, 000000FF
:0041B497 0F8452000000            je 0041B4EF
:0041B49D 6A20                    push 00000020
:0041B49F 6A04                    push 00000004
:0041B4A1 6A00                    push 00000000
:0041B4A3 6A00                    push 00000000
:0041B4A5 B918E54600              mov ecx, 0046E518
:0041B4AA E871C20200              call 00447720
:0041B4AF 8B4DC0                  mov ecx, dword ptr [ebp-40]
:0041B4B2 33D2                    xor edx, edx
:0041B4B4 8A1401                  mov dl, byte ptr [ecx+eax]
:0041B4B7 8BC2                    mov eax, edx
:0041B4B9 8D0C52                  lea ecx, dword ptr [edx+2*edx]
:0041B4BC C1E103                  shl ecx, 03
:0041B4BF 2BC8                    sub ecx, eax
:0041B4C1 8D8998C04600            lea ecx, dword ptr [ecx+0046C098]
:0041B4C7 E894DEFEFF              call 00409360
:0041B4CC 85C0                    test eax, eax
:0041B4CE 0F841B000000            je 0041B4EF
:0041B4D4 6A04                    push 00000004
:0041B4D6 6A00                    push 00000000
:0041B4D8 6A00                    push 00000000
:0041B4DA B918E54600              mov ecx, 0046E518
:0041B4DF E83CC20200              call 00447720
:0041B4E4 8B4DC0                  mov ecx, dword ptr [ebp-40]
:0041B4E7 8A0401                  mov al, byte ptr [ecx+eax]
:0041B4EA E9A4000000              jmp 0041B593

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041B473(C), :0041B497(C), :0041B4CE(C)
|
:0041B4EF 33C0                    xor eax, eax
:0041B4F1 8A4510                  mov al, byte ptr [ebp+10]
:0041B4F4 A802                    test al, 02
:0041B4F6 0F841F000000            je 0041B51B
:0041B4FC 8D45FC                  lea eax, dword ptr [ebp-04]
:0041B4FF 50                      push eax
:0041B500 8D45E0                  lea eax, dword ptr [ebp-20]
:0041B503 50                      push eax
:0041B504 E8772D0000              call 0041E280
:0041B509 83C408                  add esp, 00000008
:0041B50C 85C0                    test eax, eax
:0041B50E 0F8407000000            je 0041B51B
:0041B514 B001                    mov al, 01
:0041B516 E978000000              jmp 0041B593

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041B4F6(C), :0041B50E(C)
|
:0041B51B 33C0                    xor eax, eax
:0041B51D 8A4510                  mov al, byte ptr [ebp+10]
:0041B520 A804                    test al, 04
:0041B522 0F840C000000            je 0041B534
:0041B528 8D45E0                  lea eax, dword ptr [ebp-20]
:0041B52B 50                      push eax
:0041B52C 8B4D94                  mov ecx, dword ptr [ebp-6C]
:0041B52F E8141C0000              call 0041D148

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041B357(C), :0041B522(C)
|
:0041B534 E978FDFFFF              jmp 0041B2B1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B2B8(C)
|
:0041B539 E995FCFFFF              jmp 0041B1D3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B1E0(C)
|
:0041B53E 837DB400                cmp dword ptr [ebp-4C], 00000000
:0041B542 0F8522000000            jne 0041B56A
:0041B548 33C0                    xor eax, eax
:0041B54A 8A45D4                  mov al, byte ptr [ebp-2C]
:0041B54D 3DFF000000              cmp eax, 000000FF
:0041B552 0F840D000000            je 0041B565
:0041B558 8A45D4                  mov al, byte ptr [ebp-2C]
:0041B55B 8845B8                  mov byte ptr [ebp-48], al
:0041B55E C745B401000000          mov [ebp-4C], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B552(C)
|
:0041B565 E918000000              jmp 0041B582

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B542(C)
|
:0041B56A 33C0                    xor eax, eax
:0041B56C 8A45D4                  mov al, byte ptr [ebp-2C]
:0041B56F 33C9                    xor ecx, ecx
:0041B571 8A4DB8                  mov cl, byte ptr [ebp-48]
:0041B574 3BC1                    cmp eax, ecx
:0041B576 0F8D06000000            jnl 0041B582
:0041B57C 8A45D4                  mov al, byte ptr [ebp-2C]
:0041B57F 8845B8                  mov byte ptr [ebp-48], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041B565(U), :0041B576(C)
|
:0041B582 E92DFCFFFF              jmp 0041B1B4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B1C1(C)
|
:0041B587 E9EBFBFFFF              jmp 0041B177

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041B181(C), :0041B193(C)
|
:0041B58C B0FF                    mov al, FF
:0041B58E E900000000              jmp 0041B593

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041AFD2(U), :0041B169(U), :0041B4EA(U), :0041B516(U), :0041B58E(U)
|
:0041B593 5F                      pop edi
:0041B594 5E                      pop esi
:0041B595 5B                      pop ebx
:0041B596 C9                      leave
:0041B597 C21800                  ret 0018



* Referenced by a CALL at Address:
|:0041BDA2   
|
:0041B59A 55                      push ebp
:0041B59B 8BEC                    mov ebp, esp
:0041B59D 83EC10                  sub esp, 00000010
:0041B5A0 53                      push ebx
:0041B5A1 56                      push esi
:0041B5A2 57                      push edi
:0041B5A3 894DF0                  mov dword ptr [ebp-10], ecx
:0041B5A6 68FF000000              push 000000FF
:0041B5AB 68C0030000              push 000003C0
:0041B5B0 6A04                    push 00000004
:0041B5B2 6A00                    push 00000000
:0041B5B4 6A00                    push 00000000
:0041B5B6 B950F94600              mov ecx, 0046F950
:0041B5BB E860C10200              call 00447720
:0041B5C0 05E82C0000              add eax, 00002CE8
:0041B5C5 50                      push eax
:0041B5C6 E898BE0200              call 00447463
:0041B5CB 83C40C                  add esp, 0000000C
:0041B5CE 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0041B5D1 E8CADCFEFF              call 004092A0
:0041B5D6 8845F8                  mov byte ptr [ebp-08], al
:0041B5D9 6A00                    push 00000000
:0041B5DB 6A00                    push 00000000
:0041B5DD 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0041B5E0 E889ED0000              call 0042A36E
:0041B5E5 50                      push eax
:0041B5E6 8B45F0                  mov eax, dword ptr [ebp-10]
:0041B5E9 83C005                  add eax, 00000005
:0041B5EC 50                      push eax
:0041B5ED 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0041B5F0 E8DCE1FFFF              call 004197D1
:0041B5F5 8845FC                  mov byte ptr [ebp-04], al
:0041B5F8 6A04                    push 00000004
:0041B5FA 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0041B5FD E85EDDFEFF              call 00409360
:0041B602 85C0                    test eax, eax
:0041B604 0F8515000000            jne 0041B61F
:0041B60A 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0041B60D E8BEDDFEFF              call 004093D0
:0041B612 33C9                    xor ecx, ecx
:0041B614 8AC8                    mov cl, al
:0041B616 83F904                  cmp ecx, 00000004
:0041B619 0F8505000000            jne 0041B624

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B604(C)
|
:0041B61F E9C4000000              jmp 0041B6E8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B619(C)
|
:0041B624 33C0                    xor eax, eax
:0041B626 8A45FC                  mov al, byte ptr [ebp-04]
:0041B629 3DFF000000              cmp eax, 000000FF
:0041B62E 0F84AF000000            je 0041B6E3
:0041B634 6880000000              push 00000080
:0041B639 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0041B63C E81FDDFEFF              call 00409360
:0041B641 85C0                    test eax, eax
:0041B643 0F859A000000            jne 0041B6E3
:0041B649 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0041B64C E87FDDFEFF              call 004093D0
:0041B651 33C9                    xor ecx, ecx
:0041B653 8AC8                    mov cl, al
:0041B655 83F904                  cmp ecx, 00000004
:0041B658 0F8485000000            je 0041B6E3
:0041B65E 33C0                    xor eax, eax
:0041B660 8A45FC                  mov al, byte ptr [ebp-04]
:0041B663 8BC8                    mov ecx, eax
:0041B665 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041B668 C1E003                  shl eax, 03
:0041B66B 2BC1                    sub eax, ecx
:0041B66D 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041B673 E888DBFEFF              call 00409200
:0041B678 668B00                  mov ax, word ptr [eax]
:0041B67B 668945F4                mov word ptr [ebp-0C], ax
:0041B67F 8B45FC                  mov eax, dword ptr [ebp-04]
:0041B682 50                      push eax
:0041B683 8B45F0                  mov eax, dword ptr [ebp-10]
:0041B686 8A4004                  mov al, byte ptr [eax+04]
:0041B689 50                      push eax
:0041B68A E84EDCFFFF              call 004192DD
:0041B68F 83C408                  add esp, 00000008
:0041B692 6A01                    push 00000001
:0041B694 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0041B697 E8CF110100              call 0042C86B
:0041B69C 6A00                    push 00000000
:0041B69E 6A01                    push 00000001
:0041B6A0 33C0                    xor eax, eax
:0041B6A2 8A45FC                  mov al, byte ptr [ebp-04]
:0041B6A5 8BC8                    mov ecx, eax
:0041B6A7 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041B6AA C1E003                  shl eax, 03
:0041B6AD 2BC1                    sub eax, ecx
:0041B6AF 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041B6B5 E8162C0000              call 0041E2D0
:0041B6BA 50                      push eax
:0041B6BB 8B45F0                  mov eax, dword ptr [ebp-10]
:0041B6BE 8A4004                  mov al, byte ptr [eax+04]
:0041B6C1 50                      push eax
:0041B6C2 B9D8BC4600              mov ecx, 0046BCD8
:0041B6C7 E83C8D0000              call 00424408
:0041B6CC 6880000000              push 00000080
:0041B6D1 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0041B6D4 E8EB260100              call 0042DDC4
:0041B6D9 B900FB4600              mov ecx, 0046FB00
:0041B6DE E8BDE1FEFF              call 004098A0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041B62E(C), :0041B643(C), :0041B658(C)
|
:0041B6E3 E900000000              jmp 0041B6E8

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041B61F(U), :0041B6E3(U)
|
:0041B6E8 5F                      pop edi
:0041B6E9 5E                      pop esi
:0041B6EA 5B                      pop ebx
:0041B6EB C9                      leave
:0041B6EC C3                      ret



* Referenced by a CALL at Addresses:
|:00427B87   , :00442AF9   
|
:0041B6ED 55                      push ebp
:0041B6EE 8BEC                    mov ebp, esp
:0041B6F0 83EC18                  sub esp, 00000018
:0041B6F3 53                      push ebx
:0041B6F4 56                      push esi
:0041B6F5 57                      push edi
:0041B6F6 894DEC                  mov dword ptr [ebp-14], ecx
:0041B6F9 C645FCFF                mov [ebp-04], FF
:0041B6FD 6A04                    push 00000004
:0041B6FF 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041B702 E859DCFEFF              call 00409360
:0041B707 85C0                    test eax, eax
:0041B709 0F8409000000            je 0041B718
:0041B70F C645F464                mov [ebp-0C], 64
:0041B713 E90B000000              jmp 0041B723

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B709(C)
|
:0041B718 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041B71B E843EB0000              call 0042A263
:0041B720 8845F4                  mov byte ptr [ebp-0C], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B713(U)
|
:0041B723 8D4DF8                  lea ecx, dword ptr [ebp-08]
:0041B726 E84561FEFF              call 00401870
:0041B72B C60598A64600FF          mov byte ptr [0046A698], FF
:0041B732 C705ACA6460000000000    mov dword ptr [0046A6AC], 00000000
:0041B73C 8B45EC                  mov eax, dword ptr [ebp-14]
:0041B73F 8B00                    mov eax, dword ptr [eax]
:0041B741 50                      push eax
:0041B742 B988C04600              mov ecx, 0046C088
:0041B747 E854DCFEFF              call 004093A0
:0041B74C 8B45EC                  mov eax, dword ptr [ebp-14]
:0041B74F 33C9                    xor ecx, ecx
:0041B751 8A4807                  mov cl, byte ptr [eax+07]
:0041B754 81F9FF000000            cmp ecx, 000000FF
:0041B75A 0F843B000000            je 0041B79B
:0041B760 8B45EC                  mov eax, dword ptr [ebp-14]
:0041B763 33C9                    xor ecx, ecx
:0041B765 8A4807                  mov cl, byte ptr [eax+07]
:0041B768 8BC1                    mov eax, ecx
:0041B76A 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:0041B76D C1E103                  shl ecx, 03
:0041B770 2BC8                    sub ecx, eax
:0041B772 8D8998C04600            lea ecx, dword ptr [ecx+0046C098]
:0041B778 E8B3E0FEFF              call 00409830
:0041B77D 33C9                    xor ecx, ecx
:0041B77F 8AC8                    mov cl, al
:0041B781 83F902                  cmp ecx, 00000002
:0041B784 0F8411000000            je 0041B79B
:0041B78A 8B45EC                  mov eax, dword ptr [ebp-14]
:0041B78D C64007FF                mov [eax+07], FF
:0041B791 6A01                    push 00000001
:0041B793 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041B796 E83B0C0100              call 0042C3D6

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041B75A(C), :0041B784(C)
|
:0041B79B 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041B79E E88DE0FEFF              call 00409830
:0041B7A3 33C9                    xor ecx, ecx
:0041B7A5 8AC8                    mov cl, al
:0041B7A7 83F902                  cmp ecx, 00000002
:0041B7AA 0F8567060000            jne 0041BE17
:0041B7B0 6880000000              push 00000080
:0041B7B5 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041B7B8 E8A3DBFEFF              call 00409360
:0041B7BD 85C0                    test eax, eax
:0041B7BF 0F8552060000            jne 0041BE17
:0041B7C5 8B45EC                  mov eax, dword ptr [ebp-14]
:0041B7C8 33C9                    xor ecx, ecx
:0041B7CA 8A4816                  mov cl, byte ptr [eax+16]
:0041B7CD F6C110                  test cl, 10
:0041B7D0 0F8508060000            jne 0041BDDE
:0041B7D6 68FF000000              push 000000FF
:0041B7DB 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041B7DE E862E7FFFF              call 00419F45
:0041B7E3 33C0                    xor eax, eax
:0041B7E5 A0C4A64600              mov al, byte ptr [0046A6C4]
:0041B7EA A801                    test al, 01
:0041B7EC 0F8458010000            je 0041B94A
:0041B7F2 6A04                    push 00000004
:0041B7F4 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041B7F7 E864DBFEFF              call 00409360
:0041B7FC 85C0                    test eax, eax
:0041B7FE 0F8546010000            jne 0041B94A
:0041B804 8B45EC                  mov eax, dword ptr [ebp-14]
:0041B807 33C9                    xor ecx, ecx
:0041B809 8A4804                  mov cl, byte ptr [eax+04]
:0041B80C 83F90F                  cmp ecx, 0000000F
:0041B80F 0F8435010000            je 0041B94A
:0041B815 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041B818 E803DAFEFF              call 00409220
:0041B81D 83F801                  cmp eax, 00000001
:0041B820 1BC0                    sbb eax, eax
:0041B822 83E00F                  and eax, 0000000F
:0041B825 8BC8                    mov ecx, eax
:0041B827 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041B82A C1E003                  shl eax, 03
:0041B82D 2BC1                    sub eax, ecx
:0041B82F 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041B835 E8C6D9FEFF              call 00409200
:0041B83A 50                      push eax
:0041B83B 8D4DF8                  lea ecx, dword ptr [ebp-08]
:0041B83E E84D60FEFF              call 00401890
:0041B843 8B45EC                  mov eax, dword ptr [ebp-14]
:0041B846 8A4004                  mov al, byte ptr [eax+04]
:0041B849 50                      push eax
:0041B84A 6A0A                    push 0000000A
:0041B84C 8D45F8                  lea eax, dword ptr [ebp-08]
:0041B84F 50                      push eax
:0041B850 E82FF5FFFF              call 0041AD84
:0041B855 83C40C                  add esp, 0000000C
:0041B858 6A01                    push 00000001
:0041B85A 8B45EC                  mov eax, dword ptr [ebp-14]
:0041B85D 8A4006                  mov al, byte ptr [eax+06]
:0041B860 50                      push eax
:0041B861 8B45EC                  mov eax, dword ptr [ebp-14]
:0041B864 8A4005                  mov al, byte ptr [eax+05]
:0041B867 50                      push eax
:0041B868 6A02                    push 00000002
:0041B86A 68FF000000              push 000000FF
:0041B86F 8D45F8                  lea eax, dword ptr [ebp-08]
:0041B872 50                      push eax
:0041B873 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041B876 E8CEF6FFFF              call 0041AF49
:0041B87B 33C9                    xor ecx, ecx
:0041B87D 8AC8                    mov cl, al
:0041B87F 83F901                  cmp ecx, 00000001
:0041B882 0F8483000000            je 0041B90B
:0041B888 6A00                    push 00000000
:0041B88A 8B45EC                  mov eax, dword ptr [ebp-14]
:0041B88D 8A4006                  mov al, byte ptr [eax+06]
:0041B890 50                      push eax
:0041B891 8B45EC                  mov eax, dword ptr [ebp-14]
:0041B894 8A4005                  mov al, byte ptr [eax+05]
:0041B897 50                      push eax
:0041B898 6A02                    push 00000002
:0041B89A 68FF000000              push 000000FF
:0041B89F 8D45F8                  lea eax, dword ptr [ebp-08]
:0041B8A2 50                      push eax
:0041B8A3 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041B8A6 E89EF6FFFF              call 0041AF49
:0041B8AB 33C9                    xor ecx, ecx
:0041B8AD 8AC8                    mov cl, al
:0041B8AF 81F9FF000000            cmp ecx, 000000FF
:0041B8B5 0F843F000000            je 0041B8FA
:0041B8BB 6A01                    push 00000001
:0041B8BD 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041B8C0 50                      push eax
:0041B8C1 8B45EC                  mov eax, dword ptr [ebp-14]
:0041B8C4 83C005                  add eax, 00000005
:0041B8C7 50                      push eax
:0041B8C8 8D45F8                  lea eax, dword ptr [ebp-08]
:0041B8CB 50                      push eax
:0041B8CC 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041B8CF E86FF1FFFF              call 0041AA43
:0041B8D4 6A01                    push 00000001
:0041B8D6 68FF000000              push 000000FF
:0041B8DB 68FF000000              push 000000FF
:0041B8E0 6A04                    push 00000004
:0041B8E2 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041B8E5 50                      push eax
:0041B8E6 8B45EC                  mov eax, dword ptr [ebp-14]
:0041B8E9 83C005                  add eax, 00000005
:0041B8EC 50                      push eax
:0041B8ED 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041B8F0 E854F6FFFF              call 0041AF49
:0041B8F5 E90C000000              jmp 0041B906

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B8B5(C)
|
:0041B8FA 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041B8FD 50                      push eax
:0041B8FE 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041B901 E868270000              call 0041E06E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B8F5(U)
|
:0041B906 E93A000000              jmp 0041B945

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B882(C)
|
:0041B90B 6A01                    push 00000001
:0041B90D 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041B910 50                      push eax
:0041B911 8B45EC                  mov eax, dword ptr [ebp-14]
:0041B914 83C005                  add eax, 00000005
:0041B917 50                      push eax
:0041B918 8D45F8                  lea eax, dword ptr [ebp-08]
:0041B91B 50                      push eax
:0041B91C 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041B91F E81FF1FFFF              call 0041AA43
:0041B924 6A01                    push 00000001
:0041B926 68FF000000              push 000000FF
:0041B92B 68FF000000              push 000000FF
:0041B930 6A04                    push 00000004
:0041B932 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041B935 50                      push eax
:0041B936 8B45EC                  mov eax, dword ptr [ebp-14]
:0041B939 83C005                  add eax, 00000005
:0041B93C 50                      push eax
:0041B93D 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041B940 E804F6FFFF              call 0041AF49

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B906(U)
|
:0041B945 E90C040000              jmp 0041BD56

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041B7EC(C), :0041B7FE(C), :0041B80F(C)
|
:0041B94A 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041B94D E87EDAFEFF              call 004093D0
:0041B952 33C9                    xor ecx, ecx
:0041B954 8AC8                    mov cl, al
:0041B956 894DE8                  mov dword ptr [ebp-18], ecx
:0041B959 E9D0030000              jmp 0041BD2E
:0041B95E 8B45EC                  mov eax, dword ptr [ebp-14]
:0041B961 33C9                    xor ecx, ecx
:0041B963 8A4807                  mov cl, byte ptr [eax+07]
:0041B966 81F9FF000000            cmp ecx, 000000FF
:0041B96C 0F84AA000000            je 0041BA1C
:0041B972 8B45EC                  mov eax, dword ptr [ebp-14]
:0041B975 33C9                    xor ecx, ecx
:0041B977 8A4807                  mov cl, byte ptr [eax+07]
:0041B97A 8BC1                    mov eax, ecx
:0041B97C 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:0041B97F C1E103                  shl ecx, 03
:0041B982 2BC8                    sub ecx, eax
:0041B984 8D8998C04600            lea ecx, dword ptr [ecx+0046C098]
:0041B98A E871D8FEFF              call 00409200
:0041B98F 50                      push eax
:0041B990 8D4DF8                  lea ecx, dword ptr [ebp-08]
:0041B993 E8F85EFEFF              call 00401890
:0041B998 8B45EC                  mov eax, dword ptr [ebp-14]
:0041B99B 33C9                    xor ecx, ecx
:0041B99D 8A4807                  mov cl, byte ptr [eax+07]
:0041B9A0 8BC1                    mov eax, ecx
:0041B9A2 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:0041B9A5 C1E103                  shl ecx, 03
:0041B9A8 2BC8                    sub ecx, eax
:0041B9AA 8D8998C04600            lea ecx, dword ptr [ecx+0046C098]
:0041B9B0 E81BDAFEFF              call 004093D0
:0041B9B5 33C9                    xor ecx, ecx
:0041B9B7 8AC8                    mov cl, al
:0041B9B9 85C9                    test ecx, ecx
:0041B9BB 0F842A000000            je 0041B9EB
:0041B9C1 8B45EC                  mov eax, dword ptr [ebp-14]
:0041B9C4 33C9                    xor ecx, ecx
:0041B9C6 8A4807                  mov cl, byte ptr [eax+07]
:0041B9C9 8BC1                    mov eax, ecx
:0041B9CB 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:0041B9CE C1E103                  shl ecx, 03
:0041B9D1 2BC8                    sub ecx, eax
:0041B9D3 8D8998C04600            lea ecx, dword ptr [ecx+0046C098]
:0041B9D9 E8F2D9FEFF              call 004093D0
:0041B9DE 33C9                    xor ecx, ecx
:0041B9E0 8AC8                    mov cl, al
:0041B9E2 83F904                  cmp ecx, 00000004
:0041B9E5 0F852C000000            jne 0041BA17

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B9BB(C)
|
:0041B9EB 8D45F0                  lea eax, dword ptr [ebp-10]
:0041B9EE 50                      push eax
:0041B9EF 8B45EC                  mov eax, dword ptr [ebp-14]
:0041B9F2 33C9                    xor ecx, ecx
:0041B9F4 8A4807                  mov cl, byte ptr [eax+07]
:0041B9F7 8BC1                    mov eax, ecx
:0041B9F9 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:0041B9FC C1E103                  shl ecx, 03
:0041B9FF 2BC8                    sub ecx, eax
:0041BA01 8D8998C04600            lea ecx, dword ptr [ecx+0046C098]
:0041BA07 E8E4280000              call 0041E2F0
:0041BA0C 50                      push eax
:0041BA0D B998A64600              mov ecx, 0046A698
:0041BA12 E8795EFEFF              call 00401890

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B9E5(C)
|
:0041BA17 E90F000000              jmp 0041BA2B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B96C(C)
|
:0041BA1C 8B45EC                  mov eax, dword ptr [ebp-14]
:0041BA1F 83C008                  add eax, 00000008
:0041BA22 50                      push eax
:0041BA23 8D4DF8                  lea ecx, dword ptr [ebp-08]
:0041BA26 E8655EFEFF              call 00401890

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BA17(U)
|
:0041BA2B 6A04                    push 00000004
:0041BA2D 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041BA30 E82BD9FEFF              call 00409360
:0041BA35 85C0                    test eax, eax
:0041BA37 0F858F010000            jne 0041BBCC
:0041BA3D 6A01                    push 00000001
:0041BA3F 68FF000000              push 000000FF
:0041BA44 68FF000000              push 000000FF
:0041BA49 6A08                    push 00000008
:0041BA4B 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041BA4E 50                      push eax
:0041BA4F 8B45EC                  mov eax, dword ptr [ebp-14]
:0041BA52 83C005                  add eax, 00000005
:0041BA55 50                      push eax
:0041BA56 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041BA59 E8EBF4FFFF              call 0041AF49
:0041BA5E 8845FC                  mov byte ptr [ebp-04], al
:0041BA61 8B45EC                  mov eax, dword ptr [ebp-14]
:0041BA64 33C9                    xor ecx, ecx
:0041BA66 8A4807                  mov cl, byte ptr [eax+07]
:0041BA69 81F9FF000000            cmp ecx, 000000FF
:0041BA6F 0F8450000000            je 0041BAC5
:0041BA75 8B45EC                  mov eax, dword ptr [ebp-14]
:0041BA78 33C9                    xor ecx, ecx
:0041BA7A 8A4807                  mov cl, byte ptr [eax+07]
:0041BA7D 33C0                    xor eax, eax
:0041BA7F 8A45FC                  mov al, byte ptr [ebp-04]
:0041BA82 3BC8                    cmp ecx, eax
:0041BA84 0F853B000000            jne 0041BAC5
:0041BA8A 8B45EC                  mov eax, dword ptr [ebp-14]
:0041BA8D 8A4004                  mov al, byte ptr [eax+04]
:0041BA90 50                      push eax
:0041BA91 6A14                    push 00000014
:0041BA93 8D45F8                  lea eax, dword ptr [ebp-08]
:0041BA96 50                      push eax
:0041BA97 E8E8F2FFFF              call 0041AD84
:0041BA9C 83C40C                  add esp, 0000000C
:0041BA9F 6A01                    push 00000001
:0041BAA1 68FF000000              push 000000FF
:0041BAA6 68FF000000              push 000000FF
:0041BAAB 6A04                    push 00000004
:0041BAAD 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041BAB0 50                      push eax
:0041BAB1 8B45EC                  mov eax, dword ptr [ebp-14]
:0041BAB4 83C005                  add eax, 00000005
:0041BAB7 50                      push eax
:0041BAB8 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041BABB E889F4FFFF              call 0041AF49
:0041BAC0 E902010000              jmp 0041BBC7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041BA6F(C), :0041BA84(C)
|
:0041BAC5 8B45EC                  mov eax, dword ptr [ebp-14]
:0041BAC8 8A4004                  mov al, byte ptr [eax+04]
:0041BACB 50                      push eax
:0041BACC 6A0A                    push 0000000A
:0041BACE 8D45F8                  lea eax, dword ptr [ebp-08]
:0041BAD1 50                      push eax
:0041BAD2 E8ADF2FFFF              call 0041AD84
:0041BAD7 83C40C                  add esp, 0000000C
:0041BADA 6A01                    push 00000001
:0041BADC 8B45EC                  mov eax, dword ptr [ebp-14]
:0041BADF 8A4006                  mov al, byte ptr [eax+06]
:0041BAE2 50                      push eax
:0041BAE3 8B45EC                  mov eax, dword ptr [ebp-14]
:0041BAE6 8A4005                  mov al, byte ptr [eax+05]
:0041BAE9 50                      push eax
:0041BAEA 6A02                    push 00000002
:0041BAEC 68FF000000              push 000000FF
:0041BAF1 8D45F8                  lea eax, dword ptr [ebp-08]
:0041BAF4 50                      push eax
:0041BAF5 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041BAF8 E84CF4FFFF              call 0041AF49
:0041BAFD 33C9                    xor ecx, ecx
:0041BAFF 8AC8                    mov cl, al
:0041BB01 83F901                  cmp ecx, 00000001
:0041BB04 0F8483000000            je 0041BB8D
:0041BB0A 6A00                    push 00000000
:0041BB0C 8B45EC                  mov eax, dword ptr [ebp-14]
:0041BB0F 8A4006                  mov al, byte ptr [eax+06]
:0041BB12 50                      push eax
:0041BB13 8B45EC                  mov eax, dword ptr [ebp-14]
:0041BB16 8A4005                  mov al, byte ptr [eax+05]
:0041BB19 50                      push eax
:0041BB1A 6A02                    push 00000002
:0041BB1C 68FF000000              push 000000FF
:0041BB21 8D45F8                  lea eax, dword ptr [ebp-08]
:0041BB24 50                      push eax
:0041BB25 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041BB28 E81CF4FFFF              call 0041AF49
:0041BB2D 33C9                    xor ecx, ecx
:0041BB2F 8AC8                    mov cl, al
:0041BB31 81F9FF000000            cmp ecx, 000000FF
:0041BB37 0F843F000000            je 0041BB7C
:0041BB3D 6A01                    push 00000001
:0041BB3F 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041BB42 50                      push eax
:0041BB43 8B45EC                  mov eax, dword ptr [ebp-14]
:0041BB46 83C005                  add eax, 00000005
:0041BB49 50                      push eax
:0041BB4A 8D45F8                  lea eax, dword ptr [ebp-08]
:0041BB4D 50                      push eax
:0041BB4E 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041BB51 E8EDEEFFFF              call 0041AA43
:0041BB56 6A01                    push 00000001
:0041BB58 68FF000000              push 000000FF
:0041BB5D 68FF000000              push 000000FF
:0041BB62 6A04                    push 00000004
:0041BB64 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041BB67 50                      push eax
:0041BB68 8B45EC                  mov eax, dword ptr [ebp-14]
:0041BB6B 83C005                  add eax, 00000005
:0041BB6E 50                      push eax
:0041BB6F 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041BB72 E8D2F3FFFF              call 0041AF49
:0041BB77 E90C000000              jmp 0041BB88

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BB37(C)
|
:0041BB7C 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041BB7F 50                      push eax
:0041BB80 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041BB83 E8E6240000              call 0041E06E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BB77(U)
|
:0041BB88 E93A000000              jmp 0041BBC7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BB04(C)
|
:0041BB8D 6A01                    push 00000001
:0041BB8F 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041BB92 50                      push eax
:0041BB93 8B45EC                  mov eax, dword ptr [ebp-14]
:0041BB96 83C005                  add eax, 00000005
:0041BB99 50                      push eax
:0041BB9A 8D45F8                  lea eax, dword ptr [ebp-08]
:0041BB9D 50                      push eax
:0041BB9E 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041BBA1 E89DEEFFFF              call 0041AA43
:0041BBA6 6A01                    push 00000001
:0041BBA8 68FF000000              push 000000FF
:0041BBAD 68FF000000              push 000000FF
:0041BBB2 6A04                    push 00000004
:0041BBB4 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041BBB7 50                      push eax
:0041BBB8 8B45EC                  mov eax, dword ptr [ebp-14]
:0041BBBB 83C005                  add eax, 00000005
:0041BBBE 50                      push eax
:0041BBBF 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041BBC2 E882F3FFFF              call 0041AF49

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041BAC0(U), :0041BB88(U)
|
:0041BBC7 E9A2000000              jmp 0041BC6E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BA37(C)
|
:0041BBCC 6A01                    push 00000001
:0041BBCE 8B45F9                  mov eax, dword ptr [ebp-07]
:0041BBD1 50                      push eax
:0041BBD2 8B45F8                  mov eax, dword ptr [ebp-08]
:0041BBD5 50                      push eax
:0041BBD6 6A02                    push 00000002
:0041BBD8 68FF000000              push 000000FF
:0041BBDD 8B45EC                  mov eax, dword ptr [ebp-14]
:0041BBE0 83C005                  add eax, 00000005
:0041BBE3 50                      push eax
:0041BBE4 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041BBE7 E85DF3FFFF              call 0041AF49
:0041BBEC 33C9                    xor ecx, ecx
:0041BBEE 8AC8                    mov cl, al
:0041BBF0 83F901                  cmp ecx, 00000001
:0041BBF3 0F8467000000            je 0041BC60
:0041BBF9 6A00                    push 00000000
:0041BBFB 8B45F9                  mov eax, dword ptr [ebp-07]
:0041BBFE 50                      push eax
:0041BBFF 8B45F8                  mov eax, dword ptr [ebp-08]
:0041BC02 50                      push eax
:0041BC03 6A02                    push 00000002
:0041BC05 68FF000000              push 000000FF
:0041BC0A 8B45EC                  mov eax, dword ptr [ebp-14]
:0041BC0D 83C005                  add eax, 00000005
:0041BC10 50                      push eax
:0041BC11 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041BC14 E830F3FFFF              call 0041AF49
:0041BC19 33C9                    xor ecx, ecx
:0041BC1B 8AC8                    mov cl, al
:0041BC1D 85C9                    test ecx, ecx
:0041BC1F 0F8413000000            je 0041BC38
:0041BC25 8D45F8                  lea eax, dword ptr [ebp-08]
:0041BC28 50                      push eax
:0041BC29 B9B0A64600              mov ecx, 0046A6B0
:0041BC2E E85D5CFEFF              call 00401890
:0041BC33 E923000000              jmp 0041BC5B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BC1F(C)
|
:0041BC38 8B45EC                  mov eax, dword ptr [ebp-14]
:0041BC3B 83C005                  add eax, 00000005
:0041BC3E 50                      push eax
:0041BC3F B9B0A64600              mov ecx, 0046A6B0
:0041BC44 E8475CFEFF              call 00401890
:0041BC49 8B45EC                  mov eax, dword ptr [ebp-14]
:0041BC4C 83C005                  add eax, 00000005
:0041BC4F 50                      push eax
:0041BC50 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041BC53 83C108                  add ecx, 00000008
:0041BC56 E8355CFEFF              call 00401890

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BC33(U)
|
:0041BC5B E90E000000              jmp 0041BC6E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BBF3(C)
|
:0041BC60 8D45F8                  lea eax, dword ptr [ebp-08]
:0041BC63 50                      push eax
:0041BC64 B9B0A64600              mov ecx, 0046A6B0
:0041BC69 E8225CFEFF              call 00401890

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041BBC7(U), :0041BC5B(U)
|
:0041BC6E E9E3000000              jmp 0041BD56
:0041BC73 6A01                    push 00000001
:0041BC75 68FF000000              push 000000FF
:0041BC7A 68FF000000              push 000000FF
:0041BC7F 6A08                    push 00000008
:0041BC81 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041BC84 50                      push eax
:0041BC85 8B45EC                  mov eax, dword ptr [ebp-14]
:0041BC88 83C005                  add eax, 00000005
:0041BC8B 50                      push eax
:0041BC8C 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041BC8F E8B5F2FFFF              call 0041AF49
:0041BC94 8845FC                  mov byte ptr [ebp-04], al
:0041BC97 33C0                    xor eax, eax
:0041BC99 8A45FC                  mov al, byte ptr [ebp-04]
:0041BC9C 3DFF000000              cmp eax, 000000FF
:0041BCA1 0F8426000000            je 0041BCCD
:0041BCA7 6A01                    push 00000001
:0041BCA9 68FF000000              push 000000FF
:0041BCAE 68FF000000              push 000000FF
:0041BCB3 6A04                    push 00000004
:0041BCB5 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041BCB8 50                      push eax
:0041BCB9 8B45EC                  mov eax, dword ptr [ebp-14]
:0041BCBC 83C005                  add eax, 00000005
:0041BCBF 50                      push eax
:0041BCC0 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041BCC3 E881F2FFFF              call 0041AF49
:0041BCC8 E911000000              jmp 0041BCDE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BCA1(C)
|
:0041BCCD 8B45EC                  mov eax, dword ptr [ebp-14]
:0041BCD0 83C005                  add eax, 00000005
:0041BCD3 50                      push eax
:0041BCD4 B9B0A64600              mov ecx, 0046A6B0
:0041BCD9 E8B25BFEFF              call 00401890

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BCC8(U)
|
:0041BCDE E973000000              jmp 0041BD56
:0041BCE3 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041BCE6 50                      push eax
:0041BCE7 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041BCEA E87F230000              call 0041E06E
:0041BCEF E962000000              jmp 0041BD56
:0041BCF4 6A01                    push 00000001
:0041BCF6 68FF000000              push 000000FF
:0041BCFB 68FF000000              push 000000FF
:0041BD00 6A04                    push 00000004
:0041BD02 6A00                    push 00000000
:0041BD04 8B45EC                  mov eax, dword ptr [ebp-14]
:0041BD07 83C005                  add eax, 00000005
:0041BD0A 50                      push eax
:0041BD0B 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041BD0E E836F2FFFF              call 0041AF49
:0041BD13 8B45EC                  mov eax, dword ptr [ebp-14]
:0041BD16 83C005                  add eax, 00000005
:0041BD19 50                      push eax
:0041BD1A B9B0A64600              mov ecx, 0046A6B0
:0041BD1F E86C5BFEFF              call 00401890
:0041BD24 E92D000000              jmp 0041BD56
:0041BD29 E928000000              jmp 0041BD56

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B959(U)
|
:0041BD2E 837DE804                cmp dword ptr [ebp-18], 00000004
:0041BD32 0F871E000000            ja 0041BD56
:0041BD38 8B45E8                  mov eax, dword ptr [ebp-18]
:0041BD3B FF248542BD4100          jmp dword ptr [4*eax+0041BD42]

:0041BD42 5EB94100                DWORD 0041B95E
:0041BD46 E3BC4100                DWORD 0041BCE3
:0041BD4A F4BC4100                DWORD 0041BCF4
:0041BD4E 73BC4100                DWORD 0041BC73
:0041BD52 5EB94100                DWORD 0041B95E



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041B945(U), :0041BC6E(U), :0041BCDE(U), :0041BCEF(U), :0041BD24(U)
|:0041BD29(U), :0041BD32(C)
|
:0041BD56 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041BD59 E82FE4FFFF              call 0041A18D
:0041BD5E 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041BD61 E89F060100              call 0042C405
:0041BD66 6A04                    push 00000004
:0041BD68 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041BD6B E8F0D5FEFF              call 00409360
:0041BD70 85C0                    test eax, eax
:0041BD72 0F8566000000            jne 0041BDDE
:0041BD78 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041BD7B E850D6FEFF              call 004093D0
:0041BD80 33C9                    xor ecx, ecx
:0041BD82 8AC8                    mov cl, al
:0041BD84 83F904                  cmp ecx, 00000004
:0041BD87 0F8451000000            je 0041BDDE
:0041BD8D 33C0                    xor eax, eax
:0041BD8F A0C8A64600              mov al, byte ptr [0046A6C8]
:0041BD94 3DFF000000              cmp eax, 000000FF
:0041BD99 0F850D000000            jne 0041BDAC
:0041BD9F 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041BDA2 E8F3F7FFFF              call 0041B59A
:0041BDA7 E932000000              jmp 0041BDDE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BD99(C)
|
:0041BDAC 6A02                    push 00000002
:0041BDAE 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041BDB1 E8B50A0100              call 0042C86B
:0041BDB6 A0C8A64600              mov al, byte ptr [0046A6C8]
:0041BDBB 50                      push eax
:0041BDBC 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041BDBF E867C0FEFF              call 00407E2B
:0041BDC4 33C0                    xor eax, eax
:0041BDC6 A0C8A64600              mov al, byte ptr [0046A6C8]
:0041BDCB 83F82D                  cmp eax, 0000002D
:0041BDCE 0F850A000000            jne 0041BDDE
:0041BDD4 C705C2FC460001000000    mov dword ptr [0046FCC2], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041B7D0(C), :0041BD72(C), :0041BD87(C), :0041BDA7(U), :0041BDCE(C)
|
:0041BDDE 6880000000              push 00000080
:0041BDE3 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041BDE6 E875D5FEFF              call 00409360
:0041BDEB 85C0                    test eax, eax
:0041BDED 0F8512000000            jne 0041BE05
:0041BDF3 6A40                    push 00000040
:0041BDF5 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041BDF8 E863D5FEFF              call 00409360
:0041BDFD 85C0                    test eax, eax
:0041BDFF 0F8412000000            je 0041BE17

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BDED(C)
|
:0041BE05 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041BE08 E8B9060100              call 0042C4C6
:0041BE0D B998FC4600              mov ecx, 0046FC98
:0041BE12 E8307B0200              call 00443947

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041B7AA(C), :0041B7BF(C), :0041BDFF(C)
|
:0041BE17 E900000000              jmp 0041BE1C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BE17(U)
|
:0041BE1C 5F                      pop edi
:0041BE1D 5E                      pop esi
:0041BE1E 5B                      pop ebx
:0041BE1F C9                      leave
:0041BE20 C3                      ret



* Referenced by a CALL at Address:
|:0041D26F   
|
:0041BE21 55                      push ebp
:0041BE22 8BEC                    mov ebp, esp
:0041BE24 83EC1C                  sub esp, 0000001C
:0041BE27 53                      push ebx
:0041BE28 56                      push esi
:0041BE29 57                      push edi
:0041BE2A 894DE4                  mov dword ptr [ebp-1C], ecx
:0041BE2D C645FC00                mov [ebp-04], 00
:0041BE31 C605B8A64600FF          mov byte ptr [0046A6B8], FF
:0041BE38 C605A4A64600FF          mov byte ptr [0046A6A4], FF
:0041BE3F B808494500              mov eax, 00454908
:0041BE44 83C064                  add eax, 00000064
:0041BE47 8945F8                  mov dword ptr [ebp-08], eax
:0041BE4A E903000000              jmp 0041BE52

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BF7B(U)
|
:0041BE4F FF45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BE4A(U)
|
:0041BE52 8B45F8                  mov eax, dword ptr [ebp-08]
:0041BE55 33C9                    xor ecx, ecx
:0041BE57 8A08                    mov cl, byte ptr [eax]
:0041BE59 81F9FF000000            cmp ecx, 000000FF
:0041BE5F 0F841B010000            je 0041BF80
:0041BE65 8B45F8                  mov eax, dword ptr [ebp-08]
:0041BE68 33C9                    xor ecx, ecx
:0041BE6A 8A08                    mov cl, byte ptr [eax]
:0041BE6C 8A81B0D24400            mov al, byte ptr [ecx+0044D2B0]
:0041BE72 8845F4                  mov byte ptr [ebp-0C], al
:0041BE75 8B45F8                  mov eax, dword ptr [ebp-08]
:0041BE78 33C9                    xor ecx, ecx
:0041BE7A 8A08                    mov cl, byte ptr [eax]
:0041BE7C 83F919                  cmp ecx, 00000019
:0041BE7F 0F8C1C000000            jl 0041BEA1
:0041BE85 8B45F8                  mov eax, dword ptr [ebp-08]
:0041BE88 33C9                    xor ecx, ecx
:0041BE8A 8A08                    mov cl, byte ptr [eax]
:0041BE8C 83F92F                  cmp ecx, 0000002F
:0041BE8F 0F840C000000            je 0041BEA1
:0041BE95 C745E801000000          mov [ebp-18], 00000001
:0041BE9C E907000000              jmp 0041BEA8

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041BE7F(C), :0041BE8F(C)
|
:0041BEA1 C745E800000000          mov [ebp-18], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BE9C(U)
|
:0041BEA8 6A00                    push 00000000
:0041BEAA 8B45E8                  mov eax, dword ptr [ebp-18]
:0041BEAD 0D80000000              or eax, 00000080
:0041BEB2 50                      push eax
:0041BEB3 33C0                    xor eax, eax
:0041BEB5 8A45F4                  mov al, byte ptr [ebp-0C]
:0041BEB8 0D80000000              or eax, 00000080
:0041BEBD 50                      push eax
:0041BEBE 8B4508                  mov eax, dword ptr [ebp+08]
:0041BEC1 50                      push eax
:0041BEC2 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0041BEC5 E807D9FFFF              call 004197D1
:0041BECA 33C9                    xor ecx, ecx
:0041BECC 8AC8                    mov cl, al
:0041BECE 81F9FF000000            cmp ecx, 000000FF
:0041BED4 0F84A1000000            je 0041BF7B
:0041BEDA C745F008494500          mov [ebp-10], 00454908
:0041BEE1 E903000000              jmp 0041BEE9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BF76(U)
|
:0041BEE6 FF45F0                  inc [ebp-10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BEE1(U)
|
:0041BEE9 8B45F0                  mov eax, dword ptr [ebp-10]
:0041BEEC 33C9                    xor ecx, ecx
:0041BEEE 8A08                    mov cl, byte ptr [eax]
:0041BEF0 81F9FF000000            cmp ecx, 000000FF
:0041BEF6 0F847F000000            je 0041BF7B
:0041BEFC 8B45F8                  mov eax, dword ptr [ebp-08]
:0041BEFF 8A00                    mov al, byte ptr [eax]
:0041BF01 50                      push eax
:0041BF02 8B45F0                  mov eax, dword ptr [ebp-10]
:0041BF05 8A00                    mov al, byte ptr [eax]
:0041BF07 50                      push eax
:0041BF08 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0041BF0B E87F000000              call 0041BF8F
:0041BF10 8945EC                  mov dword ptr [ebp-14], eax
:0041BF13 8B45EC                  mov eax, dword ptr [ebp-14]
:0041BF16 3DFF000000              cmp eax, 000000FF
:0041BF1B 0F8C05000000            jl 0041BF26
:0041BF21 B8FF000000              mov eax, 000000FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BF1B(C)
|
:0041BF26 8945EC                  mov dword ptr [ebp-14], eax
:0041BF29 837DEC00                cmp dword ptr [ebp-14], 00000000
:0041BF2D 0F861B000000            jbe 0041BF4E
:0041BF33 8B45E4                  mov eax, dword ptr [ebp-1C]
:0041BF36 33C9                    xor ecx, ecx
:0041BF38 8A4807                  mov cl, byte ptr [eax+07]
:0041BF3B 8B45F0                  mov eax, dword ptr [ebp-10]
:0041BF3E 33D2                    xor edx, edx
:0041BF40 8A10                    mov dl, byte ptr [eax]
:0041BF42 3BCA                    cmp ecx, edx
:0041BF44 0F8504000000            jne 0041BF4E
:0041BF4A 8345EC0A                add dword ptr [ebp-14], 0000000A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041BF2D(C), :0041BF44(C)
|
:0041BF4E 33C0                    xor eax, eax
:0041BF50 8A45FC                  mov al, byte ptr [ebp-04]
:0041BF53 3B45EC                  cmp eax, dword ptr [ebp-14]
:0041BF56 0F831A000000            jnb 0041BF76
:0041BF5C 8A45EC                  mov al, byte ptr [ebp-14]
:0041BF5F 8845FC                  mov byte ptr [ebp-04], al
:0041BF62 8B45F0                  mov eax, dword ptr [ebp-10]
:0041BF65 8A00                    mov al, byte ptr [eax]
:0041BF67 A2B8A64600              mov byte ptr [0046A6B8], al
:0041BF6C 8B45F8                  mov eax, dword ptr [ebp-08]
:0041BF6F 8A00                    mov al, byte ptr [eax]
:0041BF71 A2A4A64600              mov byte ptr [0046A6A4], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BF56(C)
|
:0041BF76 E96BFFFFFF              jmp 0041BEE6

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041BED4(C), :0041BEF6(C)
|
:0041BF7B E9CFFEFFFF              jmp 0041BE4F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BE5F(C)
|
:0041BF80 8A45FC                  mov al, byte ptr [ebp-04]
:0041BF83 E900000000              jmp 0041BF88

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BF83(U)
|
:0041BF88 5F                      pop edi
:0041BF89 5E                      pop esi
:0041BF8A 5B                      pop ebx
:0041BF8B C9                      leave
:0041BF8C C20400                  ret 0004



* Referenced by a CALL at Address:
|:0041BF0B   
|
:0041BF8F 55                      push ebp
:0041BF90 8BEC                    mov ebp, esp
:0041BF92 83EC70                  sub esp, 00000070
:0041BF95 53                      push ebx
:0041BF96 56                      push esi
:0041BF97 57                      push edi
:0041BF98 894D9C                  mov dword ptr [ebp-64], ecx
:0041BF9B 8B459C                  mov eax, dword ptr [ebp-64]
:0041BF9E 8B00                    mov eax, dword ptr [eax]
:0041BFA0 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041BFA3 03C0                    add eax, eax
:0041BFA5 8D04C0                  lea eax, dword ptr [eax+8*eax]
:0041BFA8 05E8564500              add eax, 004556E8
:0041BFAD 8945E0                  mov dword ptr [ebp-20], eax
:0041BFB0 33C0                    xor eax, eax
:0041BFB2 8A4508                  mov al, byte ptr [ebp+08]
:0041BFB5 8BC8                    mov ecx, eax
:0041BFB7 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041BFBA C1E003                  shl eax, 03
:0041BFBD 2BC1                    sub eax, ecx
:0041BFBF 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041BFC5 E866D1FEFF              call 00409130
:0041BFCA 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041BFCD 03C0                    add eax, eax
:0041BFCF 8D04C0                  lea eax, dword ptr [eax+8*eax]
:0041BFD2 05E8564500              add eax, 004556E8
:0041BFD7 8945D8                  mov dword ptr [ebp-28], eax
:0041BFDA 33C0                    xor eax, eax
:0041BFDC 8A4508                  mov al, byte ptr [ebp+08]
:0041BFDF 8BC8                    mov ecx, eax
:0041BFE1 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041BFE4 C1E003                  shl eax, 03
:0041BFE7 2BC1                    sub eax, ecx
:0041BFE9 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041BFEF E80CD2FEFF              call 00409200
:0041BFF4 668B00                  mov ax, word ptr [eax]
:0041BFF7 668945F0                mov word ptr [ebp-10], ax
:0041BFFB 8D45F0                  lea eax, dword ptr [ebp-10]
:0041BFFE 50                      push eax
:0041BFFF E8D6D5FFFF              call 004195DA
:0041C004 83C404                  add esp, 00000004
:0041C007 8845F4                  mov byte ptr [ebp-0C], al
:0041C00A 33C0                    xor eax, eax
:0041C00C 8A450C                  mov al, byte ptr [ebp+0C]
:0041C00F 8A80B0D24400            mov al, byte ptr [eax+0044D2B0]
:0041C015 8845F8                  mov byte ptr [ebp-08], al
:0041C018 C745E400000000          mov [ebp-1C], 00000000
:0041C01F C745E800000000          mov [ebp-18], 00000000
:0041C026 8D45C8                  lea eax, dword ptr [ebp-38]
:0041C029 8945EC                  mov dword ptr [ebp-14], eax
:0041C02C 8B450C                  mov eax, dword ptr [ebp+0C]
:0041C02F 50                      push eax
:0041C030 E8150D0000              call 0041CD4A
:0041C035 83C404                  add esp, 00000004
:0041C038 8845FC                  mov byte ptr [ebp-04], al
:0041C03B C645D400                mov [ebp-2C], 00
:0041C03F B9D0A64600              mov ecx, 0046A6D0
:0041C044 E867FAFEFF              call 0040BAB0
:0041C049 85C0                    test eax, eax
:0041C04B 0F8590000000            jne 0041C0E1
:0041C051 33C0                    xor eax, eax
:0041C053 8A450C                  mov al, byte ptr [ebp+0C]
:0041C056 83F80C                  cmp eax, 0000000C
:0041C059 0F8C0E000000            jl 0041C06D
:0041C05F 33C0                    xor eax, eax
:0041C061 8A450C                  mov al, byte ptr [ebp+0C]
:0041C064 83F818                  cmp eax, 00000018
:0041C067 0F8E68000000            jle 0041C0D5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C059(C)
|
:0041C06D 33C0                    xor eax, eax
:0041C06F 8A450C                  mov al, byte ptr [ebp+0C]
:0041C072 83F82C                  cmp eax, 0000002C
:0041C075 0F845A000000            je 0041C0D5
:0041C07B 33C0                    xor eax, eax
:0041C07D 8A450C                  mov al, byte ptr [ebp+0C]
:0041C080 83F82F                  cmp eax, 0000002F
:0041C083 0F844C000000            je 0041C0D5
:0041C089 33C0                    xor eax, eax
:0041C08B 8A450C                  mov al, byte ptr [ebp+0C]
:0041C08E 83F805                  cmp eax, 00000005
:0041C091 0F8F4A000000            jg 0041C0E1
:0041C097 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0041C09A E831D2FEFF              call 004092D0
:0041C09F 33C9                    xor ecx, ecx
:0041C0A1 8AC8                    mov cl, al
:0041C0A3 85C9                    test ecx, ecx
:0041C0A5 0F8C15000000            jl 0041C0C0
:0041C0AB 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0041C0AE E81DD2FEFF              call 004092D0
:0041C0B3 33C9                    xor ecx, ecx
:0041C0B5 8AC8                    mov cl, al
:0041C0B7 83F905                  cmp ecx, 00000005
:0041C0BA 0F8E15000000            jle 0041C0D5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C0A5(C)
|
:0041C0C0 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0041C0C3 E808D2FEFF              call 004092D0
:0041C0C8 33C9                    xor ecx, ecx
:0041C0CA 8AC8                    mov cl, al
:0041C0CC 83F923                  cmp ecx, 00000023
:0041C0CF 0F850C000000            jne 0041C0E1

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041C067(C), :0041C075(C), :0041C083(C), :0041C0BA(C)
|
:0041C0D5 33C0                    xor eax, eax
:0041C0D7 E90C0C0000              jmp 0041CCE8
:0041C0DC E936000000              jmp 0041C117

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041C04B(C), :0041C091(C), :0041C0CF(C)
|
:0041C0E1 B9D0A64600              mov ecx, 0046A6D0
:0041C0E6 E8C5F9FEFF              call 0040BAB0
:0041C0EB 83F801                  cmp eax, 00000001
:0041C0EE 0F8523000000            jne 0041C117
:0041C0F4 33C0                    xor eax, eax
:0041C0F6 8A450C                  mov al, byte ptr [ebp+0C]
:0041C0F9 83F82C                  cmp eax, 0000002C
:0041C0FC 0F840E000000            je 0041C110
:0041C102 33C0                    xor eax, eax
:0041C104 8A450C                  mov al, byte ptr [ebp+0C]
:0041C107 83F82F                  cmp eax, 0000002F
:0041C10A 0F8507000000            jne 0041C117

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C0FC(C)
|
:0041C110 33C0                    xor eax, eax
:0041C112 E9D10B0000              jmp 0041CCE8

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041C0DC(U), :0041C0EE(C), :0041C10A(C)
|
:0041C117 C745DC00000000          mov [ebp-24], 00000000
:0041C11E E903000000              jmp 0041C126

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C138(U)
|
:0041C123 FF45DC                  inc [ebp-24]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C11E(U)
|
:0041C126 837DDC0A                cmp dword ptr [ebp-24], 0000000A
:0041C12A 0F830D000000            jnb 0041C13D
:0041C130 8B45DC                  mov eax, dword ptr [ebp-24]
:0041C133 C64405C8FF              mov [ebp+eax-38], FF
:0041C138 E9E6FFFFFF              jmp 0041C123

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C12A(C)
|
:0041C13D 33C0                    xor eax, eax
:0041C13F 8A45FC                  mov al, byte ptr [ebp-04]
:0041C142 85C0                    test eax, eax
:0041C144 0F8419000000            je 0041C163
:0041C14A 8D45C8                  lea eax, dword ptr [ebp-38]
:0041C14D 50                      push eax
:0041C14E 6A04                    push 00000004
:0041C150 8B45FC                  mov eax, dword ptr [ebp-04]
:0041C153 50                      push eax
:0041C154 8B45F0                  mov eax, dword ptr [ebp-10]
:0041C157 50                      push eax
:0041C158 8B4D9C                  mov ecx, dword ptr [ebp-64]
:0041C15B E8C7120000              call 0041D427
:0041C160 8945EC                  mov dword ptr [ebp-14], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C144(C)
|
:0041C163 33C0                    xor eax, eax
:0041C165 8A450C                  mov al, byte ptr [ebp+0C]
:0041C168 83F80B                  cmp eax, 0000000B
:0041C16B 0F8F3B010000            jg 0041C2AC
:0041C171 33C0                    xor eax, eax
:0041C173 8A450C                  mov al, byte ptr [ebp+0C]
:0041C176 B906000000              mov ecx, 00000006
:0041C17B 99                      cdq
:0041C17C F7F9                    idiv ecx
:0041C17E 8845C0                  mov byte ptr [ebp-40], al
:0041C181 33C0                    xor eax, eax
:0041C183 8A450C                  mov al, byte ptr [ebp+0C]
:0041C186 B906000000              mov ecx, 00000006
:0041C18B 99                      cdq
:0041C18C F7F9                    idiv ecx
:0041C18E 83FA03                  cmp edx, 00000003
:0041C191 0F8C09000000            jl 0041C1A0
:0041C197 C645C401                mov [ebp-3C], 01
:0041C19B E904000000              jmp 0041C1A4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C191(C)
|
:0041C1A0 C645C400                mov [ebp-3C], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C19B(U)
|
:0041C1A4 33C0                    xor eax, eax
:0041C1A6 8A450C                  mov al, byte ptr [ebp+0C]
:0041C1A9 8A80B0D24400            mov al, byte ptr [eax+0044D2B0]
:0041C1AF 8845BC                  mov byte ptr [ebp-44], al
:0041C1B2 33C0                    xor eax, eax
:0041C1B4 8A45C0                  mov al, byte ptr [ebp-40]
:0041C1B7 85C0                    test eax, eax
:0041C1B9 0F8517000000            jne 0041C1D6
:0041C1BF B998FC4600              mov ecx, 0046FC98
:0041C1C4 E84C7B0200              call 00443D15
:0041C1C9 33C9                    xor ecx, ecx
:0041C1CB 8AC8                    mov cl, al
:0041C1CD 83F902                  cmp ecx, 00000002
:0041C1D0 0F84D1000000            je 0041C2A7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C1B9(C)
|
:0041C1D6 6A01                    push 00000001
:0041C1D8 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041C1DB 50                      push eax
:0041C1DC 8B45C0                  mov eax, dword ptr [ebp-40]
:0041C1DF 50                      push eax
:0041C1E0 E8F35EFEFF              call 004020D8
:0041C1E5 83C40C                  add esp, 0000000C
:0041C1E8 85C0                    test eax, eax
:0041C1EA 0F84B7000000            je 0041C2A7
:0041C1F0 6A05                    push 00000005
:0041C1F2 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0041C1F5 E816CFFEFF              call 00409110
:0041C1FA 33C9                    xor ecx, ecx
:0041C1FC 8AC8                    mov cl, al
:0041C1FE 51                      push ecx
:0041C1FF 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0041C202 E809CFFEFF              call 00409110
:0041C207 33C9                    xor ecx, ecx
:0041C209 8AC8                    mov cl, al
:0041C20B 51                      push ecx
:0041C20C E8DE0A0000              call 0041CCEF
:0041C211 83C40C                  add esp, 0000000C
:0041C214 85C0                    test eax, eax
:0041C216 0F848B000000            je 0041C2A7
:0041C21C 8B45BC                  mov eax, dword ptr [ebp-44]
:0041C21F 50                      push eax
:0041C220 8B45C0                  mov eax, dword ptr [ebp-40]
:0041C223 50                      push eax
:0041C224 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0041C227 E8E4CEFEFF              call 00409110
:0041C22C 50                      push eax
:0041C22D E812C3FEFF              call 00408544
:0041C232 83C40C                  add esp, 0000000C
:0041C235 8945E8                  mov dword ptr [ebp-18], eax
:0041C238 8B45E8                  mov eax, dword ptr [ebp-18]
:0041C23B 50                      push eax
:0041C23C 8B45C0                  mov eax, dword ptr [ebp-40]
:0041C23F 50                      push eax
:0041C240 8B45D8                  mov eax, dword ptr [ebp-28]
:0041C243 50                      push eax
:0041C244 E80CC4FEFF              call 00408655
:0041C249 83C40C                  add esp, 0000000C
:0041C24C 8945E8                  mov dword ptr [ebp-18], eax
:0041C24F 33C0                    xor eax, eax
:0041C251 8A4508                  mov al, byte ptr [ebp+08]
:0041C254 8BC8                    mov ecx, eax
:0041C256 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041C259 C1E003                  shl eax, 03
:0041C25C 2BC1                    sub eax, ecx
:0041C25E 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041C264 E847D5FEFF              call 004097B0
:0041C269 3B45E8                  cmp eax, dword ptr [ebp-18]
:0041C26C 0F870C000000            ja 0041C27E
:0041C272 C745E450000000          mov [ebp-1C], 00000050
:0041C279 E907000000              jmp 0041C285

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C26C(C)
|
:0041C27E C745E414000000          mov [ebp-1C], 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C279(U)
|
:0041C285 33C0                    xor eax, eax
:0041C287 8A45C4                  mov al, byte ptr [ebp-3C]
:0041C28A 85C0                    test eax, eax
:0041C28C 0F8415000000            je 0041C2A7
:0041C292 6A00                    push 00000000
:0041C294 8B45E4                  mov eax, dword ptr [ebp-1C]
:0041C297 50                      push eax
:0041C298 8B45EC                  mov eax, dword ptr [ebp-14]
:0041C29B 50                      push eax
:0041C29C E830E5FFFF              call 0041A7D1
:0041C2A1 83C40C                  add esp, 0000000C
:0041C2A4 8945E4                  mov dword ptr [ebp-1C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041C1D0(C), :0041C1EA(C), :0041C216(C), :0041C28C(C)
|
:0041C2A7 E9DD090000              jmp 0041CC89

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C16B(C)
|
:0041C2AC 33C0                    xor eax, eax
:0041C2AE 8A450C                  mov al, byte ptr [ebp+0C]
:0041C2B1 83F80E                  cmp eax, 0000000E
:0041C2B4 0F8F76000000            jg 0041C330
:0041C2BA 33C0                    xor eax, eax
:0041C2BC 8A4508                  mov al, byte ptr [ebp+08]
:0041C2BF 8BC8                    mov ecx, eax
:0041C2C1 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041C2C4 C1E003                  shl eax, 03
:0041C2C7 2BC1                    sub eax, ecx
:0041C2C9 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041C2CF E88CCFFEFF              call 00409260
:0041C2D4 33C9                    xor ecx, ecx
:0041C2D6 8AC8                    mov cl, al
:0041C2D8 85C9                    test ecx, ecx
:0041C2DA 0F8E44000000            jle 0041C324
:0041C2E0 6A04                    push 00000004
:0041C2E2 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0041C2E5 E826CEFEFF              call 00409110
:0041C2EA 33C9                    xor ecx, ecx
:0041C2EC 8AC8                    mov cl, al
:0041C2EE 51                      push ecx
:0041C2EF 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0041C2F2 E819CEFEFF              call 00409110
:0041C2F7 33C9                    xor ecx, ecx
:0041C2F9 8AC8                    mov cl, al
:0041C2FB 51                      push ecx
:0041C2FC E8EE090000              call 0041CCEF
:0041C301 83C40C                  add esp, 0000000C
:0041C304 85C0                    test eax, eax
:0041C306 0F840C000000            je 0041C318
:0041C30C C745E411000000          mov [ebp-1C], 00000011
:0041C313 E907000000              jmp 0041C31F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C306(C)
|
:0041C318 C745E400000000          mov [ebp-1C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C313(U)
|
:0041C31F E907000000              jmp 0041C32B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C2DA(C)
|
:0041C324 33C0                    xor eax, eax
:0041C326 E9BD090000              jmp 0041CCE8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C31F(U)
|
:0041C32B E959090000              jmp 0041CC89

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C2B4(C)
|
:0041C330 33C0                    xor eax, eax
:0041C332 8A450C                  mov al, byte ptr [ebp+0C]
:0041C335 83F810                  cmp eax, 00000010
:0041C338 0F8F9F000000            jg 0041C3DD
:0041C33E 33C0                    xor eax, eax
:0041C340 8A4508                  mov al, byte ptr [ebp+08]
:0041C343 8BC8                    mov ecx, eax
:0041C345 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041C348 C1E003                  shl eax, 03
:0041C34B 2BC1                    sub eax, ecx
:0041C34D 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041C353 E878D3FEFF              call 004096D0
:0041C358 8845D4                  mov byte ptr [ebp-2C], al
:0041C35B 33C0                    xor eax, eax
:0041C35D 8A45D4                  mov al, byte ptr [ebp-2C]
:0041C360 83F804                  cmp eax, 00000004
:0041C363 0F8507000000            jne 0041C370
:0041C369 33C0                    xor eax, eax
:0041C36B E978090000              jmp 0041CCE8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C363(C)
|
:0041C370 6A03                    push 00000003
:0041C372 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0041C375 E896CDFEFF              call 00409110
:0041C37A 33C9                    xor ecx, ecx
:0041C37C 8AC8                    mov cl, al
:0041C37E 51                      push ecx
:0041C37F 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0041C382 E889CDFEFF              call 00409110
:0041C387 33C9                    xor ecx, ecx
:0041C389 8AC8                    mov cl, al
:0041C38B 51                      push ecx
:0041C38C E85E090000              call 0041CCEF
:0041C391 83C40C                  add esp, 0000000C
:0041C394 85C0                    test eax, eax
:0041C396 0F840C000000            je 0041C3A8
:0041C39C C745E812000000          mov [ebp-18], 00000012
:0041C3A3 E907000000              jmp 0041C3AF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C396(C)
|
:0041C3A8 C745E800000000          mov [ebp-18], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C3A3(U)
|
:0041C3AF 33C0                    xor eax, eax
:0041C3B1 8A450C                  mov al, byte ptr [ebp+0C]
:0041C3B4 83F810                  cmp eax, 00000010
:0041C3B7 0F8515000000            jne 0041C3D2
:0041C3BD 6A00                    push 00000000
:0041C3BF 8B45E8                  mov eax, dword ptr [ebp-18]
:0041C3C2 50                      push eax
:0041C3C3 8B45EC                  mov eax, dword ptr [ebp-14]
:0041C3C6 50                      push eax
:0041C3C7 E805E4FFFF              call 0041A7D1
:0041C3CC 83C40C                  add esp, 0000000C
:0041C3CF 8945E8                  mov dword ptr [ebp-18], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C3B7(C)
|
:0041C3D2 8B45E8                  mov eax, dword ptr [ebp-18]
:0041C3D5 8945E4                  mov dword ptr [ebp-1C], eax
:0041C3D8 E9AC080000              jmp 0041CC89

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C338(C)
|
:0041C3DD 33C0                    xor eax, eax
:0041C3DF 8A450C                  mov al, byte ptr [ebp+0C]
:0041C3E2 83F812                  cmp eax, 00000012
:0041C3E5 0F8F9F000000            jg 0041C48A
:0041C3EB 33C0                    xor eax, eax
:0041C3ED 8A4508                  mov al, byte ptr [ebp+08]
:0041C3F0 8BC8                    mov ecx, eax
:0041C3F2 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041C3F5 C1E003                  shl eax, 03
:0041C3F8 2BC1                    sub eax, ecx
:0041C3FA 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041C400 E82BD3FEFF              call 00409730
:0041C405 8845D4                  mov byte ptr [ebp-2C], al
:0041C408 33C0                    xor eax, eax
:0041C40A 8A45D4                  mov al, byte ptr [ebp-2C]
:0041C40D 83F804                  cmp eax, 00000004
:0041C410 0F8507000000            jne 0041C41D
:0041C416 33C0                    xor eax, eax
:0041C418 E9CB080000              jmp 0041CCE8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C410(C)
|
:0041C41D 6A03                    push 00000003
:0041C41F 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0041C422 E8E9CCFEFF              call 00409110
:0041C427 33C9                    xor ecx, ecx
:0041C429 8AC8                    mov cl, al
:0041C42B 51                      push ecx
:0041C42C 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0041C42F E8DCCCFEFF              call 00409110
:0041C434 33C9                    xor ecx, ecx
:0041C436 8AC8                    mov cl, al
:0041C438 51                      push ecx
:0041C439 E8B1080000              call 0041CCEF
:0041C43E 83C40C                  add esp, 0000000C
:0041C441 85C0                    test eax, eax
:0041C443 0F840C000000            je 0041C455
:0041C449 C745E813000000          mov [ebp-18], 00000013
:0041C450 E907000000              jmp 0041C45C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C443(C)
|
:0041C455 C745E800000000          mov [ebp-18], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C450(U)
|
:0041C45C 33C0                    xor eax, eax
:0041C45E 8A450C                  mov al, byte ptr [ebp+0C]
:0041C461 83F812                  cmp eax, 00000012
:0041C464 0F8515000000            jne 0041C47F
:0041C46A 6A00                    push 00000000
:0041C46C 8B45E8                  mov eax, dword ptr [ebp-18]
:0041C46F 50                      push eax
:0041C470 8B45EC                  mov eax, dword ptr [ebp-14]
:0041C473 50                      push eax
:0041C474 E858E3FFFF              call 0041A7D1
:0041C479 83C40C                  add esp, 0000000C
:0041C47C 8945E8                  mov dword ptr [ebp-18], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C464(C)
|
:0041C47F 8B45E8                  mov eax, dword ptr [ebp-18]
:0041C482 8945E4                  mov dword ptr [ebp-1C], eax
:0041C485 E9FF070000              jmp 0041CC89

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C3E5(C)
|
:0041C48A 33C0                    xor eax, eax
:0041C48C 8A450C                  mov al, byte ptr [ebp+0C]
:0041C48F 83F818                  cmp eax, 00000018
:0041C492 0F8C0E000000            jl 0041C4A6
:0041C498 33C0                    xor eax, eax
:0041C49A 8A450C                  mov al, byte ptr [ebp+0C]
:0041C49D 83F82F                  cmp eax, 0000002F
:0041C4A0 0F852C020000            jne 0041C6D2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C492(C)
|
:0041C4A6 33C0                    xor eax, eax
:0041C4A8 8A4508                  mov al, byte ptr [ebp+08]
:0041C4AB 8BC8                    mov ecx, eax
:0041C4AD 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041C4B0 C1E003                  shl eax, 03
:0041C4B3 2BC1                    sub eax, ecx
:0041C4B5 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041C4BB E8F0D2FEFF              call 004097B0
:0041C4C0 8D1C8500000000          lea ebx, dword ptr [4*eax+00000000]
:0041C4C7 8D1C9B                  lea ebx, dword ptr [ebx+4*ebx]
:0041C4CA 8D1C9B                  lea ebx, dword ptr [ebx+4*ebx]
:0041C4CD 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0041C4D0 E8BBD2FEFF              call 00409790
:0041C4D5 8BC8                    mov ecx, eax
:0041C4D7 8BC3                    mov eax, ebx
:0041C4D9 2BD2                    sub edx, edx
:0041C4DB F7F1                    div ecx
:0041C4DD 83F828                  cmp eax, 00000028
:0041C4E0 0F8307000000            jnb 0041C4ED
:0041C4E6 33C0                    xor eax, eax
:0041C4E8 E9FB070000              jmp 0041CCE8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C4E0(C)
|
:0041C4ED 33C0                    xor eax, eax
:0041C4EF 8A450C                  mov al, byte ptr [ebp+0C]
:0041C4F2 894598                  mov dword ptr [ebp-68], eax
:0041C4F5 E952010000              jmp 0041C64C
:0041C4FA C645D410                mov [ebp-2C], 10
:0041C4FE 6A04                    push 00000004
:0041C500 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0041C503 E808CCFEFF              call 00409110
:0041C508 33C9                    xor ecx, ecx
:0041C50A 8AC8                    mov cl, al
:0041C50C 51                      push ecx
:0041C50D 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0041C510 E8FBCBFEFF              call 00409110
:0041C515 33C9                    xor ecx, ecx
:0041C517 8AC8                    mov cl, al
:0041C519 51                      push ecx
:0041C51A E8D0070000              call 0041CCEF
:0041C51F 83C40C                  add esp, 0000000C
:0041C522 85C0                    test eax, eax
:0041C524 0F840C000000            je 0041C536
:0041C52A C745E816000000          mov [ebp-18], 00000016
:0041C531 E907000000              jmp 0041C53D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C524(C)
|
:0041C536 C745E800000000          mov [ebp-18], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C531(U)
|
:0041C53D 33C0                    xor eax, eax
:0041C53F 8A450C                  mov al, byte ptr [ebp+0C]
:0041C542 83F814                  cmp eax, 00000014
:0041C545 0F8515000000            jne 0041C560
:0041C54B 6A00                    push 00000000
:0041C54D 8B45E8                  mov eax, dword ptr [ebp-18]
:0041C550 50                      push eax
:0041C551 8B45EC                  mov eax, dword ptr [ebp-14]
:0041C554 50                      push eax
:0041C555 E877E2FFFF              call 0041A7D1
:0041C55A 83C40C                  add esp, 0000000C
:0041C55D 8945E8                  mov dword ptr [ebp-18], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C545(C)
|
:0041C560 E93C010000              jmp 0041C6A1
:0041C565 C645D420                mov [ebp-2C], 20
:0041C569 6A03                    push 00000003
:0041C56B 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0041C56E E89DCBFEFF              call 00409110
:0041C573 33C9                    xor ecx, ecx
:0041C575 8AC8                    mov cl, al
:0041C577 51                      push ecx
:0041C578 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0041C57B E890CBFEFF              call 00409110
:0041C580 33C9                    xor ecx, ecx
:0041C582 8AC8                    mov cl, al
:0041C584 51                      push ecx
:0041C585 E865070000              call 0041CCEF
:0041C58A 83C40C                  add esp, 0000000C
:0041C58D 85C0                    test eax, eax
:0041C58F 0F840C000000            je 0041C5A1
:0041C595 C745E814000000          mov [ebp-18], 00000014
:0041C59C E907000000              jmp 0041C5A8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C58F(C)
|
:0041C5A1 C745E800000000          mov [ebp-18], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C59C(U)
|
:0041C5A8 33C0                    xor eax, eax
:0041C5AA 8A450C                  mov al, byte ptr [ebp+0C]
:0041C5AD 83F816                  cmp eax, 00000016
:0041C5B0 0F8515000000            jne 0041C5CB
:0041C5B6 6A00                    push 00000000
:0041C5B8 8B45E8                  mov eax, dword ptr [ebp-18]
:0041C5BB 50                      push eax
:0041C5BC 8B45EC                  mov eax, dword ptr [ebp-14]
:0041C5BF 50                      push eax
:0041C5C0 E80CE2FFFF              call 0041A7D1
:0041C5C5 83C40C                  add esp, 0000000C
:0041C5C8 8945E8                  mov dword ptr [ebp-18], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C5B0(C)
|
:0041C5CB E9D1000000              jmp 0041C6A1
:0041C5D0 C645D402                mov [ebp-2C], 02
:0041C5D4 33C0                    xor eax, eax
:0041C5D6 8A4508                  mov al, byte ptr [ebp+08]
:0041C5D9 8BC8                    mov ecx, eax
:0041C5DB 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041C5DE C1E003                  shl eax, 03
:0041C5E1 2BC1                    sub eax, ecx
:0041C5E3 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041C5E9 E8A8DD0000              call 0042A396
:0041C5EE 33C9                    xor ecx, ecx
:0041C5F0 8AC8                    mov cl, al
:0041C5F2 83F908                  cmp ecx, 00000008
:0041C5F5 0F8C0C000000            jl 0041C607
:0041C5FB C745E817000000          mov [ebp-18], 00000017
:0041C602 E907000000              jmp 0041C60E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C5F5(C)
|
:0041C607 C745E800000000          mov [ebp-18], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C602(U)
|
:0041C60E E98E000000              jmp 0041C6A1
:0041C613 C645D401                mov [ebp-2C], 01
:0041C617 C745E819000000          mov [ebp-18], 00000019
:0041C61E E97E000000              jmp 0041C6A1
:0041C623 C645D404                mov [ebp-2C], 04
:0041C627 8B4508                  mov eax, dword ptr [ebp+08]
:0041C62A 50                      push eax
:0041C62B E80AE3FFFF              call 0041A93A
:0041C630 83C404                  add esp, 00000004
:0041C633 85C0                    test eax, eax
:0041C635 0F8407000000            je 0041C642
:0041C63B C745E818000000          mov [ebp-18], 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C635(C)
|
:0041C642 E95A000000              jmp 0041C6A1
:0041C647 E955000000              jmp 0041C6A1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C4F5(U)
|
:0041C64C 836D9813                sub dword ptr [ebp-68], 00000013
:0041C650 837D981C                cmp dword ptr [ebp-68], 0000001C
:0041C654 0F8747000000            ja 0041C6A1
:0041C65A 8B4598                  mov eax, dword ptr [ebp-68]
:0041C65D 33C9                    xor ecx, ecx
:0041C65F 8A8884C64100            mov cl, byte ptr [eax+0041C684]
:0041C665 FF248D6CC64100          jmp dword ptr [4*ecx+0041C66C]

:0041C66C FAC44100                DWORD 0041C4FA
:0041C670 65C54100                DWORD 0041C565
:0041C674 D0C54100                DWORD 0041C5D0
:0041C678 13C64100                DWORD 0041C613
:0041C67C 23C64100                DWORD 0041C623
:0041C680 A1C64100                DWORD 0041C6A1


:0041C684 0000                    add byte ptr [eax], al
:0041C686 0101                    add dword ptr [ecx], eax
:0041C688 0203                    add al, byte ptr [ebx]
:0041C68A 0505050505              add eax, 05050505
:0041C68F 0505050505              add eax, 05050505
:0041C694 0505050505              add eax, 05050505
:0041C699 0505050505              add eax, 05050505
:0041C69E 0505048B45              add eax, 458B0405
:0041C6A3 D450                    aam (base80)
:0041C6A5 33C0                    xor eax, eax
:0041C6A7 8A4508                  mov al, byte ptr [ebp+08]
:0041C6AA 8BC8                    mov ecx, eax
:0041C6AC 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041C6AF C1E003                  shl eax, 03
:0041C6B2 2BC1                    sub eax, ecx
:0041C6B4 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041C6BA E891CAFEFF              call 00409150
:0041C6BF 85C0                    test eax, eax
:0041C6C1 0F8506000000            jne 0041C6CD
:0041C6C7 8B45E8                  mov eax, dword ptr [ebp-18]
:0041C6CA 8945E4                  mov dword ptr [ebp-1C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C6C1(C)
|
:0041C6CD E9B7050000              jmp 0041CC89

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C4A0(C)
|
:0041C6D2 33C0                    xor eax, eax
:0041C6D4 8A450C                  mov al, byte ptr [ebp+0C]
:0041C6D7 83F819                  cmp eax, 00000019
:0041C6DA 0F8CF4010000            jl 0041C8D4
:0041C6E0 33C0                    xor eax, eax
:0041C6E2 8A450C                  mov al, byte ptr [ebp+0C]
:0041C6E5 83F823                  cmp eax, 00000023
:0041C6E8 0F8FE6010000            jg 0041C8D4
:0041C6EE 33C0                    xor eax, eax
:0041C6F0 8A4508                  mov al, byte ptr [ebp+08]
:0041C6F3 8BC8                    mov ecx, eax
:0041C6F5 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041C6F8 C1E003                  shl eax, 03
:0041C6FB 2BC1                    sub eax, ecx
:0041C6FD 8B80A7C04600            mov eax, dword ptr [eax+0046C0A7]
:0041C703 8945A4                  mov dword ptr [ebp-5C], eax
:0041C706 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0041C709 E882D0FEFF              call 00409790
:0041C70E 8945B4                  mov dword ptr [ebp-4C], eax
:0041C711 33C0                    xor eax, eax
:0041C713 8A4508                  mov al, byte ptr [ebp+08]
:0041C716 8BC8                    mov ecx, eax
:0041C718 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041C71B C1E003                  shl eax, 03
:0041C71E 2BC1                    sub eax, ecx
:0041C720 8A80ABC04600            mov al, byte ptr [eax+0046C0AB]
:0041C726 8845B0                  mov byte ptr [ebp-50], al
:0041C729 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0041C72C E8AFCAFEFF              call 004091E0
:0041C731 8845B8                  mov byte ptr [ebp-48], al
:0041C734 33C0                    xor eax, eax
:0041C736 8A450C                  mov al, byte ptr [ebp+0C]
:0041C739 83F820                  cmp eax, 00000020
:0041C73C 0F8E09000000            jle 0041C74B
:0041C742 C645AC02                mov [ebp-54], 02
:0041C746 E904000000              jmp 0041C74F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C73C(C)
|
:0041C74B C645AC01                mov [ebp-54], 01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C746(U)
|
:0041C74F 33C0                    xor eax, eax
:0041C751 8A45AC                  mov al, byte ptr [ebp-54]
:0041C754 83F802                  cmp eax, 00000002
:0041C757 0F8515000000            jne 0041C772
:0041C75D 33C0                    xor eax, eax
:0041C75F 8A450C                  mov al, byte ptr [ebp+0C]
:0041C762 B921000000              mov ecx, 00000021
:0041C767 99                      cdq
:0041C768 F7F9                    idiv ecx
:0041C76A 8855A8                  mov byte ptr [ebp-58], dl
:0041C76D E933000000              jmp 0041C7A5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C757(C)
|
:0041C772 33C0                    xor eax, eax
:0041C774 8A450C                  mov al, byte ptr [ebp+0C]
:0041C777 83F81C                  cmp eax, 0000001C
:0041C77A 0F8E15000000            jle 0041C795
:0041C780 33C0                    xor eax, eax
:0041C782 8A450C                  mov al, byte ptr [ebp+0C]
:0041C785 B91D000000              mov ecx, 0000001D
:0041C78A 99                      cdq
:0041C78B F7F9                    idiv ecx
:0041C78D 8855A8                  mov byte ptr [ebp-58], dl
:0041C790 E910000000              jmp 0041C7A5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C77A(C)
|
:0041C795 33C0                    xor eax, eax
:0041C797 8A450C                  mov al, byte ptr [ebp+0C]
:0041C79A B919000000              mov ecx, 00000019
:0041C79F 99                      cdq
:0041C7A0 F7F9                    idiv ecx
:0041C7A2 8855A8                  mov byte ptr [ebp-58], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041C76D(U), :0041C790(U)
|
:0041C7A5 33C0                    xor eax, eax
:0041C7A7 8A45AC                  mov al, byte ptr [ebp-54]
:0041C7AA 83F801                  cmp eax, 00000001
:0041C7AD 0F8520000000            jne 0041C7D3
:0041C7B3 837DB400                cmp dword ptr [ebp-4C], 00000000
:0041C7B7 0F8616000000            jbe 0041C7D3
:0041C7BD 8B45A4                  mov eax, dword ptr [ebp-5C]
:0041C7C0 8D0480                  lea eax, dword ptr [eax+4*eax]
:0041C7C3 03C0                    add eax, eax
:0041C7C5 2BD2                    sub edx, edx
:0041C7C7 F775B4                  div [ebp-4C]
:0041C7CA 83F804                  cmp eax, 00000004
:0041C7CD 0F8636000000            jbe 0041C809

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041C7AD(C), :0041C7B7(C)
|
:0041C7D3 33C0                    xor eax, eax
:0041C7D5 8A45AC                  mov al, byte ptr [ebp-54]
:0041C7D8 83F802                  cmp eax, 00000002
:0041C7DB 0F8562000000            jne 0041C843
:0041C7E1 33C0                    xor eax, eax
:0041C7E3 8A45B8                  mov al, byte ptr [ebp-48]
:0041C7E6 85C0                    test eax, eax
:0041C7E8 0F8E55000000            jle 0041C843
:0041C7EE 33C0                    xor eax, eax
:0041C7F0 8A45B0                  mov al, byte ptr [ebp-50]
:0041C7F3 8D0480                  lea eax, dword ptr [eax+4*eax]
:0041C7F6 03C0                    add eax, eax
:0041C7F8 33C9                    xor ecx, ecx
:0041C7FA 8A4DB8                  mov cl, byte ptr [ebp-48]
:0041C7FD 99                      cdq
:0041C7FE F7F9                    idiv ecx
:0041C800 83F804                  cmp eax, 00000004
:0041C803 0F8F3A000000            jg 0041C843

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C7CD(C)
|
:0041C809 8B459C                  mov eax, dword ptr [ebp-64]
:0041C80C 8A4004                  mov al, byte ptr [eax+04]
:0041C80F 50                      push eax
:0041C810 33C0                    xor eax, eax
:0041C812 8A45A8                  mov al, byte ptr [ebp-58]
:0041C815 C1E004                  shl eax, 04
:0041C818 33C9                    xor ecx, ecx
:0041C81A 8A4DAC                  mov cl, byte ptr [ebp-54]
:0041C81D 0BC1                    or eax, ecx
:0041C81F 50                      push eax
:0041C820 33C0                    xor eax, eax
:0041C822 8A4508                  mov al, byte ptr [ebp+08]
:0041C825 8BC8                    mov ecx, eax
:0041C827 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041C82A C1E003                  shl eax, 03
:0041C82D 2BC1                    sub eax, ecx
:0041C82F 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041C835 E8DF050000              call 0041CE19
:0041C83A 8945E8                  mov dword ptr [ebp-18], eax
:0041C83D 8B45E8                  mov eax, dword ptr [ebp-18]
:0041C840 8945E4                  mov dword ptr [ebp-1C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041C7DB(C), :0041C7E8(C), :0041C803(C)
|
:0041C843 33C0                    xor eax, eax
:0041C845 8A45AC                  mov al, byte ptr [ebp-54]
:0041C848 83F802                  cmp eax, 00000002
:0041C84B 0F8543000000            jne 0041C894
:0041C851 33C0                    xor eax, eax
:0041C853 8A4508                  mov al, byte ptr [ebp+08]
:0041C856 8BC8                    mov ecx, eax
:0041C858 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041C85B C1E003                  shl eax, 03
:0041C85E 2BC1                    sub eax, ecx
:0041C860 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041C866 E835CAFEFF              call 004092A0
:0041C86B 33C9                    xor ecx, ecx
:0041C86D 8AC8                    mov cl, al
:0041C86F 83F91C                  cmp ecx, 0000001C
:0041C872 0F8415000000            je 0041C88D
:0041C878 8B459C                  mov eax, dword ptr [ebp-64]
:0041C87B 33C9                    xor ecx, ecx
:0041C87D 8A4804                  mov cl, byte ptr [eax+04]
:0041C880 33C0                    xor eax, eax
:0041C882 8A4508                  mov al, byte ptr [ebp+08]
:0041C885 3BC8                    cmp ecx, eax
:0041C887 0F8507000000            jne 0041C894

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C872(C)
|
:0041C88D 33C0                    xor eax, eax
:0041C88F E954040000              jmp 0041CCE8

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041C84B(C), :0041C887(C)
|
:0041C894 837DE400                cmp dword ptr [ebp-1C], 00000000
:0041C898 0F8631000000            jbe 0041C8CF
:0041C89E 33C0                    xor eax, eax
:0041C8A0 8A450C                  mov al, byte ptr [ebp+0C]
:0041C8A3 83F81D                  cmp eax, 0000001D
:0041C8A6 0F8C23000000            jl 0041C8CF
:0041C8AC 33C0                    xor eax, eax
:0041C8AE 8A450C                  mov al, byte ptr [ebp+0C]
:0041C8B1 83F820                  cmp eax, 00000020
:0041C8B4 0F8F15000000            jg 0041C8CF
:0041C8BA 6A01                    push 00000001
:0041C8BC 8B45E4                  mov eax, dword ptr [ebp-1C]
:0041C8BF 50                      push eax
:0041C8C0 8B45EC                  mov eax, dword ptr [ebp-14]
:0041C8C3 50                      push eax
:0041C8C4 E808DFFFFF              call 0041A7D1
:0041C8C9 83C40C                  add esp, 0000000C
:0041C8CC 8945E4                  mov dword ptr [ebp-1C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041C898(C), :0041C8A6(C), :0041C8B4(C)
|
:0041C8CF E9B5030000              jmp 0041CC89

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041C6DA(C), :0041C6E8(C)
|
:0041C8D4 33C0                    xor eax, eax
:0041C8D6 8A450C                  mov al, byte ptr [ebp+0C]
:0041C8D9 83F828                  cmp eax, 00000028
:0041C8DC 0F8C14020000            jl 0041CAF6
:0041C8E2 33C0                    xor eax, eax
:0041C8E4 8A450C                  mov al, byte ptr [ebp+0C]
:0041C8E7 83F82B                  cmp eax, 0000002B
:0041C8EA 0F8F06020000            jg 0041CAF6
:0041C8F0 33C0                    xor eax, eax
:0041C8F2 8A4508                  mov al, byte ptr [ebp+08]
:0041C8F5 8BC8                    mov ecx, eax
:0041C8F7 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041C8FA C1E003                  shl eax, 03
:0041C8FD 2BC1                    sub eax, ecx
:0041C8FF 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041C905 E816C9FEFF              call 00409220
:0041C90A 8BD8                    mov ebx, eax
:0041C90C 8B4D9C                  mov ecx, dword ptr [ebp-64]
:0041C90F E80CC9FEFF              call 00409220
:0041C914 3BD8                    cmp ebx, eax
:0041C916 0F85DA010000            jne 0041CAF6
:0041C91C 833DACA6460000          cmp dword ptr [0046A6AC], 00000000
:0041C923 0F84CD010000            je 0041CAF6
:0041C929 33C0                    xor eax, eax
:0041C92B 8A450C                  mov al, byte ptr [ebp+0C]
:0041C92E 83F82A                  cmp eax, 0000002A
:0041C931 0F8C22000000            jl 0041C959
:0041C937 33C0                    xor eax, eax
:0041C939 8A4508                  mov al, byte ptr [ebp+08]
:0041C93C 8BC8                    mov ecx, eax
:0041C93E 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041C941 C1E003                  shl eax, 03
:0041C944 2BC1                    sub eax, ecx
:0041C946 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041C94C E8DFCDFEFF              call 00409730
:0041C951 8845D4                  mov byte ptr [ebp-2C], al
:0041C954 E91D000000              jmp 0041C976

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C931(C)
|
:0041C959 33C0                    xor eax, eax
:0041C95B 8A4508                  mov al, byte ptr [ebp+08]
:0041C95E 8BC8                    mov ecx, eax
:0041C960 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041C963 C1E003                  shl eax, 03
:0041C966 2BC1                    sub eax, ecx
:0041C968 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041C96E E85DCDFEFF              call 004096D0
:0041C973 8845D4                  mov byte ptr [ebp-2C], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C954(U)
|
:0041C976 33C0                    xor eax, eax
:0041C978 8A45D4                  mov al, byte ptr [ebp-2C]
:0041C97B 85C0                    test eax, eax
:0041C97D 0F8507000000            jne 0041C98A
:0041C983 33C0                    xor eax, eax
:0041C985 E95E030000              jmp 0041CCE8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C97D(C)
|
:0041C98A 33C0                    xor eax, eax
:0041C98C 8A45D4                  mov al, byte ptr [ebp-2C]
:0041C98F 894594                  mov dword ptr [ebp-6C], eax
:0041C992 E9A6000000              jmp 0041CA3D
:0041C997 B9D0A64600              mov ecx, 0046A6D0
:0041C99C E80FF1FEFF              call 0040BAB0
:0041C9A1 85C0                    test eax, eax
:0041C9A3 0F8413000000            je 0041C9BC
:0041C9A9 B9D0A64600              mov ecx, 0046A6D0
:0041C9AE E8FDF0FEFF              call 0040BAB0
:0041C9B3 83F801                  cmp eax, 00000001
:0041C9B6 0F8507000000            jne 0041C9C3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C9A3(C)
|
:0041C9BC 33C0                    xor eax, eax
:0041C9BE E925030000              jmp 0041CCE8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C9B6(C)
|
:0041C9C3 33C0                    xor eax, eax
:0041C9C5 8A450C                  mov al, byte ptr [ebp+0C]
:0041C9C8 83F82A                  cmp eax, 0000002A
:0041C9CB 0F8D1B000000            jnl 0041C9EC
:0041C9D1 8B4508                  mov eax, dword ptr [ebp+08]
:0041C9D4 50                      push eax
:0041C9D5 E860DFFFFF              call 0041A93A
:0041C9DA 83C404                  add esp, 00000004
:0041C9DD 85C0                    test eax, eax
:0041C9DF 0F8407000000            je 0041C9EC
:0041C9E5 33C0                    xor eax, eax
:0041C9E7 E9FC020000              jmp 0041CCE8

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041C9CB(C), :0041C9DF(C)
|
:0041C9EC 33C0                    xor eax, eax
:0041C9EE 8A450C                  mov al, byte ptr [ebp+0C]
:0041C9F1 83F82A                  cmp eax, 0000002A
:0041C9F4 0F8C0C000000            jl 0041CA06
:0041C9FA C745E80B000000          mov [ebp-18], 0000000B
:0041CA01 E907000000              jmp 0041CA0D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C9F4(C)
|
:0041CA06 C745E80C000000          mov [ebp-18], 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041CA01(U)
|
:0041CA0D E952000000              jmp 0041CA64
:0041CA12 33C0                    xor eax, eax
:0041CA14 8A450C                  mov al, byte ptr [ebp+0C]
:0041CA17 83F82A                  cmp eax, 0000002A
:0041CA1A 0F8C0C000000            jl 0041CA2C
:0041CA20 C745E81B000000          mov [ebp-18], 0000001B
:0041CA27 E907000000              jmp 0041CA33

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041CA1A(C)
|
:0041CA2C C745E81D000000          mov [ebp-18], 0000001D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041CA27(U)
|
:0041CA33 E92C000000              jmp 0041CA64
:0041CA38 E927000000              jmp 0041CA64

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C992(U)
|
:0041CA3D FF4D94                  dec [ebp-6C]
:0041CA40 837D9403                cmp dword ptr [ebp-6C], 00000003
:0041CA44 0F871A000000            ja 0041CA64
:0041CA4A 8B4594                  mov eax, dword ptr [ebp-6C]
:0041CA4D FF248554CA4100          jmp dword ptr [4*eax+0041CA54]

:0041CA54 97C94100                DWORD 0041C997
:0041CA58 97C94100                DWORD 0041C997
:0041CA5C 12CA4100                DWORD 0041CA12
:0041CA60 12CA4100                DWORD 0041CA12



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041CA0D(U), :0041CA33(U), :0041CA38(U), :0041CA44(C)
|
:0041CA64 33C0                    xor eax, eax
:0041CA66 8A45D4                  mov al, byte ptr [ebp-2C]
:0041CA69 83F804                  cmp eax, 00000004
:0041CA6C 0F8509000000            jne 0041CA7B
:0041CA72 8345E802                add dword ptr [ebp-18], 00000002
:0041CA76 E900000000              jmp 0041CA7B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041CA6C(C), :0041CA76(U)
|
:0041CA7B 33C0                    xor eax, eax
:0041CA7D 8A450C                  mov al, byte ptr [ebp+0C]
:0041CA80 83F829                  cmp eax, 00000029
:0041CA83 0F840E000000            je 0041CA97
:0041CA89 33C0                    xor eax, eax
:0041CA8B 8A450C                  mov al, byte ptr [ebp+0C]
:0041CA8E 83F82B                  cmp eax, 0000002B
:0041CA91 0F8532000000            jne 0041CAC9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041CA83(C)
|
:0041CA97 33C0                    xor eax, eax
:0041CA99 8A450C                  mov al, byte ptr [ebp+0C]
:0041CA9C 83F829                  cmp eax, 00000029
:0041CA9F 0F8509000000            jne 0041CAAE
:0041CAA5 C645A002                mov [ebp-60], 02
:0041CAA9 E904000000              jmp 0041CAB2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041CA9F(C)
|
:0041CAAE C645A003                mov [ebp-60], 03

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041CAA9(U)
|
:0041CAB2 8B45A0                  mov eax, dword ptr [ebp-60]
:0041CAB5 50                      push eax
:0041CAB6 8B45E8                  mov eax, dword ptr [ebp-18]
:0041CAB9 50                      push eax
:0041CABA 8B45EC                  mov eax, dword ptr [ebp-14]
:0041CABD 50                      push eax
:0041CABE E80EDDFFFF              call 0041A7D1
:0041CAC3 83C40C                  add esp, 0000000C
:0041CAC6 8945E8                  mov dword ptr [ebp-18], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041CA91(C)
|
:0041CAC9 8B45E8                  mov eax, dword ptr [ebp-18]
:0041CACC 8945E4                  mov dword ptr [ebp-1C], eax
:0041CACF 8B459C                  mov eax, dword ptr [ebp-64]
:0041CAD2 33C9                    xor ecx, ecx
:0041CAD4 8A4804                  mov cl, byte ptr [eax+04]
:0041CAD7 33C0                    xor eax, eax
:0041CAD9 8A4508                  mov al, byte ptr [ebp+08]
:0041CADC 3BC8                    cmp ecx, eax
:0041CADE 0F850D000000            jne 0041CAF1
:0041CAE4 837DE400                cmp dword ptr [ebp-1C], 00000000
:0041CAE8 0F8603000000            jbe 0041CAF1
:0041CAEE FF4DE4                  dec [ebp-1C]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041CADE(C), :0041CAE8(C)
|
:0041CAF1 E993010000              jmp 0041CC89

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041C8DC(C), :0041C8EA(C), :0041C916(C), :0041C923(C)
|
:0041CAF6 33C0                    xor eax, eax
:0041CAF8 8A450C                  mov al, byte ptr [ebp+0C]
:0041CAFB 83F824                  cmp eax, 00000024
:0041CAFE 0F8CC5000000            jl 0041CBC9
:0041CB04 33C0                    xor eax, eax
:0041CB06 8A450C                  mov al, byte ptr [ebp+0C]
:0041CB09 83F828                  cmp eax, 00000028
:0041CB0C 0F8DB7000000            jnl 0041CBC9
:0041CB12 33C0                    xor eax, eax
:0041CB14 8A450C                  mov al, byte ptr [ebp+0C]
:0041CB17 894590                  mov dword ptr [ebp-70], eax
:0041CB1A E951000000              jmp 0041CB70
:0041CB1F C645D410                mov [ebp-2C], 10
:0041CB23 C745E820000000          mov [ebp-18], 00000020
:0041CB2A E969000000              jmp 0041CB98
:0041CB2F C645D420                mov [ebp-2C], 20
:0041CB33 C745E81F000000          mov [ebp-18], 0000001F
:0041CB3A E959000000              jmp 0041CB98
:0041CB3F C645D402                mov [ebp-2C], 02
:0041CB43 C745E81B000000          mov [ebp-18], 0000001B
:0041CB4A E949000000              jmp 0041CB98
:0041CB4F C645D401                mov [ebp-2C], 01
:0041CB53 C745E81A000000          mov [ebp-18], 0000001A
:0041CB5A E939000000              jmp 0041CB98

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041CB78(C)
|
:0041CB5F C745E400000000          mov [ebp-1C], 00000000
:0041CB66 E92D000000              jmp 0041CB98
:0041CB6B E928000000              jmp 0041CB98

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041CB1A(U)
|
:0041CB70 836D9024                sub dword ptr [ebp-70], 00000024
:0041CB74 837D9003                cmp dword ptr [ebp-70], 00000003
:0041CB78 0F87E1FFFFFF            ja 0041CB5F
:0041CB7E 8B4590                  mov eax, dword ptr [ebp-70]
:0041CB81 FF248588CB4100          jmp dword ptr [4*eax+0041CB88]

:0041CB88 1FCB4100                DWORD 0041CB1F
:0041CB8C 2FCB4100                DWORD 0041CB2F
:0041CB90 3FCB4100                DWORD 0041CB3F
:0041CB94 4FCB4100                DWORD 0041CB4F



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041CB2A(U), :0041CB3A(U), :0041CB4A(U), :0041CB5A(U), :0041CB66(U)
|:0041CB6B(U)
|
:0041CB98 8B45D4                  mov eax, dword ptr [ebp-2C]
:0041CB9B 50                      push eax
:0041CB9C 33C0                    xor eax, eax
:0041CB9E 8A4508                  mov al, byte ptr [ebp+08]
:0041CBA1 8BC8                    mov ecx, eax
:0041CBA3 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041CBA6 C1E003                  shl eax, 03
:0041CBA9 2BC1                    sub eax, ecx
:0041CBAB 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041CBB1 E89AC5FEFF              call 00409150
:0041CBB6 85C0                    test eax, eax
:0041CBB8 0F8406000000            je 0041CBC4
:0041CBBE 8B45E8                  mov eax, dword ptr [ebp-18]
:0041CBC1 8945E4                  mov dword ptr [ebp-1C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041CBB8(C)
|
:0041CBC4 E9C0000000              jmp 0041CC89

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041CAFE(C), :0041CB0C(C)
|
:0041CBC9 33C0                    xor eax, eax
:0041CBCB 8A450C                  mov al, byte ptr [ebp+0C]
:0041CBCE 83F82C                  cmp eax, 0000002C
:0041CBD1 0F853D000000            jne 0041CC14
:0041CBD7 833DACA6460000          cmp dword ptr [0046A6AC], 00000000
:0041CBDE 0F8430000000            je 0041CC14
:0041CBE4 6A08                    push 00000008
:0041CBE6 33C0                    xor eax, eax
:0041CBE8 8A4508                  mov al, byte ptr [ebp+08]
:0041CBEB 8BC8                    mov ecx, eax
:0041CBED 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041CBF0 C1E003                  shl eax, 03
:0041CBF3 2BC1                    sub eax, ecx
:0041CBF5 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041CBFB E850C5FEFF              call 00409150
:0041CC00 85C0                    test eax, eax
:0041CC02 0F8507000000            jne 0041CC0F
:0041CC08 C745E40D000000          mov [ebp-1C], 0000000D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041CC02(C)
|
:0041CC0F E975000000              jmp 0041CC89

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041CBD1(C), :0041CBDE(C)
|
:0041CC14 33C0                    xor eax, eax
:0041CC16 8A450C                  mov al, byte ptr [ebp+0C]
:0041CC19 83F82D                  cmp eax, 0000002D
:0041CC1C 0F8567000000            jne 0041CC89
:0041CC22 8B459C                  mov eax, dword ptr [ebp-64]
:0041CC25 33C9                    xor ecx, ecx
:0041CC27 8A4804                  mov cl, byte ptr [eax+04]
:0041CC2A 33C0                    xor eax, eax
:0041CC2C 8A4508                  mov al, byte ptr [ebp+08]
:0041CC2F 3BC8                    cmp ecx, eax
:0041CC31 0F8452000000            je 0041CC89
:0041CC37 6A40                    push 00000040
:0041CC39 33C0                    xor eax, eax
:0041CC3B 8A4508                  mov al, byte ptr [ebp+08]
:0041CC3E 8BC8                    mov ecx, eax
:0041CC40 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041CC43 C1E003                  shl eax, 03
:0041CC46 2BC1                    sub eax, ecx
:0041CC48 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041CC4E E80DC7FEFF              call 00409360
:0041CC53 85C0                    test eax, eax
:0041CC55 0F8527000000            jne 0041CC82
:0041CC5B 6880000000              push 00000080
:0041CC60 33C0                    xor eax, eax
:0041CC62 8A4508                  mov al, byte ptr [ebp+08]
:0041CC65 8BC8                    mov ecx, eax
:0041CC67 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041CC6A C1E003                  shl eax, 03
:0041CC6D 2BC1                    sub eax, ecx
:0041CC6F 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041CC75 E8E6C6FEFF              call 00409360
:0041CC7A 85C0                    test eax, eax
:0041CC7C 0F8407000000            je 0041CC89

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041CC55(C)
|
:0041CC82 C745E40F000000          mov [ebp-1C], 0000000F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041C2A7(U), :0041C32B(U), :0041C3D8(U), :0041C485(U), :0041C6CD(U)
|:0041C8CF(U), :0041CAF1(U), :0041CBC4(U), :0041CC0F(U), :0041CC1C(C)
|:0041CC31(C), :0041CC7C(C)
|
:0041CC89 837DE400                cmp dword ptr [ebp-1C], 00000000
:0041CC8D 0F864D000000            jbe 0041CCE0
:0041CC93 33C0                    xor eax, eax
:0041CC95 8A4508                  mov al, byte ptr [ebp+08]
:0041CC98 8BC8                    mov ecx, eax
:0041CC9A 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041CC9D C1E003                  shl eax, 03
:0041CCA0 2BC1                    sub eax, ecx
:0041CCA2 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041CCA8 E883C4FEFF              call 00409130
:0041CCAD 3DEC000000              cmp eax, 000000EC
:0041CCB2 0F8328000000            jnb 0041CCE0
:0041CCB8 33C0                    xor eax, eax
:0041CCBA 8A4508                  mov al, byte ptr [ebp+08]
:0041CCBD 85C0                    test eax, eax
:0041CCBF 0F840E000000            je 0041CCD3
:0041CCC5 33C0                    xor eax, eax
:0041CCC7 8A4508                  mov al, byte ptr [ebp+08]
:0041CCCA 83F80F                  cmp eax, 0000000F
:0041CCCD 0F8509000000            jne 0041CCDC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041CCBF(C)
|
:0041CCD3 8345E40A                add dword ptr [ebp-1C], 0000000A
:0041CCD7 E904000000              jmp 0041CCE0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041CCCD(C)
|
:0041CCDC 8345E406                add dword ptr [ebp-1C], 00000006

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041CC8D(C), :0041CCB2(C), :0041CCD7(U)
|
:0041CCE0 8B45E4                  mov eax, dword ptr [ebp-1C]
:0041CCE3 E900000000              jmp 0041CCE8

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041C0D7(U), :0041C112(U), :0041C326(U), :0041C36B(U), :0041C418(U)
|:0041C4E8(U), :0041C88F(U), :0041C985(U), :0041C9BE(U), :0041C9E7(U)
|:0041CCE3(U)
|
:0041CCE8 5F                      pop edi
:0041CCE9 5E                      pop esi
:0041CCEA 5B                      pop ebx
:0041CCEB C9                      leave
:0041CCEC C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0041C20C   , :0041C2FC   , :0041C38C   , :0041C439   , :0041C51A   
|:0041C585   
|
:0041CCEF 55                      push ebp
:0041CCF0 8BEC                    mov ebp, esp
:0041CCF2 83EC04                  sub esp, 00000004
:0041CCF5 53                      push ebx
:0041CCF6 56                      push esi
:0041CCF7 57                      push edi
:0041CCF8 C745FC00000000          mov [ebp-04], 00000000
:0041CCFF 8B450C                  mov eax, dword ptr [ebp+0C]
:0041CD02 2BD2                    sub edx, edx
:0041CD04 F77510                  div [ebp+10]
:0041CD07 3B4508                  cmp eax, dword ptr [ebp+08]
:0041CD0A 0F832D000000            jnb 0041CD3D
:0041CD10 B964000000              mov ecx, 00000064
:0041CD15 8B450C                  mov eax, dword ptr [ebp+0C]
:0041CD18 C1E002                  shl eax, 02
:0041CD1B 8D0480                  lea eax, dword ptr [eax+4*eax]
:0041CD1E 8D0480                  lea eax, dword ptr [eax+4*eax]
:0041CD21 2BD2                    sub edx, edx
:0041CD23 F77508                  div [ebp+08]
:0041CD26 2BD2                    sub edx, edx
:0041CD28 F77510                  div [ebp+10]
:0041CD2B 2BC8                    sub ecx, eax
:0041CD2D 83F932                  cmp ecx, 00000032
:0041CD30 0F8207000000            jb 0041CD3D
:0041CD36 C745FC01000000          mov [ebp-04], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041CD0A(C), :0041CD30(C)
|
:0041CD3D 8B45FC                  mov eax, dword ptr [ebp-04]
:0041CD40 E900000000              jmp 0041CD45

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041CD40(U)
|
:0041CD45 5F                      pop edi
:0041CD46 5E                      pop esi
:0041CD47 5B                      pop ebx
:0041CD48 C9                      leave
:0041CD49 C3                      ret



* Referenced by a CALL at Address:
|:0041C030   
|
:0041CD4A 55                      push ebp
:0041CD4B 8BEC                    mov ebp, esp
:0041CD4D 83EC04                  sub esp, 00000004
:0041CD50 53                      push ebx
:0041CD51 56                      push esi
:0041CD52 57                      push edi
:0041CD53 C645FC00                mov [ebp-04], 00
:0041CD57 33C0                    xor eax, eax
:0041CD59 8A4508                  mov al, byte ptr [ebp+08]
:0041CD5C 83F803                  cmp eax, 00000003
:0041CD5F 0F8C0E000000            jl 0041CD73
:0041CD65 33C0                    xor eax, eax
:0041CD67 8A4508                  mov al, byte ptr [ebp+08]
:0041CD6A 83F805                  cmp eax, 00000005
:0041CD6D 0F8E54000000            jle 0041CDC7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041CD5F(C)
|
:0041CD73 33C0                    xor eax, eax
:0041CD75 8A4508                  mov al, byte ptr [ebp+08]
:0041CD78 83F809                  cmp eax, 00000009
:0041CD7B 0F8C0E000000            jl 0041CD8F
:0041CD81 33C0                    xor eax, eax
:0041CD83 8A4508                  mov al, byte ptr [ebp+08]
:0041CD86 83F80B                  cmp eax, 0000000B
:0041CD89 0F8E38000000            jle 0041CDC7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041CD7B(C)
|
:0041CD8F 33C0                    xor eax, eax
:0041CD91 8A4508                  mov al, byte ptr [ebp+08]
:0041CD94 83F810                  cmp eax, 00000010
:0041CD97 0F842A000000            je 0041CDC7
:0041CD9D 33C0                    xor eax, eax
:0041CD9F 8A4508                  mov al, byte ptr [ebp+08]
:0041CDA2 83F812                  cmp eax, 00000012
:0041CDA5 0F841C000000            je 0041CDC7
:0041CDAB 33C0                    xor eax, eax
:0041CDAD 8A4508                  mov al, byte ptr [ebp+08]
:0041CDB0 83F814                  cmp eax, 00000014
:0041CDB3 0F840E000000            je 0041CDC7
:0041CDB9 33C0                    xor eax, eax
:0041CDBB 8A4508                  mov al, byte ptr [ebp+08]
:0041CDBE 83F816                  cmp eax, 00000016
:0041CDC1 0F8509000000            jne 0041CDD0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041CD6D(C), :0041CD89(C), :0041CD97(C), :0041CDA5(C), :0041CDB3(C)
|
:0041CDC7 C645FC01                mov [ebp-04], 01
:0041CDCB E93C000000              jmp 0041CE0C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041CDC1(C)
|
:0041CDD0 33C0                    xor eax, eax
:0041CDD2 8A4508                  mov al, byte ptr [ebp+08]
:0041CDD5 83F81D                  cmp eax, 0000001D
:0041CDD8 0F8C0E000000            jl 0041CDEC
:0041CDDE 33C0                    xor eax, eax
:0041CDE0 8A4508                  mov al, byte ptr [ebp+08]
:0041CDE3 83F820                  cmp eax, 00000020
:0041CDE6 0F8E1C000000            jle 0041CE08

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041CDD8(C)
|
:0041CDEC 33C0                    xor eax, eax
:0041CDEE 8A4508                  mov al, byte ptr [ebp+08]
:0041CDF1 83F829                  cmp eax, 00000029
:0041CDF4 0F840E000000            je 0041CE08
:0041CDFA 33C0                    xor eax, eax
:0041CDFC 8A4508                  mov al, byte ptr [ebp+08]
:0041CDFF 83F82B                  cmp eax, 0000002B
:0041CE02 0F8504000000            jne 0041CE0C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041CDE6(C), :0041CDF4(C)
|
:0041CE08 C645FC02                mov [ebp-04], 02

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041CDCB(U), :0041CE02(C)
|
:0041CE0C 8A45FC                  mov al, byte ptr [ebp-04]
:0041CE0F E900000000              jmp 0041CE14

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041CE0F(U)
|
:0041CE14 5F                      pop edi
:0041CE15 5E                      pop esi
:0041CE16 5B                      pop ebx
:0041CE17 C9                      leave
:0041CE18 C3                      ret



* Referenced by a CALL at Address:
|:0041C835   
|
:0041CE19 55                      push ebp
:0041CE1A 8BEC                    mov ebp, esp
:0041CE1C 83EC20                  sub esp, 00000020
:0041CE1F 53                      push ebx
:0041CE20 56                      push esi
:0041CE21 57                      push edi
:0041CE22 894DE0                  mov dword ptr [ebp-20], ecx
:0041CE25 8B45E0                  mov eax, dword ptr [ebp-20]
:0041CE28 8B00                    mov eax, dword ptr [eax]
:0041CE2A 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041CE2D 03C0                    add eax, eax
:0041CE2F 8D04C0                  lea eax, dword ptr [eax+8*eax]
:0041CE32 05E8564500              add eax, 004556E8
:0041CE37 8945EC                  mov dword ptr [ebp-14], eax
:0041CE3A 33C0                    xor eax, eax
:0041CE3C 8A450C                  mov al, byte ptr [ebp+0C]
:0041CE3F 8BC8                    mov ecx, eax
:0041CE41 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041CE44 C1E003                  shl eax, 03
:0041CE47 2BC1                    sub eax, ecx
:0041CE49 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041CE4F E8DCC2FEFF              call 00409130
:0041CE54 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041CE57 03C0                    add eax, eax
:0041CE59 8D04C0                  lea eax, dword ptr [eax+8*eax]
:0041CE5C 05E8564500              add eax, 004556E8
:0041CE61 8945F4                  mov dword ptr [ebp-0C], eax
:0041CE64 33C0                    xor eax, eax
:0041CE66 8A4508                  mov al, byte ptr [ebp+08]
:0041CE69 25F0000000              and eax, 000000F0
:0041CE6E C1E804                  shr eax, 04
:0041CE71 8845E8                  mov byte ptr [ebp-18], al
:0041CE74 C745F000000000          mov [ebp-10], 00000000
:0041CE7B C745FC00000000          mov [ebp-04], 00000000
:0041CE82 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041CE85 E846C4FEFF              call 004092D0
:0041CE8A 8845E4                  mov byte ptr [ebp-1C], al
:0041CE8D C745F800000000          mov [ebp-08], 00000000
:0041CE94 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0041CE97 E894C9FEFF              call 00409830
:0041CE9C 33C9                    xor ecx, ecx
:0041CE9E 8AC8                    mov cl, al
:0041CEA0 83F902                  cmp ecx, 00000002
:0041CEA3 0F8407000000            je 0041CEB0
:0041CEA9 33C0                    xor eax, eax
:0041CEAB E9B2010000              jmp 0041D062

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041CEA3(C)
|
:0041CEB0 33C0                    xor eax, eax
:0041CEB2 8A4508                  mov al, byte ptr [ebp+08]
:0041CEB5 A801                    test al, 01
:0041CEB7 0F84DD000000            je 0041CF9A
:0041CEBD C745F81E000000          mov [ebp-08], 0000001E
:0041CEC4 33C0                    xor eax, eax
:0041CEC6 8A45E8                  mov al, byte ptr [ebp-18]
:0041CEC9 83F803                  cmp eax, 00000003
:0041CECC 0F8510000000            jne 0041CEE2
:0041CED2 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041CED5 E8B6C8FEFF              call 00409790
:0041CEDA 8945F0                  mov dword ptr [ebp-10], eax
:0041CEDD E923000000              jmp 0041CF05

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041CECC(C)
|
:0041CEE2 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041CEE5 E896C3FEFF              call 00409280
:0041CEEA 33C9                    xor ecx, ecx
:0041CEEC 8AC8                    mov cl, al
:0041CEEE 33C0                    xor eax, eax
:0041CEF0 8A45E8                  mov al, byte ptr [ebp-18]
:0041CEF3 8D0480                  lea eax, dword ptr [eax+4*eax]
:0041CEF6 8D0480                  lea eax, dword ptr [eax+4*eax]
:0041CEF9 8D0CC1                  lea ecx, dword ptr [ecx+8*eax]
:0041CEFC 81C1C8000000            add ecx, 000000C8
:0041CF02 894DF0                  mov dword ptr [ebp-10], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041CEDD(U)
|
:0041CF05 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041CF08 E883C8FEFF              call 00409790
:0041CF0D 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0041CF10 2B410F                  sub eax, dword ptr [ecx+0F]
:0041CF13 3B45F0                  cmp eax, dword ptr [ebp-10]
:0041CF16 0F8F16000000            jg 0041CF32
:0041CF1C 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041CF1F E86CC8FEFF              call 00409790
:0041CF24 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0041CF27 2B410F                  sub eax, dword ptr [ecx+0F]
:0041CF2A 8945F0                  mov dword ptr [ebp-10], eax
:0041CF2D E900000000              jmp 0041CF32

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041CF16(C), :0041CF2D(U)
|
:0041CF32 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041CF35 E856C8FEFF              call 00409790
:0041CF3A 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0041CF3D 8B490F                  mov ecx, dword ptr [ecx+0F]
:0041CF40 034DF0                  add ecx, dword ptr [ebp-10]
:0041CF43 3BC1                    cmp eax, ecx
:0041CF45 0F8704000000            ja 0041CF4F
:0041CF4B 8345F802                add dword ptr [ebp-08], 00000002

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041CF45(C)
|
:0041CF4F 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041CF52 E839C8FEFF              call 00409790
:0041CF57 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0041CF5A 2B410F                  sub eax, dword ptr [ecx+0F]
:0041CF5D 8D0480                  lea eax, dword ptr [eax+4*eax]
:0041CF60 2BD2                    sub edx, edx
:0041CF62 F775F0                  div [ebp-10]
:0041CF65 83F803                  cmp eax, 00000003
:0041CF68 0F8704000000            ja 0041CF72
:0041CF6E 836DF804                sub dword ptr [ebp-08], 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041CF68(C)
|
:0041CF72 8B45E0                  mov eax, dword ptr [ebp-20]
:0041CF75 8B580F                  mov ebx, dword ptr [eax+0F]
:0041CF78 8D1C9B                  lea ebx, dword ptr [ebx+4*ebx]
:0041CF7B 03DB                    add ebx, ebx
:0041CF7D 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041CF80 E80BC8FEFF              call 00409790
:0041CF85 8BC8                    mov ecx, eax
:0041CF87 8BC3                    mov eax, ebx
:0041CF89 2BD2                    sub edx, edx
:0041CF8B F7F1                    div ecx
:0041CF8D 83F802                  cmp eax, 00000002
:0041CF90 0F8704000000            ja 0041CF9A
:0041CF96 8345F804                add dword ptr [ebp-08], 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041CEB7(C), :0041CF90(C)
|
:0041CF9A 33C0                    xor eax, eax
:0041CF9C 8A4508                  mov al, byte ptr [ebp+08]
:0041CF9F A802                    test al, 02
:0041CFA1 0F849B000000            je 0041D042
:0041CFA7 C745F81C000000          mov [ebp-08], 0000001C
:0041CFAE 6A00                    push 00000000
:0041CFB0 8B45E8                  mov eax, dword ptr [ebp-18]
:0041CFB3 50                      push eax
:0041CFB4 8B45E0                  mov eax, dword ptr [ebp-20]
:0041CFB7 8A4004                  mov al, byte ptr [eax+04]
:0041CFBA 50                      push eax
:0041CFBB E89153FEFF              call 00402351
:0041CFC0 83C40C                  add esp, 0000000C
:0041CFC3 33C9                    xor ecx, ecx
:0041CFC5 8AC8                    mov cl, al
:0041CFC7 894DFC                  mov dword ptr [ebp-04], ecx
:0041CFCA 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041CFCD E80EC2FEFF              call 004091E0
:0041CFD2 33C9                    xor ecx, ecx
:0041CFD4 8AC8                    mov cl, al
:0041CFD6 8B45E0                  mov eax, dword ptr [ebp-20]
:0041CFD9 33D2                    xor edx, edx
:0041CFDB 8A5013                  mov dl, byte ptr [eax+13]
:0041CFDE 0355FC                  add edx, dword ptr [ebp-04]
:0041CFE1 3BCA                    cmp ecx, edx
:0041CFE3 0F8F04000000            jg 0041CFED
:0041CFE9 8345F802                add dword ptr [ebp-08], 00000002

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041CFE3(C)
|
:0041CFED 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041CFF0 E8EBC1FEFF              call 004091E0
:0041CFF5 33C9                    xor ecx, ecx
:0041CFF7 8AC8                    mov cl, al
:0041CFF9 8B45E0                  mov eax, dword ptr [ebp-20]
:0041CFFC 33D2                    xor edx, edx
:0041CFFE 8A5013                  mov dl, byte ptr [eax+13]
:0041D001 2BCA                    sub ecx, edx
:0041D003 8D0489                  lea eax, dword ptr [ecx+4*ecx]
:0041D006 99                      cdq
:0041D007 F77DFC                  idiv [ebp-04]
:0041D00A 83F803                  cmp eax, 00000003
:0041D00D 0F8F04000000            jg 0041D017
:0041D013 836DF804                sub dword ptr [ebp-08], 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D00D(C)
|
:0041D017 8B45E0                  mov eax, dword ptr [ebp-20]
:0041D01A 33DB                    xor ebx, ebx
:0041D01C 8A5813                  mov bl, byte ptr [eax+13]
:0041D01F 8D1C9B                  lea ebx, dword ptr [ebx+4*ebx]
:0041D022 03DB                    add ebx, ebx
:0041D024 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041D027 E8B4C1FEFF              call 004091E0
:0041D02C 33C9                    xor ecx, ecx
:0041D02E 8AC8                    mov cl, al
:0041D030 8BC3                    mov eax, ebx
:0041D032 99                      cdq
:0041D033 F7F9                    idiv ecx
:0041D035 83F802                  cmp eax, 00000002
:0041D038 0F8F04000000            jg 0041D042
:0041D03E 8345F804                add dword ptr [ebp-08], 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041CFA1(C), :0041D038(C)
|
:0041D042 8B45E0                  mov eax, dword ptr [ebp-20]
:0041D045 33C9                    xor ecx, ecx
:0041D047 8A4804                  mov cl, byte ptr [eax+04]
:0041D04A 33C0                    xor eax, eax
:0041D04C 8A450C                  mov al, byte ptr [ebp+0C]
:0041D04F 3BC8                    cmp ecx, eax
:0041D051 0F8503000000            jne 0041D05A
:0041D057 FF45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D051(C)
|
:0041D05A 8B45F8                  mov eax, dword ptr [ebp-08]
:0041D05D E900000000              jmp 0041D062

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041CEAB(U), :0041D05D(U)
|
:0041D062 5F                      pop edi
:0041D063 5E                      pop esi
:0041D064 5B                      pop ebx
:0041D065 C9                      leave
:0041D066 C20800                  ret 0008



* Referenced by a CALL at Address:
|:0041D2A0   
|
:0041D069 55                      push ebp
:0041D06A 8BEC                    mov ebp, esp
:0041D06C 83EC10                  sub esp, 00000010
:0041D06F 53                      push ebx
:0041D070 56                      push esi
:0041D071 57                      push edi
:0041D072 894DF4                  mov dword ptr [ebp-0C], ecx
:0041D075 8B4508                  mov eax, dword ptr [ebp+08]
:0041D078 50                      push eax
:0041D079 E85CC5FFFF              call 004195DA
:0041D07E 83C404                  add esp, 00000004
:0041D081 8845FC                  mov byte ptr [ebp-04], al
:0041D084 C745F800000000          mov [ebp-08], 00000000
:0041D08B 33C0                    xor eax, eax
:0041D08D 8A45FC                  mov al, byte ptr [ebp-04]
:0041D090 8945F0                  mov dword ptr [ebp-10], eax
:0041D093 E96D000000              jmp 0041D105
:0041D098 C745F808000000          mov [ebp-08], 00000008
:0041D09F E995000000              jmp 0041D139
:0041D0A4 C745F807000000          mov [ebp-08], 00000007
:0041D0AB E989000000              jmp 0041D139
:0041D0B0 C745F806000000          mov [ebp-08], 00000006
:0041D0B7 E97D000000              jmp 0041D139
:0041D0BC C745F805000000          mov [ebp-08], 00000005
:0041D0C3 E971000000              jmp 0041D139
:0041D0C8 C745F804000000          mov [ebp-08], 00000004
:0041D0CF E965000000              jmp 0041D139

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D10D(C)
|
:0041D0D4 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041D0D7 E845D20000              call 0042A321
:0041D0DC 33C9                    xor ecx, ecx
:0041D0DE 8AC8                    mov cl, al
:0041D0E0 83F90A                  cmp ecx, 0000000A
:0041D0E3 0F8E12000000            jle 0041D0FB
:0041D0E9 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041D0EC E830D20000              call 0042A321
:0041D0F1 33C9                    xor ecx, ecx
:0041D0F3 8AC8                    mov cl, al
:0041D0F5 83E90A                  sub ecx, 0000000A
:0041D0F8 894DF8                  mov dword ptr [ebp-08], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D0E3(C)
|
:0041D0FB E939000000              jmp 0041D139
:0041D100 E934000000              jmp 0041D139

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D093(U)
|
:0041D105 836DF007                sub dword ptr [ebp-10], 00000007
:0041D109 837DF006                cmp dword ptr [ebp-10], 00000006
:0041D10D 0F87C1FFFFFF            ja 0041D0D4
:0041D113 8B45F0                  mov eax, dword ptr [ebp-10]
:0041D116 FF24851DD14100          jmp dword ptr [4*eax+0041D11D]

:0041D11D BCD04100                DWORD 0041D0BC
:0041D121 B0D04100                DWORD 0041D0B0
:0041D125 C8D04100                DWORD 0041D0C8
:0041D129 D4D04100                DWORD 0041D0D4
:0041D12D D4D04100                DWORD 0041D0D4
:0041D131 98D04100                DWORD 0041D098
:0041D135 A4D04100                DWORD 0041D0A4



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041D09F(U), :0041D0AB(U), :0041D0B7(U), :0041D0C3(U), :0041D0CF(U)
|:0041D0FB(U), :0041D100(U)
|
:0041D139 8B45F8                  mov eax, dword ptr [ebp-08]
:0041D13C E900000000              jmp 0041D141

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D13C(U)
|
:0041D141 5F                      pop edi
:0041D142 5E                      pop esi
:0041D143 5B                      pop ebx
:0041D144 C9                      leave
:0041D145 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0041B137   , :0041B52F   
|
:0041D148 55                      push ebp
:0041D149 8BEC                    mov ebp, esp
:0041D14B 83EC20                  sub esp, 00000020
:0041D14E 53                      push ebx
:0041D14F 56                      push esi
:0041D150 57                      push edi
:0041D151 894DE0                  mov dword ptr [ebp-20], ecx
:0041D154 8B4508                  mov eax, dword ptr [ebp+08]
:0041D157 33DB                    xor ebx, ebx
:0041D159 8A5801                  mov bl, byte ptr [eax+01]
:0041D15C 33C0                    xor eax, eax
:0041D15E A0C8FC4600              mov al, byte ptr [0046FCC8]
:0041D163 0FAFD8                  imul ebx, eax
:0041D166 8B4508                  mov eax, dword ptr [ebp+08]
:0041D169 33C9                    xor ecx, ecx
:0041D16B 8A08                    mov cl, byte ptr [eax]
:0041D16D 03D9                    add ebx, ecx
:0041D16F 6A04                    push 00000004
:0041D171 6A00                    push 00000000
:0041D173 6A00                    push 00000000
:0041D175 B918E54600              mov ecx, 0046E518
:0041D17A E8A1A50200              call 00447720
:0041D17F 03D8                    add ebx, eax
:0041D181 81C3C0030000            add ebx, 000003C0
:0041D187 895DF8                  mov dword ptr [ebp-08], ebx
:0041D18A C645FC00                mov [ebp-04], 00
:0041D18E C645F400                mov [ebp-0C], 00
:0041D192 8B4508                  mov eax, dword ptr [ebp+08]
:0041D195 50                      push eax
:0041D196 E8A2C3FFFF              call 0041953D
:0041D19B 83C404                  add esp, 00000004
:0041D19E 33C9                    xor ecx, ecx
:0041D1A0 8AC8                    mov cl, al
:0041D1A2 81F9FF000000            cmp ecx, 000000FF
:0041D1A8 0F841B000000            je 0041D1C9
:0041D1AE 8B45E0                  mov eax, dword ptr [ebp-20]
:0041D1B1 83C005                  add eax, 00000005
:0041D1B4 50                      push eax
:0041D1B5 8B4508                  mov eax, dword ptr [ebp+08]
:0041D1B8 50                      push eax
:0041D1B9 E8C2100000              call 0041E280
:0041D1BE 83C408                  add esp, 00000008
:0041D1C1 85C0                    test eax, eax
:0041D1C3 0F8452020000            je 0041D41B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D1A8(C)
|
:0041D1C9 6A04                    push 00000004
:0041D1CB 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0041D1CE E88DC1FEFF              call 00409360
:0041D1D3 85C0                    test eax, eax
:0041D1D5 0F8548010000            jne 0041D323
:0041D1DB 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0041D1DE E8EDC1FEFF              call 004093D0
:0041D1E3 33C9                    xor ecx, ecx
:0041D1E5 8AC8                    mov cl, al
:0041D1E7 83F904                  cmp ecx, 00000004
:0041D1EA 0F84A9000000            je 0041D299
:0041D1F0 8B4508                  mov eax, dword ptr [ebp+08]
:0041D1F3 33DB                    xor ebx, ebx
:0041D1F5 8A5801                  mov bl, byte ptr [eax+01]
:0041D1F8 33C0                    xor eax, eax
:0041D1FA A0C8FC4600              mov al, byte ptr [0046FCC8]
:0041D1FF 0FAFD8                  imul ebx, eax
:0041D202 8B4508                  mov eax, dword ptr [ebp+08]
:0041D205 33C9                    xor ecx, ecx
:0041D207 8A08                    mov cl, byte ptr [eax]
:0041D209 03D9                    add ebx, ecx
:0041D20B 6A04                    push 00000004
:0041D20D 6A00                    push 00000000
:0041D20F 6A00                    push 00000000
:0041D211 B918E54600              mov ecx, 0046E518
:0041D216 E805A50200              call 00447720
:0041D21B 33C9                    xor ecx, ecx
:0041D21D 8A0C03                  mov cl, byte ptr [ebx+eax]
:0041D220 81F9FF000000            cmp ecx, 000000FF
:0041D226 0F851B000000            jne 0041D247
:0041D22C 8B45E0                  mov eax, dword ptr [ebp-20]
:0041D22F 83C005                  add eax, 00000005
:0041D232 50                      push eax
:0041D233 8B4508                  mov eax, dword ptr [ebp+08]
:0041D236 50                      push eax
:0041D237 E844100000              call 0041E280
:0041D23C 83C408                  add esp, 00000008
:0041D23F 85C0                    test eax, eax
:0041D241 0F840F000000            je 0041D256

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D226(C)
|
:0041D247 8B4508                  mov eax, dword ptr [ebp+08]
:0041D24A 50                      push eax
:0041D24B 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0041D24E E8C5D0FFFF              call 0041A318
:0041D253 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D241(C)
|
:0041D256 6A04                    push 00000004
:0041D258 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0041D25B E8F0BEFEFF              call 00409150
:0041D260 85C0                    test eax, eax
:0041D262 0F850F000000            jne 0041D277
:0041D268 8B4508                  mov eax, dword ptr [ebp+08]
:0041D26B 50                      push eax
:0041D26C 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0041D26F E8ADEBFFFF              call 0041BE21
:0041D274 8845F4                  mov byte ptr [ebp-0C], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D262(C)
|
:0041D277 33C0                    xor eax, eax
:0041D279 8A45F4                  mov al, byte ptr [ebp-0C]
:0041D27C 33C9                    xor ecx, ecx
:0041D27E 8A4DFC                  mov cl, byte ptr [ebp-04]
:0041D281 3BC1                    cmp eax, ecx
:0041D283 0F8F02000000            jg 0041D28B
:0041D289 8BC1                    mov eax, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D283(C)
|
:0041D28B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041D28E 33D2                    xor edx, edx
:0041D290 8A11                    mov dl, byte ptr [ecx]
:0041D292 03C2                    add eax, edx
:0041D294 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041D297 8801                    mov byte ptr [ecx], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D1EA(C)
|
:0041D299 8B4508                  mov eax, dword ptr [ebp+08]
:0041D29C 50                      push eax
:0041D29D 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0041D2A0 E8C4FDFFFF              call 0041D069
:0041D2A5 8945F0                  mov dword ptr [ebp-10], eax
:0041D2A8 B8FF000000              mov eax, 000000FF
:0041D2AD 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041D2B0 33D2                    xor edx, edx
:0041D2B2 8A11                    mov dl, byte ptr [ecx]
:0041D2B4 2BC2                    sub eax, edx
:0041D2B6 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0041D2B9 3BC1                    cmp eax, ecx
:0041D2BB 0F8C02000000            jl 0041D2C3
:0041D2C1 8BC1                    mov eax, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D2BB(C)
|
:0041D2C3 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041D2C6 33D2                    xor edx, edx
:0041D2C8 8A11                    mov dl, byte ptr [ecx]
:0041D2CA 03C2                    add eax, edx
:0041D2CC 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041D2CF 8801                    mov byte ptr [ecx], al
:0041D2D1 8B45E0                  mov eax, dword ptr [ebp-20]
:0041D2D4 83C005                  add eax, 00000005
:0041D2D7 50                      push eax
:0041D2D8 8B4508                  mov eax, dword ptr [ebp+08]
:0041D2DB 50                      push eax
:0041D2DC E89F0F0000              call 0041E280
:0041D2E1 83C408                  add esp, 00000008
:0041D2E4 85C0                    test eax, eax
:0041D2E6 0F8437000000            je 0041D323
:0041D2EC 33C0                    xor eax, eax
:0041D2EE 8A45FC                  mov al, byte ptr [ebp-04]
:0041D2F1 85C0                    test eax, eax
:0041D2F3 0F852A000000            jne 0041D323
:0041D2F9 B8FF000000              mov eax, 000000FF
:0041D2FE 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041D301 33D2                    xor edx, edx
:0041D303 8A11                    mov dl, byte ptr [ecx]
:0041D305 2BC2                    sub eax, edx
:0041D307 83F801                  cmp eax, 00000001
:0041D30A 0F8C05000000            jl 0041D315
:0041D310 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D30A(C)
|
:0041D315 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041D318 33D2                    xor edx, edx
:0041D31A 8A11                    mov dl, byte ptr [ecx]
:0041D31C 03C2                    add eax, edx
:0041D31E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041D321 8801                    mov byte ptr [ecx], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041D1D5(C), :0041D2E6(C), :0041D2F3(C)
|
:0041D323 B9D0A64600              mov ecx, 0046A6D0
:0041D328 E883E7FEFF              call 0040BAB0
:0041D32D 83F802                  cmp eax, 00000002
:0041D330 0F854A000000            jne 0041D380
:0041D336 8D45E4                  lea eax, dword ptr [ebp-1C]
:0041D339 50                      push eax
:0041D33A 6A04                    push 00000004
:0041D33C 6A02                    push 00000002
:0041D33E 8B45E0                  mov eax, dword ptr [ebp-20]
:0041D341 668B4005                mov ax, word ptr [eax+05]
:0041D345 50                      push eax
:0041D346 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0041D349 E8D9000000              call 0041D427
:0041D34E 8945EC                  mov dword ptr [ebp-14], eax
:0041D351 8B45EC                  mov eax, dword ptr [ebp-14]
:0041D354 33C9                    xor ecx, ecx
:0041D356 8A08                    mov cl, byte ptr [eax]
:0041D358 81F9FF000000            cmp ecx, 000000FF
:0041D35E 0F841C000000            je 0041D380
:0041D364 8B45F8                  mov eax, dword ptr [ebp-08]
:0041D367 33C9                    xor ecx, ecx
:0041D369 8A08                    mov cl, byte ptr [eax]
:0041D36B 85C9                    test ecx, ecx
:0041D36D 0F8E0D000000            jle 0041D380
:0041D373 8B45F8                  mov eax, dword ptr [ebp-08]
:0041D376 33C9                    xor ecx, ecx
:0041D378 8A08                    mov cl, byte ptr [eax]
:0041D37A 49                      dec ecx
:0041D37B 8B45F8                  mov eax, dword ptr [ebp-08]
:0041D37E 8808                    mov byte ptr [eax], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041D330(C), :0041D35E(C), :0041D36D(C)
|
:0041D380 33C0                    xor eax, eax
:0041D382 A098A64600              mov al, byte ptr [0046A698]
:0041D387 3DFF000000              cmp eax, 000000FF
:0041D38C 0F841F000000            je 0041D3B1
:0041D392 6898A64600              push 0046A698
:0041D397 8B4508                  mov eax, dword ptr [ebp+08]
:0041D39A 50                      push eax
:0041D39B E8E00E0000              call 0041E280
:0041D3A0 83C408                  add esp, 00000008
:0041D3A3 85C0                    test eax, eax
:0041D3A5 0F8406000000            je 0041D3B1
:0041D3AB 8B45F8                  mov eax, dword ptr [ebp-08]
:0041D3AE C60000                  mov byte ptr [eax], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041D38C(C), :0041D3A5(C)
|
:0041D3B1 8B45F8                  mov eax, dword ptr [ebp-08]
:0041D3B4 33C9                    xor ecx, ecx
:0041D3B6 8A08                    mov cl, byte ptr [eax]
:0041D3B8 33C0                    xor eax, eax
:0041D3BA A0C0A64600              mov al, byte ptr [0046A6C0]
:0041D3BF 3BC8                    cmp ecx, eax
:0041D3C1 0F8E54000000            jle 0041D41B
:0041D3C7 33C0                    xor eax, eax
:0041D3C9 8A45F4                  mov al, byte ptr [ebp-0C]
:0041D3CC 33C9                    xor ecx, ecx
:0041D3CE 8A4DFC                  mov cl, byte ptr [ebp-04]
:0041D3D1 3BC1                    cmp eax, ecx
:0041D3D3 0F8E19000000            jle 0041D3F2
:0041D3D9 A0A4A64600              mov al, byte ptr [0046A6A4]
:0041D3DE A2C8A64600              mov byte ptr [0046A6C8], al
:0041D3E3 A0B8A64600              mov al, byte ptr [0046A6B8]
:0041D3E8 A2BCA64600              mov byte ptr [0046A6BC], al
:0041D3ED E911000000              jmp 0041D403

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D3D3(C)
|
:0041D3F2 C605C8A64600FF          mov byte ptr [0046A6C8], FF
:0041D3F9 A09CA64600              mov al, byte ptr [0046A69C]
:0041D3FE A2BCA64600              mov byte ptr [0046A6BC], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D3ED(U)
|
:0041D403 8B45F8                  mov eax, dword ptr [ebp-08]
:0041D406 8A00                    mov al, byte ptr [eax]
:0041D408 A2C0A64600              mov byte ptr [0046A6C0], al
:0041D40D 8B4508                  mov eax, dword ptr [ebp+08]
:0041D410 50                      push eax
:0041D411 B9B0A64600              mov ecx, 0046A6B0
:0041D416 E87544FEFF              call 00401890

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041D1C3(C), :0041D3C1(C)
|
:0041D41B E900000000              jmp 0041D420

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D41B(U)
|
:0041D420 5F                      pop edi
:0041D421 5E                      pop esi
:0041D422 5B                      pop ebx
:0041D423 C9                      leave
:0041D424 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0041A6C4   , :0041C15B   , :0041D349   
|
:0041D427 55                      push ebp
:0041D428 8BEC                    mov ebp, esp
:0041D42A 83EC18                  sub esp, 00000018
:0041D42D 53                      push ebx
:0041D42E 56                      push esi
:0041D42F 57                      push edi
:0041D430 894DE8                  mov dword ptr [ebp-18], ecx
:0041D433 33C0                    xor eax, eax
:0041D435 8A450C                  mov al, byte ptr [ebp+0C]
:0041D438 83F802                  cmp eax, 00000002
:0041D43B 0F8510000000            jne 0041D451
:0041D441 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0041D444 E8D7BDFEFF              call 00409220
:0041D449 8845EC                  mov byte ptr [ebp-14], al
:0041D44C E90F000000              jmp 0041D460

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D43B(C)
|
:0041D451 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0041D454 E8C7BDFEFF              call 00409220
:0041D459 F7D0                    not eax
:0041D45B 2401                    and al, 01
:0041D45D 8845EC                  mov byte ptr [ebp-14], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D44C(U)
|
:0041D460 8B4514                  mov eax, dword ptr [ebp+14]
:0041D463 8945F8                  mov dword ptr [ebp-08], eax
:0041D466 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0041D469 E80244FEFF              call 00401870
:0041D46E C645F400                mov [ebp-0C], 00
:0041D472 E903000000              jmp 0041D47A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D514(U)
|
:0041D477 FE45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D472(U)
|
:0041D47A 33C0                    xor eax, eax
:0041D47C 8A4510                  mov al, byte ptr [ebp+10]
:0041D47F 33C9                    xor ecx, ecx
:0041D481 8A4DF4                  mov cl, byte ptr [ebp-0C]
:0041D484 3BC1                    cmp eax, ecx
:0041D486 0F8E8D000000            jle 0041D519
:0041D48C 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041D48F 50                      push eax
:0041D490 8D4508                  lea eax, dword ptr [ebp+08]
:0041D493 50                      push eax
:0041D494 E8BCC1FFFF              call 00419655
:0041D499 83C408                  add esp, 00000008
:0041D49C 50                      push eax
:0041D49D 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0041D4A0 E8EB43FEFF              call 00401890
:0041D4A5 33C0                    xor eax, eax
:0041D4A7 8A45FC                  mov al, byte ptr [ebp-04]
:0041D4AA 3DFF000000              cmp eax, 000000FF
:0041D4AF 0F845F000000            je 0041D514
:0041D4B5 8D45FC                  lea eax, dword ptr [ebp-04]
:0041D4B8 50                      push eax
:0041D4B9 E87FC0FFFF              call 0041953D
:0041D4BE 83C404                  add esp, 00000004
:0041D4C1 8845F0                  mov byte ptr [ebp-10], al
:0041D4C4 33C0                    xor eax, eax
:0041D4C6 8A45F0                  mov al, byte ptr [ebp-10]
:0041D4C9 3DFF000000              cmp eax, 000000FF
:0041D4CE 0F8440000000            je 0041D514
:0041D4D4 33C0                    xor eax, eax
:0041D4D6 8A45F0                  mov al, byte ptr [ebp-10]
:0041D4D9 83F82D                  cmp eax, 0000002D
:0041D4DC 0F8D32000000            jnl 0041D514
:0041D4E2 33C0                    xor eax, eax
:0041D4E4 8A45F0                  mov al, byte ptr [ebp-10]
:0041D4E7 8BC8                    mov ecx, eax
:0041D4E9 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041D4EC C1E003                  shl eax, 03
:0041D4EF 2BC1                    sub eax, ecx
:0041D4F1 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041D4F7 E824BDFEFF              call 00409220
:0041D4FC 33C9                    xor ecx, ecx
:0041D4FE 8A4DEC                  mov cl, byte ptr [ebp-14]
:0041D501 3BC1                    cmp eax, ecx
:0041D503 0F850B000000            jne 0041D514
:0041D509 8A45F0                  mov al, byte ptr [ebp-10]
:0041D50C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041D50F 8801                    mov byte ptr [ecx], al
:0041D511 FF45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041D4AF(C), :0041D4CE(C), :0041D4DC(C), :0041D503(C)
|
:0041D514 E95EFFFFFF              jmp 0041D477

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D486(C)
|
:0041D519 8B45F8                  mov eax, dword ptr [ebp-08]
:0041D51C C600FF                  mov byte ptr [eax], FF
:0041D51F 8B4514                  mov eax, dword ptr [ebp+14]
:0041D522 E900000000              jmp 0041D527

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D522(U)
|
:0041D527 5F                      pop edi
:0041D528 5E                      pop esi
:0041D529 5B                      pop ebx
:0041D52A C9                      leave
:0041D52B C21000                  ret 0010



* Referenced by a CALL at Address:
|:004244B4   
|
:0041D52E 55                      push ebp
:0041D52F 8BEC                    mov ebp, esp
:0041D531 83EC1C                  sub esp, 0000001C
:0041D534 53                      push ebx
:0041D535 56                      push esi
:0041D536 57                      push edi
:0041D537 894DE8                  mov dword ptr [ebp-18], ecx
:0041D53A 8D4DF8                  lea ecx, dword ptr [ebp-08]
:0041D53D E82E43FEFF              call 00401870
:0041D542 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0041D545 E82643FEFF              call 00401870
:0041D54A 33C0                    xor eax, eax
:0041D54C 8A4508                  mov al, byte ptr [ebp+08]
:0041D54F 8BC8                    mov ecx, eax
:0041D551 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041D554 C1E003                  shl eax, 03
:0041D557 2BC1                    sub eax, ecx
:0041D559 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041D55F E89CBCFEFF              call 00409200
:0041D564 50                      push eax
:0041D565 8D4DF8                  lea ecx, dword ptr [ebp-08]
:0041D568 E82343FEFF              call 00401890
:0041D56D 8B4510                  mov eax, dword ptr [ebp+10]
:0041D570 8945EC                  mov dword ptr [ebp-14], eax
:0041D573 33C0                    xor eax, eax
:0041D575 8A450C                  mov al, byte ptr [ebp+0C]
:0041D578 8945E4                  mov dword ptr [ebp-1C], eax
:0041D57B E9B3030000              jmp 0041D933
:0041D580 8B45E8                  mov eax, dword ptr [ebp-18]
:0041D583 8A400E                  mov al, byte ptr [eax+0E]
:0041D586 50                      push eax
:0041D587 8D45F8                  lea eax, dword ptr [ebp-08]
:0041D58A 50                      push eax
:0041D58B E8C5C0FFFF              call 00419655
:0041D590 83C408                  add esp, 00000008
:0041D593 50                      push eax
:0041D594 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0041D597 E8F442FEFF              call 00401890
:0041D59C 8D45FC                  lea eax, dword ptr [ebp-04]
:0041D59F 50                      push eax
:0041D5A0 E898BFFFFF              call 0041953D
:0041D5A5 83C404                  add esp, 00000004
:0041D5A8 8845F0                  mov byte ptr [ebp-10], al
:0041D5AB 33C0                    xor eax, eax
:0041D5AD 8A45F0                  mov al, byte ptr [ebp-10]
:0041D5B0 3DFF000000              cmp eax, 000000FF
:0041D5B5 0F8437000000            je 0041D5F2
:0041D5BB 33C0                    xor eax, eax
:0041D5BD 8A45F0                  mov al, byte ptr [ebp-10]
:0041D5C0 8BC8                    mov ecx, eax
:0041D5C2 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041D5C5 C1E003                  shl eax, 03
:0041D5C8 2BC1                    sub eax, ecx
:0041D5CA 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041D5D0 E84BBCFEFF              call 00409220
:0041D5D5 8BD8                    mov ebx, eax
:0041D5D7 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0041D5DA E841BCFEFF              call 00409220
:0041D5DF 3BD8                    cmp ebx, eax
:0041D5E1 0F840B000000            je 0041D5F2
:0041D5E7 8A45F0                  mov al, byte ptr [ebp-10]
:0041D5EA 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041D5ED 8801                    mov byte ptr [ecx], al
:0041D5EF FF45EC                  inc [ebp-14]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041D5B5(C), :0041D5E1(C)
|
:0041D5F2 8B45EC                  mov eax, dword ptr [ebp-14]
:0041D5F5 C600FF                  mov byte ptr [eax], FF
:0041D5F8 E962030000              jmp 0041D95F
:0041D5FD C745F400000000          mov [ebp-0C], 00000000
:0041D604 E903000000              jmp 0041D60C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D694(U)
|
:0041D609 FF45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D604(U)
|
:0041D60C 837DF402                cmp dword ptr [ebp-0C], 00000002
:0041D610 0F8383000000            jnb 0041D699
:0041D616 8B45E8                  mov eax, dword ptr [ebp-18]
:0041D619 8A400E                  mov al, byte ptr [eax+0E]
:0041D61C 50                      push eax
:0041D61D 8D45F8                  lea eax, dword ptr [ebp-08]
:0041D620 50                      push eax
:0041D621 E82FC0FFFF              call 00419655
:0041D626 83C408                  add esp, 00000008
:0041D629 50                      push eax
:0041D62A 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0041D62D E85E42FEFF              call 00401890
:0041D632 8D45FC                  lea eax, dword ptr [ebp-04]
:0041D635 50                      push eax
:0041D636 E802BFFFFF              call 0041953D
:0041D63B 83C404                  add esp, 00000004
:0041D63E 8845F0                  mov byte ptr [ebp-10], al
:0041D641 33C0                    xor eax, eax
:0041D643 8A45F0                  mov al, byte ptr [ebp-10]
:0041D646 3DFF000000              cmp eax, 000000FF
:0041D64B 0F8437000000            je 0041D688
:0041D651 33C0                    xor eax, eax
:0041D653 8A45F0                  mov al, byte ptr [ebp-10]
:0041D656 8BC8                    mov ecx, eax
:0041D658 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041D65B C1E003                  shl eax, 03
:0041D65E 2BC1                    sub eax, ecx
:0041D660 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041D666 E8B5BBFEFF              call 00409220
:0041D66B 8BD8                    mov ebx, eax
:0041D66D 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0041D670 E8ABBBFEFF              call 00409220
:0041D675 3BD8                    cmp ebx, eax
:0041D677 0F840B000000            je 0041D688
:0041D67D 8A45F0                  mov al, byte ptr [ebp-10]
:0041D680 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041D683 8801                    mov byte ptr [ecx], al
:0041D685 FF45EC                  inc [ebp-14]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041D64B(C), :0041D677(C)
|
:0041D688 8D45FC                  lea eax, dword ptr [ebp-04]
:0041D68B 50                      push eax
:0041D68C 8D4DF8                  lea ecx, dword ptr [ebp-08]
:0041D68F E8FC41FEFF              call 00401890
:0041D694 E970FFFFFF              jmp 0041D609

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D610(C)
|
:0041D699 8B45EC                  mov eax, dword ptr [ebp-14]
:0041D69C C600FF                  mov byte ptr [eax], FF
:0041D69F E9BB020000              jmp 0041D95F
:0041D6A4 C745F400000000          mov [ebp-0C], 00000000
:0041D6AB E903000000              jmp 0041D6B3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D741(U)
|
:0041D6B0 FF45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D6AB(U)
|
:0041D6B3 837DF404                cmp dword ptr [ebp-0C], 00000004
:0041D6B7 0F8389000000            jnb 0041D746
:0041D6BD 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041D6C0 50                      push eax
:0041D6C1 8B45E8                  mov eax, dword ptr [ebp-18]
:0041D6C4 83C005                  add eax, 00000005
:0041D6C7 50                      push eax
:0041D6C8 E888BFFFFF              call 00419655
:0041D6CD 83C408                  add esp, 00000008
:0041D6D0 50                      push eax
:0041D6D1 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0041D6D4 E8B741FEFF              call 00401890
:0041D6D9 8D45FC                  lea eax, dword ptr [ebp-04]
:0041D6DC 50                      push eax
:0041D6DD E85BBEFFFF              call 0041953D
:0041D6E2 83C404                  add esp, 00000004
:0041D6E5 8845F0                  mov byte ptr [ebp-10], al
:0041D6E8 33C0                    xor eax, eax
:0041D6EA 8A45F0                  mov al, byte ptr [ebp-10]
:0041D6ED 3DFF000000              cmp eax, 000000FF
:0041D6F2 0F8449000000            je 0041D741
:0041D6F8 33C0                    xor eax, eax
:0041D6FA 8A4508                  mov al, byte ptr [ebp+08]
:0041D6FD 33C9                    xor ecx, ecx
:0041D6FF 8A4DF0                  mov cl, byte ptr [ebp-10]
:0041D702 3BC1                    cmp eax, ecx
:0041D704 0F8437000000            je 0041D741
:0041D70A 33C0                    xor eax, eax
:0041D70C 8A45F0                  mov al, byte ptr [ebp-10]
:0041D70F 8BC8                    mov ecx, eax
:0041D711 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041D714 C1E003                  shl eax, 03
:0041D717 2BC1                    sub eax, ecx
:0041D719 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041D71F E8FCBAFEFF              call 00409220
:0041D724 8BD8                    mov ebx, eax
:0041D726 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0041D729 E8F2BAFEFF              call 00409220
:0041D72E 3BD8                    cmp ebx, eax
:0041D730 0F840B000000            je 0041D741
:0041D736 8A45F0                  mov al, byte ptr [ebp-10]
:0041D739 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041D73C 8801                    mov byte ptr [ecx], al
:0041D73E FF45EC                  inc [ebp-14]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041D6F2(C), :0041D704(C), :0041D730(C)
|
:0041D741 E96AFFFFFF              jmp 0041D6B0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D6B7(C)
|
:0041D746 8B45EC                  mov eax, dword ptr [ebp-14]
:0041D749 C600FF                  mov byte ptr [eax], FF
:0041D74C E90E020000              jmp 0041D95F
:0041D751 C745F400000000          mov [ebp-0C], 00000000
:0041D758 E903000000              jmp 0041D760

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D7EE(U)
|
:0041D75D FF45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D758(U)
|
:0041D760 837DF408                cmp dword ptr [ebp-0C], 00000008
:0041D764 0F8389000000            jnb 0041D7F3
:0041D76A 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041D76D 50                      push eax
:0041D76E 8B45E8                  mov eax, dword ptr [ebp-18]
:0041D771 83C005                  add eax, 00000005
:0041D774 50                      push eax
:0041D775 E8DBBEFFFF              call 00419655
:0041D77A 83C408                  add esp, 00000008
:0041D77D 50                      push eax
:0041D77E 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0041D781 E80A41FEFF              call 00401890
:0041D786 8D45FC                  lea eax, dword ptr [ebp-04]
:0041D789 50                      push eax
:0041D78A E8AEBDFFFF              call 0041953D
:0041D78F 83C404                  add esp, 00000004
:0041D792 8845F0                  mov byte ptr [ebp-10], al
:0041D795 33C0                    xor eax, eax
:0041D797 8A45F0                  mov al, byte ptr [ebp-10]
:0041D79A 3DFF000000              cmp eax, 000000FF
:0041D79F 0F8449000000            je 0041D7EE
:0041D7A5 33C0                    xor eax, eax
:0041D7A7 8A4508                  mov al, byte ptr [ebp+08]
:0041D7AA 33C9                    xor ecx, ecx
:0041D7AC 8A4DF0                  mov cl, byte ptr [ebp-10]
:0041D7AF 3BC1                    cmp eax, ecx
:0041D7B1 0F8437000000            je 0041D7EE
:0041D7B7 33C0                    xor eax, eax
:0041D7B9 8A45F0                  mov al, byte ptr [ebp-10]
:0041D7BC 8BC8                    mov ecx, eax
:0041D7BE 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041D7C1 C1E003                  shl eax, 03
:0041D7C4 2BC1                    sub eax, ecx
:0041D7C6 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041D7CC E84FBAFEFF              call 00409220
:0041D7D1 8BD8                    mov ebx, eax
:0041D7D3 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0041D7D6 E845BAFEFF              call 00409220
:0041D7DB 3BD8                    cmp ebx, eax
:0041D7DD 0F840B000000            je 0041D7EE
:0041D7E3 8A45F0                  mov al, byte ptr [ebp-10]
:0041D7E6 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041D7E9 8801                    mov byte ptr [ecx], al
:0041D7EB FF45EC                  inc [ebp-14]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041D79F(C), :0041D7B1(C), :0041D7DD(C)
|
:0041D7EE E96AFFFFFF              jmp 0041D75D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D764(C)
|
:0041D7F3 8B45EC                  mov eax, dword ptr [ebp-14]
:0041D7F6 C600FF                  mov byte ptr [eax], FF
:0041D7F9 E961010000              jmp 0041D95F
:0041D7FE C745F400000000          mov [ebp-0C], 00000000
:0041D805 E903000000              jmp 0041D80D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D886(U)
|
:0041D80A FF45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D805(U)
|
:0041D80D 837DF404                cmp dword ptr [ebp-0C], 00000004
:0041D811 0F8374000000            jnb 0041D88B
:0041D817 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041D81A 50                      push eax
:0041D81B 8D45F8                  lea eax, dword ptr [ebp-08]
:0041D81E 50                      push eax
:0041D81F E831BEFFFF              call 00419655
:0041D824 83C408                  add esp, 00000008
:0041D827 50                      push eax
:0041D828 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0041D82B E86040FEFF              call 00401890
:0041D830 8D45FC                  lea eax, dword ptr [ebp-04]
:0041D833 50                      push eax
:0041D834 E804BDFFFF              call 0041953D
:0041D839 83C404                  add esp, 00000004
:0041D83C 8845F0                  mov byte ptr [ebp-10], al
:0041D83F 33C0                    xor eax, eax
:0041D841 8A45F0                  mov al, byte ptr [ebp-10]
:0041D844 3DFF000000              cmp eax, 000000FF
:0041D849 0F8437000000            je 0041D886
:0041D84F 33C0                    xor eax, eax
:0041D851 8A45F0                  mov al, byte ptr [ebp-10]
:0041D854 8BC8                    mov ecx, eax
:0041D856 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041D859 C1E003                  shl eax, 03
:0041D85C 2BC1                    sub eax, ecx
:0041D85E 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041D864 E8B7B9FEFF              call 00409220
:0041D869 8BD8                    mov ebx, eax
:0041D86B 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0041D86E E8ADB9FEFF              call 00409220
:0041D873 3BD8                    cmp ebx, eax
:0041D875 0F840B000000            je 0041D886
:0041D87B 8A45F0                  mov al, byte ptr [ebp-10]
:0041D87E 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041D881 8801                    mov byte ptr [ecx], al
:0041D883 FF45EC                  inc [ebp-14]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041D849(C), :0041D875(C)
|
:0041D886 E97FFFFFFF              jmp 0041D80A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D811(C)
|
:0041D88B 8B45EC                  mov eax, dword ptr [ebp-14]
:0041D88E C600FF                  mov byte ptr [eax], FF
:0041D891 E9C9000000              jmp 0041D95F
:0041D896 C745F400000000          mov [ebp-0C], 00000000
:0041D89D E903000000              jmp 0041D8A5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D91E(U)
|
:0041D8A2 FF45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D89D(U)
|
:0041D8A5 837DF408                cmp dword ptr [ebp-0C], 00000008
:0041D8A9 0F8374000000            jnb 0041D923
:0041D8AF 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041D8B2 50                      push eax
:0041D8B3 8D45F8                  lea eax, dword ptr [ebp-08]
:0041D8B6 50                      push eax
:0041D8B7 E899BDFFFF              call 00419655
:0041D8BC 83C408                  add esp, 00000008
:0041D8BF 50                      push eax
:0041D8C0 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0041D8C3 E8C83FFEFF              call 00401890
:0041D8C8 8D45FC                  lea eax, dword ptr [ebp-04]
:0041D8CB 50                      push eax
:0041D8CC E86CBCFFFF              call 0041953D
:0041D8D1 83C404                  add esp, 00000004
:0041D8D4 8845F0                  mov byte ptr [ebp-10], al
:0041D8D7 33C0                    xor eax, eax
:0041D8D9 8A45F0                  mov al, byte ptr [ebp-10]
:0041D8DC 3DFF000000              cmp eax, 000000FF
:0041D8E1 0F8437000000            je 0041D91E
:0041D8E7 33C0                    xor eax, eax
:0041D8E9 8A45F0                  mov al, byte ptr [ebp-10]
:0041D8EC 8BC8                    mov ecx, eax
:0041D8EE 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041D8F1 C1E003                  shl eax, 03
:0041D8F4 2BC1                    sub eax, ecx
:0041D8F6 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041D8FC E81FB9FEFF              call 00409220
:0041D901 8BD8                    mov ebx, eax
:0041D903 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0041D906 E815B9FEFF              call 00409220
:0041D90B 3BD8                    cmp ebx, eax
:0041D90D 0F840B000000            je 0041D91E
:0041D913 8A45F0                  mov al, byte ptr [ebp-10]
:0041D916 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041D919 8801                    mov byte ptr [ecx], al
:0041D91B FF45EC                  inc [ebp-14]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041D8E1(C), :0041D90D(C)
|
:0041D91E E97FFFFFFF              jmp 0041D8A2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D8A9(C)
|
:0041D923 8B45EC                  mov eax, dword ptr [ebp-14]
:0041D926 C600FF                  mov byte ptr [eax], FF
:0041D929 E931000000              jmp 0041D95F
:0041D92E E92C000000              jmp 0041D95F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D57B(U)
|
:0041D933 837DE405                cmp dword ptr [ebp-1C], 00000005
:0041D937 0F8722000000            ja 0041D95F
:0041D93D 8B45E4                  mov eax, dword ptr [ebp-1C]
:0041D940 FF248547D94100          jmp dword ptr [4*eax+0041D947]

:0041D947 80D54100                DWORD 0041D580
:0041D94B FDD54100                DWORD 0041D5FD
:0041D94F A4D64100                DWORD 0041D6A4
:0041D953 51D74100                DWORD 0041D751
:0041D957 FED74100                DWORD 0041D7FE
:0041D95B 96D84100                DWORD 0041D896



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041D5F8(U), :0041D69F(U), :0041D74C(U), :0041D7F9(U), :0041D891(U)
|:0041D929(U), :0041D92E(U), :0041D937(C)
|
:0041D95F 8B4510                  mov eax, dword ptr [ebp+10]
:0041D962 E900000000              jmp 0041D967
:0041D967 5F                      pop edi
:0041D968 5E                      pop esi
:0041D969 5B                      pop ebx
:0041D96A C9                      leave
:0041D96B C20C00                  ret 000C



* Referenced by a CALL at Address:
|:004028B0   
|
:0041D96E 55                      push ebp
:0041D96F 8BEC                    mov ebp, esp
:0041D971 83EC0C                  sub esp, 0000000C
:0041D974 53                      push ebx
:0041D975 56                      push esi
:0041D976 57                      push edi
:0041D977 894DF4                  mov dword ptr [ebp-0C], ecx
:0041D97A C645F8FF                mov [ebp-08], FF
:0041D97E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041D981 E81AB9FEFF              call 004092A0
:0041D986 8845FC                  mov byte ptr [ebp-04], al
:0041D989 33C0                    xor eax, eax
:0041D98B 8A45FC                  mov al, byte ptr [ebp-04]
:0041D98E 83F80D                  cmp eax, 0000000D
:0041D991 0F8511000000            jne 0041D9A8
:0041D997 6A01                    push 00000001
:0041D999 B900FB4600              mov ecx, 0046FB00
:0041D99E E89DBCFEFF              call 00409640
:0041D9A3 E958000000              jmp 0041DA00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D991(C)
|
:0041D9A8 33C0                    xor eax, eax
:0041D9AA 8A45FC                  mov al, byte ptr [ebp-04]
:0041D9AD 83F80E                  cmp eax, 0000000E
:0041D9B0 0F8511000000            jne 0041D9C7
:0041D9B6 6A02                    push 00000002
:0041D9B8 B900FB4600              mov ecx, 0046FB00
:0041D9BD E87EBCFEFF              call 00409640
:0041D9C2 E939000000              jmp 0041DA00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D9B0(C)
|
:0041D9C7 33C0                    xor eax, eax
:0041D9C9 8A45FC                  mov al, byte ptr [ebp-04]
:0041D9CC 83F819                  cmp eax, 00000019
:0041D9CF 0F8511000000            jne 0041D9E6
:0041D9D5 6A03                    push 00000003
:0041D9D7 B900FB4600              mov ecx, 0046FB00
:0041D9DC E85FBCFEFF              call 00409640
:0041D9E1 E91A000000              jmp 0041DA00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D9CF(C)
|
:0041D9E6 33C0                    xor eax, eax
:0041D9E8 8A45FC                  mov al, byte ptr [ebp-04]
:0041D9EB 83F81A                  cmp eax, 0000001A
:0041D9EE 0F850C000000            jne 0041DA00
:0041D9F4 6A04                    push 00000004
:0041D9F6 B900FB4600              mov ecx, 0046FB00
:0041D9FB E840BCFEFF              call 00409640

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041D9A3(U), :0041D9C2(U), :0041D9E1(U), :0041D9EE(C)
|
:0041DA00 6A00                    push 00000000
:0041DA02 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041DA05 E864C90000              call 0042A36E
:0041DA0A 50                      push eax
:0041DA0B 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041DA0E 8A4004                  mov al, byte ptr [eax+04]
:0041DA11 50                      push eax
:0041DA12 B900FB4600              mov ecx, 0046FB00
:0041DA17 E899F40100              call 0043CEB5
:0041DA1C 8845F8                  mov byte ptr [ebp-08], al
:0041DA1F 33C0                    xor eax, eax
:0041DA21 8A45F8                  mov al, byte ptr [ebp-08]
:0041DA24 3DFF000000              cmp eax, 000000FF
:0041DA29 0F845A000000            je 0041DA89
:0041DA2F 8B45F8                  mov eax, dword ptr [ebp-08]
:0041DA32 50                      push eax
:0041DA33 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041DA36 8A4004                  mov al, byte ptr [eax+04]
:0041DA39 50                      push eax
:0041DA3A E89EB8FFFF              call 004192DD
:0041DA3F 83C408                  add esp, 00000008
:0041DA42 6A00                    push 00000000
:0041DA44 6A01                    push 00000001
:0041DA46 33C0                    xor eax, eax
:0041DA48 8A45F8                  mov al, byte ptr [ebp-08]
:0041DA4B 8BC8                    mov ecx, eax
:0041DA4D 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041DA50 C1E003                  shl eax, 03
:0041DA53 2BC1                    sub eax, ecx
:0041DA55 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041DA5B E870080000              call 0041E2D0
:0041DA60 50                      push eax
:0041DA61 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041DA64 8A4004                  mov al, byte ptr [eax+04]
:0041DA67 50                      push eax
:0041DA68 B9D8BC4600              mov ecx, 0046BCD8
:0041DA6D E896690000              call 00424408
:0041DA72 6880000000              push 00000080
:0041DA77 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041DA7A E845030100              call 0042DDC4
:0041DA7F B900FB4600              mov ecx, 0046FB00
:0041DA84 E817BEFEFF              call 004098A0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041DA29(C)
|
:0041DA89 E900000000              jmp 0041DA8E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041DA89(U)
|
:0041DA8E 5F                      pop edi
:0041DA8F 5E                      pop esi
:0041DA90 5B                      pop ebx
:0041DA91 C9                      leave
:0041DA92 C3                      ret



* Referenced by a CALL at Addresses:
|:0041DD9C   , :0041DDF4   , :0041DE5D   , :0041DEB5   
|
:0041DA93 55                      push ebp
:0041DA94 8BEC                    mov ebp, esp
:0041DA96 53                      push ebx
:0041DA97 56                      push esi
:0041DA98 57                      push edi
:0041DA99 6A04                    push 00000004
:0041DA9B E8BA990100              call 0043745A
:0041DAA0 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041DAFF(U)
|
:0041DAA3 B988534500              mov ecx, 00455388
:0041DAA8 E8CF42FEFF              call 00401D7C
:0041DAAD 85C0                    test eax, eax
:0041DAAF 0F844F000000            je 0041DB04
:0041DAB5 B9B0FA4600              mov ecx, 0046FAB0
:0041DABA E8F1ABFFFF              call 004186B0
:0041DABF 85C0                    test eax, eax
:0041DAC1 0F8438000000            je 0041DAFF
:0041DAC7 B998FC4600              mov ecx, 0046FC98
:0041DACC E84F080000              call 0041E320
:0041DAD1 33C0                    xor eax, eax
:0041DAD3 8A4508                  mov al, byte ptr [ebp+08]
:0041DAD6 8BC8                    mov ecx, eax
:0041DAD8 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041DADB C1E003                  shl eax, 03
:0041DADE 2BC1                    sub eax, ecx
:0041DAE0 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041DAE6 E8D4E30000              call 0042BEBF
:0041DAEB 6A02                    push 00000002
:0041DAED E8C99A0100              call 004375BB
:0041DAF2 83C404                  add esp, 00000004
:0041DAF5 6A04                    push 00000004
:0041DAF7 E85E990100              call 0043745A
:0041DAFC 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041DAC1(C)
|
:0041DAFF E99FFFFFFF              jmp 0041DAA3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041DAAF(C)
|
:0041DB04 6A0A                    push 0000000A
:0041DB06 B994A64600              mov ecx, 0046A694
:0041DB0B E814B5FFFF              call 00419024
:0041DB10 E900000000              jmp 0041DB15

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041DB10(U)
|
:0041DB15 5F                      pop edi
:0041DB16 5E                      pop esi
:0041DB17 5B                      pop ebx
:0041DB18 C9                      leave
:0041DB19 C3                      ret



* Referenced by a CALL at Address:
|:004025F9   
|
:0041DB1A 55                      push ebp
:0041DB1B 8BEC                    mov ebp, esp
:0041DB1D 83EC28                  sub esp, 00000028
:0041DB20 53                      push ebx
:0041DB21 56                      push esi
:0041DB22 57                      push edi
:0041DB23 894DDC                  mov dword ptr [ebp-24], ecx
:0041DB26 8D4DF4                  lea ecx, dword ptr [ebp-0C]
:0041DB29 E8423DFEFF              call 00401870
:0041DB2E 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0041DB31 E83A3DFEFF              call 00401870
:0041DB36 C645E8FF                mov [ebp-18], FF
:0041DB3A 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0041DB3D E8DEB6FEFF              call 00409220
:0041DB42 85C0                    test eax, eax
:0041DB44 0F8518000000            jne 0041DB62
:0041DB4A 33C0                    xor eax, eax
:0041DB4C A0A4354500              mov al, byte ptr [004535A4]
:0041DB51 A804                    test al, 04
:0041DB53 0F8509000000            jne 0041DB62
:0041DB59 C645E800                mov [ebp-18], 00
:0041DB5D E972000000              jmp 0041DBD4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041DB44(C), :0041DB53(C)
|
:0041DB62 6A04                    push 00000004
:0041DB64 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0041DB67 E8F4B7FEFF              call 00409360
:0041DB6C 85C0                    test eax, eax
:0041DB6E 0F8515000000            jne 0041DB89
:0041DB74 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0041DB77 E854B8FEFF              call 004093D0
:0041DB7C 33C9                    xor ecx, ecx
:0041DB7E 8AC8                    mov cl, al
:0041DB80 83F907                  cmp ecx, 00000007
:0041DB83 0F8418000000            je 0041DBA1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041DB6E(C)
|
:0041DB89 33C0                    xor eax, eax
:0041DB8B A0A4354500              mov al, byte ptr [004535A4]
:0041DB90 A804                    test al, 04
:0041DB92 0F8509000000            jne 0041DBA1
:0041DB98 C645E801                mov [ebp-18], 01
:0041DB9C E933000000              jmp 0041DBD4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041DB83(C), :0041DB92(C)
|
:0041DBA1 8B45DC                  mov eax, dword ptr [ebp-24]
:0041DBA4 33C9                    xor ecx, ecx
:0041DBA6 8A4816                  mov cl, byte ptr [eax+16]
:0041DBA9 F6C110                  test cl, 10
:0041DBAC 0F8409000000            je 0041DBBB
:0041DBB2 C645E805                mov [ebp-18], 05
:0041DBB6 E919000000              jmp 0041DBD4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041DBAC(C)
|
:0041DBBB 6880000000              push 00000080
:0041DBC0 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0041DBC3 E898B7FEFF              call 00409360
:0041DBC8 85C0                    test eax, eax
:0041DBCA 0F8404000000            je 0041DBD4
:0041DBD0 C645E806                mov [ebp-18], 06

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041DB5D(U), :0041DB9C(U), :0041DBB6(U), :0041DBCA(C)
|
:0041DBD4 6A20                    push 00000020
:0041DBD6 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0041DBD9 E882B7FEFF              call 00409360
:0041DBDE 85C0                    test eax, eax
:0041DBE0 0F8410000000            je 0041DBF6
:0041DBE6 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0041DBE9 E875C60000              call 0042A263
:0041DBEE 8845E0                  mov byte ptr [ebp-20], al
:0041DBF1 E904000000              jmp 0041DBFA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041DBE0(C)
|
:0041DBF6 C645E000                mov [ebp-20], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041DBF1(U)
|
:0041DBFA 6A01                    push 00000001
:0041DBFC 68FF000000              push 000000FF
:0041DC01 68FF000000              push 000000FF
:0041DC06 6A00                    push 00000000
:0041DC08 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0041DC0B E853C60000              call 0042A263
:0041DC10 50                      push eax
:0041DC11 8B45DC                  mov eax, dword ptr [ebp-24]
:0041DC14 83C005                  add eax, 00000005
:0041DC17 50                      push eax
:0041DC18 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0041DC1B E829D3FFFF              call 0041AF49
:0041DC20 6A01                    push 00000001
:0041DC22 B900FB4600              mov ecx, 0046FB00
:0041DC27 E824BCFEFF              call 00409850
:0041DC2C B900FB4600              mov ecx, 0046FB00
:0041DC31 E86ABCFEFF              call 004098A0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041DD83(U)
|
:0041DC36 33C0                    xor eax, eax
:0041DC38 8A45E8                  mov al, byte ptr [ebp-18]
:0041DC3B 3DFF000000              cmp eax, 000000FF
:0041DC40 0F8542010000            jne 0041DD88
:0041DC46 B900FB4600              mov ecx, 0046FB00
:0041DC4B E8E1CF0100              call 0043AC31
:0041DC50 50                      push eax
:0041DC51 8D4DF4                  lea ecx, dword ptr [ebp-0C]
:0041DC54 E8373CFEFF              call 00401890
:0041DC59 33C0                    xor eax, eax
:0041DC5B 8A45F4                  mov al, byte ptr [ebp-0C]
:0041DC5E 3DFF000000              cmp eax, 000000FF
:0041DC63 0F8509000000            jne 0041DC72
:0041DC69 C645E802                mov [ebp-18], 02
:0041DC6D E916010000              jmp 0041DD88

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041DC63(C)
|
:0041DC72 8D45F4                  lea eax, dword ptr [ebp-0C]
:0041DC75 50                      push eax
:0041DC76 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0041DC79 E8D2E50000              call 0042C250
:0041DC7E 85C0                    test eax, eax
:0041DC80 0F844A000000            je 0041DCD0
:0041DC86 33DB                    xor ebx, ebx
:0041DC88 8A1DC8FC4600            mov bl, byte ptr [0046FCC8]
:0041DC8E 33C0                    xor eax, eax
:0041DC90 8A45F5                  mov al, byte ptr [ebp-0B]
:0041DC93 0FAFD8                  imul ebx, eax
:0041DC96 6A04                    push 00000004
:0041DC98 6A00                    push 00000000
:0041DC9A 6A00                    push 00000000
:0041DC9C B950F94600              mov ecx, 0046F950
:0041DCA1 E87A9A0200              call 00447720
:0041DCA6 03D8                    add ebx, eax
:0041DCA8 33C0                    xor eax, eax
:0041DCAA 8A45F4                  mov al, byte ptr [ebp-0C]
:0041DCAD 33C9                    xor ecx, ecx
:0041DCAF 8A8C03E82C0000          mov cl, byte ptr [ebx+eax+00002CE8]
:0041DCB6 81F9FF000000            cmp ecx, 000000FF
:0041DCBC 0F840E000000            je 0041DCD0
:0041DCC2 C645E804                mov [ebp-18], 04
:0041DCC6 E9BD000000              jmp 0041DD88
:0041DCCB E9B3000000              jmp 0041DD83

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041DC80(C), :0041DCBC(C)
|
:0041DCD0 8D45F4                  lea eax, dword ptr [ebp-0C]
:0041DCD3 50                      push eax
:0041DCD4 E864B8FFFF              call 0041953D
:0041DCD9 83C404                  add esp, 00000004
:0041DCDC 33C9                    xor ecx, ecx
:0041DCDE 8AC8                    mov cl, al
:0041DCE0 8B45DC                  mov eax, dword ptr [ebp-24]
:0041DCE3 33D2                    xor edx, edx
:0041DCE5 8A5004                  mov dl, byte ptr [eax+04]
:0041DCE8 3BCA                    cmp ecx, edx
:0041DCEA 0F850E000000            jne 0041DCFE
:0041DCF0 C645E803                mov [ebp-18], 03
:0041DCF4 E98F000000              jmp 0041DD88
:0041DCF9 E985000000              jmp 0041DD83

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041DCEA(C)
|
:0041DCFE 33C0                    xor eax, eax
:0041DD00 A0A4354500              mov al, byte ptr [004535A4]
:0041DD05 A808                    test al, 08
:0041DD07 0F845B000000            je 0041DD68
:0041DD0D 8D45F4                  lea eax, dword ptr [ebp-0C]
:0041DD10 50                      push eax
:0041DD11 E827B8FFFF              call 0041953D
:0041DD16 83C404                  add esp, 00000004
:0041DD19 33C9                    xor ecx, ecx
:0041DD1B 8AC8                    mov cl, al
:0041DD1D 81F9FF000000            cmp ecx, 000000FF
:0041DD23 0F852B000000            jne 0041DD54
:0041DD29 6830FC4400              push 0044FC30
:0041DD2E 6A00                    push 00000000
:0041DD30 E800B20100              call 00438F35
:0041DD35 83C408                  add esp, 00000008
:0041DD38 6A00                    push 00000000
:0041DD3A 8D45F4                  lea eax, dword ptr [ebp-0C]
:0041DD3D 50                      push eax
:0041DD3E 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0041DD41 E8AAB5FEFF              call 004092F0
:0041DD46 C645E803                mov [ebp-18], 03
:0041DD4A E939000000              jmp 0041DD88
:0041DD4F E90F000000              jmp 0041DD63

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041DD23(C)
|

* Possible StringData Ref from Data Obj ->"ΪвӣУ"
                                  |
:0041DD54 6850FC4400              push 0044FC50
:0041DD59 6A00                    push 00000000
:0041DD5B E8D5B10100              call 00438F35
:0041DD60 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041DD4F(U)
|
:0041DD63 E91B000000              jmp 0041DD83

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041DD07(C)
|
:0041DD68 6A0A                    push 0000000A
:0041DD6A B994A64600              mov ecx, 0046A694
:0041DD6F E8B0B2FFFF              call 00419024

* Possible StringData Ref from Data Obj ->"ƶΧ"
                                  |
:0041DD74 6864FC4400              push 0044FC64
:0041DD79 6A00                    push 00000000
:0041DD7B E8B5B10100              call 00438F35
:0041DD80 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041DCCB(U), :0041DCF9(U), :0041DD63(U)
|
:0041DD83 E9AEFEFFFF              jmp 0041DC36

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041DC40(C), :0041DC6D(U), :0041DCC6(U), :0041DCF4(U), :0041DD4A(U)
|
:0041DD88 33C0                    xor eax, eax
:0041DD8A 8A45E8                  mov al, byte ptr [ebp-18]
:0041DD8D 8945D8                  mov dword ptr [ebp-28], eax
:0041DD90 E976010000              jmp 0041DF0B
:0041DD95 8B45DC                  mov eax, dword ptr [ebp-24]
:0041DD98 8A4004                  mov al, byte ptr [eax+04]
:0041DD9B 50                      push eax
:0041DD9C E8F2FCFFFF              call 0041DA93
:0041DDA1 83C404                  add esp, 00000004
:0041DDA4 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0041DDA7 E8DA000100              call 0042DE86
:0041DDAC 85C0                    test eax, eax
:0041DDAE 0F8434000000            je 0041DDE8

* Possible StringData Ref from Data Obj ->"Ҿӡ

ۿ֧ӵ鱨"
                                  |
:0041DDB4 6874FC4400              push 0044FC74
:0041DDB9 6A01                    push 00000001
:0041DDBB E875B10100              call 00438F35
:0041DDC0 83C408                  add esp, 00000008
:0041DDC3 85C0                    test eax, eax
:0041DDC5 0F841D000000            je 0041DDE8
:0041DDCB 6A00                    push 00000000
:0041DDCD 8B45DC                  mov eax, dword ptr [ebp-24]
:0041DDD0 8B00                    mov eax, dword ptr [eax]
:0041DDD2 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041DDD5 03C0                    add eax, eax
:0041DDD7 8D04C0                  lea eax, dword ptr [eax+8*eax]
:0041DDDA 05E8564500              add eax, 004556E8
:0041DDDF 50                      push eax
:0041DDE0 E87F110200              call 0043EF64
:0041DDE5 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041DDAE(C), :0041DDC5(C)
|
:0041DDE8 E94E010000              jmp 0041DF3B
:0041DDED 8B45DC                  mov eax, dword ptr [ebp-24]
:0041DDF0 8A4004                  mov al, byte ptr [eax+04]
:0041DDF3 50                      push eax
:0041DDF4 E89AFCFFFF              call 0041DA93
:0041DDF9 83C404                  add esp, 00000004
:0041DDFC 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0041DDFF E882000100              call 0042DE86
:0041DE04 85C0                    test eax, eax
:0041DE06 0F8434000000            je 0041DE40

* Possible StringData Ref from Data Obj ->"ܿƵĲӡ

ۿ֧ӵ鱨"
                                  |
:0041DE0C 689CFC4400              push 0044FC9C
:0041DE11 6A01                    push 00000001
:0041DE13 E81DB10100              call 00438F35
:0041DE18 83C408                  add esp, 00000008
:0041DE1B 85C0                    test eax, eax
:0041DE1D 0F841D000000            je 0041DE40
:0041DE23 6A00                    push 00000000
:0041DE25 8B45DC                  mov eax, dword ptr [ebp-24]
:0041DE28 8B00                    mov eax, dword ptr [eax]
:0041DE2A 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041DE2D 03C0                    add eax, eax
:0041DE2F 8D04C0                  lea eax, dword ptr [eax+8*eax]
:0041DE32 05E8564500              add eax, 004556E8
:0041DE37 50                      push eax
:0041DE38 E827110200              call 0043EF64
:0041DE3D 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041DE06(C), :0041DE1D(C)
|
:0041DE40 E9F6000000              jmp 0041DF3B
:0041DE45 6A01                    push 00000001
:0041DE47 B994A64600              mov ecx, 0046A694
:0041DE4C E8D3B1FFFF              call 00419024
:0041DE51 E9E5000000              jmp 0041DF3B
:0041DE56 8B45DC                  mov eax, dword ptr [ebp-24]
:0041DE59 8A4004                  mov al, byte ptr [eax+04]
:0041DE5C 50                      push eax
:0041DE5D E831FCFFFF              call 0041DA93
:0041DE62 83C404                  add esp, 00000004
:0041DE65 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0041DE68 E819000100              call 0042DE86
:0041DE6D 85C0                    test eax, eax
:0041DE6F 0F8434000000            je 0041DEA9

* Possible StringData Ref from Data Obj ->"в

ۿ֧ӵ鱨"
                                  |
:0041DE75 68C8FC4400              push 0044FCC8
:0041DE7A 6A01                    push 00000001
:0041DE7C E8B4B00100              call 00438F35
:0041DE81 83C408                  add esp, 00000008
:0041DE84 85C0                    test eax, eax
:0041DE86 0F841D000000            je 0041DEA9
:0041DE8C 6A00                    push 00000000
:0041DE8E 8B45DC                  mov eax, dword ptr [ebp-24]
:0041DE91 8B00                    mov eax, dword ptr [eax]
:0041DE93 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041DE96 03C0                    add eax, eax
:0041DE98 8D04C0                  lea eax, dword ptr [eax+8*eax]
:0041DE9B 05E8564500              add eax, 004556E8
:0041DEA0 50                      push eax
:0041DEA1 E8BE100200              call 0043EF64
:0041DEA6 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041DE6F(C), :0041DE86(C)
|
:0041DEA9 E98D000000              jmp 0041DF3B
:0041DEAE 8B45DC                  mov eax, dword ptr [ebp-24]
:0041DEB1 8A4004                  mov al, byte ptr [eax+04]
:0041DEB4 50                      push eax
:0041DEB5 E8D9FBFFFF              call 0041DA93
:0041DEBA 83C404                  add esp, 00000004
:0041DEBD 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0041DEC0 E8C1FF0000              call 0042DE86
:0041DEC5 85C0                    test eax, eax
:0041DEC7 0F8434000000            je 0041DF01

* Possible StringData Ref from Data Obj ->"ִн

ۿ֧ӵ鱨"
                                  |
:0041DECD 68F4FC4400              push 0044FCF4
:0041DED2 6A01                    push 00000001
:0041DED4 E85CB00100              call 00438F35
:0041DED9 83C408                  add esp, 00000008
:0041DEDC 85C0                    test eax, eax
:0041DEDE 0F841D000000            je 0041DF01
:0041DEE4 6A00                    push 00000000
:0041DEE6 8B45DC                  mov eax, dword ptr [ebp-24]
:0041DEE9 8B00                    mov eax, dword ptr [eax]
:0041DEEB 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041DEEE 03C0                    add eax, eax
:0041DEF0 8D04C0                  lea eax, dword ptr [eax+8*eax]
:0041DEF3 05E8564500              add eax, 004556E8
:0041DEF8 50                      push eax
:0041DEF9 E866100200              call 0043EF64
:0041DEFE 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041DEC7(C), :0041DEDE(C)
|
:0041DF01 E935000000              jmp 0041DF3B
:0041DF06 E930000000              jmp 0041DF3B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041DD90(U)
|
:0041DF0B 837DD806                cmp dword ptr [ebp-28], 00000006
:0041DF0F 0F8726000000            ja 0041DF3B
:0041DF15 8B45D8                  mov eax, dword ptr [ebp-28]
:0041DF18 FF24851FDF4100          jmp dword ptr [4*eax+0041DF1F]

:0041DF1F 95DD4100                DWORD 0041DD95
:0041DF23 EDDD4100                DWORD 0041DDED
:0041DF27 45DE4100                DWORD 0041DE45
:0041DF2B 3BDF4100                DWORD 0041DF3B
:0041DF2F 3BDF4100                DWORD 0041DF3B
:0041DF33 56DE4100                DWORD 0041DE56
:0041DF37 AEDE4100                DWORD 0041DEAE



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041DDE8(U), :0041DE40(U), :0041DE51(U), :0041DEA9(U), :0041DF01(U)
|:0041DF06(U), :0041DF0F(C)
|
:0041DF3B 6A00                    push 00000000
:0041DF3D B900FB4600              mov ecx, 0046FB00
:0041DF42 E809B9FEFF              call 00409850
:0041DF47 B900FB4600              mov ecx, 0046FB00
:0041DF4C E84FB9FEFF              call 004098A0
:0041DF51 33C0                    xor eax, eax
:0041DF53 8A45E8                  mov al, byte ptr [ebp-18]
:0041DF56 83F803                  cmp eax, 00000003
:0041DF59 0F8520000000            jne 0041DF7F
:0041DF5F 6A00                    push 00000000
:0041DF61 B994A64600              mov ecx, 0046A694
:0041DF66 E8B9B0FFFF              call 00419024
:0041DF6B E877950100              call 004374E7
:0041DF70 B801000000              mov eax, 00000001
:0041DF75 E9EF000000              jmp 0041E069
:0041DF7A E91A000000              jmp 0041DF99

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041DF59(C)
|
:0041DF7F 33C0                    xor eax, eax
:0041DF81 8A45E8                  mov al, byte ptr [ebp-18]
:0041DF84 83F804                  cmp eax, 00000004
:0041DF87 0F840C000000            je 0041DF99
:0041DF8D E855950100              call 004374E7
:0041DF92 33C0                    xor eax, eax
:0041DF94 E9D0000000              jmp 0041E069

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041DF7A(U), :0041DF87(C)
|
:0041DF99 6A00                    push 00000000
:0041DF9B 68FF000000              push 000000FF
:0041DFA0 8D45F4                  lea eax, dword ptr [ebp-0C]
:0041DFA3 50                      push eax
:0041DFA4 8B45DC                  mov eax, dword ptr [ebp-24]
:0041DFA7 83C005                  add eax, 00000005
:0041DFAA 50                      push eax
:0041DFAB 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0041DFAE E890CAFFFF              call 0041AA43
:0041DFB3 8945F8                  mov dword ptr [ebp-08], eax
:0041DFB6 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041DFB9 E8B238FEFF              call 00401870
:0041DFBE 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0041DFC1 E87DD90000              call 0042B943
:0041DFC6 C745EC00000000          mov [ebp-14], 00000000
:0041DFCD E903000000              jmp 0041DFD5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041E028(U), :0041E048(U)
|
:0041DFD2 FF45EC                  inc [ebp-14]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041DFCD(U)
|
:0041DFD5 8D45F4                  lea eax, dword ptr [ebp-0C]
:0041DFD8 50                      push eax
:0041DFD9 8B45DC                  mov eax, dword ptr [ebp-24]
:0041DFDC 83C005                  add eax, 00000005
:0041DFDF 50                      push eax
:0041DFE0 E89B020000              call 0041E280
:0041DFE5 83C408                  add esp, 00000008
:0041DFE8 85C0                    test eax, eax
:0041DFEA 0F855D000000            jne 0041E04D
:0041DFF0 8B45EC                  mov eax, dword ptr [ebp-14]
:0041DFF3 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041DFF6 8A0408                  mov al, byte ptr [eax+ecx]
:0041DFF9 8845E4                  mov byte ptr [ebp-1C], al
:0041DFFC 8B45E4                  mov eax, dword ptr [ebp-1C]
:0041DFFF 50                      push eax
:0041E000 8B45DC                  mov eax, dword ptr [ebp-24]
:0041E003 83C005                  add eax, 00000005
:0041E006 50                      push eax
:0041E007 E849B6FFFF              call 00419655
:0041E00C 83C408                  add esp, 00000008
:0041E00F 50                      push eax
:0041E010 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041E013 E87838FEFF              call 00401890
:0041E018 33C0                    xor eax, eax
:0041E01A 8A45F0                  mov al, byte ptr [ebp-10]
:0041E01D 3DFF000000              cmp eax, 000000FF
:0041E022 0F8505000000            jne 0041E02D
:0041E028 E9A5FFFFFF              jmp 0041DFD2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E022(C)
|
:0041E02D 8B45E4                  mov eax, dword ptr [ebp-1C]
:0041E030 50                      push eax
:0041E031 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0041E034 E8AEEC0000              call 0042CCE7
:0041E039 8D45F0                  lea eax, dword ptr [ebp-10]
:0041E03C 50                      push eax
:0041E03D 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0041E040 83C105                  add ecx, 00000005
:0041E043 E84838FEFF              call 00401890
:0041E048 E985FFFFFF              jmp 0041DFD2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041DFEA(C)
|
:0041E04D 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0041E050 E8BAD80000              call 0042B90F
:0041E055 6A40                    push 00000040
:0041E057 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0041E05A E865FD0000              call 0042DDC4
:0041E05F B801000000              mov eax, 00000001
:0041E064 E900000000              jmp 0041E069

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041DF75(U), :0041DF94(U), :0041E064(U)
|
:0041E069 5F                      pop edi
:0041E06A 5E                      pop esi
:0041E06B 5B                      pop ebx
:0041E06C C9                      leave
:0041E06D C3                      ret



* Referenced by a CALL at Addresses:
|:0041B901   , :0041BB83   , :0041BCEA   
|
:0041E06E 55                      push ebp
:0041E06F 8BEC                    mov ebp, esp
:0041E071 83EC10                  sub esp, 00000010
:0041E074 53                      push ebx
:0041E075 56                      push esi
:0041E076 57                      push edi
:0041E077 894DF0                  mov dword ptr [ebp-10], ecx
:0041E07A 6A01                    push 00000001
:0041E07C 68FF000000              push 000000FF
:0041E081 68FF000000              push 000000FF
:0041E086 6A08                    push 00000008
:0041E088 8B4508                  mov eax, dword ptr [ebp+08]
:0041E08B 50                      push eax
:0041E08C 8B45F0                  mov eax, dword ptr [ebp-10]
:0041E08F 83C005                  add eax, 00000005
:0041E092 50                      push eax
:0041E093 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0041E096 E8AECEFFFF              call 0041AF49
:0041E09B 8845FC                  mov byte ptr [ebp-04], al
:0041E09E 33C0                    xor eax, eax
:0041E0A0 8A45FC                  mov al, byte ptr [ebp-04]
:0041E0A3 3DFF000000              cmp eax, 000000FF
:0041E0A8 0F8430000000            je 0041E0DE
:0041E0AE C705ACA6460001000000    mov dword ptr [0046A6AC], 00000001
:0041E0B8 6A01                    push 00000001
:0041E0BA 68FF000000              push 000000FF
:0041E0BF 68FF000000              push 000000FF
:0041E0C4 6A04                    push 00000004
:0041E0C6 8B4508                  mov eax, dword ptr [ebp+08]
:0041E0C9 50                      push eax
:0041E0CA 8B45F0                  mov eax, dword ptr [ebp-10]
:0041E0CD 83C005                  add eax, 00000005
:0041E0D0 50                      push eax
:0041E0D1 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0041E0D4 E870CEFFFF              call 0041AF49
:0041E0D9 E927010000              jmp 0041E205

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E0A8(C)
|
:0041E0DE 6A01                    push 00000001
:0041E0E0 68FF000000              push 000000FF
:0041E0E5 68FF000000              push 000000FF
:0041E0EA 6A08                    push 00000008
:0041E0EC 68FF000000              push 000000FF
:0041E0F1 8B45F0                  mov eax, dword ptr [ebp-10]
:0041E0F4 83C005                  add eax, 00000005
:0041E0F7 50                      push eax
:0041E0F8 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0041E0FB E849CEFFFF              call 0041AF49
:0041E100 8845FC                  mov byte ptr [ebp-04], al
:0041E103 33C0                    xor eax, eax
:0041E105 8A45FC                  mov al, byte ptr [ebp-04]
:0041E108 3DFF000000              cmp eax, 000000FF
:0041E10D 0F84E1000000            je 0041E1F4
:0041E113 33C0                    xor eax, eax
:0041E115 8A45FC                  mov al, byte ptr [ebp-04]
:0041E118 8BC8                    mov ecx, eax
:0041E11A 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041E11D C1E003                  shl eax, 03
:0041E120 2BC1                    sub eax, ecx
:0041E122 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0041E128 E8D3B0FEFF              call 00409200
:0041E12D 668B00                  mov ax, word ptr [eax]
:0041E130 668945F4                mov word ptr [ebp-0C], ax
:0041E134 C645F800                mov [ebp-08], 00
:0041E138 6A01                    push 00000001
:0041E13A 8B45F0                  mov eax, dword ptr [ebp-10]
:0041E13D 8A4006                  mov al, byte ptr [eax+06]
:0041E140 50                      push eax
:0041E141 8B45F0                  mov eax, dword ptr [ebp-10]
:0041E144 8A4005                  mov al, byte ptr [eax+05]
:0041E147 50                      push eax
:0041E148 6A02                    push 00000002
:0041E14A 68FF000000              push 000000FF
:0041E14F 8D45F4                  lea eax, dword ptr [ebp-0C]
:0041E152 50                      push eax
:0041E153 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0041E156 E8EECDFFFF              call 0041AF49
:0041E15B 33C9                    xor ecx, ecx
:0041E15D 8AC8                    mov cl, al
:0041E15F 83F901                  cmp ecx, 00000001
:0041E162 0F843C000000            je 0041E1A4
:0041E168 6A00                    push 00000000
:0041E16A 8B45F0                  mov eax, dword ptr [ebp-10]
:0041E16D 8A4006                  mov al, byte ptr [eax+06]
:0041E170 50                      push eax
:0041E171 8B45F0                  mov eax, dword ptr [ebp-10]
:0041E174 8A4005                  mov al, byte ptr [eax+05]
:0041E177 50                      push eax
:0041E178 6A02                    push 00000002
:0041E17A 68FF000000              push 000000FF
:0041E17F 8D45F4                  lea eax, dword ptr [ebp-0C]
:0041E182 50                      push eax
:0041E183 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0041E186 E8BECDFFFF              call 0041AF49
:0041E18B 33C9                    xor ecx, ecx
:0041E18D 8AC8                    mov cl, al
:0041E18F 81F9FF000000            cmp ecx, 000000FF
:0041E195 0F8404000000            je 0041E19F
:0041E19B C645F801                mov [ebp-08], 01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E195(C)
|
:0041E19F E904000000              jmp 0041E1A8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E162(C)
|
:0041E1A4 C645F801                mov [ebp-08], 01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E19F(U)
|
:0041E1A8 33C0                    xor eax, eax
:0041E1AA 8A45F8                  mov al, byte ptr [ebp-08]
:0041E1AD 85C0                    test eax, eax
:0041E1AF 0F843A000000            je 0041E1EF
:0041E1B5 6A01                    push 00000001
:0041E1B7 8B4508                  mov eax, dword ptr [ebp+08]
:0041E1BA 50                      push eax
:0041E1BB 8B45F0                  mov eax, dword ptr [ebp-10]
:0041E1BE 83C005                  add eax, 00000005
:0041E1C1 50                      push eax
:0041E1C2 8D45F4                  lea eax, dword ptr [ebp-0C]
:0041E1C5 50                      push eax
:0041E1C6 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0041E1C9 E875C8FFFF              call 0041AA43
:0041E1CE 6A01                    push 00000001
:0041E1D0 68FF000000              push 000000FF
:0041E1D5 68FF000000              push 000000FF
:0041E1DA 6A04                    push 00000004
:0041E1DC 8B4508                  mov eax, dword ptr [ebp+08]
:0041E1DF 50                      push eax
:0041E1E0 8B45F0                  mov eax, dword ptr [ebp-10]
:0041E1E3 83C005                  add eax, 00000005
:0041E1E6 50                      push eax
:0041E1E7 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0041E1EA E85ACDFFFF              call 0041AF49

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E1AF(C)
|
:0041E1EF E911000000              jmp 0041E205

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E10D(C)
|
:0041E1F4 8B45F0                  mov eax, dword ptr [ebp-10]
:0041E1F7 83C005                  add eax, 00000005
:0041E1FA 50                      push eax
:0041E1FB B9B0A64600              mov ecx, 0046A6B0
:0041E200 E88B36FEFF              call 00401890

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041E0D9(U), :0041E1EF(U)
|
:0041E205 E900000000              jmp 0041E20A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E205(U)
|
:0041E20A 5F                      pop edi
:0041E20B 5E                      pop esi
:0041E20C 5B                      pop ebx
:0041E20D C9                      leave
:0041E20E C20400                  ret 0004


:0041E211 CC                      int 03
:0041E212 CC                      int 03
:0041E213 CC                      int 03
:0041E214 CC                      int 03
:0041E215 CC                      int 03
:0041E216 CC                      int 03
:0041E217 CC                      int 03
:0041E218 CC                      int 03
:0041E219 CC                      int 03
:0041E21A CC                      int 03
:0041E21B CC                      int 03
:0041E21C CC                      int 03
:0041E21D CC                      int 03
:0041E21E CC                      int 03
:0041E21F CC                      int 03

* Referenced by a CALL at Addresses:
|:004193C4   , :004193E0   , :00419424   , :00419440   , :00419484   
|:004194A0   , :004194D6   , :004194F2   , :00427A1C   , :00440BF1   
|:00440CD9   , :00440F69   , :004410D6   
|
:0041E220 55                      push ebp
:0041E221 8BEC                    mov ebp, esp
:0041E223 83EC04                  sub esp, 00000004
:0041E226 53                      push ebx
:0041E227 56                      push esi
:0041E228 57                      push edi
:0041E229 894DFC                  mov dword ptr [ebp-04], ecx
:0041E22C 8A4508                  mov al, byte ptr [ebp+08]
:0041E22F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041E232 88410E                  mov byte ptr [ecx+0E], al
:0041E235 E900000000              jmp 0041E23A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E235(U)
|
:0041E23A 5F                      pop edi
:0041E23B 5E                      pop esi
:0041E23C 5B                      pop ebx
:0041E23D C9                      leave
:0041E23E C20400                  ret 0004


:0041E241 CC                      int 03
:0041E242 CC                      int 03
:0041E243 CC                      int 03
:0041E244 CC                      int 03
:0041E245 CC                      int 03
:0041E246 CC                      int 03
:0041E247 CC                      int 03
:0041E248 CC                      int 03
:0041E249 CC                      int 03
:0041E24A CC                      int 03
:0041E24B CC                      int 03
:0041E24C CC                      int 03
:0041E24D CC                      int 03
:0041E24E CC                      int 03
:0041E24F CC                      int 03

* Referenced by a CALL at Addresses:
|:004197EE   , :00419DB5   , :0041AF88   , :00427FF1   , :0042B9AF   
|:0042DD86   , :00432340   , :004324F1   , :004337AC   
|
:0041E250 55                      push ebp
:0041E251 8BEC                    mov ebp, esp
:0041E253 83EC04                  sub esp, 00000004
:0041E256 53                      push ebx
:0041E257 56                      push esi
:0041E258 57                      push edi
:0041E259 894DFC                  mov dword ptr [ebp-04], ecx
:0041E25C 8A4508                  mov al, byte ptr [ebp+08]
:0041E25F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041E262 8801                    mov byte ptr [ecx], al
:0041E264 8A450C                  mov al, byte ptr [ebp+0C]
:0041E267 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041E26A 884101                  mov byte ptr [ecx+01], al
:0041E26D E900000000              jmp 0041E272

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E26D(U)
|
:0041E272 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E275 5F                      pop edi
:0041E276 5E                      pop esi
:0041E277 5B                      pop ebx
:0041E278 C9                      leave
:0041E279 C20800                  ret 0008


:0041E27C CC                      int 03
:0041E27D CC                      int 03
:0041E27E CC                      int 03
:0041E27F CC                      int 03

* Referenced by a CALL at Addresses:
|:0041A1D8   , :0041A26C   , :0041AACE   , :0041AB85   , :0041AE4D   
|:0041AFC0   , :0041B262   , :0041B504   , :0041D1B9   , :0041D237   
|:0041D2DC   , :0041D39B   , :0041DFE0   , :0042C45D   , :0043A884   
|:0043A9D7   , :0043AD25   
|
:0041E280 55                      push ebp
:0041E281 8BEC                    mov ebp, esp
:0041E283 53                      push ebx
:0041E284 56                      push esi
:0041E285 57                      push edi
:0041E286 8B450C                  mov eax, dword ptr [ebp+0C]
:0041E289 33C9                    xor ecx, ecx
:0041E28B 8A08                    mov cl, byte ptr [eax]
:0041E28D 8B4508                  mov eax, dword ptr [ebp+08]
:0041E290 33D2                    xor edx, edx
:0041E292 8A10                    mov dl, byte ptr [eax]
:0041E294 3BCA                    cmp ecx, edx
:0041E296 0F8522000000            jne 0041E2BE
:0041E29C 8B450C                  mov eax, dword ptr [ebp+0C]
:0041E29F 33C9                    xor ecx, ecx
:0041E2A1 8A4801                  mov cl, byte ptr [eax+01]
:0041E2A4 8B4508                  mov eax, dword ptr [ebp+08]
:0041E2A7 33D2                    xor edx, edx
:0041E2A9 8A5001                  mov dl, byte ptr [eax+01]
:0041E2AC 3BCA                    cmp ecx, edx
:0041E2AE 0F850A000000            jne 0041E2BE
:0041E2B4 B801000000              mov eax, 00000001
:0041E2B9 E902000000              jmp 0041E2C0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041E296(C), :0041E2AE(C)
|
:0041E2BE 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E2B9(U)
|
:0041E2C0 E900000000              jmp 0041E2C5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E2C0(U)
|
:0041E2C5 5F                      pop edi
:0041E2C6 5E                      pop esi
:0041E2C7 5B                      pop ebx
:0041E2C8 C9                      leave
:0041E2C9 C3                      ret


:0041E2CA CC                      int 03
:0041E2CB CC                      int 03
:0041E2CC CC                      int 03
:0041E2CD CC                      int 03
:0041E2CE CC                      int 03
:0041E2CF CC                      int 03

* Referenced by a CALL at Addresses:
|:0041B6B5   , :0041DA5B   , :00422391   , :004223B0   , :004225C4   
|:00423C5B   , :00423E2E   , :0042490B   , :00424A0B   , :00424A1F   
|:00424A75   , :00424A89   , :00428701   
|
:0041E2D0 55                      push ebp
:0041E2D1 8BEC                    mov ebp, esp
:0041E2D3 83EC04                  sub esp, 00000004
:0041E2D6 53                      push ebx
:0041E2D7 56                      push esi
:0041E2D8 57                      push edi
:0041E2D9 894DFC                  mov dword ptr [ebp-04], ecx
:0041E2DC 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E2DF 8A4004                  mov al, byte ptr [eax+04]
:0041E2E2 E900000000              jmp 0041E2E7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E2E2(U)
|
:0041E2E7 5F                      pop edi
:0041E2E8 5E                      pop esi
:0041E2E9 5B                      pop ebx
:0041E2EA C9                      leave
:0041E2EB C3                      ret


:0041E2EC CC                      int 03
:0041E2ED CC                      int 03
:0041E2EE CC                      int 03
:0041E2EF CC                      int 03

* Referenced by a CALL at Address:
|:0041BA07   
|
:0041E2F0 55                      push ebp
:0041E2F1 8BEC                    mov ebp, esp
:0041E2F3 83EC04                  sub esp, 00000004
:0041E2F6 53                      push ebx
:0041E2F7 56                      push esi
:0041E2F8 57                      push edi
:0041E2F9 894DFC                  mov dword ptr [ebp-04], ecx
:0041E2FC 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E2FF 668B4008                mov ax, word ptr [eax+08]
:0041E303 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041E306 668901                  mov word ptr [ecx], ax
:0041E309 8B4508                  mov eax, dword ptr [ebp+08]
:0041E30C E900000000              jmp 0041E311

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E30C(U)
|
:0041E311 5F                      pop edi
:0041E312 5E                      pop esi
:0041E313 5B                      pop ebx
:0041E314 C9                      leave
:0041E315 C20400                  ret 0004


:0041E318 CC                      int 03
:0041E319 CC                      int 03
:0041E31A CC                      int 03
:0041E31B CC                      int 03
:0041E31C CC                      int 03
:0041E31D CC                      int 03
:0041E31E CC                      int 03
:0041E31F CC                      int 03

* Referenced by a CALL at Addresses:
|:0041DACC   , :0042C9F1   , :0043ACEF   , :0043ADD9   , :0043E477   
|
:0041E320 55                      push ebp
:0041E321 8BEC                    mov ebp, esp
:0041E323 83EC04                  sub esp, 00000004
:0041E326 53                      push ebx
:0041E327 56                      push esi
:0041E328 57                      push edi
:0041E329 894DFC                  mov dword ptr [ebp-04], ecx
:0041E32C 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E32F 33C9                    xor ecx, ecx
:0041E331 8A4805                  mov cl, byte ptr [eax+05]
:0041E334 80F101                  xor cl, 01
:0041E337 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E33A 884805                  mov byte ptr [eax+05], cl
:0041E33D E900000000              jmp 0041E342

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E33D(U)
|
:0041E342 5F                      pop edi
:0041E343 5E                      pop esi
:0041E344 5B                      pop ebx
:0041E345 C9                      leave
:0041E346 C3                      ret


:0041E347 CC                      int 03
:0041E348 CC                      int 03
:0041E349 CC                      int 03
:0041E34A CC                      int 03
:0041E34B CC                      int 03
:0041E34C CC                      int 03
:0041E34D CC                      int 03
:0041E34E CC                      int 03
:0041E34F CC                      int 03
:0041E350 55                      push ebp
:0041E351 8BEC                    mov ebp, esp
:0041E353 53                      push ebx
:0041E354 56                      push esi
:0041E355 57                      push edi
:0041E356 E80F000000              call 0041E36A
:0041E35B E832000000              call 0041E392
:0041E360 E900000000              jmp 0041E365

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E360(U)
|
:0041E365 5F                      pop edi
:0041E366 5E                      pop esi
:0041E367 5B                      pop ebx
:0041E368 C9                      leave
:0041E369 C3                      ret



* Referenced by a CALL at Address:
|:0041E356   
|
:0041E36A 55                      push ebp
:0041E36B 8BEC                    mov ebp, esp
:0041E36D 53                      push ebx
:0041E36E 56                      push esi
:0041E36F 57                      push edi
:0041E370 6830F24100              push 0041F230
:0041E375 68E0F14100              push 0041F1E0
:0041E37A 6A02                    push 00000002
:0041E37C 6A0A                    push 0000000A
:0041E37E 6800AA4600              push 0046AA00
:0041E383 E8B8990200              call 00447D40
:0041E388 E900000000              jmp 0041E38D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E388(U)
|
:0041E38D 5F                      pop edi
:0041E38E 5E                      pop esi
:0041E38F 5B                      pop ebx
:0041E390 C9                      leave
:0041E391 C3                      ret



* Referenced by a CALL at Address:
|:0041E35B   
|
:0041E392 55                      push ebp
:0041E393 8BEC                    mov ebp, esp
:0041E395 53                      push ebx
:0041E396 56                      push esi
:0041E397 57                      push edi
:0041E398 68AFE34100              push 0041E3AF
:0041E39D E83E990200              call 00447CE0
:0041E3A2 83C404                  add esp, 00000004
:0041E3A5 E900000000              jmp 0041E3AA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E3A5(U)
|
:0041E3AA 5F                      pop edi
:0041E3AB 5E                      pop esi
:0041E3AC 5B                      pop ebx
:0041E3AD C9                      leave
:0041E3AE C3                      ret


:0041E3AF 55                      push ebp
:0041E3B0 8BEC                    mov ebp, esp
:0041E3B2 53                      push ebx
:0041E3B3 56                      push esi
:0041E3B4 57                      push edi
:0041E3B5 6830F24100              push 0041F230
:0041E3BA 6A02                    push 00000002
:0041E3BC 6A0A                    push 0000000A
:0041E3BE 6800AA4600              push 0046AA00
:0041E3C3 E8089A0200              call 00447DD0
:0041E3C8 E900000000              jmp 0041E3CD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E3C8(U)
|
:0041E3CD 5F                      pop edi
:0041E3CE 5E                      pop esi
:0041E3CF 5B                      pop ebx
:0041E3D0 C9                      leave
:0041E3D1 C3                      ret


:0041E3D2 55                      push ebp
:0041E3D3 8BEC                    mov ebp, esp
:0041E3D5 53                      push ebx
:0041E3D6 56                      push esi
:0041E3D7 57                      push edi
:0041E3D8 E80F000000              call 0041E3EC
:0041E3DD E824000000              call 0041E406
:0041E3E2 E900000000              jmp 0041E3E7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E3E2(U)
|
:0041E3E7 5F                      pop edi
:0041E3E8 5E                      pop esi
:0041E3E9 5B                      pop ebx
:0041E3EA C9                      leave
:0041E3EB C3                      ret



* Referenced by a CALL at Address:
|:0041E3D8   
|
:0041E3EC 55                      push ebp
:0041E3ED 8BEC                    mov ebp, esp
:0041E3EF 53                      push ebx
:0041E3F0 56                      push esi
:0041E3F1 57                      push edi
:0041E3F2 B9D0A64600              mov ecx, 0046A6D0
:0041E3F7 E8540E0000              call 0041F250
:0041E3FC E900000000              jmp 0041E401

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E3FC(U)
|
:0041E401 5F                      pop edi
:0041E402 5E                      pop esi
:0041E403 5B                      pop ebx
:0041E404 C9                      leave
:0041E405 C3                      ret



* Referenced by a CALL at Address:
|:0041E3DD   
|
:0041E406 55                      push ebp
:0041E407 8BEC                    mov ebp, esp
:0041E409 53                      push ebx
:0041E40A 56                      push esi
:0041E40B 57                      push edi
:0041E40C 6823E44100              push 0041E423
:0041E411 E8CA980200              call 00447CE0
:0041E416 83C404                  add esp, 00000004
:0041E419 E900000000              jmp 0041E41E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E419(U)
|
:0041E41E 5F                      pop edi
:0041E41F 5E                      pop esi
:0041E420 5B                      pop ebx
:0041E421 C9                      leave
:0041E422 C3                      ret


:0041E423 55                      push ebp
:0041E424 8BEC                    mov ebp, esp
:0041E426 53                      push ebx
:0041E427 56                      push esi
:0041E428 57                      push edi
:0041E429 B9D0A64600              mov ecx, 0046A6D0
:0041E42E E88D0E0000              call 0041F2C0
:0041E433 E900000000              jmp 0041E438

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E433(U)
|
:0041E438 5F                      pop edi
:0041E439 5E                      pop esi
:0041E43A 5B                      pop ebx
:0041E43B C9                      leave
:0041E43C C3                      ret


:0041E43D 55                      push ebp
:0041E43E 8BEC                    mov ebp, esp
:0041E440 53                      push ebx
:0041E441 56                      push esi
:0041E442 57                      push edi
:0041E443 E80F000000              call 0041E457
:0041E448 E835000000              call 0041E482
:0041E44D E900000000              jmp 0041E452

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E44D(U)
|
:0041E452 5F                      pop edi
:0041E453 5E                      pop esi
:0041E454 5B                      pop ebx
:0041E455 C9                      leave
:0041E456 C3                      ret



* Referenced by a CALL at Address:
|:0041E443   
|
:0041E457 55                      push ebp
:0041E458 8BEC                    mov ebp, esp
:0041E45A 53                      push ebx
:0041E45B 56                      push esi
:0041E45C 57                      push edi
:0041E45D 6800F34100              push 0041F300
:0041E462 68E0F24100              push 0041F2E0
:0041E467 68FF000000              push 000000FF
:0041E46C 6A11                    push 00000011
:0041E46E 6818AA4600              push 0046AA18
:0041E473 E8C8980200              call 00447D40
:0041E478 E900000000              jmp 0041E47D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E478(U)
|
:0041E47D 5F                      pop edi
:0041E47E 5E                      pop esi
:0041E47F 5B                      pop ebx
:0041E480 C9                      leave
:0041E481 C3                      ret



* Referenced by a CALL at Address:
|:0041E448   
|
:0041E482 55                      push ebp
:0041E483 8BEC                    mov ebp, esp
:0041E485 53                      push ebx
:0041E486 56                      push esi
:0041E487 57                      push edi
:0041E488 689FE44100              push 0041E49F
:0041E48D E84E980200              call 00447CE0
:0041E492 83C404                  add esp, 00000004
:0041E495 E900000000              jmp 0041E49A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E495(U)
|
:0041E49A 5F                      pop edi
:0041E49B 5E                      pop esi
:0041E49C 5B                      pop ebx
:0041E49D C9                      leave
:0041E49E C3                      ret


:0041E49F 55                      push ebp
:0041E4A0 8BEC                    mov ebp, esp
:0041E4A2 53                      push ebx
:0041E4A3 56                      push esi
:0041E4A4 57                      push edi
:0041E4A5 6800F34100              push 0041F300
:0041E4AA 68FF000000              push 000000FF
:0041E4AF 6A11                    push 00000011
:0041E4B1 6818AA4600              push 0046AA18
:0041E4B6 E815990200              call 00447DD0
:0041E4BB E900000000              jmp 0041E4C0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E4BB(U)
|
:0041E4C0 5F                      pop edi
:0041E4C1 5E                      pop esi
:0041E4C2 5B                      pop ebx
:0041E4C3 C9                      leave
:0041E4C4 C3                      ret


:0041E4C5 55                      push ebp
:0041E4C6 8BEC                    mov ebp, esp
:0041E4C8 53                      push ebx
:0041E4C9 56                      push esi
:0041E4CA 57                      push edi
:0041E4CB E80F000000              call 0041E4DF
:0041E4D0 E832000000              call 0041E507
:0041E4D5 E900000000              jmp 0041E4DA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E4D5(U)
|
:0041E4DA 5F                      pop edi
:0041E4DB 5E                      pop esi
:0041E4DC 5B                      pop ebx
:0041E4DD C9                      leave
:0041E4DE C3                      ret



* Referenced by a CALL at Address:
|:0041E4CB   
|
:0041E4DF 55                      push ebp
:0041E4E0 8BEC                    mov ebp, esp
:0041E4E2 53                      push ebx
:0041E4E3 56                      push esi
:0041E4E4 57                      push edi
:0041E4E5 6860F34100              push 0041F360
:0041E4EA 6820F34100              push 0041F320
:0041E4EF 6A40                    push 00000040
:0041E4F1 6A0C                    push 0000000C
:0041E4F3 6800A74600              push 0046A700
:0041E4F8 E843980200              call 00447D40
:0041E4FD E900000000              jmp 0041E502

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E4FD(U)
|
:0041E502 5F                      pop edi
:0041E503 5E                      pop esi
:0041E504 5B                      pop ebx
:0041E505 C9                      leave
:0041E506 C3                      ret



* Referenced by a CALL at Address:
|:0041E4D0   
|
:0041E507 55                      push ebp
:0041E508 8BEC                    mov ebp, esp
:0041E50A 53                      push ebx
:0041E50B 56                      push esi
:0041E50C 57                      push edi
:0041E50D 6824E54100              push 0041E524
:0041E512 E8C9970200              call 00447CE0
:0041E517 83C404                  add esp, 00000004
:0041E51A E900000000              jmp 0041E51F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E51A(U)
|
:0041E51F 5F                      pop edi
:0041E520 5E                      pop esi
:0041E521 5B                      pop ebx
:0041E522 C9                      leave
:0041E523 C3                      ret


:0041E524 55                      push ebp
:0041E525 8BEC                    mov ebp, esp
:0041E527 53                      push ebx
:0041E528 56                      push esi
:0041E529 57                      push edi
:0041E52A 6860F34100              push 0041F360
:0041E52F 6A40                    push 00000040
:0041E531 6A0C                    push 0000000C
:0041E533 6800A74600              push 0046A700
:0041E538 E893980200              call 00447DD0
:0041E53D E900000000              jmp 0041E542

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E53D(U)
|
:0041E542 5F                      pop edi
:0041E543 5E                      pop esi
:0041E544 5B                      pop ebx
:0041E545 C9                      leave
:0041E546 C3                      ret



* Referenced by a CALL at Address:
|:00409CB3   
|
:0041E547 55                      push ebp
:0041E548 8BEC                    mov ebp, esp
:0041E54A 83EC10                  sub esp, 00000010
:0041E54D 53                      push ebx
:0041E54E 56                      push esi
:0041E54F 57                      push edi
:0041E550 894DF0                  mov dword ptr [ebp-10], ecx
:0041E553 8B4508                  mov eax, dword ptr [ebp+08]
:0041E556 8945FC                  mov dword ptr [ebp-04], eax
:0041E559 8B45F0                  mov eax, dword ptr [ebp-10]
:0041E55C 8945F8                  mov dword ptr [ebp-08], eax
:0041E55F C745F400000000          mov [ebp-0C], 00000000
:0041E566 E903000000              jmp 0041E56E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E588(U)
|
:0041E56B FF45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E566(U)
|
:0041E56E 837DF40C                cmp dword ptr [ebp-0C], 0000000C
:0041E572 0F8315000000            jnb 0041E58D
:0041E578 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E57B 8A00                    mov al, byte ptr [eax]
:0041E57D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041E580 8801                    mov byte ptr [ecx], al
:0041E582 FF45FC                  inc [ebp-04]
:0041E585 FF45F8                  inc [ebp-08]
:0041E588 E9DEFFFFFF              jmp 0041E56B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E572(C)
|
:0041E58D 8B45F8                  mov eax, dword ptr [ebp-08]
:0041E590 C60000                  mov byte ptr [eax], 00
:0041E593 8345080C                add dword ptr [ebp+08], 0000000C
:0041E597 8B4508                  mov eax, dword ptr [ebp+08]
:0041E59A 8A00                    mov al, byte ptr [eax]
:0041E59C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0041E59F 88410D                  mov byte ptr [ecx+0D], al
:0041E5A2 FF4508                  inc [ebp+08]
:0041E5A5 8B4508                  mov eax, dword ptr [ebp+08]
:0041E5A8 8A00                    mov al, byte ptr [eax]
:0041E5AA 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0041E5AD 88410E                  mov byte ptr [ecx+0E], al
:0041E5B0 FF4508                  inc [ebp+08]
:0041E5B3 8B4508                  mov eax, dword ptr [ebp+08]
:0041E5B6 8A00                    mov al, byte ptr [eax]
:0041E5B8 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0041E5BB 88410F                  mov byte ptr [ecx+0F], al
:0041E5BE FF4508                  inc [ebp+08]
:0041E5C1 8B4508                  mov eax, dword ptr [ebp+08]
:0041E5C4 8A00                    mov al, byte ptr [eax]
:0041E5C6 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0041E5C9 884110                  mov byte ptr [ecx+10], al
:0041E5CC FF4508                  inc [ebp+08]
:0041E5CF E900000000              jmp 0041E5D4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E5CF(U)
|
:0041E5D4 5F                      pop edi
:0041E5D5 5E                      pop esi
:0041E5D6 5B                      pop ebx
:0041E5D7 C9                      leave
:0041E5D8 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:004161AB   , :004162BA   
|
:0041E5DB 55                      push ebp
:0041E5DC 8BEC                    mov ebp, esp
:0041E5DE 53                      push ebx
:0041E5DF 56                      push esi
:0041E5E0 57                      push edi
:0041E5E1 817D08FF000000          cmp dword ptr [ebp+08], 000000FF
:0041E5E8 0F8314000000            jnb 0041E602
:0041E5EE 8B4508                  mov eax, dword ptr [ebp+08]
:0041E5F1 8BC8                    mov ecx, eax
:0041E5F3 C1E004                  shl eax, 04
:0041E5F6 8D840818AA4600          lea eax, dword ptr [eax+ecx+0046AA18]
:0041E5FD E907000000              jmp 0041E609

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E5E8(C)
|
:0041E602 33C0                    xor eax, eax
:0041E604 E900000000              jmp 0041E609

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041E5FD(U), :0041E604(U)
|
:0041E609 5F                      pop edi
:0041E60A 5E                      pop esi
:0041E60B 5B                      pop ebx
:0041E60C C9                      leave
:0041E60D C3                      ret



* Referenced by a CALL at Addresses:
|:0040389B   , :0040D011   , :0040D041   , :0040D0BA   , :00434F09   
|:00435F27   , :0043600A   , :00436077   , :004364C9   , :004365EF   
|:0043668F   , :00436773   , :004368DF   , :00436990   , :0043FA75   
|:0043FAC5   , :0043FB15   , :0043FC88   
|
:0041E60E 55                      push ebp
:0041E60F 8BEC                    mov ebp, esp
:0041E611 53                      push ebx
:0041E612 56                      push esi
:0041E613 57                      push edi
:0041E614 817D08FF000000          cmp dword ptr [ebp+08], 000000FF
:0041E61B 0F8207000000            jb 0041E628
:0041E621 33C0                    xor eax, eax
:0041E623 E919000000              jmp 0041E641

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E61B(C)
|
:0041E628 8B4508                  mov eax, dword ptr [ebp+08]
:0041E62B 8BC8                    mov ecx, eax
:0041E62D C1E004                  shl eax, 04
:0041E630 8D8C0818AA4600          lea ecx, dword ptr [eax+ecx+0046AA18]
:0041E637 E824AFFEFF              call 00409560
:0041E63C E900000000              jmp 0041E641

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041E623(U), :0041E63C(U)
|
:0041E641 5F                      pop edi
:0041E642 5E                      pop esi
:0041E643 5B                      pop ebx
:0041E644 C9                      leave
:0041E645 C3                      ret



* Referenced by a CALL at Addresses:
|:00403907   , :0043FD0F   
|
:0041E646 55                      push ebp
:0041E647 8BEC                    mov ebp, esp
:0041E649 83EC04                  sub esp, 00000004
:0041E64C 53                      push ebx
:0041E64D 56                      push esi
:0041E64E 57                      push edi
:0041E64F 894DFC                  mov dword ptr [ebp-04], ecx
:0041E652 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E655 33C9                    xor ecx, ecx
:0041E657 8A480D                  mov cl, byte ptr [eax+0D]
:0041E65A 83F919                  cmp ecx, 00000019
:0041E65D 0F8C32000000            jl 0041E695
:0041E663 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E666 33C9                    xor ecx, ecx
:0041E668 8A4810                  mov cl, byte ptr [eax+10]
:0041E66B BB67000000              mov ebx, 00000067
:0041E670 8BC1                    mov eax, ecx
:0041E672 99                      cdq
:0041E673 F7FB                    idiv ebx
:0041E675 8B0495E0FF4400          mov eax, dword ptr [4*edx+0044FFE0]
:0041E67C 50                      push eax
:0041E67D 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E680 50                      push eax

* Possible StringData Ref from Data Obj ->"     C6%s
C7%s"
                                  |
:0041E681 6848124500              push 00451248
:0041E686 6A04                    push 00000004
:0041E688 E8A8A80100              call 00438F35
:0041E68D 83C410                  add esp, 00000010
:0041E690 E936000000              jmp 0041E6CB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E65D(C)
|
:0041E695 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E698 33C9                    xor ecx, ecx
:0041E69A 8A4810                  mov cl, byte ptr [eax+10]
:0041E69D BB67000000              mov ebx, 00000067
:0041E6A2 8BC1                    mov eax, ecx
:0041E6A4 99                      cdq
:0041E6A5 F7FB                    idiv ebx
:0041E6A7 8B0495E0FF4400          mov eax, dword ptr [4*edx+0044FFE0]
:0041E6AE 50                      push eax
:0041E6AF 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E6B2 33C9                    xor ecx, ecx
:0041E6B4 8A480F                  mov cl, byte ptr [eax+0F]
:0041E6B7 51                      push ecx
:0041E6B8 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E6BB 50                      push eax

* Possible StringData Ref from Data Obj ->"     C6%s(+%u)
C7%s"
                                  |
:0041E6BC 685C124500              push 0045125C
:0041E6C1 6A04                    push 00000004
:0041E6C3 E86DA80100              call 00438F35
:0041E6C8 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E690(U)
|
:0041E6CB E8178E0100              call 004374E7
:0041E6D0 E900000000              jmp 0041E6D5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E6D0(U)
|
:0041E6D5 5F                      pop edi
:0041E6D6 5E                      pop esi
:0041E6D7 5B                      pop ebx
:0041E6D8 C9                      leave
:0041E6D9 C3                      ret



* Referenced by a CALL at Addresses:
|:004099F4   , :00409E3A   , :0040ABA1   
|
:0041E6DA 55                      push ebp
:0041E6DB 8BEC                    mov ebp, esp
:0041E6DD 83EC08                  sub esp, 00000008
:0041E6E0 53                      push ebx
:0041E6E1 56                      push esi
:0041E6E2 57                      push edi
:0041E6E3 894DF8                  mov dword ptr [ebp-08], ecx
:0041E6E6 8B4508                  mov eax, dword ptr [ebp+08]
:0041E6E9 33C9                    xor ecx, ecx
:0041E6EB 8A08                    mov cl, byte ptr [eax]
:0041E6ED 894DFC                  mov dword ptr [ebp-04], ecx
:0041E6F0 FF4508                  inc [ebp+08]
:0041E6F3 8B4508                  mov eax, dword ptr [ebp+08]
:0041E6F6 33C9                    xor ecx, ecx
:0041E6F8 8A08                    mov cl, byte ptr [eax]
:0041E6FA C1E108                  shl ecx, 08
:0041E6FD 014DFC                  add dword ptr [ebp-04], ecx
:0041E700 FF4508                  inc [ebp+08]
:0041E703 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E706 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041E709 8901                    mov dword ptr [ecx], eax
:0041E70B 8B4508                  mov eax, dword ptr [ebp+08]
:0041E70E 33C9                    xor ecx, ecx
:0041E710 8A08                    mov cl, byte ptr [eax]
:0041E712 894DFC                  mov dword ptr [ebp-04], ecx
:0041E715 FF4508                  inc [ebp+08]
:0041E718 8B4508                  mov eax, dword ptr [ebp+08]
:0041E71B 33C9                    xor ecx, ecx
:0041E71D 8A08                    mov cl, byte ptr [eax]
:0041E71F C1E108                  shl ecx, 08
:0041E722 014DFC                  add dword ptr [ebp-04], ecx
:0041E725 FF4508                  inc [ebp+08]
:0041E728 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E72B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041E72E 894104                  mov dword ptr [ecx+04], eax
:0041E731 8B4508                  mov eax, dword ptr [ebp+08]
:0041E734 33C9                    xor ecx, ecx
:0041E736 8A08                    mov cl, byte ptr [eax]
:0041E738 894DFC                  mov dword ptr [ebp-04], ecx
:0041E73B FF4508                  inc [ebp+08]
:0041E73E 8B4508                  mov eax, dword ptr [ebp+08]
:0041E741 33C9                    xor ecx, ecx
:0041E743 8A08                    mov cl, byte ptr [eax]
:0041E745 C1E108                  shl ecx, 08
:0041E748 014DFC                  add dword ptr [ebp-04], ecx
:0041E74B FF4508                  inc [ebp+08]
:0041E74E 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E751 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041E754 66894108                mov word ptr [ecx+08], ax
:0041E758 8B4508                  mov eax, dword ptr [ebp+08]
:0041E75B 33C9                    xor ecx, ecx
:0041E75D 8A08                    mov cl, byte ptr [eax]
:0041E75F 894DFC                  mov dword ptr [ebp-04], ecx
:0041E762 FF4508                  inc [ebp+08]
:0041E765 8B4508                  mov eax, dword ptr [ebp+08]
:0041E768 33C9                    xor ecx, ecx
:0041E76A 8A08                    mov cl, byte ptr [eax]
:0041E76C C1E108                  shl ecx, 08
:0041E76F 014DFC                  add dword ptr [ebp-04], ecx
:0041E772 FF4508                  inc [ebp+08]
:0041E775 837DFC1E                cmp dword ptr [ebp-04], 0000001E
:0041E779 0F8207000000            jb 0041E786
:0041E77F C745FC05000000          mov [ebp-04], 00000005

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E779(C)
|
:0041E786 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E789 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041E78C 6689410A                mov word ptr [ecx+0A], ax
:0041E790 8B4508                  mov eax, dword ptr [ebp+08]
:0041E793 33C9                    xor ecx, ecx
:0041E795 8A08                    mov cl, byte ptr [eax]
:0041E797 894DFC                  mov dword ptr [ebp-04], ecx
:0041E79A FF4508                  inc [ebp+08]
:0041E79D 8B4508                  mov eax, dword ptr [ebp+08]
:0041E7A0 33C9                    xor ecx, ecx
:0041E7A2 8A08                    mov cl, byte ptr [eax]
:0041E7A4 C1E108                  shl ecx, 08
:0041E7A7 014DFC                  add dword ptr [ebp-04], ecx
:0041E7AA FF4508                  inc [ebp+08]
:0041E7AD 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E7B0 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041E7B3 6689410C                mov word ptr [ecx+0C], ax
:0041E7B7 8B4508                  mov eax, dword ptr [ebp+08]
:0041E7BA 33C9                    xor ecx, ecx
:0041E7BC 8A08                    mov cl, byte ptr [eax]
:0041E7BE 894DFC                  mov dword ptr [ebp-04], ecx
:0041E7C1 FF4508                  inc [ebp+08]
:0041E7C4 8B4508                  mov eax, dword ptr [ebp+08]
:0041E7C7 33C9                    xor ecx, ecx
:0041E7C9 8A08                    mov cl, byte ptr [eax]
:0041E7CB C1E108                  shl ecx, 08
:0041E7CE 014DFC                  add dword ptr [ebp-04], ecx
:0041E7D1 FF4508                  inc [ebp+08]
:0041E7D4 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E7D7 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041E7DA 6689410E                mov word ptr [ecx+0E], ax
:0041E7DE 8B4508                  mov eax, dword ptr [ebp+08]
:0041E7E1 33C9                    xor ecx, ecx
:0041E7E3 8A08                    mov cl, byte ptr [eax]
:0041E7E5 894DFC                  mov dword ptr [ebp-04], ecx
:0041E7E8 FF4508                  inc [ebp+08]
:0041E7EB 8B4508                  mov eax, dword ptr [ebp+08]
:0041E7EE 33C9                    xor ecx, ecx
:0041E7F0 8A08                    mov cl, byte ptr [eax]
:0041E7F2 C1E108                  shl ecx, 08
:0041E7F5 014DFC                  add dword ptr [ebp-04], ecx
:0041E7F8 FF4508                  inc [ebp+08]
:0041E7FB 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E7FE 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041E801 66894110                mov word ptr [ecx+10], ax
:0041E805 8B4508                  mov eax, dword ptr [ebp+08]
:0041E808 8A00                    mov al, byte ptr [eax]
:0041E80A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041E80D 884112                  mov byte ptr [ecx+12], al
:0041E810 FF4508                  inc [ebp+08]
:0041E813 8B4508                  mov eax, dword ptr [ebp+08]
:0041E816 8A00                    mov al, byte ptr [eax]
:0041E818 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041E81B 884113                  mov byte ptr [ecx+13], al
:0041E81E FF4508                  inc [ebp+08]
:0041E821 8B4508                  mov eax, dword ptr [ebp+08]
:0041E824 8A00                    mov al, byte ptr [eax]
:0041E826 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041E829 884114                  mov byte ptr [ecx+14], al
:0041E82C FF4508                  inc [ebp+08]
:0041E82F 8B4508                  mov eax, dword ptr [ebp+08]
:0041E832 8A00                    mov al, byte ptr [eax]
:0041E834 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041E837 884115                  mov byte ptr [ecx+15], al
:0041E83A FF4508                  inc [ebp+08]
:0041E83D 8B4508                  mov eax, dword ptr [ebp+08]
:0041E840 8A00                    mov al, byte ptr [eax]
:0041E842 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041E845 884116                  mov byte ptr [ecx+16], al
:0041E848 FF4508                  inc [ebp+08]
:0041E84B 8B4508                  mov eax, dword ptr [ebp+08]
:0041E84E 8A00                    mov al, byte ptr [eax]
:0041E850 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041E853 884117                  mov byte ptr [ecx+17], al
:0041E856 FF4508                  inc [ebp+08]
:0041E859 6A0F                    push 0000000F
:0041E85B 8B45F8                  mov eax, dword ptr [ebp-08]
:0041E85E 83C018                  add eax, 00000018
:0041E861 50                      push eax
:0041E862 8B4508                  mov eax, dword ptr [ebp+08]
:0041E865 50                      push eax
:0041E866 E8E28B0200              call 0044744D
:0041E86B 83C40C                  add esp, 0000000C
:0041E86E 8345080F                add dword ptr [ebp+08], 0000000F
:0041E872 6A08                    push 00000008
:0041E874 8B45F8                  mov eax, dword ptr [ebp-08]
:0041E877 83C027                  add eax, 00000027
:0041E87A 50                      push eax
:0041E87B 8B4508                  mov eax, dword ptr [ebp+08]
:0041E87E 50                      push eax
:0041E87F E8C98B0200              call 0044744D
:0041E884 83C40C                  add esp, 0000000C
:0041E887 83450808                add dword ptr [ebp+08], 00000008
:0041E88B E900000000              jmp 0041E890

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E88B(U)
|
:0041E890 5F                      pop edi
:0041E891 5E                      pop esi
:0041E892 5B                      pop ebx
:0041E893 C9                      leave
:0041E894 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00409DAB   , :0040A02B   , :0040B4F3   
|
:0041E897 55                      push ebp
:0041E898 8BEC                    mov ebp, esp
:0041E89A 83EC04                  sub esp, 00000004
:0041E89D 53                      push ebx
:0041E89E 56                      push esi
:0041E89F 57                      push edi
:0041E8A0 894DFC                  mov dword ptr [ebp-04], ecx
:0041E8A3 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E8A6 8A00                    mov al, byte ptr [eax]
:0041E8A8 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041E8AB 8801                    mov byte ptr [ecx], al
:0041E8AD FF4508                  inc [ebp+08]
:0041E8B0 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E8B3 8B00                    mov eax, dword ptr [eax]
:0041E8B5 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041E8B8 8821                    mov byte ptr [ecx], ah
:0041E8BA FF4508                  inc [ebp+08]
:0041E8BD 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E8C0 8A4004                  mov al, byte ptr [eax+04]
:0041E8C3 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041E8C6 8801                    mov byte ptr [ecx], al
:0041E8C8 FF4508                  inc [ebp+08]
:0041E8CB 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E8CE 8B4004                  mov eax, dword ptr [eax+04]
:0041E8D1 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041E8D4 8821                    mov byte ptr [ecx], ah
:0041E8D6 FF4508                  inc [ebp+08]
:0041E8D9 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E8DC 33C9                    xor ecx, ecx
:0041E8DE 8A4808                  mov cl, byte ptr [eax+08]
:0041E8E1 8B4508                  mov eax, dword ptr [ebp+08]
:0041E8E4 8808                    mov byte ptr [eax], cl
:0041E8E6 FF4508                  inc [ebp+08]
:0041E8E9 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E8EC 33C9                    xor ecx, ecx
:0041E8EE 668B4808                mov cx, word ptr [eax+08]
:0041E8F2 8B4508                  mov eax, dword ptr [ebp+08]
:0041E8F5 8828                    mov byte ptr [eax], ch
:0041E8F7 FF4508                  inc [ebp+08]
:0041E8FA 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E8FD 33C9                    xor ecx, ecx
:0041E8FF 8A480A                  mov cl, byte ptr [eax+0A]
:0041E902 8B4508                  mov eax, dword ptr [ebp+08]
:0041E905 8808                    mov byte ptr [eax], cl
:0041E907 FF4508                  inc [ebp+08]
:0041E90A 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E90D 33C9                    xor ecx, ecx
:0041E90F 668B480A                mov cx, word ptr [eax+0A]
:0041E913 8B4508                  mov eax, dword ptr [ebp+08]
:0041E916 8828                    mov byte ptr [eax], ch
:0041E918 FF4508                  inc [ebp+08]
:0041E91B 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E91E 33C9                    xor ecx, ecx
:0041E920 8A480C                  mov cl, byte ptr [eax+0C]
:0041E923 8B4508                  mov eax, dword ptr [ebp+08]
:0041E926 8808                    mov byte ptr [eax], cl
:0041E928 FF4508                  inc [ebp+08]
:0041E92B 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E92E 33C9                    xor ecx, ecx
:0041E930 668B480C                mov cx, word ptr [eax+0C]
:0041E934 8B4508                  mov eax, dword ptr [ebp+08]
:0041E937 8828                    mov byte ptr [eax], ch
:0041E939 FF4508                  inc [ebp+08]
:0041E93C 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E93F 33C9                    xor ecx, ecx
:0041E941 8A480E                  mov cl, byte ptr [eax+0E]
:0041E944 8B4508                  mov eax, dword ptr [ebp+08]
:0041E947 8808                    mov byte ptr [eax], cl
:0041E949 FF4508                  inc [ebp+08]
:0041E94C 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E94F 33C9                    xor ecx, ecx
:0041E951 668B480E                mov cx, word ptr [eax+0E]
:0041E955 8B4508                  mov eax, dword ptr [ebp+08]
:0041E958 8828                    mov byte ptr [eax], ch
:0041E95A FF4508                  inc [ebp+08]
:0041E95D 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E960 33C9                    xor ecx, ecx
:0041E962 8A4810                  mov cl, byte ptr [eax+10]
:0041E965 8B4508                  mov eax, dword ptr [ebp+08]
:0041E968 8808                    mov byte ptr [eax], cl
:0041E96A FF4508                  inc [ebp+08]
:0041E96D 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E970 33C9                    xor ecx, ecx
:0041E972 668B4810                mov cx, word ptr [eax+10]
:0041E976 8B4508                  mov eax, dword ptr [ebp+08]
:0041E979 8828                    mov byte ptr [eax], ch
:0041E97B FF4508                  inc [ebp+08]
:0041E97E 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E981 8A4012                  mov al, byte ptr [eax+12]
:0041E984 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041E987 8801                    mov byte ptr [ecx], al
:0041E989 FF4508                  inc [ebp+08]
:0041E98C 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E98F 8A4013                  mov al, byte ptr [eax+13]
:0041E992 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041E995 8801                    mov byte ptr [ecx], al
:0041E997 FF4508                  inc [ebp+08]
:0041E99A 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E99D 8A4014                  mov al, byte ptr [eax+14]
:0041E9A0 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041E9A3 8801                    mov byte ptr [ecx], al
:0041E9A5 FF4508                  inc [ebp+08]
:0041E9A8 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E9AB 8A4015                  mov al, byte ptr [eax+15]
:0041E9AE 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041E9B1 8801                    mov byte ptr [ecx], al
:0041E9B3 FF4508                  inc [ebp+08]
:0041E9B6 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E9B9 8A4016                  mov al, byte ptr [eax+16]
:0041E9BC 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041E9BF 8801                    mov byte ptr [ecx], al
:0041E9C1 FF4508                  inc [ebp+08]
:0041E9C4 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E9C7 8A4017                  mov al, byte ptr [eax+17]
:0041E9CA 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041E9CD 8801                    mov byte ptr [ecx], al
:0041E9CF FF4508                  inc [ebp+08]
:0041E9D2 6A0F                    push 0000000F
:0041E9D4 8B4508                  mov eax, dword ptr [ebp+08]
:0041E9D7 50                      push eax
:0041E9D8 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E9DB 83C018                  add eax, 00000018
:0041E9DE 50                      push eax
:0041E9DF E8698A0200              call 0044744D
:0041E9E4 83C40C                  add esp, 0000000C
:0041E9E7 8345080F                add dword ptr [ebp+08], 0000000F
:0041E9EB 6A08                    push 00000008
:0041E9ED 8B4508                  mov eax, dword ptr [ebp+08]
:0041E9F0 50                      push eax
:0041E9F1 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E9F4 83C027                  add eax, 00000027
:0041E9F7 50                      push eax
:0041E9F8 E8508A0200              call 0044744D
:0041E9FD 83C40C                  add esp, 0000000C
:0041EA00 83450808                add dword ptr [ebp+08], 00000008
:0041EA04 8B4508                  mov eax, dword ptr [ebp+08]
:0041EA07 E900000000              jmp 0041EA0C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EA07(U)
|
:0041EA0C 5F                      pop edi
:0041EA0D 5E                      pop esi
:0041EA0E 5B                      pop ebx
:0041EA0F C9                      leave
:0041EA10 C20400                  ret 0004



* Referenced by a CALL at Address:
|:004101EE   
|
:0041EA13 55                      push ebp
:0041EA14 8BEC                    mov ebp, esp
:0041EA16 83EC08                  sub esp, 00000008
:0041EA19 53                      push ebx
:0041EA1A 56                      push esi
:0041EA1B 57                      push edi
:0041EA1C 894DF8                  mov dword ptr [ebp-08], ecx
:0041EA1F 8B45F8                  mov eax, dword ptr [ebp-08]
:0041EA22 33C9                    xor ecx, ecx
:0041EA24 668B480E                mov cx, word ptr [eax+0E]
:0041EA28 894DFC                  mov dword ptr [ebp-04], ecx
:0041EA2B 8B45F8                  mov eax, dword ptr [ebp-08]
:0041EA2E 33C9                    xor ecx, ecx
:0041EA30 668B480E                mov cx, word ptr [eax+0E]
:0041EA34 81E1FFEFFFFF            and ecx, FFFFEFFF
:0041EA3A 8B45F8                  mov eax, dword ptr [ebp-08]
:0041EA3D 6689480E                mov word ptr [eax+0E], cx
:0041EA41 8B45FC                  mov eax, dword ptr [ebp-04]
:0041EA44 E900000000              jmp 0041EA49

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EA44(U)
|
:0041EA49 5F                      pop edi
:0041EA4A 5E                      pop esi
:0041EA4B 5B                      pop ebx
:0041EA4C C9                      leave
:0041EA4D C3                      ret



* Referenced by a CALL at Address:
|:004376BB   
|
:0041EA4E 55                      push ebp
:0041EA4F 8BEC                    mov ebp, esp
:0041EA51 83EC04                  sub esp, 00000004
:0041EA54 53                      push ebx
:0041EA55 56                      push esi
:0041EA56 57                      push edi
:0041EA57 894DFC                  mov dword ptr [ebp-04], ecx
:0041EA5A 8B45FC                  mov eax, dword ptr [ebp-04]
:0041EA5D 33C9                    xor ecx, ecx
:0041EA5F 668B4810                mov cx, word ptr [eax+10]
:0041EA63 8BC1                    mov eax, ecx
:0041EA65 E900000000              jmp 0041EA6A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EA65(U)
|
:0041EA6A 5F                      pop edi
:0041EA6B 5E                      pop esi
:0041EA6C 5B                      pop ebx
:0041EA6D C9                      leave
:0041EA6E C3                      ret



* Referenced by a CALL at Address:
|:0043767C   
|
:0041EA6F 55                      push ebp
:0041EA70 8BEC                    mov ebp, esp
:0041EA72 83EC04                  sub esp, 00000004
:0041EA75 53                      push ebx
:0041EA76 56                      push esi
:0041EA77 57                      push edi
:0041EA78 894DFC                  mov dword ptr [ebp-04], ecx
:0041EA7B 8B4508                  mov eax, dword ptr [ebp+08]
:0041EA7E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041EA81 66894110                mov word ptr [ecx+10], ax
:0041EA85 E900000000              jmp 0041EA8A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EA85(U)
|
:0041EA8A 5F                      pop edi
:0041EA8B 5E                      pop esi
:0041EA8C 5B                      pop ebx
:0041EA8D C9                      leave
:0041EA8E C20400                  ret 0004


:0041EA91 55                      push ebp
:0041EA92 8BEC                    mov ebp, esp
:0041EA94 83EC08                  sub esp, 00000008
:0041EA97 53                      push ebx
:0041EA98 56                      push esi
:0041EA99 57                      push edi
:0041EA9A 894DF8                  mov dword ptr [ebp-08], ecx
:0041EA9D C745FC00000000          mov [ebp-04], 00000000
:0041EAA4 E903000000              jmp 0041EAAC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EAD7(U)
|
:0041EAA9 FF45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EAA4(U)
|
:0041EAAC 837DFC0F                cmp dword ptr [ebp-04], 0000000F
:0041EAB0 0F8326000000            jnb 0041EADC
:0041EAB6 8B45FC                  mov eax, dword ptr [ebp-04]
:0041EAB9 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041EABC 33D2                    xor edx, edx
:0041EABE 8A540818                mov dl, byte ptr [eax+ecx+18]
:0041EAC2 33C0                    xor eax, eax
:0041EAC4 8A4508                  mov al, byte ptr [ebp+08]
:0041EAC7 3BD0                    cmp edx, eax
:0041EAC9 0F8508000000            jne 0041EAD7
:0041EACF 8A45FC                  mov al, byte ptr [ebp-04]
:0041EAD2 E90C000000              jmp 0041EAE3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EAC9(C)
|
:0041EAD7 E9CDFFFFFF              jmp 0041EAA9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EAB0(C)
|
:0041EADC B0FF                    mov al, FF
:0041EADE E900000000              jmp 0041EAE3

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041EAD2(U), :0041EADE(U)
|
:0041EAE3 5F                      pop edi
:0041EAE4 5E                      pop esi
:0041EAE5 5B                      pop ebx
:0041EAE6 C9                      leave
:0041EAE7 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:004365A5   , :00436729   , :00436DC3   
|
:0041EAEA 55                      push ebp
:0041EAEB 8BEC                    mov ebp, esp
:0041EAED 83EC0C                  sub esp, 0000000C
:0041EAF0 53                      push ebx
:0041EAF1 56                      push esi
:0041EAF2 57                      push edi
:0041EAF3 894DF4                  mov dword ptr [ebp-0C], ecx
:0041EAF6 C745F800000000          mov [ebp-08], 00000000
:0041EAFD 8B45F8                  mov eax, dword ptr [ebp-08]
:0041EB00 8945FC                  mov dword ptr [ebp-04], eax
:0041EB03 E903000000              jmp 0041EB0B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EB30(U)
|
:0041EB08 FF45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EB03(U)
|
:0041EB0B 837DFC0F                cmp dword ptr [ebp-04], 0000000F
:0041EB0F 0F8320000000            jnb 0041EB35
:0041EB15 8B45FC                  mov eax, dword ptr [ebp-04]
:0041EB18 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041EB1B 33D2                    xor edx, edx
:0041EB1D 8A540818                mov dl, byte ptr [eax+ecx+18]
:0041EB21 81FAFF000000            cmp edx, 000000FF
:0041EB27 0F8403000000            je 0041EB30
:0041EB2D FF45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EB27(C)
|
:0041EB30 E9D3FFFFFF              jmp 0041EB08

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EB0F(C)
|
:0041EB35 8A45F8                  mov al, byte ptr [ebp-08]
:0041EB38 E900000000              jmp 0041EB3D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EB38(U)
|
:0041EB3D 5F                      pop edi
:0041EB3E 5E                      pop esi
:0041EB3F 5B                      pop ebx
:0041EB40 C9                      leave
:0041EB41 C3                      ret



* Referenced by a CALL at Addresses:
|:00436633   , :004367C3   
|
:0041EB42 55                      push ebp
:0041EB43 8BEC                    mov ebp, esp
:0041EB45 83EC08                  sub esp, 00000008
:0041EB48 53                      push ebx
:0041EB49 56                      push esi
:0041EB4A 57                      push edi
:0041EB4B 894DF8                  mov dword ptr [ebp-08], ecx
:0041EB4E C745FC00000000          mov [ebp-04], 00000000
:0041EB55 E903000000              jmp 0041EB5D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EB91(U)
|
:0041EB5A FF45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EB55(U)
|
:0041EB5D 837DFC0F                cmp dword ptr [ebp-04], 0000000F
:0041EB61 0F832F000000            jnb 0041EB96
:0041EB67 8B45FC                  mov eax, dword ptr [ebp-04]
:0041EB6A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041EB6D 33D2                    xor edx, edx
:0041EB6F 8A540818                mov dl, byte ptr [eax+ecx+18]
:0041EB73 81FAFF000000            cmp edx, 000000FF
:0041EB79 0F8512000000            jne 0041EB91
:0041EB7F 8A4508                  mov al, byte ptr [ebp+08]
:0041EB82 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041EB85 8B55F8                  mov edx, dword ptr [ebp-08]
:0041EB88 88441118                mov byte ptr [ecx+edx+18], al
:0041EB8C E905000000              jmp 0041EB96

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EB79(C)
|
:0041EB91 E9C4FFFFFF              jmp 0041EB5A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041EB61(C), :0041EB8C(U)
|
:0041EB96 8A45FC                  mov al, byte ptr [ebp-04]
:0041EB99 E900000000              jmp 0041EB9E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EB99(U)
|
:0041EB9E 5F                      pop edi
:0041EB9F 5E                      pop esi
:0041EBA0 5B                      pop ebx
:0041EBA1 C9                      leave
:0041EBA2 C20400                  ret 0004


:0041EBA5 55                      push ebp
:0041EBA6 8BEC                    mov ebp, esp
:0041EBA8 83EC08                  sub esp, 00000008
:0041EBAB 53                      push ebx
:0041EBAC 56                      push esi
:0041EBAD 57                      push edi
:0041EBAE 894DF8                  mov dword ptr [ebp-08], ecx
:0041EBB1 C745FC00000000          mov [ebp-04], 00000000
:0041EBB8 E903000000              jmp 0041EBC0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EBDC(U)
|
:0041EBBD FF45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EBB8(U)
|
:0041EBC0 837DFC0F                cmp dword ptr [ebp-04], 0000000F
:0041EBC4 0F8317000000            jnb 0041EBE1
:0041EBCA 8B4508                  mov eax, dword ptr [ebp+08]
:0041EBCD 8A00                    mov al, byte ptr [eax]
:0041EBCF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041EBD2 8B55F8                  mov edx, dword ptr [ebp-08]
:0041EBD5 88441118                mov byte ptr [ecx+edx+18], al
:0041EBD9 FF4508                  inc [ebp+08]
:0041EBDC E9DCFFFFFF              jmp 0041EBBD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EBC4(C)
|
:0041EBE1 E900000000              jmp 0041EBE6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EBE1(U)
|
:0041EBE6 5F                      pop edi
:0041EBE7 5E                      pop esi
:0041EBE8 5B                      pop ebx
:0041EBE9 C9                      leave
:0041EBEA C20400                  ret 0004


:0041EBED 55                      push ebp
:0041EBEE 8BEC                    mov ebp, esp
:0041EBF0 83EC08                  sub esp, 00000008
:0041EBF3 53                      push ebx
:0041EBF4 56                      push esi
:0041EBF5 57                      push edi
:0041EBF6 894DF8                  mov dword ptr [ebp-08], ecx
:0041EBF9 C745FC00000000          mov [ebp-04], 00000000
:0041EC00 E903000000              jmp 0041EC08

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EC24(U)
|
:0041EC05 FF45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EC00(U)
|
:0041EC08 837DFC0F                cmp dword ptr [ebp-04], 0000000F
:0041EC0C 0F8317000000            jnb 0041EC29
:0041EC12 8B45FC                  mov eax, dword ptr [ebp-04]
:0041EC15 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041EC18 8A440818                mov al, byte ptr [eax+ecx+18]
:0041EC1C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041EC1F 8801                    mov byte ptr [ecx], al
:0041EC21 FF4508                  inc [ebp+08]
:0041EC24 E9DCFFFFFF              jmp 0041EC05

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EC0C(C)
|
:0041EC29 E900000000              jmp 0041EC2E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EC29(U)
|
:0041EC2E 5F                      pop edi
:0041EC2F 5E                      pop esi
:0041EC30 5B                      pop ebx
:0041EC31 C9                      leave
:0041EC32 C20400                  ret 0004



* Referenced by a CALL at Address:
|:004316CC   
|
:0041EC35 55                      push ebp
:0041EC36 8BEC                    mov ebp, esp
:0041EC38 83EC04                  sub esp, 00000004
:0041EC3B 53                      push ebx
:0041EC3C 56                      push esi
:0041EC3D 57                      push edi
:0041EC3E B9D0A64600              mov ecx, 0046A6D0
:0041EC43 E838070000              call 0041F380
:0041EC48 8945FC                  mov dword ptr [ebp-04], eax
:0041EC4B 8B4508                  mov eax, dword ptr [ebp+08]
:0041EC4E 50                      push eax
:0041EC4F 8B45FC                  mov eax, dword ptr [ebp-04]
:0041EC52 50                      push eax
:0041EC53 E873860200              call 004472CB
:0041EC58 83C408                  add esp, 00000008
:0041EC5B 8945FC                  mov dword ptr [ebp-04], eax
:0041EC5E 8B45FC                  mov eax, dword ptr [ebp-04]
:0041EC61 50                      push eax
:0041EC62 B9D0A64600              mov ecx, 0046A6D0
:0041EC67 E834CDFEFF              call 0040B9A0
:0041EC6C E900000000              jmp 0041EC71

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EC6C(U)
|
:0041EC71 5F                      pop edi
:0041EC72 5E                      pop esi
:0041EC73 5B                      pop ebx
:0041EC74 C9                      leave
:0041EC75 C3                      ret



* Referenced by a CALL at Address:
|:004316E5   
|
:0041EC76 55                      push ebp
:0041EC77 8BEC                    mov ebp, esp
:0041EC79 83EC04                  sub esp, 00000004
:0041EC7C 53                      push ebx
:0041EC7D 56                      push esi
:0041EC7E 57                      push edi
:0041EC7F B9D0A64600              mov ecx, 0046A6D0
:0041EC84 E8F7060000              call 0041F380
:0041EC89 8945FC                  mov dword ptr [ebp-04], eax
:0041EC8C 68C8000000              push 000000C8
:0041EC91 8B4508                  mov eax, dword ptr [ebp+08]
:0041EC94 50                      push eax
:0041EC95 8B45FC                  mov eax, dword ptr [ebp-04]
:0041EC98 50                      push eax
:0041EC99 E818860200              call 004472B6
:0041EC9E 83C40C                  add esp, 0000000C
:0041ECA1 8945FC                  mov dword ptr [ebp-04], eax
:0041ECA4 8B45FC                  mov eax, dword ptr [ebp-04]
:0041ECA7 50                      push eax
:0041ECA8 B9D0A64600              mov ecx, 0046A6D0
:0041ECAD E8EECCFEFF              call 0040B9A0
:0041ECB2 E900000000              jmp 0041ECB7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041ECB2(U)
|
:0041ECB7 5F                      pop edi
:0041ECB8 5E                      pop esi
:0041ECB9 5B                      pop ebx
:0041ECBA C9                      leave
:0041ECBB C3                      ret



* Referenced by a CALL at Address:
|:004316FE   
|
:0041ECBC 55                      push ebp
:0041ECBD 8BEC                    mov ebp, esp
:0041ECBF 83EC04                  sub esp, 00000004
:0041ECC2 53                      push ebx
:0041ECC3 56                      push esi
:0041ECC4 57                      push edi
:0041ECC5 B9D0A64600              mov ecx, 0046A6D0
:0041ECCA E8D1060000              call 0041F3A0
:0041ECCF 8945FC                  mov dword ptr [ebp-04], eax
:0041ECD2 6850C30000              push 0000C350
:0041ECD7 8B4508                  mov eax, dword ptr [ebp+08]
:0041ECDA 50                      push eax
:0041ECDB 8B45FC                  mov eax, dword ptr [ebp-04]
:0041ECDE 50                      push eax
:0041ECDF E8D2850200              call 004472B6
:0041ECE4 83C40C                  add esp, 0000000C
:0041ECE7 8945FC                  mov dword ptr [ebp-04], eax
:0041ECEA 8B45FC                  mov eax, dword ptr [ebp-04]
:0041ECED 50                      push eax
:0041ECEE B9D0A64600              mov ecx, 0046A6D0
:0041ECF3 E8D8060000              call 0041F3D0
:0041ECF8 E900000000              jmp 0041ECFD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041ECF8(U)
|
:0041ECFD 5F                      pop edi
:0041ECFE 5E                      pop esi
:0041ECFF 5B                      pop ebx
:0041ED00 C9                      leave
:0041ED01 C3                      ret



* Referenced by a CALL at Address:
|:0043170B   
|
:0041ED02 55                      push ebp
:0041ED03 8BEC                    mov ebp, esp
:0041ED05 53                      push ebx
:0041ED06 56                      push esi
:0041ED07 57                      push edi
:0041ED08 6A00                    push 00000000
:0041ED0A B9D0A64600              mov ecx, 0046A6D0
:0041ED0F E8BC060000              call 0041F3D0
:0041ED14 E900000000              jmp 0041ED19

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041ED14(U)
|
:0041ED19 5F                      pop edi
:0041ED1A 5E                      pop esi
:0041ED1B 5B                      pop ebx
:0041ED1C C9                      leave
:0041ED1D C3                      ret



* Referenced by a CALL at Address:
|:00409B46   
|
:0041ED1E 55                      push ebp
:0041ED1F 8BEC                    mov ebp, esp
:0041ED21 83EC04                  sub esp, 00000004
:0041ED24 53                      push ebx
:0041ED25 56                      push esi
:0041ED26 57                      push edi
:0041ED27 894DFC                  mov dword ptr [ebp-04], ecx
:0041ED2A 8B4508                  mov eax, dword ptr [ebp+08]
:0041ED2D 8A00                    mov al, byte ptr [eax]
:0041ED2F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041ED32 8801                    mov byte ptr [ecx], al
:0041ED34 FF4508                  inc [ebp+08]
:0041ED37 8B4508                  mov eax, dword ptr [ebp+08]
:0041ED3A 8A00                    mov al, byte ptr [eax]
:0041ED3C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041ED3F 884101                  mov byte ptr [ecx+01], al
:0041ED42 FF4508                  inc [ebp+08]
:0041ED45 8B4508                  mov eax, dword ptr [ebp+08]
:0041ED48 8A00                    mov al, byte ptr [eax]
:0041ED4A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041ED4D 884102                  mov byte ptr [ecx+02], al
:0041ED50 FF4508                  inc [ebp+08]
:0041ED53 8B4508                  mov eax, dword ptr [ebp+08]
:0041ED56 8A00                    mov al, byte ptr [eax]
:0041ED58 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041ED5B 884103                  mov byte ptr [ecx+03], al
:0041ED5E FF4508                  inc [ebp+08]
:0041ED61 8B4508                  mov eax, dword ptr [ebp+08]
:0041ED64 8A00                    mov al, byte ptr [eax]
:0041ED66 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041ED69 884104                  mov byte ptr [ecx+04], al
:0041ED6C FF4508                  inc [ebp+08]
:0041ED6F 8B4508                  mov eax, dword ptr [ebp+08]
:0041ED72 8A00                    mov al, byte ptr [eax]
:0041ED74 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041ED77 884105                  mov byte ptr [ecx+05], al
:0041ED7A FF4508                  inc [ebp+08]
:0041ED7D 8B4508                  mov eax, dword ptr [ebp+08]
:0041ED80 8A00                    mov al, byte ptr [eax]
:0041ED82 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041ED85 884106                  mov byte ptr [ecx+06], al
:0041ED88 FF4508                  inc [ebp+08]
:0041ED8B 8B4508                  mov eax, dword ptr [ebp+08]
:0041ED8E 8A00                    mov al, byte ptr [eax]
:0041ED90 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041ED93 884107                  mov byte ptr [ecx+07], al
:0041ED96 FF4508                  inc [ebp+08]
:0041ED99 8B4508                  mov eax, dword ptr [ebp+08]
:0041ED9C 8A00                    mov al, byte ptr [eax]
:0041ED9E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041EDA1 884108                  mov byte ptr [ecx+08], al
:0041EDA4 FF4508                  inc [ebp+08]
:0041EDA7 8B45FC                  mov eax, dword ptr [ebp-04]
:0041EDAA C6400900                mov [eax+09], 00
:0041EDAE E900000000              jmp 0041EDB3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EDAE(U)
|
:0041EDB3 5F                      pop edi
:0041EDB4 5E                      pop esi
:0041EDB5 5B                      pop ebx
:0041EDB6 C9                      leave
:0041EDB7 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0040A05E   , :0040B526   
|
:0041EDBA 55                      push ebp
:0041EDBB 8BEC                    mov ebp, esp
:0041EDBD 83EC04                  sub esp, 00000004
:0041EDC0 53                      push ebx
:0041EDC1 56                      push esi
:0041EDC2 57                      push edi
:0041EDC3 894DFC                  mov dword ptr [ebp-04], ecx
:0041EDC6 8B45FC                  mov eax, dword ptr [ebp-04]
:0041EDC9 8A00                    mov al, byte ptr [eax]
:0041EDCB 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041EDCE 8801                    mov byte ptr [ecx], al
:0041EDD0 FF4508                  inc [ebp+08]
:0041EDD3 8B45FC                  mov eax, dword ptr [ebp-04]
:0041EDD6 8A4001                  mov al, byte ptr [eax+01]
:0041EDD9 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041EDDC 8801                    mov byte ptr [ecx], al
:0041EDDE FF4508                  inc [ebp+08]
:0041EDE1 8B45FC                  mov eax, dword ptr [ebp-04]
:0041EDE4 8A4002                  mov al, byte ptr [eax+02]
:0041EDE7 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041EDEA 8801                    mov byte ptr [ecx], al
:0041EDEC FF4508                  inc [ebp+08]
:0041EDEF 8B45FC                  mov eax, dword ptr [ebp-04]
:0041EDF2 8A4003                  mov al, byte ptr [eax+03]
:0041EDF5 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041EDF8 8801                    mov byte ptr [ecx], al
:0041EDFA FF4508                  inc [ebp+08]
:0041EDFD 8B45FC                  mov eax, dword ptr [ebp-04]
:0041EE00 8A4004                  mov al, byte ptr [eax+04]
:0041EE03 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041EE06 8801                    mov byte ptr [ecx], al
:0041EE08 FF4508                  inc [ebp+08]
:0041EE0B 8B45FC                  mov eax, dword ptr [ebp-04]
:0041EE0E 8A4005                  mov al, byte ptr [eax+05]
:0041EE11 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041EE14 8801                    mov byte ptr [ecx], al
:0041EE16 FF4508                  inc [ebp+08]
:0041EE19 8B45FC                  mov eax, dword ptr [ebp-04]
:0041EE1C 8A4006                  mov al, byte ptr [eax+06]
:0041EE1F 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041EE22 8801                    mov byte ptr [ecx], al
:0041EE24 FF4508                  inc [ebp+08]
:0041EE27 8B45FC                  mov eax, dword ptr [ebp-04]
:0041EE2A 8A4007                  mov al, byte ptr [eax+07]
:0041EE2D 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041EE30 8801                    mov byte ptr [ecx], al
:0041EE32 FF4508                  inc [ebp+08]
:0041EE35 8B45FC                  mov eax, dword ptr [ebp-04]
:0041EE38 8A4008                  mov al, byte ptr [eax+08]
:0041EE3B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041EE3E 8801                    mov byte ptr [ecx], al
:0041EE40 FF4508                  inc [ebp+08]
:0041EE43 8B4508                  mov eax, dword ptr [ebp+08]
:0041EE46 E900000000              jmp 0041EE4B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EE46(U)
|
:0041EE4B 5F                      pop edi
:0041EE4C 5E                      pop esi
:0041EE4D 5B                      pop ebx
:0041EE4E C9                      leave
:0041EE4F C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0040122B   , :0040F7FE   
|
:0041EE52 55                      push ebp
:0041EE53 8BEC                    mov ebp, esp
:0041EE55 53                      push ebx
:0041EE56 56                      push esi
:0041EE57 57                      push edi
:0041EE58 33C0                    xor eax, eax
:0041EE5A 8A4508                  mov al, byte ptr [ebp+08]
:0041EE5D 83F840                  cmp eax, 00000040
:0041EE60 0F8D14000000            jnl 0041EE7A
:0041EE66 33C0                    xor eax, eax
:0041EE68 8A4508                  mov al, byte ptr [ebp+08]
:0041EE6B 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041EE6E 8D048500A74600          lea eax, dword ptr [4*eax+0046A700]
:0041EE75 E907000000              jmp 0041EE81

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EE60(C)
|
:0041EE7A 33C0                    xor eax, eax
:0041EE7C E900000000              jmp 0041EE81

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041EE75(U), :0041EE7C(U)
|
:0041EE81 5F                      pop edi
:0041EE82 5E                      pop esi
:0041EE83 5B                      pop ebx
:0041EE84 C9                      leave
:0041EE85 C3                      ret



* Referenced by a CALL at Addresses:
|:00409FCE   , :0040B1F1   , :0040F5BE   , :0040F7C5   , :0040FA01   
|
:0041EE86 55                      push ebp
:0041EE87 8BEC                    mov ebp, esp
:0041EE89 53                      push ebx
:0041EE8A 56                      push esi
:0041EE8B 57                      push edi
:0041EE8C 837D0840                cmp dword ptr [ebp+08], 00000040
:0041EE90 0F8207000000            jb 0041EE9D
:0041EE96 33C0                    xor eax, eax
:0041EE98 E917000000              jmp 0041EEB4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EE90(C)
|
:0041EE9D 8B4508                  mov eax, dword ptr [ebp+08]
:0041EEA0 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041EEA3 8D0C8500A74600          lea ecx, dword ptr [4*eax+0046A700]
:0041EEAA E8612AFEFF              call 00401910
:0041EEAF E900000000              jmp 0041EEB4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041EE98(U), :0041EEAF(U)
|
:0041EEB4 5F                      pop edi
:0041EEB5 5E                      pop esi
:0041EEB6 5B                      pop ebx
:0041EEB7 C9                      leave
:0041EEB8 C3                      ret


:0041EEB9 55                      push ebp
:0041EEBA 8BEC                    mov ebp, esp
:0041EEBC 53                      push ebx
:0041EEBD 56                      push esi
:0041EEBE 57                      push edi
:0041EEBF 8B4508                  mov eax, dword ptr [ebp+08]
:0041EEC2 2D00A74600              sub eax, 0046A700
:0041EEC7 B90C000000              mov ecx, 0000000C
:0041EECC 99                      cdq
:0041EECD F7F9                    idiv ecx
:0041EECF E900000000              jmp 0041EED4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EECF(U)
|
:0041EED4 5F                      pop edi
:0041EED5 5E                      pop esi
:0041EED6 5B                      pop ebx
:0041EED7 C9                      leave
:0041EED8 C3                      ret



* Referenced by a CALL at Addresses:
|:00409D83   , :00409E10   , :00410B8A   , :004110F5   , :00411189   
|:00415CFA   , :004165A3   , :0041EFA8   , :0041F024   , :00432235   
|:00432612   , :00433968   , :004339A8   , :00433EBB   , :0043571C   
|:0043638F   
|
:0041EED9 55                      push ebp
:0041EEDA 8BEC                    mov ebp, esp
:0041EEDC 53                      push ebx
:0041EEDD 56                      push esi
:0041EEDE 57                      push edi
:0041EEDF 817D0800020000          cmp dword ptr [ebp+08], 00000200
:0041EEE6 0F8314000000            jnb 0041EF00
:0041EEEC 8B4508                  mov eax, dword ptr [ebp+08]
:0041EEEF 8D0440                  lea eax, dword ptr [eax+2*eax]
:0041EEF2 03C0                    add eax, eax
:0041EEF4 8D84C0E8564500          lea eax, dword ptr [eax+8*eax+004556E8]
:0041EEFB E907000000              jmp 0041EF07

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EEE6(C)
|
:0041EF00 33C0                    xor eax, eax
:0041EF02 E900000000              jmp 0041EF07

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041EEFB(U), :0041EF02(U)
|
:0041EF07 5F                      pop edi
:0041EF08 5E                      pop esi
:0041EF09 5B                      pop ebx
:0041EF0A C9                      leave
:0041EF0B C3                      ret



* Referenced by a CALL at Addresses:
|:00408662   , :00410722   , :0042A4BD   , :0043EF90   , :0043F3AB   
|:0043F488   
|
:0041EF0C 55                      push ebp
:0041EF0D 8BEC                    mov ebp, esp
:0041EF0F 53                      push ebx
:0041EF10 56                      push esi
:0041EF11 57                      push edi
:0041EF12 8B4508                  mov eax, dword ptr [ebp+08]
:0041EF15 2DE8564500              sub eax, 004556E8
:0041EF1A B936000000              mov ecx, 00000036
:0041EF1F 99                      cdq
:0041EF20 F7F9                    idiv ecx
:0041EF22 E900000000              jmp 0041EF27

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EF22(U)
|
:0041EF27 5F                      pop edi
:0041EF28 5E                      pop esi
:0041EF29 5B                      pop ebx
:0041EF2A C9                      leave
:0041EF2B C3                      ret



* Referenced by a CALL at Addresses:
|:0041110E   , :004111A6   , :0041EFBC   
|
:0041EF2C 55                      push ebp
:0041EF2D 8BEC                    mov ebp, esp
:0041EF2F 53                      push ebx
:0041EF30 56                      push esi
:0041EF31 57                      push edi
:0041EF32 817D0800010000          cmp dword ptr [ebp+08], 00000100
:0041EF39 0F8311000000            jnb 0041EF50
:0041EF3F 8B4508                  mov eax, dword ptr [ebp+08]
:0041EF42 C1E004                  shl eax, 04
:0041EF45 8D80E8C24500            lea eax, dword ptr [eax+0045C2E8]
:0041EF4B E907000000              jmp 0041EF57

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EF39(C)
|
:0041EF50 33C0                    xor eax, eax
:0041EF52 E900000000              jmp 0041EF57

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041EF4B(U), :0041EF52(U)
|
:0041EF57 5F                      pop edi
:0041EF58 5E                      pop esi
:0041EF59 5B                      pop ebx
:0041EF5A C9                      leave
:0041EF5B C3                      ret


:0041EF5C 55                      push ebp
:0041EF5D 8BEC                    mov ebp, esp
:0041EF5F 53                      push ebx
:0041EF60 56                      push esi
:0041EF61 57                      push edi
:0041EF62 8B4508                  mov eax, dword ptr [ebp+08]
:0041EF65 2DE8C24500              sub eax, 0045C2E8
:0041EF6A C1F804                  sar eax, 04
:0041EF6D E900000000              jmp 0041EF72

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EF6D(U)
|
:0041EF72 5F                      pop edi
:0041EF73 5E                      pop esi
:0041EF74 5B                      pop ebx
:0041EF75 C9                      leave
:0041EF76 C3                      ret



* Referenced by a CALL at Addresses:
|:00401781   , :0040CEC2   , :00436D21   , :00436D66   
|
:0041EF77 55                      push ebp
:0041EF78 8BEC                    mov ebp, esp
:0041EF7A 83EC0C                  sub esp, 0000000C
:0041EF7D 53                      push ebx
:0041EF7E 56                      push esi
:0041EF7F 57                      push edi
:0041EF80 8B4508                  mov eax, dword ptr [ebp+08]
:0041EF83 2500FE0000              and eax, 0000FE00
:0041EF88 8945F8                  mov dword ptr [ebp-08], eax
:0041EF8B 816508FF01FFFF          and dword ptr [ebp+08], FFFF01FF
:0041EF92 C745FC00000000          mov [ebp-04], 00000000
:0041EF99 8B45F8                  mov eax, dword ptr [ebp-08]
:0041EF9C 8945F4                  mov dword ptr [ebp-0C], eax
:0041EF9F E92D000000              jmp 0041EFD1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EFD8(C)
|
:0041EFA4 8B4508                  mov eax, dword ptr [ebp+08]
:0041EFA7 50                      push eax
:0041EFA8 E82CFFFFFF              call 0041EED9
:0041EFAD 83C404                  add esp, 00000004
:0041EFB0 8945FC                  mov dword ptr [ebp-04], eax
:0041EFB3 E938000000              jmp 0041EFF0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EFE5(C)
|
:0041EFB8 8B4508                  mov eax, dword ptr [ebp+08]
:0041EFBB 50                      push eax
:0041EFBC E86BFFFFFF              call 0041EF2C
:0041EFC1 83C404                  add esp, 00000004
:0041EFC4 8945FC                  mov dword ptr [ebp-04], eax
:0041EFC7 E924000000              jmp 0041EFF0
:0041EFCC E91F000000              jmp 0041EFF0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EF9F(U)
|
:0041EFD1 817DF400020000          cmp dword ptr [ebp-0C], 00000200
:0041EFD8 0F84C6FFFFFF            je 0041EFA4
:0041EFDE 817DF400040000          cmp dword ptr [ebp-0C], 00000400
:0041EFE5 0F84CDFFFFFF            je 0041EFB8
:0041EFEB E900000000              jmp 0041EFF0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041EFB3(U), :0041EFC7(U), :0041EFCC(U), :0041EFEB(U)
|
:0041EFF0 8B45FC                  mov eax, dword ptr [ebp-04]
:0041EFF3 E900000000              jmp 0041EFF8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EFF3(U)
|
:0041EFF8 5F                      pop edi
:0041EFF9 5E                      pop esi
:0041EFFA 5B                      pop ebx
:0041EFFB C9                      leave
:0041EFFC C3                      ret



* Referenced by a CALL at Address:
|:00431366   
|
:0041EFFD 55                      push ebp
:0041EFFE 8BEC                    mov ebp, esp
:0041F000 53                      push ebx
:0041F001 56                      push esi
:0041F002 57                      push edi
:0041F003 F6450902                test [ebp+09], 02
:0041F007 0F850A000000            jne 0041F017
:0041F00D B8FFFFFFFF              mov eax, FFFFFFFF
:0041F012 E923000000              jmp 0041F03A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F007(C)
|
:0041F017 8B450C                  mov eax, dword ptr [ebp+0C]
:0041F01A 50                      push eax
:0041F01B 8B4508                  mov eax, dword ptr [ebp+08]
:0041F01E 25FF01FFFF              and eax, FFFF01FF
:0041F023 50                      push eax
:0041F024 E8B0FEFFFF              call 0041EED9
:0041F029 83C404                  add esp, 00000004
:0041F02C 8BC8                    mov ecx, eax
:0041F02E E8CD030000              call 0041F400
:0041F033 33C0                    xor eax, eax
:0041F035 E900000000              jmp 0041F03A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041F012(U), :0041F035(U)
|
:0041F03A 5F                      pop edi
:0041F03B 5E                      pop esi
:0041F03C 5B                      pop ebx
:0041F03D C9                      leave
:0041F03E C3                      ret



* Referenced by a CALL at Addresses:
|:00431721   , :004364FC   , :004366BF   
|
:0041F03F 55                      push ebp
:0041F040 8BEC                    mov ebp, esp
:0041F042 83EC04                  sub esp, 00000004
:0041F045 53                      push ebx
:0041F046 56                      push esi
:0041F047 57                      push edi
:0041F048 B9D0A64600              mov ecx, 0046A6D0
:0041F04D E8EE030000              call 0041F440
:0041F052 8945FC                  mov dword ptr [ebp-04], eax
:0041F055 6850C30000              push 0000C350
:0041F05A 8B4508                  mov eax, dword ptr [ebp+08]
:0041F05D 50                      push eax
:0041F05E 8B45FC                  mov eax, dword ptr [ebp-04]
:0041F061 50                      push eax
:0041F062 E84F820200              call 004472B6
:0041F067 83C40C                  add esp, 0000000C
:0041F06A 8945FC                  mov dword ptr [ebp-04], eax
:0041F06D 8B45FC                  mov eax, dword ptr [ebp-04]
:0041F070 50                      push eax
:0041F071 B9D0A64600              mov ecx, 0046A6D0
:0041F076 E84595FFFF              call 004185C0
:0041F07B 33C0                    xor eax, eax
:0041F07D E900000000              jmp 0041F082

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F07D(U)
|
:0041F082 5F                      pop edi
:0041F083 5E                      pop esi
:0041F084 5B                      pop ebx
:0041F085 C9                      leave
:0041F086 C3                      ret



* Referenced by a CALL at Addresses:
|:0040F1F6   , :0041F115   
|
:0041F087 55                      push ebp
:0041F088 8BEC                    mov ebp, esp
:0041F08A 53                      push ebx
:0041F08B 56                      push esi
:0041F08C 57                      push edi
:0041F08D B9D0A64600              mov ecx, 0046A6D0
:0041F092 E849CBFEFF              call 0040BBE0
:0041F097 33C9                    xor ecx, ecx
:0041F099 8AC8                    mov cl, al
:0041F09B 33C0                    xor eax, eax
:0041F09D 8A81982C4500            mov al, byte ptr [ecx+00452C98]
:0041F0A3 E900000000              jmp 0041F0A8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F0A3(U)
|
:0041F0A8 5F                      pop edi
:0041F0A9 5E                      pop esi
:0041F0AA 5B                      pop ebx
:0041F0AB C9                      leave
:0041F0AC C3                      ret



* Referenced by a CALL at Address:
|:00409CFA   
|
:0041F0AD 55                      push ebp
:0041F0AE 8BEC                    mov ebp, esp
:0041F0B0 83EC14                  sub esp, 00000014
:0041F0B3 53                      push ebx
:0041F0B4 56                      push esi
:0041F0B5 57                      push edi
:0041F0B6 894DEC                  mov dword ptr [ebp-14], ecx
:0041F0B9 8B4508                  mov eax, dword ptr [ebp+08]
:0041F0BC 8BC8                    mov ecx, eax
:0041F0BE 8D0480                  lea eax, dword ptr [eax+4*eax]
:0041F0C1 8D0441                  lea eax, dword ptr [ecx+2*eax]
:0041F0C4 0520FD4400              add eax, 0044FD20
:0041F0C9 8945F4                  mov dword ptr [ebp-0C], eax
:0041F0CC 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041F0CF 8945FC                  mov dword ptr [ebp-04], eax
:0041F0D2 8B45EC                  mov eax, dword ptr [ebp-14]
:0041F0D5 8945F8                  mov dword ptr [ebp-08], eax
:0041F0D8 C745F000000000          mov [ebp-10], 00000000
:0041F0DF E903000000              jmp 0041F0E7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F101(U)
|
:0041F0E4 FF45F0                  inc [ebp-10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F0DF(U)
|
:0041F0E7 837DF008                cmp dword ptr [ebp-10], 00000008
:0041F0EB 0F8315000000            jnb 0041F106
:0041F0F1 8B45FC                  mov eax, dword ptr [ebp-04]
:0041F0F4 8A00                    mov al, byte ptr [eax]
:0041F0F6 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041F0F9 8801                    mov byte ptr [ecx], al
:0041F0FB FF45FC                  inc [ebp-04]
:0041F0FE FF45F8                  inc [ebp-08]
:0041F101 E9DEFFFFFF              jmp 0041F0E4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F0EB(C)
|
:0041F106 8B45F8                  mov eax, dword ptr [ebp-08]
:0041F109 C60000                  mov byte ptr [eax], 00
:0041F10C 8A4508                  mov al, byte ptr [ebp+08]
:0041F10F 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041F112 88410B                  mov byte ptr [ecx+0B], al
:0041F115 E86DFFFFFF              call 0041F087
:0041F11A 85C0                    test eax, eax
:0041F11C 0F8561000000            jne 0041F183
:0041F122 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041F125 33C9                    xor ecx, ecx
:0041F127 8A4809                  mov cl, byte ptr [eax+09]
:0041F12A 81F9FF000000            cmp ecx, 000000FF
:0041F130 0F8411000000            je 0041F147
:0041F136 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041F139 33C9                    xor ecx, ecx
:0041F13B 8A4809                  mov cl, byte ptr [eax+09]
:0041F13E 83F917                  cmp ecx, 00000017
:0041F141 0F8D1A000000            jnl 0041F161

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F130(C)
|
:0041F147 8B45EC                  mov eax, dword ptr [ebp-14]
:0041F14A C64009FF                mov [eax+09], FF
:0041F14E 8B45EC                  mov eax, dword ptr [ebp-14]
:0041F151 C6400AFF                mov [eax+0A], FF
:0041F155 8B45EC                  mov eax, dword ptr [ebp-14]
:0041F158 C6400BFF                mov [eax+0B], FF
:0041F15C E91D000000              jmp 0041F17E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F141(C)
|
:0041F161 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041F164 33C9                    xor ecx, ecx
:0041F166 8A4809                  mov cl, byte ptr [eax+09]
:0041F169 83E914                  sub ecx, 00000014
:0041F16C 8B45EC                  mov eax, dword ptr [ebp-14]
:0041F16F 884809                  mov byte ptr [eax+09], cl
:0041F172 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041F175 8A400A                  mov al, byte ptr [eax+0A]
:0041F178 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041F17B 88410A                  mov byte ptr [ecx+0A], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F15C(U)
|
:0041F17E E943000000              jmp 0041F1C6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F11C(C)
|
:0041F183 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041F186 33C9                    xor ecx, ecx
:0041F188 8A4809                  mov cl, byte ptr [eax+09]
:0041F18B 83F950                  cmp ecx, 00000050
:0041F18E 0F8E1A000000            jle 0041F1AE
:0041F194 8B45EC                  mov eax, dword ptr [ebp-14]
:0041F197 C64009FF                mov [eax+09], FF
:0041F19B 8B45EC                  mov eax, dword ptr [ebp-14]
:0041F19E C6400AFF                mov [eax+0A], FF
:0041F1A2 8B45EC                  mov eax, dword ptr [ebp-14]
:0041F1A5 C6400BFF                mov [eax+0B], FF
:0041F1A9 E918000000              jmp 0041F1C6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F18E(C)
|
:0041F1AE 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041F1B1 8A4009                  mov al, byte ptr [eax+09]
:0041F1B4 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041F1B7 884109                  mov byte ptr [ecx+09], al
:0041F1BA 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041F1BD 8A400A                  mov al, byte ptr [eax+0A]
:0041F1C0 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041F1C3 88410A                  mov byte ptr [ecx+0A], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041F17E(U), :0041F1A9(U)
|
:0041F1C6 E900000000              jmp 0041F1CB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F1C6(U)
|
:0041F1CB 5F                      pop edi
:0041F1CC 5E                      pop esi
:0041F1CD 5B                      pop ebx
:0041F1CE C9                      leave
:0041F1CF C20400                  ret 0004


:0041F1D2 CC                      int 03
:0041F1D3 CC                      int 03
:0041F1D4 CC                      int 03
:0041F1D5 CC                      int 03
:0041F1D6 CC                      int 03
:0041F1D7 CC                      int 03
:0041F1D8 CC                      int 03
:0041F1D9 CC                      int 03
:0041F1DA CC                      int 03
:0041F1DB CC                      int 03
:0041F1DC CC                      int 03
:0041F1DD CC                      int 03
:0041F1DE CC                      int 03
:0041F1DF CC                      int 03
:0041F1E0 55                      push ebp
:0041F1E1 8BEC                    mov ebp, esp
:0041F1E3 83EC04                  sub esp, 00000004
:0041F1E6 53                      push ebx
:0041F1E7 56                      push esi
:0041F1E8 57                      push edi
:0041F1E9 894DFC                  mov dword ptr [ebp-04], ecx
:0041F1EC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041F1EF E87C26FEFF              call 00401870
:0041F1F4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041F1F7 83C102                  add ecx, 00000002
:0041F1FA E87126FEFF              call 00401870
:0041F1FF 8B45FC                  mov eax, dword ptr [ebp-04]
:0041F202 C64005FF                mov [eax+05], FF
:0041F206 8B45FC                  mov eax, dword ptr [ebp-04]
:0041F209 C6400700                mov [eax+07], 00
:0041F20D 8B45FC                  mov eax, dword ptr [ebp-04]
:0041F210 C6400900                mov [eax+09], 00
:0041F214 E900000000              jmp 0041F219

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F214(U)
|
:0041F219 8B45FC                  mov eax, dword ptr [ebp-04]
:0041F21C 5F                      pop edi
:0041F21D 5E                      pop esi
:0041F21E 5B                      pop ebx
:0041F21F C9                      leave
:0041F220 C3                      ret


:0041F221 CC                      int 03
:0041F222 CC                      int 03
:0041F223 CC                      int 03
:0041F224 CC                      int 03
:0041F225 CC                      int 03
:0041F226 CC                      int 03
:0041F227 CC                      int 03
:0041F228 CC                      int 03
:0041F229 CC                      int 03
:0041F22A CC                      int 03
:0041F22B CC                      int 03
:0041F22C CC                      int 03
:0041F22D CC                      int 03
:0041F22E CC                      int 03
:0041F22F CC                      int 03
:0041F230 55                      push ebp
:0041F231 8BEC                    mov ebp, esp
:0041F233 83EC04                  sub esp, 00000004
:0041F236 53                      push ebx
:0041F237 56                      push esi
:0041F238 57                      push edi
:0041F239 894DFC                  mov dword ptr [ebp-04], ecx
:0041F23C E900000000              jmp 0041F241

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F23C(U)
|
:0041F241 5F                      pop edi
:0041F242 5E                      pop esi
:0041F243 5B                      pop ebx
:0041F244 C9                      leave
:0041F245 C3                      ret


:0041F246 CC                      int 03
:0041F247 CC                      int 03
:0041F248 CC                      int 03
:0041F249 CC                      int 03
:0041F24A CC                      int 03
:0041F24B CC                      int 03
:0041F24C CC                      int 03
:0041F24D CC                      int 03
:0041F24E CC                      int 03
:0041F24F CC                      int 03

* Referenced by a CALL at Address:
|:0041E3F7   
|
:0041F250 55                      push ebp
:0041F251 8BEC                    mov ebp, esp
:0041F253 83EC04                  sub esp, 00000004
:0041F256 53                      push ebx
:0041F257 56                      push esi
:0041F258 57                      push edi
:0041F259 894DFC                  mov dword ptr [ebp-04], ecx
:0041F25C 8B45FC                  mov eax, dword ptr [ebp-04]
:0041F25F C7400464000000          mov [eax+04], 00000064
:0041F266 8B45FC                  mov eax, dword ptr [ebp-04]
:0041F269 C6401701                mov [eax+17], 01
:0041F26D 8B45FC                  mov eax, dword ptr [ebp-04]
:0041F270 66C7400A0100            mov [eax+0A], 0001
:0041F276 8B45FC                  mov eax, dword ptr [ebp-04]
:0041F279 66C7400C0000            mov [eax+0C], 0000
:0041F27F 8B45FC                  mov eax, dword ptr [ebp-04]
:0041F282 C6401502                mov [eax+15], 02
:0041F286 8B45FC                  mov eax, dword ptr [ebp-04]
:0041F289 C6401600                mov [eax+16], 00
:0041F28D 8B45FC                  mov eax, dword ptr [ebp-04]
:0041F290 66C740080000            mov [eax+08], 0000
:0041F296 8B45FC                  mov eax, dword ptr [ebp-04]
:0041F299 66C740100100            mov [eax+10], 0001
:0041F29F 8B45FC                  mov eax, dword ptr [ebp-04]
:0041F2A2 C6401304                mov [eax+13], 04
:0041F2A6 8B45FC                  mov eax, dword ptr [ebp-04]
:0041F2A9 C64012FF                mov [eax+12], FF
:0041F2AD E900000000              jmp 0041F2B2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F2AD(U)
|
:0041F2B2 8B45FC                  mov eax, dword ptr [ebp-04]
:0041F2B5 5F                      pop edi
:0041F2B6 5E                      pop esi
:0041F2B7 5B                      pop ebx
:0041F2B8 C9                      leave
:0041F2B9 C3                      ret


:0041F2BA CC                      int 03
:0041F2BB CC                      int 03
:0041F2BC CC                      int 03
:0041F2BD CC                      int 03
:0041F2BE CC                      int 03
:0041F2BF CC                      int 03

* Referenced by a CALL at Address:
|:0041E42E   
|
:0041F2C0 55                      push ebp
:0041F2C1 8BEC                    mov ebp, esp
:0041F2C3 83EC04                  sub esp, 00000004
:0041F2C6 53                      push ebx
:0041F2C7 56                      push esi
:0041F2C8 57                      push edi
:0041F2C9 894DFC                  mov dword ptr [ebp-04], ecx
:0041F2CC E900000000              jmp 0041F2D1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F2CC(U)
|
:0041F2D1 5F                      pop edi
:0041F2D2 5E                      pop esi
:0041F2D3 5B                      pop ebx
:0041F2D4 C9                      leave
:0041F2D5 C3                      ret


:0041F2D6 CC                      int 03
:0041F2D7 CC                      int 03
:0041F2D8 CC                      int 03
:0041F2D9 CC                      int 03
:0041F2DA CC                      int 03
:0041F2DB CC                      int 03
:0041F2DC CC                      int 03
:0041F2DD CC                      int 03
:0041F2DE CC                      int 03
:0041F2DF CC                      int 03
:0041F2E0 55                      push ebp
:0041F2E1 8BEC                    mov ebp, esp
:0041F2E3 83EC04                  sub esp, 00000004
:0041F2E6 53                      push ebx
:0041F2E7 56                      push esi
:0041F2E8 57                      push edi
:0041F2E9 894DFC                  mov dword ptr [ebp-04], ecx
:0041F2EC 8B45FC                  mov eax, dword ptr [ebp-04]
:0041F2EF C60000                  mov byte ptr [eax], 00
:0041F2F2 E900000000              jmp 0041F2F7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F2F2(U)
|
:0041F2F7 8B45FC                  mov eax, dword ptr [ebp-04]
:0041F2FA 5F                      pop edi
:0041F2FB 5E                      pop esi
:0041F2FC 5B                      pop ebx
:0041F2FD C9                      leave
:0041F2FE C3                      ret


:0041F2FF CC                      int 03
:0041F300 55                      push ebp
:0041F301 8BEC                    mov ebp, esp
:0041F303 83EC04                  sub esp, 00000004
:0041F306 53                      push ebx
:0041F307 56                      push esi
:0041F308 57                      push edi
:0041F309 894DFC                  mov dword ptr [ebp-04], ecx
:0041F30C E900000000              jmp 0041F311

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F30C(U)
|
:0041F311 5F                      pop edi
:0041F312 5E                      pop esi
:0041F313 5B                      pop ebx
:0041F314 C9                      leave
:0041F315 C3                      ret


:0041F316 CC                      int 03
:0041F317 CC                      int 03
:0041F318 CC                      int 03
:0041F319 CC                      int 03
:0041F31A CC                      int 03
:0041F31B CC                      int 03
:0041F31C CC                      int 03
:0041F31D CC                      int 03
:0041F31E CC                      int 03
:0041F31F CC                      int 03
:0041F320 55                      push ebp
:0041F321 8BEC                    mov ebp, esp
:0041F323 83EC04                  sub esp, 00000004
:0041F326 53                      push ebx
:0041F327 56                      push esi
:0041F328 57                      push edi
:0041F329 894DFC                  mov dword ptr [ebp-04], ecx
:0041F32C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041F32F 83C109                  add ecx, 00000009
:0041F332 E83925FEFF              call 00401870
:0041F337 8B45FC                  mov eax, dword ptr [ebp-04]
:0041F33A C60000                  mov byte ptr [eax], 00
:0041F33D 8B45FC                  mov eax, dword ptr [ebp-04]
:0041F340 C6400BFF                mov [eax+0B], FF
:0041F344 E900000000              jmp 0041F349

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F344(U)
|
:0041F349 8B45FC                  mov eax, dword ptr [ebp-04]
:0041F34C 5F                      pop edi
:0041F34D 5E                      pop esi
:0041F34E 5B                      pop ebx
:0041F34F C9                      leave
:0041F350 C3                      ret


:0041F351 CC                      int 03
:0041F352 CC                      int 03
:0041F353 CC                      int 03
:0041F354 CC                      int 03
:0041F355 CC                      int 03
:0041F356 CC                      int 03
:0041F357 CC                      int 03
:0041F358 CC                      int 03
:0041F359 CC                      int 03
:0041F35A CC                      int 03
:0041F35B CC                      int 03
:0041F35C CC                      int 03
:0041F35D CC                      int 03
:0041F35E CC                      int 03
:0041F35F CC                      int 03
:0041F360 55                      push ebp
:0041F361 8BEC                    mov ebp, esp
:0041F363 83EC04                  sub esp, 00000004
:0041F366 53                      push ebx
:0041F367 56                      push esi
:0041F368 57                      push edi
:0041F369 894DFC                  mov dword ptr [ebp-04], ecx
:0041F36C E900000000              jmp 0041F371

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F36C(U)
|
:0041F371 5F                      pop edi
:0041F372 5E                      pop esi
:0041F373 5B                      pop ebx
:0041F374 C9                      leave
:0041F375 C3                      ret


:0041F376 CC                      int 03
:0041F377 CC                      int 03
:0041F378 CC                      int 03
:0041F379 CC                      int 03
:0041F37A CC                      int 03
:0041F37B CC                      int 03
:0041F37C CC                      int 03
:0041F37D CC                      int 03
:0041F37E CC                      int 03
:0041F37F CC                      int 03

* Referenced by a CALL at Addresses:
|:0041EC43   , :0041EC84   , :004319BD   , :0043F50B   , :0044351E   
|:00443530   
|
:0041F380 55                      push ebp
:0041F381 8BEC                    mov ebp, esp
:0041F383 83EC04                  sub esp, 00000004
:0041F386 53                      push ebx
:0041F387 56                      push esi
:0041F388 57                      push edi
:0041F389 894DFC                  mov dword ptr [ebp-04], ecx
:0041F38C 8B45FC                  mov eax, dword ptr [ebp-04]
:0041F38F 8B4004                  mov eax, dword ptr [eax+04]
:0041F392 E900000000              jmp 0041F397

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F392(U)
|
:0041F397 5F                      pop edi
:0041F398 5E                      pop esi
:0041F399 5B                      pop ebx
:0041F39A C9                      leave
:0041F39B C3                      ret


:0041F39C CC                      int 03
:0041F39D CC                      int 03
:0041F39E CC                      int 03
:0041F39F CC                      int 03

* Referenced by a CALL at Addresses:
|:0041ECCA   , :00431A15   
|
:0041F3A0 55                      push ebp
:0041F3A1 8BEC                    mov ebp, esp
:0041F3A3 83EC04                  sub esp, 00000004
:0041F3A6 53                      push ebx
:0041F3A7 56                      push esi
:0041F3A8 57                      push edi
:0041F3A9 894DFC                  mov dword ptr [ebp-04], ecx
:0041F3AC 8B45FC                  mov eax, dword ptr [ebp-04]
:0041F3AF 33C9                    xor ecx, ecx
:0041F3B1 668B480C                mov cx, word ptr [eax+0C]
:0041F3B5 8BC1                    mov eax, ecx
:0041F3B7 E900000000              jmp 0041F3BC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F3B7(U)
|
:0041F3BC 5F                      pop edi
:0041F3BD 5E                      pop esi
:0041F3BE 5B                      pop ebx
:0041F3BF C9                      leave
:0041F3C0 C3                      ret


:0041F3C1 CC                      int 03
:0041F3C2 CC                      int 03
:0041F3C3 CC                      int 03
:0041F3C4 CC                      int 03
:0041F3C5 CC                      int 03
:0041F3C6 CC                      int 03
:0041F3C7 CC                      int 03
:0041F3C8 CC                      int 03
:0041F3C9 CC                      int 03
:0041F3CA CC                      int 03
:0041F3CB CC                      int 03
:0041F3CC CC                      int 03
:0041F3CD CC                      int 03
:0041F3CE CC                      int 03
:0041F3CF CC                      int 03

* Referenced by a CALL at Addresses:
|:0041ECF3   , :0041ED0F   
|
:0041F3D0 55                      push ebp
:0041F3D1 8BEC                    mov ebp, esp
:0041F3D3 83EC04                  sub esp, 00000004
:0041F3D6 53                      push ebx
:0041F3D7 56                      push esi
:0041F3D8 57                      push edi
:0041F3D9 894DFC                  mov dword ptr [ebp-04], ecx
:0041F3DC 8B4508                  mov eax, dword ptr [ebp+08]
:0041F3DF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041F3E2 6689410C                mov word ptr [ecx+0C], ax
:0041F3E6 E900000000              jmp 0041F3EB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F3E6(U)
|
:0041F3EB 5F                      pop edi
:0041F3EC 5E                      pop esi
:0041F3ED 5B                      pop ebx
:0041F3EE C9                      leave
:0041F3EF C20400                  ret 0004


:0041F3F2 CC                      int 03
:0041F3F3 CC                      int 03
:0041F3F4 CC                      int 03
:0041F3F5 CC                      int 03
:0041F3F6 CC                      int 03
:0041F3F7 CC                      int 03
:0041F3F8 CC                      int 03
:0041F3F9 CC                      int 03
:0041F3FA CC                      int 03
:0041F3FB CC                      int 03
:0041F3FC CC                      int 03
:0041F3FD CC                      int 03
:0041F3FE CC                      int 03
:0041F3FF CC                      int 03

* Referenced by a CALL at Addresses:
|:0041F02E   , :0042859C   , :0042CB2E   
|
:0041F400 55                      push ebp
:0041F401 8BEC                    mov ebp, esp
:0041F403 83EC04                  sub esp, 00000004
:0041F406 53                      push ebx
:0041F407 56                      push esi
:0041F408 57                      push edi
:0041F409 894DFC                  mov dword ptr [ebp-04], ecx
:0041F40C 8B45FC                  mov eax, dword ptr [ebp-04]
:0041F40F 33C9                    xor ecx, ecx
:0041F411 8A481A                  mov cl, byte ptr [eax+1A]
:0041F414 80E1E0                  and cl, E0
:0041F417 8B45FC                  mov eax, dword ptr [ebp-04]
:0041F41A 88481A                  mov byte ptr [eax+1A], cl
:0041F41D 8B45FC                  mov eax, dword ptr [ebp-04]
:0041F420 33C9                    xor ecx, ecx
:0041F422 8A481A                  mov cl, byte ptr [eax+1A]
:0041F425 33C0                    xor eax, eax
:0041F427 8A4508                  mov al, byte ptr [ebp+08]
:0041F42A 241F                    and al, 1F
:0041F42C 0AC8                    or cl, al
:0041F42E 8B45FC                  mov eax, dword ptr [ebp-04]
:0041F431 88481A                  mov byte ptr [eax+1A], cl
:0041F434 E900000000              jmp 0041F439

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F434(U)
|
:0041F439 5F                      pop edi
:0041F43A 5E                      pop esi
:0041F43B 5B                      pop ebx
:0041F43C C9                      leave
:0041F43D C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0041F04D   , :00434AD1   , :00435DA7   , :00436573   , :00436836   
|:0043F4AE   
|
:0041F440 55                      push ebp
:0041F441 8BEC                    mov ebp, esp
:0041F443 83EC04                  sub esp, 00000004
:0041F446 53                      push ebx
:0041F447 56                      push esi
:0041F448 57                      push edi
:0041F449 894DFC                  mov dword ptr [ebp-04], ecx
:0041F44C 8B45FC                  mov eax, dword ptr [ebp-04]
:0041F44F 8B00                    mov eax, dword ptr [eax]
:0041F451 E900000000              jmp 0041F456

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F451(U)
|
:0041F456 5F                      pop edi
:0041F457 5E                      pop esi
:0041F458 5B                      pop ebx
:0041F459 C9                      leave
:0041F45A C3                      ret


:0041F45B CC                      int 03
:0041F45C CC                      int 03
:0041F45D CC                      int 03
:0041F45E CC                      int 03
:0041F45F CC                      int 03
:0041F460 55                      push ebp
:0041F461 8BEC                    mov ebp, esp
:0041F463 53                      push ebx
:0041F464 56                      push esi
:0041F465 57                      push edi
:0041F466 E80A000000              call 0041F475
:0041F46B E900000000              jmp 0041F470

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F46B(U)
|
:0041F470 5F                      pop edi
:0041F471 5E                      pop esi
:0041F472 5B                      pop ebx
:0041F473 C9                      leave
:0041F474 C3                      ret



* Referenced by a CALL at Address:
|:0041F466   
|
:0041F475 55                      push ebp
:0041F476 8BEC                    mov ebp, esp
:0041F478 53                      push ebx
:0041F479 56                      push esi
:0041F47A 57                      push edi
:0041F47B B910BC4600              mov ecx, 0046BC10
:0041F480 E855060000              call 0041FADA
:0041F485 E900000000              jmp 0041F48A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F485(U)
|
:0041F48A 5F                      pop edi
:0041F48B 5E                      pop esi
:0041F48C 5B                      pop ebx
:0041F48D C9                      leave
:0041F48E C3                      ret



* Referenced by a CALL at Addresses:
|:0041F4CE   , :0041F4E9   , :0041F75D   
|
:0041F48F 55                      push ebp
:0041F490 8BEC                    mov ebp, esp
:0041F492 83EC04                  sub esp, 00000004
:0041F495 53                      push ebx
:0041F496 56                      push esi
:0041F497 57                      push edi
:0041F498 837D0C0A                cmp dword ptr [ebp+0C], 0000000A
:0041F49C 0F8D1C000000            jnl 0041F4BE
:0041F4A2 8B450C                  mov eax, dword ptr [ebp+0C]
:0041F4A5 83C030                  add eax, 00000030
:0041F4A8 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041F4AB 8B09                    mov ecx, dword ptr [ecx]
:0041F4AD 8801                    mov byte ptr [ecx], al
:0041F4AF 8B4508                  mov eax, dword ptr [ebp+08]
:0041F4B2 FF00                    inc dword ptr [eax]
:0041F4B4 B801000000              mov eax, 00000001
:0041F4B9 E93C000000              jmp 0041F4FA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F49C(C)
|
:0041F4BE B90A000000              mov ecx, 0000000A
:0041F4C3 8B450C                  mov eax, dword ptr [ebp+0C]
:0041F4C6 99                      cdq
:0041F4C7 F7F9                    idiv ecx
:0041F4C9 50                      push eax
:0041F4CA 8B4508                  mov eax, dword ptr [ebp+08]
:0041F4CD 50                      push eax
:0041F4CE E8BCFFFFFF              call 0041F48F
:0041F4D3 83C408                  add esp, 00000008
:0041F4D6 8945FC                  mov dword ptr [ebp-04], eax
:0041F4D9 B90A000000              mov ecx, 0000000A
:0041F4DE 8B450C                  mov eax, dword ptr [ebp+0C]
:0041F4E1 99                      cdq
:0041F4E2 F7F9                    idiv ecx
:0041F4E4 52                      push edx
:0041F4E5 8B4508                  mov eax, dword ptr [ebp+08]
:0041F4E8 50                      push eax
:0041F4E9 E8A1FFFFFF              call 0041F48F
:0041F4EE 83C408                  add esp, 00000008
:0041F4F1 8B45FC                  mov eax, dword ptr [ebp-04]
:0041F4F4 40                      inc eax
:0041F4F5 E900000000              jmp 0041F4FA

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041F4B9(U), :0041F4F5(U)
|
:0041F4FA 5F                      pop edi
:0041F4FB 5E                      pop esi
:0041F4FC 5B                      pop ebx
:0041F4FD C9                      leave
:0041F4FE C3                      ret



* Referenced by a CALL at Addresses:
|:0041F53F   , :0041F55B   , :0041F786   
|
:0041F4FF 55                      push ebp
:0041F500 8BEC                    mov ebp, esp
:0041F502 83EC04                  sub esp, 00000004
:0041F505 53                      push ebx
:0041F506 56                      push esi
:0041F507 57                      push edi
:0041F508 837D0C0A                cmp dword ptr [ebp+0C], 0000000A
:0041F50C 0F831C000000            jnb 0041F52E
:0041F512 8B450C                  mov eax, dword ptr [ebp+0C]
:0041F515 83C030                  add eax, 00000030
:0041F518 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041F51B 8B09                    mov ecx, dword ptr [ecx]
:0041F51D 8801                    mov byte ptr [ecx], al
:0041F51F 8B4508                  mov eax, dword ptr [ebp+08]
:0041F522 FF00                    inc dword ptr [eax]
:0041F524 B801000000              mov eax, 00000001
:0041F529 E93E000000              jmp 0041F56C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F50C(C)
|
:0041F52E B90A000000              mov ecx, 0000000A
:0041F533 8B450C                  mov eax, dword ptr [ebp+0C]
:0041F536 2BD2                    sub edx, edx
:0041F538 F7F1                    div ecx
:0041F53A 50                      push eax
:0041F53B 8B4508                  mov eax, dword ptr [ebp+08]
:0041F53E 50                      push eax
:0041F53F E8BBFFFFFF              call 0041F4FF
:0041F544 83C408                  add esp, 00000008
:0041F547 8945FC                  mov dword ptr [ebp-04], eax
:0041F54A B90A000000              mov ecx, 0000000A
:0041F54F 8B450C                  mov eax, dword ptr [ebp+0C]
:0041F552 2BD2                    sub edx, edx
:0041F554 F7F1                    div ecx
:0041F556 52                      push edx
:0041F557 8B4508                  mov eax, dword ptr [ebp+08]
:0041F55A 50                      push eax
:0041F55B E89FFFFFFF              call 0041F4FF
:0041F560 83C408                  add esp, 00000008
:0041F563 8B45FC                  mov eax, dword ptr [ebp-04]
:0041F566 40                      inc eax
:0041F567 E900000000              jmp 0041F56C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041F529(U), :0041F567(U)
|
:0041F56C 5F                      pop edi
:0041F56D 5E                      pop esi
:0041F56E 5B                      pop ebx
:0041F56F C9                      leave
:0041F570 C3                      ret



* Referenced by a CALL at Addresses:
|:00420B32   , :0043EF18   
|
:0041F571 55                      push ebp
:0041F572 8BEC                    mov ebp, esp
:0041F574 83EC64                  sub esp, 00000064
:0041F577 53                      push ebx
:0041F578 56                      push esi
:0041F579 57                      push edi
:0041F57A C745D408BB4600          mov [ebp-2C], 0046BB08
:0041F581 8B4508                  mov eax, dword ptr [ebp+08]
:0041F584 8B00                    mov eax, dword ptr [eax]
:0041F586 8945F4                  mov dword ptr [ebp-0C], eax
:0041F589 83450804                add dword ptr [ebp+08], 00000004
:0041F58D 8B4508                  mov eax, dword ptr [ebp+08]
:0041F590 8945D0                  mov dword ptr [ebp-30], eax
:0041F593 C745F800000000          mov [ebp-08], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FA65(U)
|
:0041F59A 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041F59D 8A00                    mov al, byte ptr [eax]
:0041F59F 8845F0                  mov byte ptr [ebp-10], al
:0041F5A2 FF45F4                  inc [ebp-0C]
:0041F5A5 33C0                    xor eax, eax
:0041F5A7 8A45F0                  mov al, byte ptr [ebp-10]
:0041F5AA 85C0                    test eax, eax
:0041F5AC 0F84B8040000            je 0041FA6A
:0041F5B2 837DF800                cmp dword ptr [ebp-08], 00000000
:0041F5B6 0F85AE040000            jne 0041FA6A
:0041F5BC 33C0                    xor eax, eax
:0041F5BE 8A45F0                  mov al, byte ptr [ebp-10]
:0041F5C1 83F825                  cmp eax, 00000025
:0041F5C4 0F856B040000            jne 0041FA35
:0041F5CA 8D45B4                  lea eax, dword ptr [ebp-4C]
:0041F5CD 8945E4                  mov dword ptr [ebp-1C], eax
:0041F5D0 C745CC06000000          mov [ebp-34], 00000006
:0041F5D7 C745EC00000000          mov [ebp-14], 00000000
:0041F5DE 8B45EC                  mov eax, dword ptr [ebp-14]
:0041F5E1 8945E0                  mov dword ptr [ebp-20], eax
:0041F5E4 8B45E0                  mov eax, dword ptr [ebp-20]
:0041F5E7 8945E8                  mov dword ptr [ebp-18], eax
:0041F5EA 8B45E8                  mov eax, dword ptr [ebp-18]
:0041F5ED 8945B0                  mov dword ptr [ebp-50], eax
:0041F5F0 8B45B0                  mov eax, dword ptr [ebp-50]
:0041F5F3 8945D8                  mov dword ptr [ebp-28], eax
:0041F5F6 C745C800000000          mov [ebp-38], 00000000
:0041F5FD 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041F600 33C9                    xor ecx, ecx
:0041F602 8A08                    mov cl, byte ptr [eax]
:0041F604 83F92D                  cmp ecx, 0000002D
:0041F607 0F850A000000            jne 0041F617
:0041F60D FF45F4                  inc [ebp-0C]
:0041F610 C745D801000000          mov [ebp-28], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F607(C)
|
:0041F617 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041F61A 8A00                    mov al, byte ptr [eax]
:0041F61C 8845F0                  mov byte ptr [ebp-10], al
:0041F61F 33C0                    xor eax, eax
:0041F621 8A45F0                  mov al, byte ptr [ebp-10]
:0041F624 83F830                  cmp eax, 00000030
:0041F627 0F8509000000            jne 0041F636
:0041F62D C645FC30                mov [ebp-04], 30
:0041F631 E904000000              jmp 0041F63A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F627(C)
|
:0041F636 C645FC20                mov [ebp-04], 20

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F631(U)
|
:0041F63A 8B45F0                  mov eax, dword ptr [ebp-10]
:0041F63D 50                      push eax
:0041F63E E80D150000              call 00420B50
:0041F643 83C404                  add esp, 00000004
:0041F646 85C0                    test eax, eax
:0041F648 0F8414000000            je 0041F662
:0041F64E 8D45F4                  lea eax, dword ptr [ebp-0C]
:0041F651 50                      push eax
:0041F652 E830040000              call 0041FA87
:0041F657 83C404                  add esp, 00000004
:0041F65A 8945DC                  mov dword ptr [ebp-24], eax
:0041F65D E907000000              jmp 0041F669

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F648(C)
|
:0041F662 C745DC00000000          mov [ebp-24], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F65D(U)
|
:0041F669 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041F66C 8A00                    mov al, byte ptr [eax]
:0041F66E 8845F0                  mov byte ptr [ebp-10], al
:0041F671 FF45F4                  inc [ebp-0C]
:0041F674 33C0                    xor eax, eax
:0041F676 8A45F0                  mov al, byte ptr [ebp-10]
:0041F679 83F82E                  cmp eax, 0000002E
:0041F67C 0F8521000000            jne 0041F6A3
:0041F682 8D45F4                  lea eax, dword ptr [ebp-0C]
:0041F685 50                      push eax
:0041F686 E8FC030000              call 0041FA87
:0041F68B 83C404                  add esp, 00000004
:0041F68E 8945CC                  mov dword ptr [ebp-34], eax
:0041F691 C745B001000000          mov [ebp-50], 00000001
:0041F698 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041F69B 8A00                    mov al, byte ptr [eax]
:0041F69D 8845F0                  mov byte ptr [ebp-10], al
:0041F6A0 FF45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F67C(C)
|
:0041F6A3 33C0                    xor eax, eax
:0041F6A5 8A45F0                  mov al, byte ptr [ebp-10]
:0041F6A8 83F86C                  cmp eax, 0000006C
:0041F6AB 0F8512000000            jne 0041F6C3
:0041F6B1 C745E801000000          mov [ebp-18], 00000001
:0041F6B8 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041F6BB 8A00                    mov al, byte ptr [eax]
:0041F6BD 8845F0                  mov byte ptr [ebp-10], al
:0041F6C0 FF45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F6AB(C)
|
:0041F6C3 8B45F0                  mov eax, dword ptr [ebp-10]
:0041F6C6 50                      push eax
:0041F6C7 E8C4140000              call 00420B90
:0041F6CC 83C404                  add esp, 00000004
:0041F6CF 33C9                    xor ecx, ecx
:0041F6D1 8AC8                    mov cl, al
:0041F6D3 894D9C                  mov dword ptr [ebp-64], ecx
:0041F6D6 E9CB020000              jmp 0041F9A6
:0041F6DB 837DE800                cmp dword ptr [ebp-18], 00000000
:0041F6DF 0F8429000000            je 0041F70E
:0041F6E5 8B45D0                  mov eax, dword ptr [ebp-30]
:0041F6E8 833800                  cmp dword ptr [eax], 00000000
:0041F6EB 0F8D1D000000            jnl 0041F70E
:0041F6F1 8B45D0                  mov eax, dword ptr [ebp-30]
:0041F6F4 8B00                    mov eax, dword ptr [eax]
:0041F6F6 F7D8                    neg eax
:0041F6F8 8B4DD0                  mov ecx, dword ptr [ebp-30]
:0041F6FB 8901                    mov dword ptr [ecx], eax
:0041F6FD 8B45E4                  mov eax, dword ptr [ebp-1C]
:0041F700 C6002D                  mov byte ptr [eax], 2D
:0041F703 FF45E4                  inc [ebp-1C]
:0041F706 FF4DDC                  dec [ebp-24]
:0041F709 E92E000000              jmp 0041F73C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041F6DF(C), :0041F6EB(C)
|
:0041F70E 837DE800                cmp dword ptr [ebp-18], 00000000
:0041F712 0F8524000000            jne 0041F73C
:0041F718 8B45D0                  mov eax, dword ptr [ebp-30]
:0041F71B 833800                  cmp dword ptr [eax], 00000000
:0041F71E 0F8D18000000            jnl 0041F73C
:0041F724 8B45D0                  mov eax, dword ptr [ebp-30]
:0041F727 8B00                    mov eax, dword ptr [eax]
:0041F729 F7D8                    neg eax
:0041F72B 8B4DD0                  mov ecx, dword ptr [ebp-30]
:0041F72E 8901                    mov dword ptr [ecx], eax
:0041F730 8B45E4                  mov eax, dword ptr [ebp-1C]
:0041F733 C6002D                  mov byte ptr [eax], 2D
:0041F736 FF45E4                  inc [ebp-1C]
:0041F739 FF4DDC                  dec [ebp-24]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041F709(U), :0041F712(C), :0041F71E(C)
|
:0041F73C 837DE800                cmp dword ptr [ebp-18], 00000000
:0041F740 0F8429000000            je 0041F76F
:0041F746 8B45D0                  mov eax, dword ptr [ebp-30]
:0041F749 8945AC                  mov dword ptr [ebp-54], eax
:0041F74C 8345D004                add dword ptr [ebp-30], 00000004
:0041F750 8B5DDC                  mov ebx, dword ptr [ebp-24]
:0041F753 8B45AC                  mov eax, dword ptr [ebp-54]
:0041F756 8B00                    mov eax, dword ptr [eax]
:0041F758 50                      push eax
:0041F759 8D45E4                  lea eax, dword ptr [ebp-1C]
:0041F75C 50                      push eax
:0041F75D E82DFDFFFF              call 0041F48F
:0041F762 83C408                  add esp, 00000008
:0041F765 2BD8                    sub ebx, eax
:0041F767 895DDC                  mov dword ptr [ebp-24], ebx
:0041F76A E924000000              jmp 0041F793

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F740(C)
|
:0041F76F 8B45D0                  mov eax, dword ptr [ebp-30]
:0041F772 8945A8                  mov dword ptr [ebp-58], eax
:0041F775 8345D004                add dword ptr [ebp-30], 00000004
:0041F779 8B5DDC                  mov ebx, dword ptr [ebp-24]
:0041F77C 8B45A8                  mov eax, dword ptr [ebp-58]
:0041F77F 8B00                    mov eax, dword ptr [eax]
:0041F781 50                      push eax
:0041F782 8D45E4                  lea eax, dword ptr [ebp-1C]
:0041F785 50                      push eax
:0041F786 E874FDFFFF              call 0041F4FF
:0041F78B 83C408                  add esp, 00000008
:0041F78E 2BD8                    sub ebx, eax
:0041F790 895DDC                  mov dword ptr [ebp-24], ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F76A(U)
|
:0041F793 E9E5020000              jmp 0041FA7D
:0041F798 E94F000000              jmp 0041F7EC
:0041F79D 8B45D0                  mov eax, dword ptr [ebp-30]
:0041F7A0 8B00                    mov eax, dword ptr [eax]
:0041F7A2 8945E4                  mov dword ptr [ebp-1C], eax
:0041F7A5 8345D004                add dword ptr [ebp-30], 00000004
:0041F7A9 837DE400                cmp dword ptr [ebp-1C], 00000000
:0041F7AD 0F8507000000            jne 0041F7BA
:0041F7B3 C745E418134500          mov [ebp-1C], 00451318

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F7AD(C)
|
:0041F7BA 8B5DDC                  mov ebx, dword ptr [ebp-24]
:0041F7BD 8B45E4                  mov eax, dword ptr [ebp-1C]
:0041F7C0 50                      push eax
:0041F7C1 E8E47B0200              call 004473AA
:0041F7C6 83C404                  add esp, 00000004
:0041F7C9 2BD8                    sub ebx, eax
:0041F7CB 895DDC                  mov dword ptr [ebp-24], ebx
:0041F7CE E9A5020000              jmp 0041FA78
:0041F7D3 E927000000              jmp 0041F7FF
:0041F7D8 8B45D0                  mov eax, dword ptr [ebp-30]
:0041F7DB 8A00                    mov al, byte ptr [eax]
:0041F7DD 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0041F7E0 8801                    mov byte ptr [ecx], al
:0041F7E2 FF45E4                  inc [ebp-1C]
:0041F7E5 8345D004                add dword ptr [ebp-30], 00000004
:0041F7E9 FF4DDC                  dec [ebp-24]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041F798(U), :0041FA7D(U)
|
:0041F7EC C745B000000000          mov [ebp-50], 00000000
:0041F7F3 8B45E4                  mov eax, dword ptr [ebp-1C]
:0041F7F6 C60000                  mov byte ptr [eax], 00
:0041F7F9 8D45B4                  lea eax, dword ptr [ebp-4C]
:0041F7FC 8945E4                  mov dword ptr [ebp-1C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041F7D3(U), :0041FA78(U)
|
:0041F7FF 837DD800                cmp dword ptr [ebp-28], 00000000
:0041F803 0F8558000000            jne 0041F861

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F85C(U)
|
:0041F809 8B45DC                  mov eax, dword ptr [ebp-24]
:0041F80C 8945A4                  mov dword ptr [ebp-5C], eax
:0041F80F FF4DDC                  dec [ebp-24]
:0041F812 837DA400                cmp dword ptr [ebp-5C], 00000000
:0041F816 0F8E45000000            jle 0041F861
:0041F81C 837DEC01                cmp dword ptr [ebp-14], 00000001
:0041F820 0F8504000000            jne 0041F82A
:0041F826 C645FC30                mov [ebp-04], 30

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F820(C)
|
:0041F82A 833D08BC460001          cmp dword ptr [0046BC08], 00000001
:0041F831 0F8510000000            jne 0041F847
:0041F837 8A45FC                  mov al, byte ptr [ebp-04]
:0041F83A 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0041F83D 8801                    mov byte ptr [ecx], al
:0041F83F FF45D4                  inc [ebp-2C]
:0041F842 E915000000              jmp 0041F85C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F831(C)
|
:0041F847 8B45C8                  mov eax, dword ptr [ebp-38]
:0041F84A 50                      push eax
:0041F84B 8B45FC                  mov eax, dword ptr [ebp-04]
:0041F84E 50                      push eax
:0041F84F B910BC4600              mov ecx, 0046BC10
:0041F854 E8E3060000              call 0041FF3C
:0041F859 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F842(U)
|
:0041F85C E9A8FFFFFF              jmp 0041F809

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041F803(C), :0041F816(C), :0041F910(U)
|
:0041F861 8B45E4                  mov eax, dword ptr [ebp-1C]
:0041F864 33C9                    xor ecx, ecx
:0041F866 8A08                    mov cl, byte ptr [eax]
:0041F868 85C9                    test ecx, ecx
:0041F86A 0F84A5000000            je 0041F915
:0041F870 837DB000                cmp dword ptr [ebp-50], 00000000
:0041F874 0F840A000000            je 0041F884
:0041F87A 837DCC00                cmp dword ptr [ebp-34], 00000000
:0041F87E 0F8E89000000            jle 0041F90D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F874(C)
|
:0041F884 837DE000                cmp dword ptr [ebp-20], 00000000
:0041F888 0F8410000000            je 0041F89E
:0041F88E 8B45E4                  mov eax, dword ptr [ebp-1C]
:0041F891 33C9                    xor ecx, ecx
:0041F893 8A08                    mov cl, byte ptr [eax]
:0041F895 83F920                  cmp ecx, 00000020
:0041F898 0F846F000000            je 0041F90D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F888(C)
|
:0041F89E 837DE000                cmp dword ptr [ebp-20], 00000000
:0041F8A2 0F842C000000            je 0041F8D4
:0041F8A8 8B45E4                  mov eax, dword ptr [ebp-1C]
:0041F8AB 33C9                    xor ecx, ecx
:0041F8AD 8A08                    mov cl, byte ptr [eax]
:0041F8AF 81F981000000            cmp ecx, 00000081
:0041F8B5 0F8519000000            jne 0041F8D4
:0041F8BB 8B45E4                  mov eax, dword ptr [ebp-1C]
:0041F8BE 33C9                    xor ecx, ecx
:0041F8C0 8A4801                  mov cl, byte ptr [eax+01]
:0041F8C3 83F940                  cmp ecx, 00000040
:0041F8C6 0F8508000000            jne 0041F8D4
:0041F8CC FF45E4                  inc [ebp-1C]
:0041F8CF E939000000              jmp 0041F90D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041F8A2(C), :0041F8B5(C), :0041F8C6(C)
|
:0041F8D4 833D08BC460001          cmp dword ptr [0046BC08], 00000001
:0041F8DB 0F8512000000            jne 0041F8F3
:0041F8E1 8B45E4                  mov eax, dword ptr [ebp-1C]
:0041F8E4 8A00                    mov al, byte ptr [eax]
:0041F8E6 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0041F8E9 8801                    mov byte ptr [ecx], al
:0041F8EB FF45D4                  inc [ebp-2C]
:0041F8EE E917000000              jmp 0041F90A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F8DB(C)
|
:0041F8F3 8B45C8                  mov eax, dword ptr [ebp-38]
:0041F8F6 50                      push eax
:0041F8F7 8B45E4                  mov eax, dword ptr [ebp-1C]
:0041F8FA 8A00                    mov al, byte ptr [eax]
:0041F8FC 50                      push eax
:0041F8FD B910BC4600              mov ecx, 0046BC10
:0041F902 E835060000              call 0041FF3C
:0041F907 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F8EE(U)
|
:0041F90A FF4DCC                  dec [ebp-34]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041F87E(C), :0041F898(C), :0041F8CF(U)
|
:0041F90D FF45E4                  inc [ebp-1C]
:0041F910 E94CFFFFFF              jmp 0041F861

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F86A(C)
|
:0041F915 837DD800                cmp dword ptr [ebp-28], 00000000
:0041F919 0F8444000000            je 0041F963

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F95E(U)
|
:0041F91F 8B45DC                  mov eax, dword ptr [ebp-24]
:0041F922 8945A0                  mov dword ptr [ebp-60], eax
:0041F925 FF4DDC                  dec [ebp-24]
:0041F928 837DA000                cmp dword ptr [ebp-60], 00000000
:0041F92C 0F8E31000000            jle 0041F963
:0041F932 833D08BC460001          cmp dword ptr [0046BC08], 00000001
:0041F939 0F850E000000            jne 0041F94D
:0041F93F 8B45D4                  mov eax, dword ptr [ebp-2C]
:0041F942 C60020                  mov byte ptr [eax], 20
:0041F945 FF45D4                  inc [ebp-2C]
:0041F948 E911000000              jmp 0041F95E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F939(C)
|
:0041F94D 6A00                    push 00000000
:0041F94F 6A20                    push 00000020
:0041F951 B910BC4600              mov ecx, 0046BC10
:0041F956 E8E1050000              call 0041FF3C
:0041F95B 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F948(U)
|
:0041F95E E9BCFFFFFF              jmp 0041F91F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041F919(C), :0041F92C(C)
|
:0041F963 E9C8000000              jmp 0041FA30
:0041F968 8B45F8                  mov eax, dword ptr [ebp-08]
:0041F96B E912010000              jmp 0041FA82

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F9AA(C)
|
:0041F970 833D08BC460001          cmp dword ptr [0046BC08], 00000001
:0041F977 0F8511000000            jne 0041F98E
:0041F97D 8A45F0                  mov al, byte ptr [ebp-10]
:0041F980 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0041F983 8801                    mov byte ptr [ecx], al
:0041F985 8345D401                add dword ptr [ebp-2C], 00000001
:0041F989 E913000000              jmp 0041F9A1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F977(C)
|
:0041F98E 6A00                    push 00000000
:0041F990 8B45F0                  mov eax, dword ptr [ebp-10]
:0041F993 50                      push eax
:0041F994 B910BC4600              mov ecx, 0046BC10
:0041F999 E89E050000              call 0041FF3C
:0041F99E 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F989(U)
|
:0041F9A1 E98A000000              jmp 0041FA30

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F6D6(U)
|
:0041F9A6 837D9C55                cmp dword ptr [ebp-64], 00000055
:0041F9AA 0F87C0FFFFFF            ja 0041F970
:0041F9B0 8B459C                  mov eax, dword ptr [ebp-64]
:0041F9B3 33C9                    xor ecx, ecx
:0041F9B5 8A88DAF94100            mov cl, byte ptr [eax+0041F9DA]
:0041F9BB FF248DC2F94100          jmp dword ptr [4*ecx+0041F9C2]

:0041F9C2 68F94100                DWORD 0041F968
:0041F9C6 D8F74100                DWORD 0041F7D8
:0041F9CA DBF64100                DWORD 0041F6DB
:0041F9CE 9DF74100                DWORD 0041F79D
:0041F9D2 3CF74100                DWORD 0041F73C
:0041F9D6 70F94100                DWORD 0041F970


:0041F9DA 000505050505            add byte ptr [05050505], al
:0041F9E0 0505050505              add eax, 05050505
:0041F9E5 0505050505              add eax, 05050505
:0041F9EA 0505050505              add eax, 05050505
:0041F9EF 0505050505              add eax, 05050505
:0041F9F4 0505050505              add eax, 05050505
:0041F9F9 0505050505              add eax, 05050505
:0041F9FE 0505050505              add eax, 05050505
:0041FA03 0505050505              add eax, 05050505
:0041FA08 0505050505              add eax, 05050505
:0041FA0D 0505050505              add eax, 05050505
:0041FA12 0505050505              add eax, 05050505
:0041FA17 0505050505              add eax, 05050505
:0041FA1C 0501020505              add eax, 05050201
:0041FA21 0505050505              add eax, 05050505
:0041FA26 0505050505              add eax, 05050505
:0041FA2B 0505030504              add eax, 04050305

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041F963(U), :0041F9A1(U)
|
:0041FA30 E930000000              jmp 0041FA65

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F5C4(C)
|
:0041FA35 833D08BC460001          cmp dword ptr [0046BC08], 00000001
:0041FA3C 0F8510000000            jne 0041FA52
:0041FA42 8A45F0                  mov al, byte ptr [ebp-10]
:0041FA45 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0041FA48 8801                    mov byte ptr [ecx], al
:0041FA4A FF45D4                  inc [ebp-2C]
:0041FA4D E913000000              jmp 0041FA65

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FA3C(C)
|
:0041FA52 6A00                    push 00000000
:0041FA54 8B45F0                  mov eax, dword ptr [ebp-10]
:0041FA57 50                      push eax
:0041FA58 B910BC4600              mov ecx, 0046BC10
:0041FA5D E8DA040000              call 0041FF3C
:0041FA62 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041FA30(U), :0041FA4D(U)
|
:0041FA65 E930FBFFFF              jmp 0041F59A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041F5AC(C), :0041F5B6(C)
|
:0041FA6A 8B45D4                  mov eax, dword ptr [ebp-2C]
:0041FA6D C60000                  mov byte ptr [eax], 00
:0041FA70 8B45F8                  mov eax, dword ptr [ebp-08]
:0041FA73 E90A000000              jmp 0041FA82

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F7CE(U)
|
:0041FA78 E982FDFFFF              jmp 0041F7FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F793(U)
|
:0041FA7D E96AFDFFFF              jmp 0041F7EC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041F96B(U), :0041FA73(U)
|
:0041FA82 5F                      pop edi
:0041FA83 5E                      pop esi
:0041FA84 5B                      pop ebx
:0041FA85 C9                      leave
:0041FA86 C3                      ret



* Referenced by a CALL at Addresses:
|:0041F652   , :0041F686   
|
:0041FA87 55                      push ebp
:0041FA88 8BEC                    mov ebp, esp
:0041FA8A 83EC08                  sub esp, 00000008
:0041FA8D 53                      push ebx
:0041FA8E 56                      push esi
:0041FA8F 57                      push edi
:0041FA90 C745F800000000          mov [ebp-08], 00000000
:0041FA97 E905000000              jmp 0041FAA1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FAC8(U)
|
:0041FA9C 8B4508                  mov eax, dword ptr [ebp+08]
:0041FA9F FF00                    inc dword ptr [eax]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FA97(U)
|
:0041FAA1 8B4508                  mov eax, dword ptr [ebp+08]
:0041FAA4 8B00                    mov eax, dword ptr [eax]
:0041FAA6 33C9                    xor ecx, ecx
:0041FAA8 8A08                    mov cl, byte ptr [eax]
:0041FAAA 83E930                  sub ecx, 00000030
:0041FAAD 894DFC                  mov dword ptr [ebp-04], ecx
:0041FAB0 837DFC0A                cmp dword ptr [ebp-04], 0000000A
:0041FAB4 0F8313000000            jnb 0041FACD
:0041FABA 8B45F8                  mov eax, dword ptr [ebp-08]
:0041FABD 8D0480                  lea eax, dword ptr [eax+4*eax]
:0041FAC0 03C0                    add eax, eax
:0041FAC2 0345FC                  add eax, dword ptr [ebp-04]
:0041FAC5 8945F8                  mov dword ptr [ebp-08], eax
:0041FAC8 E9CFFFFFFF              jmp 0041FA9C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FAB4(C)
|
:0041FACD 8B45F8                  mov eax, dword ptr [ebp-08]
:0041FAD0 E900000000              jmp 0041FAD5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FAD0(U)
|
:0041FAD5 5F                      pop edi
:0041FAD6 5E                      pop esi
:0041FAD7 5B                      pop ebx
:0041FAD8 C9                      leave
:0041FAD9 C3                      ret



* Referenced by a CALL at Address:
|:0041F480   
|
:0041FADA 55                      push ebp
:0041FADB 8BEC                    mov ebp, esp
:0041FADD 83EC04                  sub esp, 00000004
:0041FAE0 53                      push ebx
:0041FAE1 56                      push esi
:0041FAE2 57                      push edi
:0041FAE3 894DFC                  mov dword ptr [ebp-04], ecx
:0041FAE6 8B45FC                  mov eax, dword ptr [ebp-04]
:0041FAE9 C7401300000000          mov [eax+13], 00000000
:0041FAF0 8B45FC                  mov eax, dword ptr [ebp-04]
:0041FAF3 8B4013                  mov eax, dword ptr [eax+13]
:0041FAF6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041FAF9 89410B                  mov dword ptr [ecx+0B], eax
:0041FAFC 8B45FC                  mov eax, dword ptr [ebp-04]
:0041FAFF 8B400B                  mov eax, dword ptr [eax+0B]
:0041FB02 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041FB05 894107                  mov dword ptr [ecx+07], eax
:0041FB08 8B45FC                  mov eax, dword ptr [ebp-04]
:0041FB0B 8B4007                  mov eax, dword ptr [eax+07]
:0041FB0E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041FB11 894103                  mov dword ptr [ecx+03], eax
:0041FB14 8B45FC                  mov eax, dword ptr [ebp-04]
:0041FB17 C7401B08000000          mov [eax+1B], 00000008
:0041FB1E 8B45FC                  mov eax, dword ptr [ebp-04]
:0041FB21 C7400F4F000000          mov [eax+0F], 0000004F
:0041FB28 8B45FC                  mov eax, dword ptr [ebp-04]
:0041FB2B C74017B8010000          mov [eax+17], 000001B8
:0041FB32 8B45FC                  mov eax, dword ptr [ebp-04]
:0041FB35 C6402400                mov [eax+24], 00
:0041FB39 8B45FC                  mov eax, dword ptr [ebp-04]
:0041FB3C C6402312                mov [eax+23], 12
:0041FB40 8B45FC                  mov eax, dword ptr [ebp-04]
:0041FB43 C7403500000000          mov [eax+35], 00000000
:0041FB4A 8B45FC                  mov eax, dword ptr [ebp-04]
:0041FB4D C7401F00000000          mov [eax+1F], 00000000
:0041FB54 6A00                    push 00000000
:0041FB56 6A0A                    push 0000000A
:0041FB58 8B45FC                  mov eax, dword ptr [ebp-04]
:0041FB5B 83C039                  add eax, 00000039
:0041FB5E 50                      push eax
:0041FB5F E8FF780200              call 00447463
:0041FB64 83C40C                  add esp, 0000000C
:0041FB67 8B45FC                  mov eax, dword ptr [ebp-04]
:0041FB6A C7403100000000          mov [eax+31], 00000000
:0041FB71 E900000000              jmp 0041FB76

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FB71(U)
|
:0041FB76 8B45FC                  mov eax, dword ptr [ebp-04]
:0041FB79 5F                      pop edi
:0041FB7A 5E                      pop esi
:0041FB7B 5B                      pop ebx
:0041FB7C C9                      leave
:0041FB7D C3                      ret



* Referenced by a CALL at Addresses:
|:0041FC1A   , :00420080   , :00420AFA   
|
:0041FB7E 55                      push ebp
:0041FB7F 8BEC                    mov ebp, esp
:0041FB81 83EC08                  sub esp, 00000008
:0041FB84 53                      push ebx
:0041FB85 56                      push esi
:0041FB86 57                      push edi
:0041FB87 894DF8                  mov dword ptr [ebp-08], ecx
:0041FB8A 8B45F8                  mov eax, dword ptr [ebp-08]
:0041FB8D 8B400F                  mov eax, dword ptr [eax+0F]
:0041FB90 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041FB93 2B410B                  sub eax, dword ptr [ecx+0B]
:0041FB96 40                      inc eax
:0041FB97 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FBB0(U)
|
:0041FB9A 8B4508                  mov eax, dword ptr [ebp+08]
:0041FB9D 3945FC                  cmp dword ptr [ebp-04], eax
:0041FBA0 0F870F000000            ja 0041FBB5
:0041FBA6 33C0                    xor eax, eax
:0041FBA8 2B45FC                  sub eax, dword ptr [ebp-04]
:0041FBAB F7D8                    neg eax
:0041FBAD 294508                  sub dword ptr [ebp+08], eax
:0041FBB0 E9E5FFFFFF              jmp 0041FB9A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FBA0(C)
|
:0041FBB5 8B45F8                  mov eax, dword ptr [ebp-08]
:0041FBB8 8B400B                  mov eax, dword ptr [eax+0B]
:0041FBBB 034508                  add eax, dword ptr [ebp+08]
:0041FBBE 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041FBC1 894103                  mov dword ptr [ecx+03], eax
:0041FBC4 E900000000              jmp 0041FBC9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FBC4(U)
|
:0041FBC9 5F                      pop edi
:0041FBCA 5E                      pop esi
:0041FBCB 5B                      pop ebx
:0041FBCC C9                      leave
:0041FBCD C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0041FC26   , :00420060   
|
:0041FBD0 55                      push ebp
:0041FBD1 8BEC                    mov ebp, esp
:0041FBD3 83EC04                  sub esp, 00000004
:0041FBD6 53                      push ebx
:0041FBD7 56                      push esi
:0041FBD8 57                      push edi
:0041FBD9 894DFC                  mov dword ptr [ebp-04], ecx
:0041FBDC 8B45FC                  mov eax, dword ptr [ebp-04]
:0041FBDF 8B4013                  mov eax, dword ptr [eax+13]
:0041FBE2 034508                  add eax, dword ptr [ebp+08]
:0041FBE5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041FBE8 8B4917                  mov ecx, dword ptr [ecx+17]
:0041FBEB 3BC1                    cmp eax, ecx
:0041FBED 0F8202000000            jb 0041FBF5
:0041FBF3 8BC1                    mov eax, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FBED(C)
|
:0041FBF5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041FBF8 894107                  mov dword ptr [ecx+07], eax
:0041FBFB E900000000              jmp 0041FC00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FBFB(U)
|
:0041FC00 5F                      pop edi
:0041FC01 5E                      pop esi
:0041FC02 5B                      pop ebx
:0041FC03 C9                      leave
:0041FC04 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:004011C3   , :00401263   , :004032FC   , :0040346E   , :0040A479   
|:0040CF30   , :0040D030   , :0040F56F   , :0040F611   , :0040FA55   
|:0041094D   , :00410989   , :004109C9   , :00410A01   , :004139A2   
|:0041671F   , :00416CCA   , :00421717   , :00424CAC   , :004267B9   
|:0042680D   , :00426878   , :004268CA   , :00426BEB   , :004296E8   
|:00429732   , :00429794   , :0042AA78   , :0042C149   , :0042C175   
|:0042C1A9   , :0042C1DD   , :0042C214   , :0042C994   , :004343AD   
|:004343FF   , :0043468B   , :004348C3   , :00434A6B   , :00434AC7   
|:004352E0   , :004353B9   , :004359D4   , :00435DEC   , :00435FB2   
|:00436B2F   , :00437948   , :00437ACB   , :00437C48   , :00438373   
|:00438915   , :00438EFC   , :00439390   , :00439D13   , :00439F8B   
|:00439FDC   , :0043A02C   , :0043AEED   , :0043BBE6   , :0043C9B2   
|:0043C9DE   , :0043E2C8   , :0043E304   , :0043E6B5   , :0043EED9   
|:0043EEEB   , :0043F0C0   , :0043F10E   , :0043F334   , :0043F372   
|:0043F4A4   , :0043F594   , :0043F689   , :0043F6B0   , :0043F84E   
|:0043F8B9   , :0043F924   , :0043FA4C   , :0043FA9C   , :0043FAEC   
|:004401AB   , :00440612   , :00443C4F   , :00443DC1   , :00443F01   
|:00443F55   
|
:0041FC07 55                      push ebp
:0041FC08 8BEC                    mov ebp, esp
:0041FC0A 83EC04                  sub esp, 00000004
:0041FC0D 53                      push ebx
:0041FC0E 56                      push esi
:0041FC0F 57                      push edi
:0041FC10 894DFC                  mov dword ptr [ebp-04], ecx
:0041FC13 8B4508                  mov eax, dword ptr [ebp+08]
:0041FC16 50                      push eax
:0041FC17 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041FC1A E85FFFFFFF              call 0041FB7E
:0041FC1F 8B450C                  mov eax, dword ptr [ebp+0C]
:0041FC22 50                      push eax
:0041FC23 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041FC26 E8A5FFFFFF              call 0041FBD0
:0041FC2B E900000000              jmp 0041FC30

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FC2B(U)
|
:0041FC30 5F                      pop edi
:0041FC31 5E                      pop esi
:0041FC32 5B                      pop ebx
:0041FC33 C9                      leave
:0041FC34 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:004200ED   , :004352D0   , :00435FA1   
|
:0041FC37 55                      push ebp
:0041FC38 8BEC                    mov ebp, esp
:0041FC3A 83EC08                  sub esp, 00000008
:0041FC3D 53                      push ebx
:0041FC3E 56                      push esi
:0041FC3F 57                      push edi
:0041FC40 894DF8                  mov dword ptr [ebp-08], ecx
:0041FC43 8B45F8                  mov eax, dword ptr [ebp-08]
:0041FC46 8B400F                  mov eax, dword ptr [eax+0F]
:0041FC49 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041FC4C 2B410B                  sub eax, dword ptr [ecx+0B]
:0041FC4F 40                      inc eax
:0041FC50 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FC69(U)
|
:0041FC53 8B4508                  mov eax, dword ptr [ebp+08]
:0041FC56 3945FC                  cmp dword ptr [ebp-04], eax
:0041FC59 0F870F000000            ja 0041FC6E
:0041FC5F 33C0                    xor eax, eax
:0041FC61 2B45FC                  sub eax, dword ptr [ebp-04]
:0041FC64 F7D8                    neg eax
:0041FC66 294508                  sub dword ptr [ebp+08], eax
:0041FC69 E9E5FFFFFF              jmp 0041FC53

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FC59(C)
|
:0041FC6E 8B45F8                  mov eax, dword ptr [ebp-08]
:0041FC71 8B400B                  mov eax, dword ptr [eax+0B]
:0041FC74 034508                  add eax, dword ptr [ebp+08]
:0041FC77 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041FC7A 89411B                  mov dword ptr [ecx+1B], eax
:0041FC7D E900000000              jmp 0041FC82

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FC7D(U)
|
:0041FC82 5F                      pop edi
:0041FC83 5E                      pop esi
:0041FC84 5B                      pop ebx
:0041FC85 C9                      leave
:0041FC86 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00420261   , :00420327   
|
:0041FC89 55                      push ebp
:0041FC8A 8BEC                    mov ebp, esp
:0041FC8C 83EC04                  sub esp, 00000004
:0041FC8F 53                      push ebx
:0041FC90 56                      push esi
:0041FC91 57                      push edi
:0041FC92 894DFC                  mov dword ptr [ebp-04], ecx
:0041FC95 8B45FC                  mov eax, dword ptr [ebp-04]
:0041FC98 8B401B                  mov eax, dword ptr [eax+1B]
:0041FC9B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041FC9E 894103                  mov dword ptr [ecx+03], eax
:0041FCA1 8B45FC                  mov eax, dword ptr [ebp-04]
:0041FCA4 33C9                    xor ecx, ecx
:0041FCA6 8A4823                  mov cl, byte ptr [eax+23]
:0041FCA9 8B45FC                  mov eax, dword ptr [ebp-04]
:0041FCAC 034807                  add ecx, dword ptr [eax+07]
:0041FCAF 8B45FC                  mov eax, dword ptr [ebp-04]
:0041FCB2 3B4817                  cmp ecx, dword ptr [eax+17]
:0041FCB5 0F870E000000            ja 0041FCC9
:0041FCBB 8B45FC                  mov eax, dword ptr [ebp-04]
:0041FCBE 33C9                    xor ecx, ecx
:0041FCC0 8A4823                  mov cl, byte ptr [eax+23]
:0041FCC3 8B45FC                  mov eax, dword ptr [ebp-04]
:0041FCC6 014807                  add dword ptr [eax+07], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FCB5(C)
|
:0041FCC9 E900000000              jmp 0041FCCE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FCC9(U)
|
:0041FCCE 5F                      pop edi
:0041FCCF 5E                      pop esi
:0041FCD0 5B                      pop ebx
:0041FCD1 C9                      leave
:0041FCD2 C3                      ret



* Referenced by a CALL at Addresses:
|:0040341D   , :0040F5EB   , :0040F982   , :0041092A   , :00416CE2   
|:004200D7   , :004216C8   , :004216D9   , :00423DA5   , :00424CB8   
|:00429721   , :00429783   , :0042A98A   , :0042C03D   , :0042C15D   
|:0042C90A   , :0042CC46   , :0042CC57   , :0042CC68   , :0042CC79   
|:0042CC9A   , :0042CCBD   , :004343E7   , :00434442   , :004352EC   
|:004359F8   , :00437936   , :00437AA0   , :00437C33   , :004382CB   
|:004383AA   , :004383E2   , :0043894C   , :00438EDE   , :004392CE   
|:004396C4   , :00439C6C   , :00439F73   , :00439FC4   , :0043C40F   
|:0043C9F8   , :0043E227   , :0043EEF7   , :0043EFDA   , :0043F5EF   
|:0043F612   , :0043F635   , :0043F653   , :00443DA4   , :00443EF0   
|
:0041FCD3 55                      push ebp
:0041FCD4 8BEC                    mov ebp, esp
:0041FCD6 83EC04                  sub esp, 00000004
:0041FCD9 53                      push ebx
:0041FCDA 56                      push esi
:0041FCDB 57                      push edi
:0041FCDC 894DFC                  mov dword ptr [ebp-04], ecx
:0041FCDF 8B4508                  mov eax, dword ptr [ebp+08]
:0041FCE2 50                      push eax
:0041FCE3 E837000000              call 0041FD1F
:0041FCE8 83C404                  add esp, 00000004
:0041FCEB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041FCEE 884101                  mov byte ptr [ecx+01], al
:0041FCF1 8B45FC                  mov eax, dword ptr [ebp-04]
:0041FCF4 33C9                    xor ecx, ecx
:0041FCF6 8A4802                  mov cl, byte ptr [eax+02]
:0041FCF9 51                      push ecx
:0041FCFA 8B45FC                  mov eax, dword ptr [ebp-04]
:0041FCFD 33C9                    xor ecx, ecx
:0041FCFF 8A4801                  mov cl, byte ptr [eax+01]
:0041FD02 51                      push ecx
:0041FD03 8B45FC                  mov eax, dword ptr [ebp-04]
:0041FD06 33C9                    xor ecx, ecx
:0041FD08 8A08                    mov cl, byte ptr [eax]
:0041FD0A 51                      push ecx
:0041FD0B E83E500200              call 00444D4E
:0041FD10 83C40C                  add esp, 0000000C
:0041FD13 E900000000              jmp 0041FD18

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FD13(U)
|
:0041FD18 5F                      pop edi
:0041FD19 5E                      pop esi
:0041FD1A 5B                      pop ebx
:0041FD1B C9                      leave
:0041FD1C C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0041FCE3   , :0041FDF6   , :0041FE42   
|
:0041FD1F 55                      push ebp
:0041FD20 8BEC                    mov ebp, esp
:0041FD22 83EC08                  sub esp, 00000008
:0041FD25 53                      push ebx
:0041FD26 56                      push esi
:0041FD27 57                      push edi
:0041FD28 C745FC00000000          mov [ebp-04], 00000000
:0041FD2F 8B4508                  mov eax, dword ptr [ebp+08]
:0041FD32 8945F8                  mov dword ptr [ebp-08], eax
:0041FD35 E951000000              jmp 0041FD8B
:0041FD3A 8B4508                  mov eax, dword ptr [ebp+08]
:0041FD3D 83C00A                  add eax, 0000000A
:0041FD40 8945FC                  mov dword ptr [ebp-04], eax
:0041FD43 E97B000000              jmp 0041FDC3
:0041FD48 C745FC18000000          mov [ebp-04], 00000018
:0041FD4F E96F000000              jmp 0041FDC3
:0041FD54 8B4508                  mov eax, dword ptr [ebp+08]
:0041FD57 83C009                  add eax, 00000009
:0041FD5A 8945FC                  mov dword ptr [ebp-04], eax
:0041FD5D E961000000              jmp 0041FDC3
:0041FD62 C745FC17000000          mov [ebp-04], 00000017
:0041FD69 E955000000              jmp 0041FDC3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FD8F(C)
|
:0041FD6E 817D08FF000000          cmp dword ptr [ebp+08], 000000FF
:0041FD75 0F8706000000            ja 0041FD81
:0041FD7B 8B4508                  mov eax, dword ptr [ebp+08]
:0041FD7E 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FD75(C)
|
:0041FD81 E93D000000              jmp 0041FDC3
:0041FD86 E938000000              jmp 0041FDC3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FD35(U)
|
:0041FD8B 837DF807                cmp dword ptr [ebp-08], 00000007
:0041FD8F 0F87D9FFFFFF            ja 0041FD6E
:0041FD95 8B45F8                  mov eax, dword ptr [ebp-08]
:0041FD98 33C9                    xor ecx, ecx
:0041FD9A 8A88BBFD4100            mov cl, byte ptr [eax+0041FDBB]
:0041FDA0 FF248DA7FD4100          jmp dword ptr [4*ecx+0041FDA7]

:0041FDA7 3AFD4100                DWORD 0041FD3A
:0041FDAB 48FD4100                DWORD 0041FD48
:0041FDAF 54FD4100                DWORD 0041FD54
:0041FDB3 62FD4100                DWORD 0041FD62
:0041FDB7 6EFD4100                DWORD 0041FD6E


:0041FDBB 000000                  BYTE  3 DUP(0)


:0041FDBE 0102                    add dword ptr [edx], eax
:0041FDC0 0202                    add al, byte ptr [edx]
:0041FDC2 038A45FCE900            add ecx, dword ptr [edx+00E9FC45]
:0041FDC8 000000                  BYTE  3 DUP(0)


:0041FDCB 5F                      pop edi
:0041FDCC 5E                      pop esi
:0041FDCD 5B                      pop ebx
:0041FDCE C9                      leave
:0041FDCF C3                      ret



* Referenced by a CALL at Addresses:
|:00403429   , :004108FA   , :00416CEE   , :00420150   , :004216E5   
|:00423DB1   , :00424CC4   , :0042A996   , :0042C049   , :0042C916   
|:00437A27   , :004382D7   , :00438EEA   , :004392DA   , :00439C78   
|:0043C403   , :0043E233   , :0043EF03   , :0043EFF2   , :0043F708   
|:00443DB0   , :00443EE4   
|
:0041FDD0 55                      push ebp
:0041FDD1 8BEC                    mov ebp, esp
:0041FDD3 83EC04                  sub esp, 00000004
:0041FDD6 53                      push ebx
:0041FDD7 56                      push esi
:0041FDD8 57                      push edi
:0041FDD9 894DFC                  mov dword ptr [ebp-04], ecx
:0041FDDC 837D0800                cmp dword ptr [ebp+08], 00000000
:0041FDE0 0F850C000000            jne 0041FDF2
:0041FDE6 8B45FC                  mov eax, dword ptr [ebp-04]
:0041FDE9 C6400200                mov [eax+02], 00
:0041FDED E912000000              jmp 0041FE04

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FDE0(C)
|
:0041FDF2 8B4508                  mov eax, dword ptr [ebp+08]
:0041FDF5 50                      push eax
:0041FDF6 E824FFFFFF              call 0041FD1F
:0041FDFB 83C404                  add esp, 00000004
:0041FDFE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041FE01 884102                  mov byte ptr [ecx+02], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FDED(U)
|
:0041FE04 8B45FC                  mov eax, dword ptr [ebp-04]
:0041FE07 33C9                    xor ecx, ecx
:0041FE09 8A4802                  mov cl, byte ptr [eax+02]
:0041FE0C 51                      push ecx
:0041FE0D 8B45FC                  mov eax, dword ptr [ebp-04]
:0041FE10 33C9                    xor ecx, ecx
:0041FE12 8A4801                  mov cl, byte ptr [eax+01]
:0041FE15 51                      push ecx
:0041FE16 8B45FC                  mov eax, dword ptr [ebp-04]
:0041FE19 33C9                    xor ecx, ecx
:0041FE1B 8A08                    mov cl, byte ptr [eax]
:0041FE1D 51                      push ecx
:0041FE1E E82B4F0200              call 00444D4E
:0041FE23 83C40C                  add esp, 0000000C
:0041FE26 E900000000              jmp 0041FE2B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FE26(U)
|
:0041FE2B 5F                      pop edi
:0041FE2C 5E                      pop esi
:0041FE2D 5B                      pop ebx
:0041FE2E C9                      leave
:0041FE2F C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0040F486   , :0041091E   , :0042019D   , :004343DB   , :004359EC   
|:00439C90   , :0043BBD3   , :00443ED8   
|
:0041FE32 55                      push ebp
:0041FE33 8BEC                    mov ebp, esp
:0041FE35 83EC04                  sub esp, 00000004
:0041FE38 53                      push ebx
:0041FE39 56                      push esi
:0041FE3A 57                      push edi
:0041FE3B 894DFC                  mov dword ptr [ebp-04], ecx
:0041FE3E 8B4508                  mov eax, dword ptr [ebp+08]
:0041FE41 50                      push eax
:0041FE42 E8D8FEFFFF              call 0041FD1F
:0041FE47 83C404                  add esp, 00000004
:0041FE4A 33C9                    xor ecx, ecx
:0041FE4C 8AC8                    mov cl, al
:0041FE4E 8B45FC                  mov eax, dword ptr [ebp-04]
:0041FE51 89481F                  mov dword ptr [eax+1F], ecx
:0041FE54 E900000000              jmp 0041FE59

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FE54(U)
|
:0041FE59 5F                      pop edi
:0041FE5A 5E                      pop esi
:0041FE5B 5B                      pop ebx
:0041FE5C C9                      leave
:0041FE5D C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0040F46E   , :0040F546   , :00410912   , :00410A67   , :0041672B   
|:00416752   , :004201B3   , :004343CF   , :00434436   , :004359E0   
|:00435A1A   , :00439C84   , :00439DB2   , :00443ECC   , :00443F2D   
|
:0041FE60 55                      push ebp
:0041FE61 8BEC                    mov ebp, esp
:0041FE63 83EC04                  sub esp, 00000004
:0041FE66 53                      push ebx
:0041FE67 56                      push esi
:0041FE68 57                      push edi
:0041FE69 894DFC                  mov dword ptr [ebp-04], ecx
:0041FE6C 8B4508                  mov eax, dword ptr [ebp+08]
:0041FE6F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041FE72 894131                  mov dword ptr [ecx+31], eax
:0041FE75 E900000000              jmp 0041FE7A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FE75(U)
|
:0041FE7A 5F                      pop edi
:0041FE7B 5E                      pop esi
:0041FE7C 5B                      pop ebx
:0041FE7D C9                      leave
:0041FE7E C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:004032C6   , :00403411   , :0040CF05   , :0040CFF9   , :0040F47A   
|:00410906   , :00416CD6   , :00420103   , :004216AB   , :00423D99   
|:00429777   , :0042A97E   , :0042C031   , :0042C8FE   , :00437A1B   
|:004382BF   , :00438ED2   , :004392C2   , :004396B8   , :00439C5C   
|:00439F63   , :0043BBC7   , :0043C3F7   , :0043E21B   , :0043EF0F   
|:0043EFE6   , :0043F714   , :00443D98   
|
:0041FE81 55                      push ebp
:0041FE82 8BEC                    mov ebp, esp
:0041FE84 83EC04                  sub esp, 00000004
:0041FE87 53                      push ebx
:0041FE88 56                      push esi
:0041FE89 57                      push edi
:0041FE8A 894DFC                  mov dword ptr [ebp-04], ecx
:0041FE8D 8A4508                  mov al, byte ptr [ebp+08]
:0041FE90 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041FE93 8801                    mov byte ptr [ecx], al
:0041FE95 8B45FC                  mov eax, dword ptr [ebp-04]
:0041FE98 33C9                    xor ecx, ecx
:0041FE9A 8A4802                  mov cl, byte ptr [eax+02]
:0041FE9D 51                      push ecx
:0041FE9E 8B45FC                  mov eax, dword ptr [ebp-04]
:0041FEA1 33C9                    xor ecx, ecx
:0041FEA3 8A4801                  mov cl, byte ptr [eax+01]
:0041FEA6 51                      push ecx
:0041FEA7 8B45FC                  mov eax, dword ptr [ebp-04]
:0041FEAA 33C9                    xor ecx, ecx
:0041FEAC 8A08                    mov cl, byte ptr [eax]
:0041FEAE 51                      push ecx
:0041FEAF E89A4E0200              call 00444D4E
:0041FEB4 83C40C                  add esp, 0000000C
:0041FEB7 E900000000              jmp 0041FEBC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FEB7(U)
|
:0041FEBC 5F                      pop edi
:0041FEBD 5E                      pop esi
:0041FEBE 5B                      pop ebx
:0041FEBF C9                      leave
:0041FEC0 C20400                  ret 0004


:0041FEC3 55                      push ebp
:0041FEC4 8BEC                    mov ebp, esp
:0041FEC6 83EC04                  sub esp, 00000004
:0041FEC9 53                      push ebx
:0041FECA 56                      push esi
:0041FECB 57                      push edi
:0041FECC 894DFC                  mov dword ptr [ebp-04], ecx
:0041FECF 817D08A8010000          cmp dword ptr [ebp+08], 000001A8
:0041FED6 0F8709000000            ja 0041FEE5
:0041FEDC 8A4508                  mov al, byte ptr [ebp+08]
:0041FEDF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041FEE2 884123                  mov byte ptr [ecx+23], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FED6(C)
|
:0041FEE5 E900000000              jmp 0041FEEA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FEE5(U)
|
:0041FEEA 5F                      pop edi
:0041FEEB 5E                      pop esi
:0041FEEC 5B                      pop ebx
:0041FEED C9                      leave
:0041FEEE C20400                  ret 0004


:0041FEF1 55                      push ebp
:0041FEF2 8BEC                    mov ebp, esp
:0041FEF4 83EC04                  sub esp, 00000004
:0041FEF7 53                      push ebx
:0041FEF8 56                      push esi
:0041FEF9 57                      push edi
:0041FEFA 894DFC                  mov dword ptr [ebp-04], ecx
:0041FEFD 837D084F                cmp dword ptr [ebp+08], 0000004F
:0041FF01 0F8709000000            ja 0041FF10
:0041FF07 8B4508                  mov eax, dword ptr [ebp+08]
:0041FF0A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041FF0D 89410F                  mov dword ptr [ecx+0F], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FF01(C)
|
:0041FF10 E900000000              jmp 0041FF15

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FF10(U)
|
:0041FF15 5F                      pop edi
:0041FF16 5E                      pop esi
:0041FF17 5B                      pop ebx
:0041FF18 C9                      leave
:0041FF19 C20400                  ret 0004


:0041FF1C 55                      push ebp
:0041FF1D 8BEC                    mov ebp, esp
:0041FF1F 83EC04                  sub esp, 00000004
:0041FF22 53                      push ebx
:0041FF23 56                      push esi
:0041FF24 57                      push edi
:0041FF25 894DFC                  mov dword ptr [ebp-04], ecx
:0041FF28 8B45FC                  mov eax, dword ptr [ebp-04]
:0041FF2B C7400F4F000000          mov [eax+0F], 0000004F
:0041FF32 E900000000              jmp 0041FF37

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FF32(U)
|
:0041FF37 5F                      pop edi
:0041FF38 5E                      pop esi
:0041FF39 5B                      pop ebx
:0041FF3A C9                      leave
:0041FF3B C3                      ret



* Referenced by a CALL at Addresses:
|:0041F854   , :0041F902   , :0041F956   , :0041F999   , :0041FA5D   
|:00420A5E   
|
:0041FF3C 55                      push ebp
:0041FF3D 8BEC                    mov ebp, esp
:0041FF3F 83EC24                  sub esp, 00000024
:0041FF42 53                      push ebx
:0041FF43 56                      push esi
:0041FF44 57                      push edi
:0041FF45 894DE8                  mov dword ptr [ebp-18], ecx
:0041FF48 C745F800000000          mov [ebp-08], 00000000
:0041FF4F 8B45E8                  mov eax, dword ptr [ebp-18]
:0041FF52 8B4035                  mov eax, dword ptr [eax+35]
:0041FF55 8945E4                  mov dword ptr [ebp-1C], eax
:0041FF58 E9A5040000              jmp 00420402
:0041FF5D 33C0                    xor eax, eax
:0041FF5F 8A4508                  mov al, byte ptr [ebp+08]
:0041FF62 8945E0                  mov dword ptr [ebp-20], eax
:0041FF65 E982000000              jmp 0041FFEC
:0041FF6A 8B45E8                  mov eax, dword ptr [ebp-18]
:0041FF6D C7403502000000          mov [eax+35], 00000002
:0041FF74 E9D2000000              jmp 0042004B
:0041FF79 8B45E8                  mov eax, dword ptr [ebp-18]
:0041FF7C C7403504000000          mov [eax+35], 00000004
:0041FF83 E9C3000000              jmp 0042004B
:0041FF88 8B45E8                  mov eax, dword ptr [ebp-18]
:0041FF8B C7403505000000          mov [eax+35], 00000005
:0041FF92 E9B4000000              jmp 0042004B
:0041FF97 8B45E8                  mov eax, dword ptr [ebp-18]
:0041FF9A C7403506000000          mov [eax+35], 00000006
:0041FFA1 E9A5000000              jmp 0042004B
:0041FFA6 6A01                    push 00000001
:0041FFA8 E8A1760100              call 0043764E
:0041FFAD 83C404                  add esp, 00000004
:0041FFB0 E994040000              jmp 00420449
:0041FFB5 E9CB000000              jmp 00420085
:0041FFBA 8B45E8                  mov eax, dword ptr [ebp-18]
:0041FFBD C7403508000000          mov [eax+35], 00000008
:0041FFC4 E982000000              jmp 0042004B
:0041FFC9 8B45E8                  mov eax, dword ptr [ebp-18]
:0041FFCC C7403509000000          mov [eax+35], 00000009
:0041FFD3 E973000000              jmp 0042004B
:0041FFD8 8B45E8                  mov eax, dword ptr [ebp-18]
:0041FFDB C740350A000000          mov [eax+35], 0000000A
:0041FFE2 E964000000              jmp 0042004B
:0041FFE7 E95F000000              jmp 0042004B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FF65(U)
|
:0041FFEC 836DE03D                sub dword ptr [ebp-20], 0000003D
:0041FFF0 837DE01A                cmp dword ptr [ebp-20], 0000001A
:0041FFF4 0F8751000000            ja 0042004B
:0041FFFA 8B45E0                  mov eax, dword ptr [ebp-20]
:0041FFFD 33C9                    xor ecx, ecx
:0041FFFF 8A8830004200            mov cl, byte ptr [eax+00420030]
:00420005 FF248D0C004200          jmp dword ptr [4*ecx+0042000C]
:0042000C 6AFF                    push FFFFFFFF
:0042000E 41                      inc ecx
:0042000F 00BAFF410079            add byte ptr [edx+790041FF], bh
:00420015 FF4100                  inc [ecx+00]
:00420018 C9                      leave
:00420019 FF4100                  inc [ecx+00]
:0042001C D8FF                    fdivr st(0), st(7)
:0042001E 41                      inc ecx
:0042001F 0097FF410088            add byte ptr [edi+880041FF], dl
:00420025 FF4100                  inc [ecx+00]
:00420028 A6                      cmpsb
:00420029 FF4100                  inc [ecx+00]
:0042002C 4B                      dec ebx
:0042002D 004200                  add byte ptr [edx+00], al
:00420030 0008                    add byte ptr [eax], cl
:00420032 0808                    or byte ptr [eax], cl
:00420034 0801                    or byte ptr [ecx], al
:00420036 0208                    add cl, byte ptr [eax]
:00420038 0803                    or byte ptr [ebx], al
:0042003A 0408                    add al, 08
:0042003C 0808                    or byte ptr [eax], cl
:0042003E 0808                    or byte ptr [eax], cl
:00420040 0508080808              add eax, 08080808
:00420045 06                      push es
:00420046 0808                    or byte ptr [eax], cl
:00420048 0808                    or byte ptr [eax], cl
:0042004A 07                      pop es

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041FF74(U), :0041FF83(U), :0041FF92(U), :0041FFA1(U), :0041FFC4(U)
|:0041FFD3(U), :0041FFE2(U), :0041FFE7(U), :0041FFF4(C)
|
:0042004B E9F1030000              jmp 00420441
:00420050 33C0                    xor eax, eax
:00420052 8A4508                  mov al, byte ptr [ebp+08]
:00420055 8D04C500FFFFFF          lea eax, dword ptr [8*eax+FFFFFF00]
:0042005C 50                      push eax
:0042005D 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00420060 E86BFBFFFF              call 0041FBD0
:00420065 8B45E8                  mov eax, dword ptr [ebp-18]
:00420068 C7403503000000          mov [eax+35], 00000003
:0042006F E9CD030000              jmp 00420441
:00420074 33C0                    xor eax, eax
:00420076 8A4508                  mov al, byte ptr [ebp+08]
:00420079 83E820                  sub eax, 00000020
:0042007C 50                      push eax
:0042007D 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00420080 E8F9FAFFFF              call 0041FB7E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041FFB5(U), :004200DC(U), :004200F2(U), :00420108(U), :00420155(U)
|:004201A2(U), :004201B8(U), :00420449(U)
|
:00420085 8B45E8                  mov eax, dword ptr [ebp-18]
:00420088 C7403500000000          mov [eax+35], 00000000
:0042008F E9AD030000              jmp 00420441
:00420094 8B4508                  mov eax, dword ptr [ebp+08]
:00420097 50                      push eax
:00420098 E8B30A0000              call 00420B50
:0042009D 83C404                  add esp, 00000004
:004200A0 85C0                    test eax, eax
:004200A2 0F8410000000            je 004200B8
:004200A8 33C0                    xor eax, eax
:004200AA 8A4508                  mov al, byte ptr [ebp+08]
:004200AD 83E830                  sub eax, 00000030
:004200B0 884508                  mov byte ptr [ebp+08], al
:004200B3 E916000000              jmp 004200CE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004200A2(C)
|
:004200B8 8B4508                  mov eax, dword ptr [ebp+08]
:004200BB 50                      push eax
:004200BC E8CF0A0000              call 00420B90
:004200C1 83C404                  add esp, 00000004
:004200C4 33C9                    xor ecx, ecx
:004200C6 8AC8                    mov cl, al
:004200C8 83E937                  sub ecx, 00000037
:004200CB 884D08                  mov byte ptr [ebp+08], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004200B3(U)
|
:004200CE 33C0                    xor eax, eax
:004200D0 8A4508                  mov al, byte ptr [ebp+08]
:004200D3 50                      push eax
:004200D4 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004200D7 E8F7FBFFFF              call 0041FCD3
:004200DC E9A4FFFFFF              jmp 00420085
:004200E1 33C0                    xor eax, eax
:004200E3 8A4508                  mov al, byte ptr [ebp+08]
:004200E6 83E820                  sub eax, 00000020
:004200E9 50                      push eax
:004200EA 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004200ED E845FBFFFF              call 0041FC37
:004200F2 E98EFFFFFF              jmp 00420085
:004200F7 33C0                    xor eax, eax
:004200F9 8A4508                  mov al, byte ptr [ebp+08]
:004200FC 83E830                  sub eax, 00000030
:004200FF 50                      push eax
:00420100 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00420103 E879FDFFFF              call 0041FE81
:00420108 E978FFFFFF              jmp 00420085
:0042010D 8B4508                  mov eax, dword ptr [ebp+08]
:00420110 50                      push eax
:00420111 E83A0A0000              call 00420B50
:00420116 83C404                  add esp, 00000004
:00420119 85C0                    test eax, eax
:0042011B 0F8410000000            je 00420131
:00420121 33C0                    xor eax, eax
:00420123 8A4508                  mov al, byte ptr [ebp+08]
:00420126 83E830                  sub eax, 00000030
:00420129 884508                  mov byte ptr [ebp+08], al
:0042012C E916000000              jmp 00420147

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042011B(C)
|
:00420131 8B4508                  mov eax, dword ptr [ebp+08]
:00420134 50                      push eax
:00420135 E8560A0000              call 00420B90
:0042013A 83C404                  add esp, 00000004
:0042013D 33C9                    xor ecx, ecx
:0042013F 8AC8                    mov cl, al
:00420141 83E937                  sub ecx, 00000037
:00420144 884D08                  mov byte ptr [ebp+08], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042012C(U)
|
:00420147 33C0                    xor eax, eax
:00420149 8A4508                  mov al, byte ptr [ebp+08]
:0042014C 50                      push eax
:0042014D 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00420150 E87BFCFFFF              call 0041FDD0
:00420155 E92BFFFFFF              jmp 00420085
:0042015A 8B4508                  mov eax, dword ptr [ebp+08]
:0042015D 50                      push eax
:0042015E E8ED090000              call 00420B50
:00420163 83C404                  add esp, 00000004
:00420166 85C0                    test eax, eax
:00420168 0F8410000000            je 0042017E
:0042016E 33C0                    xor eax, eax
:00420170 8A4508                  mov al, byte ptr [ebp+08]
:00420173 83E830                  sub eax, 00000030
:00420176 884508                  mov byte ptr [ebp+08], al
:00420179 E916000000              jmp 00420194

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420168(C)
|
:0042017E 8B4508                  mov eax, dword ptr [ebp+08]
:00420181 50                      push eax
:00420182 E8090A0000              call 00420B90
:00420187 83C404                  add esp, 00000004
:0042018A 33C9                    xor ecx, ecx
:0042018C 8AC8                    mov cl, al
:0042018E 83E937                  sub ecx, 00000037
:00420191 884D08                  mov byte ptr [ebp+08], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420179(U)
|
:00420194 33C0                    xor eax, eax
:00420196 8A4508                  mov al, byte ptr [ebp+08]
:00420199 50                      push eax
:0042019A 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0042019D E890FCFFFF              call 0041FE32
:004201A2 E9DEFEFFFF              jmp 00420085
:004201A7 33C0                    xor eax, eax
:004201A9 8A4508                  mov al, byte ptr [ebp+08]
:004201AC 83E830                  sub eax, 00000030
:004201AF 50                      push eax
:004201B0 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004201B3 E8A8FCFFFF              call 0041FE60
:004201B8 E9C8FEFFFF              jmp 00420085

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420409(C)
|
:004201BD 8B45E8                  mov eax, dword ptr [ebp-18]
:004201C0 33C9                    xor ecx, ecx
:004201C2 8A4824                  mov cl, byte ptr [eax+24]
:004201C5 85C9                    test ecx, ecx
:004201C7 0F8421000000            je 004201EE
:004201CD 8B45E8                  mov eax, dword ptr [ebp-18]
:004201D0 33C9                    xor ecx, ecx
:004201D2 8A4824                  mov cl, byte ptr [eax+24]
:004201D5 C1E108                  shl ecx, 08
:004201D8 33C0                    xor eax, eax
:004201DA 8A4508                  mov al, byte ptr [ebp+08]
:004201DD 03C8                    add ecx, eax
:004201DF 894DF0                  mov dword ptr [ebp-10], ecx
:004201E2 8B45E8                  mov eax, dword ptr [ebp-18]
:004201E5 C6402400                mov [eax+24], 00
:004201E9 E9BE000000              jmp 004202AC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004201C7(C)
|
:004201EE 837D0C02                cmp dword ptr [ebp+0C], 00000002
:004201F2 0F842E000000            je 00420226
:004201F8 33C0                    xor eax, eax
:004201FA 8A4508                  mov al, byte ptr [ebp+08]
:004201FD 3D81000000              cmp eax, 00000081
:00420202 0F8C1E000000            jl 00420226
:00420208 33C0                    xor eax, eax
:0042020A 8A4508                  mov al, byte ptr [ebp+08]
:0042020D 3DFE000000              cmp eax, 000000FE
:00420212 0F8F0E000000            jg 00420226
:00420218 8A4508                  mov al, byte ptr [ebp+08]
:0042021B 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0042021E 884124                  mov byte ptr [ecx+24], al
:00420221 E91B020000              jmp 00420441

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004201F2(C), :00420202(C), :00420212(C)
|
:00420226 33C0                    xor eax, eax
:00420228 8A4508                  mov al, byte ptr [ebp+08]
:0042022B 83F81B                  cmp eax, 0000001B
:0042022E 0F850F000000            jne 00420243
:00420234 8B45E8                  mov eax, dword ptr [ebp-18]
:00420237 C7403501000000          mov [eax+35], 00000001
:0042023E E9FE010000              jmp 00420441

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042022E(C)
|
:00420243 33C0                    xor eax, eax
:00420245 8A4508                  mov al, byte ptr [ebp+08]
:00420248 83F820                  cmp eax, 00000020
:0042024B 0F8D53000000            jnl 004202A4
:00420251 33C0                    xor eax, eax
:00420253 8A4508                  mov al, byte ptr [ebp+08]
:00420256 8945DC                  mov dword ptr [ebp-24], eax
:00420259 E928000000              jmp 00420286

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042028A(C)
|
:0042025E 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00420261 E823FAFFFF              call 0041FC89
:00420266 E934000000              jmp 0042029F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420294(C)
|
:0042026B 8B45E8                  mov eax, dword ptr [ebp-18]
:0042026E 8B401B                  mov eax, dword ptr [eax+1B]
:00420271 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00420274 894103                  mov dword ptr [ecx+03], eax
:00420277 E923000000              jmp 0042029F
:0042027C E91E000000              jmp 0042029F
:00420281 E919000000              jmp 0042029F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420259(U)
|
:00420286 837DDC0A                cmp dword ptr [ebp-24], 0000000A
:0042028A 0F84CEFFFFFF            je 0042025E
:00420290 837DDC0D                cmp dword ptr [ebp-24], 0000000D
:00420294 0F84D1FFFFFF            je 0042026B
:0042029A E900000000              jmp 0042029F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00420266(U), :00420277(U), :0042027C(U), :00420281(U), :0042029A(U)
|
:0042029F E99D010000              jmp 00420441

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042024B(C)
|
:004202A4 33C0                    xor eax, eax
:004202A6 8A4508                  mov al, byte ptr [ebp+08]
:004202A9 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004201E9(U)
|
:004202AC 817DF000020000          cmp dword ptr [ebp-10], 00000200
:004202B3 0F830C000000            jnb 004202C5
:004202B9 C745F401000000          mov [ebp-0C], 00000001
:004202C0 E907000000              jmp 004202CC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004202B3(C)
|
:004202C5 C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004202C0(U)
|
:004202CC 837DF400                cmp dword ptr [ebp-0C], 00000000
:004202D0 0F840E000000            je 004202E4
:004202D6 8B45E8                  mov eax, dword ptr [ebp-18]
:004202D9 8B400F                  mov eax, dword ptr [eax+0F]
:004202DC 8945EC                  mov dword ptr [ebp-14], eax
:004202DF E90A000000              jmp 004202EE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004202D0(C)
|
:004202E4 8B45E8                  mov eax, dword ptr [ebp-18]
:004202E7 8B400F                  mov eax, dword ptr [eax+0F]
:004202EA 48                      dec eax
:004202EB 8945EC                  mov dword ptr [ebp-14], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004202DF(U)
|
:004202EE 8B45E8                  mov eax, dword ptr [ebp-18]
:004202F1 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004202F4 394803                  cmp dword ptr [eax+03], ecx
:004202F7 0F862F000000            jbe 0042032C
:004202FD 8B45E8                  mov eax, dword ptr [ebp-18]
:00420300 83780F4F                cmp dword ptr [eax+0F], 0000004F
:00420304 0F841A000000            je 00420324
:0042030A 817DF022210000          cmp dword ptr [ebp-10], 00002122
:00420311 0F820D000000            jb 00420324
:00420317 817DF025210000          cmp dword ptr [ebp-10], 00002125
:0042031E 0F8608000000            jbe 0042032C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00420304(C), :00420311(C)
|
:00420324 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00420327 E85DF9FFFF              call 0041FC89

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004202F7(C), :0042031E(C)
|
:0042032C 8B450C                  mov eax, dword ptr [ebp+0C]
:0042032F 50                      push eax
:00420330 8B45F0                  mov eax, dword ptr [ebp-10]
:00420333 50                      push eax
:00420334 8B45E8                  mov eax, dword ptr [ebp-18]
:00420337 8B4007                  mov eax, dword ptr [eax+07]
:0042033A 50                      push eax
:0042033B 8B45E8                  mov eax, dword ptr [ebp-18]
:0042033E 8B4003                  mov eax, dword ptr [eax+03]
:00420341 50                      push eax
:00420342 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00420345 E8FB030000              call 00420745
:0042034A 8945F8                  mov dword ptr [ebp-08], eax
:0042034D 8B45E8                  mov eax, dword ptr [ebp-18]
:00420350 33C9                    xor ecx, ecx
:00420352 8A08                    mov cl, byte ptr [eax]
:00420354 F6C140                  test cl, 40
:00420357 0F840C000000            je 00420369
:0042035D C745FC02000000          mov [ebp-04], 00000002
:00420364 E907000000              jmp 00420370

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420357(C)
|
:00420369 C745FC01000000          mov [ebp-04], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420364(U)
|
:00420370 8B45E8                  mov eax, dword ptr [ebp-18]
:00420373 33C9                    xor ecx, ecx
:00420375 8A08                    mov cl, byte ptr [eax]
:00420377 F6C120                  test cl, 20
:0042037A 0F844C000000            je 004203CC
:00420380 8B45E8                  mov eax, dword ptr [ebp-18]
:00420383 33C9                    xor ecx, ecx
:00420385 8A08                    mov cl, byte ptr [eax]
:00420387 81E1C0000000            and ecx, 000000C0
:0042038D 83F901                  cmp ecx, 00000001
:00420390 B800000000              mov eax, 00000000
:00420395 83D0FF                  adc eax, FFFFFFFF
:00420398 83E010                  and eax, 00000010
:0042039B 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0042039E 33D2                    xor edx, edx
:004203A0 8A5123                  mov dl, byte ptr [ecx+23]
:004203A3 03C2                    add eax, edx
:004203A5 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004203A8 014107                  add dword ptr [ecx+07], eax
:004203AB 8B45E8                  mov eax, dword ptr [ebp-18]
:004203AE 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004203B1 8B4907                  mov ecx, dword ptr [ecx+07]
:004203B4 394817                  cmp dword ptr [eax+17], ecx
:004203B7 0F830A000000            jnb 004203C7
:004203BD 8B45E8                  mov eax, dword ptr [ebp-18]
:004203C0 C7400700000000          mov [eax+07], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004203B7(C)
|
:004203C7 E92C000000              jmp 004203F8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042037A(C)
|
:004203CC 837D0C01                cmp dword ptr [ebp+0C], 00000001
:004203D0 0F850C000000            jne 004203E2
:004203D6 8B45E8                  mov eax, dword ptr [ebp-18]
:004203D9 83400304                add dword ptr [eax+03], 00000004
:004203DD E916000000              jmp 004203F8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004203D0(C)
|
:004203E2 837DF401                cmp dword ptr [ebp-0C], 00000001
:004203E6 B802000000              mov eax, 00000002
:004203EB 83D0FF                  adc eax, FFFFFFFF
:004203EE 0FAF45FC                imul eax, dword ptr [ebp-04]
:004203F2 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004203F5 014103                  add dword ptr [ecx+03], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004203C7(U), :004203DD(U)
|
:004203F8 E944000000              jmp 00420441
:004203FD E93F000000              jmp 00420441

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FF58(U)
|
:00420402 FF4DE4                  dec [ebp-1C]
:00420405 837DE409                cmp dword ptr [ebp-1C], 00000009
:00420409 0F87AEFDFFFF            ja 004201BD
:0042040F 8B45E4                  mov eax, dword ptr [ebp-1C]
:00420412 FF248519044200          jmp dword ptr [4*eax+00420419]
:00420419 5D                      pop ebp
:0042041A FF4100                  inc [ecx+00]

:0042041D 50004200                DWORD 00420050
:00420421 74004200                DWORD 00420074
:00420425 94004200                DWORD 00420094
:00420429 E1004200                DWORD 004200E1
:0042042D F7004200                DWORD 004200F7
:00420431 BD014200                DWORD 004201BD
:00420435 0D014200                DWORD 0042010D
:00420439 5A014200                DWORD 0042015A
:0042043D A7014200                DWORD 004201A7



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042004B(U), :0042006F(U), :0042008F(U), :00420221(U), :0042023E(U)
|:0042029F(U), :004203F8(U), :004203FD(U)
|
:00420441 8B45F8                  mov eax, dword ptr [ebp-08]
:00420444 E905000000              jmp 0042044E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FFB0(U)
|
:00420449 E937FCFFFF              jmp 00420085

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420444(U)
|
:0042044E 5F                      pop edi
:0042044F 5E                      pop esi
:00420450 5B                      pop ebx
:00420451 C9                      leave
:00420452 C20800                  ret 0008



* Referenced by a CALL at Address:
|:00420860   
|
:00420455 55                      push ebp
:00420456 8BEC                    mov ebp, esp
:00420458 83EC18                  sub esp, 00000018
:0042045B 53                      push ebx
:0042045C 56                      push esi
:0042045D 57                      push edi
:0042045E 8B4510                  mov eax, dword ptr [ebp+10]
:00420461 C1E004                  shl eax, 04
:00420464 50                      push eax
:00420465 8B450C                  mov eax, dword ptr [ebp+0C]
:00420468 50                      push eax
:00420469 8B4508                  mov eax, dword ptr [ebp+08]
:0042046C 50                      push eax
:0042046D E8DB6F0200              call 0044744D
:00420472 83C40C                  add esp, 0000000C
:00420475 837D1001                cmp dword ptr [ebp+10], 00000001
:00420479 0F8461010000            je 004205E0
:0042047F 8B450C                  mov eax, dword ptr [ebp+0C]
:00420482 8945FC                  mov dword ptr [ebp-04], eax
:00420485 C745F800000000          mov [ebp-08], 00000000
:0042048C E903000000              jmp 00420494

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004204E5(U)
|
:00420491 FF45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042048C(U)
|
:00420494 837DF810                cmp dword ptr [ebp-08], 00000010
:00420498 0F8D4C000000            jnl 004204EA
:0042049E 8B45FC                  mov eax, dword ptr [ebp-04]
:004204A1 668B00                  mov ax, word ptr [eax]
:004204A4 668945F4                mov word ptr [ebp-0C], ax
:004204A8 8B45F4                  mov eax, dword ptr [ebp-0C]
:004204AB 25FFFF0000              and eax, 0000FFFF
:004204B0 03C0                    add eax, eax
:004204B2 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004204B5 81E1FFFF0000            and ecx, 0000FFFF
:004204BB C1E90F                  shr ecx, 0F
:004204BE 0BC1                    or eax, ecx
:004204C0 25FEFF0000              and eax, 0000FFFE
:004204C5 668945F4                mov word ptr [ebp-0C], ax
:004204C9 8B45FC                  mov eax, dword ptr [ebp-04]
:004204CC 33C9                    xor ecx, ecx
:004204CE 668B08                  mov cx, word ptr [eax]
:004204D1 8B45F4                  mov eax, dword ptr [ebp-0C]
:004204D4 25FFFF0000              and eax, 0000FFFF
:004204D9 0BC8                    or ecx, eax
:004204DB 8B45FC                  mov eax, dword ptr [ebp-04]
:004204DE 668908                  mov word ptr [eax], cx
:004204E1 8345FC02                add dword ptr [ebp-04], 00000002
:004204E5 E9A7FFFFFF              jmp 00420491

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420498(C)
|
:004204EA 8B450C                  mov eax, dword ptr [ebp+0C]
:004204ED 8945FC                  mov dword ptr [ebp-04], eax
:004204F0 C745F800000000          mov [ebp-08], 00000000
:004204F7 E903000000              jmp 004204FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420551(U)
|
:004204FC FF45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004204F7(U)
|
:004204FF 837DF810                cmp dword ptr [ebp-08], 00000010
:00420503 0F8D4D000000            jnl 00420556
:00420509 8B45FC                  mov eax, dword ptr [ebp-04]
:0042050C 668B00                  mov ax, word ptr [eax]
:0042050F 668945F0                mov word ptr [ebp-10], ax
:00420513 8B45F0                  mov eax, dword ptr [ebp-10]
:00420516 25FFFF0000              and eax, 0000FFFF
:0042051B C1E00F                  shl eax, 0F
:0042051E 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00420521 81E1FFFF0000            and ecx, 0000FFFF
:00420527 C1E901                  shr ecx, 01
:0042052A 0BC1                    or eax, ecx
:0042052C 25FEFF0000              and eax, 0000FFFE
:00420531 668945F0                mov word ptr [ebp-10], ax
:00420535 8B45FC                  mov eax, dword ptr [ebp-04]
:00420538 33C9                    xor ecx, ecx
:0042053A 668B08                  mov cx, word ptr [eax]
:0042053D 8B45F0                  mov eax, dword ptr [ebp-10]
:00420540 25FFFF0000              and eax, 0000FFFF
:00420545 0BC8                    or ecx, eax
:00420547 8B45FC                  mov eax, dword ptr [ebp-04]
:0042054A 668908                  mov word ptr [eax], cx
:0042054D 8345FC02                add dword ptr [ebp-04], 00000002
:00420551 E9A6FFFFFF              jmp 004204FC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420503(C)
|
:00420556 8B450C                  mov eax, dword ptr [ebp+0C]
:00420559 8945FC                  mov dword ptr [ebp-04], eax
:0042055C C745F800000000          mov [ebp-08], 00000000
:00420563 E903000000              jmp 0042056B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420592(U)
|
:00420568 FF45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420563(U)
|
:0042056B 837DF80F                cmp dword ptr [ebp-08], 0000000F
:0042056F 0F8D22000000            jnl 00420597
:00420575 8B45FC                  mov eax, dword ptr [ebp-04]
:00420578 33C9                    xor ecx, ecx
:0042057A 668B4802                mov cx, word ptr [eax+02]
:0042057E 8B45FC                  mov eax, dword ptr [ebp-04]
:00420581 33D2                    xor edx, edx
:00420583 668B10                  mov dx, word ptr [eax]
:00420586 0BCA                    or ecx, edx
:00420588 8B45FC                  mov eax, dword ptr [ebp-04]
:0042058B 668908                  mov word ptr [eax], cx
:0042058E 8345FC02                add dword ptr [ebp-04], 00000002
:00420592 E9D1FFFFFF              jmp 00420568

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042056F(C)
|
:00420597 8B450C                  mov eax, dword ptr [ebp+0C]
:0042059A 83C01E                  add eax, 0000001E
:0042059D 8945FC                  mov dword ptr [ebp-04], eax
:004205A0 C745F800000000          mov [ebp-08], 00000000
:004205A7 E903000000              jmp 004205AF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004205D6(U)
|
:004205AC FF45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004205A7(U)
|
:004205AF 837DF80F                cmp dword ptr [ebp-08], 0000000F
:004205B3 0F8D22000000            jnl 004205DB
:004205B9 8B45FC                  mov eax, dword ptr [ebp-04]
:004205BC 33C9                    xor ecx, ecx
:004205BE 668B48FE                mov cx, word ptr [eax-02]
:004205C2 8B45FC                  mov eax, dword ptr [ebp-04]
:004205C5 33D2                    xor edx, edx
:004205C7 668B10                  mov dx, word ptr [eax]
:004205CA 0BCA                    or ecx, edx
:004205CC 8B45FC                  mov eax, dword ptr [ebp-04]
:004205CF 668908                  mov word ptr [eax], cx
:004205D2 836DFC02                sub dword ptr [ebp-04], 00000002
:004205D6 E9D1FFFFFF              jmp 004205AC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004205B3(C)
|
:004205DB E910010000              jmp 004206F0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420479(C)
|
:004205E0 8B450C                  mov eax, dword ptr [ebp+0C]
:004205E3 8945EC                  mov dword ptr [ebp-14], eax
:004205E6 C745E800000000          mov [ebp-18], 00000000
:004205ED E903000000              jmp 004205F5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042062C(U)
|
:004205F2 FF45E8                  inc [ebp-18]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004205ED(U)
|
:004205F5 837DE810                cmp dword ptr [ebp-18], 00000010
:004205F9 0F8D32000000            jnl 00420631
:004205FF 8B45EC                  mov eax, dword ptr [ebp-14]
:00420602 33C9                    xor ecx, ecx
:00420604 8A08                    mov cl, byte ptr [eax]
:00420606 C1F907                  sar ecx, 07
:00420609 8B45EC                  mov eax, dword ptr [ebp-14]
:0042060C 33D2                    xor edx, edx
:0042060E 8A10                    mov dl, byte ptr [eax]
:00420610 8D045500000000          lea eax, dword ptr [2*edx+00000000]
:00420617 0BC8                    or ecx, eax
:00420619 81E1FE000000            and ecx, 000000FE
:0042061F 8B45EC                  mov eax, dword ptr [ebp-14]
:00420622 0A08                    or cl, byte ptr [eax]
:00420624 8B45EC                  mov eax, dword ptr [ebp-14]
:00420627 8808                    mov byte ptr [eax], cl
:00420629 FF45EC                  inc [ebp-14]
:0042062C E9C1FFFFFF              jmp 004205F2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004205F9(C)
|
:00420631 8B450C                  mov eax, dword ptr [ebp+0C]
:00420634 8945EC                  mov dword ptr [ebp-14], eax
:00420637 C745E800000000          mov [ebp-18], 00000000
:0042063E E903000000              jmp 00420646

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420676(U)
|
:00420643 FF45E8                  inc [ebp-18]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042063E(U)
|
:00420646 837DE810                cmp dword ptr [ebp-18], 00000010
:0042064A 0F8D2B000000            jnl 0042067B
:00420650 8B45EC                  mov eax, dword ptr [ebp-14]
:00420653 33C9                    xor ecx, ecx
:00420655 8A08                    mov cl, byte ptr [eax]
:00420657 C1E107                  shl ecx, 07
:0042065A 8B45EC                  mov eax, dword ptr [ebp-14]
:0042065D 33D2                    xor edx, edx
:0042065F 8A10                    mov dl, byte ptr [eax]
:00420661 C1FA01                  sar edx, 01
:00420664 0BCA                    or ecx, edx
:00420666 83E17F                  and ecx, 0000007F
:00420669 8B45EC                  mov eax, dword ptr [ebp-14]
:0042066C 0A08                    or cl, byte ptr [eax]
:0042066E 8B45EC                  mov eax, dword ptr [ebp-14]
:00420671 8808                    mov byte ptr [eax], cl
:00420673 FF45EC                  inc [ebp-14]
:00420676 E9C8FFFFFF              jmp 00420643

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042064A(C)
|
:0042067B 8B450C                  mov eax, dword ptr [ebp+0C]
:0042067E 8945EC                  mov dword ptr [ebp-14], eax
:00420681 C745E800000000          mov [ebp-18], 00000000
:00420688 E903000000              jmp 00420690

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004206AF(U)
|
:0042068D FF45E8                  inc [ebp-18]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420688(U)
|
:00420690 837DE80F                cmp dword ptr [ebp-18], 0000000F
:00420694 0F8D1A000000            jnl 004206B4
:0042069A 8B45EC                  mov eax, dword ptr [ebp-14]
:0042069D 33C9                    xor ecx, ecx
:0042069F 8A4801                  mov cl, byte ptr [eax+01]
:004206A2 8B45EC                  mov eax, dword ptr [ebp-14]
:004206A5 0A08                    or cl, byte ptr [eax]
:004206A7 8B45EC                  mov eax, dword ptr [ebp-14]
:004206AA 8808                    mov byte ptr [eax], cl
:004206AC FF45EC                  inc [ebp-14]
:004206AF E9D9FFFFFF              jmp 0042068D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420694(C)
|
:004206B4 8B450C                  mov eax, dword ptr [ebp+0C]
:004206B7 83C00F                  add eax, 0000000F
:004206BA 8945EC                  mov dword ptr [ebp-14], eax
:004206BD C745E800000000          mov [ebp-18], 00000000
:004206C4 E903000000              jmp 004206CC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004206EB(U)
|
:004206C9 FF45E8                  inc [ebp-18]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004206C4(U)
|
:004206CC 837DE80F                cmp dword ptr [ebp-18], 0000000F
:004206D0 0F8D1A000000            jnl 004206F0
:004206D6 8B45EC                  mov eax, dword ptr [ebp-14]
:004206D9 33C9                    xor ecx, ecx
:004206DB 8A48FF                  mov cl, byte ptr [eax-01]
:004206DE 8B45EC                  mov eax, dword ptr [ebp-14]
:004206E1 0A08                    or cl, byte ptr [eax]
:004206E3 8B45EC                  mov eax, dword ptr [ebp-14]
:004206E6 8808                    mov byte ptr [eax], cl
:004206E8 FF4DEC                  dec [ebp-14]
:004206EB E9D9FFFFFF              jmp 004206C9

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004205DB(U), :004206D0(C)
|
:004206F0 E900000000              jmp 004206F5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004206F0(U)
|
:004206F5 5F                      pop edi
:004206F6 5E                      pop esi
:004206F7 5B                      pop ebx
:004206F8 C9                      leave
:004206F9 C3                      ret


:004206FA 55                      push ebp
:004206FB 8BEC                    mov ebp, esp
:004206FD 53                      push ebx
:004206FE 56                      push esi
:004206FF 57                      push edi
:00420700 6A00                    push 00000000
:00420702 8B4518                  mov eax, dword ptr [ebp+18]
:00420705 25FF000000              and eax, 000000FF
:0042070A 50                      push eax
:0042070B 33C0                    xor eax, eax
:0042070D 8A4519                  mov al, byte ptr [ebp+19]
:00420710 50                      push eax
:00420711 E838460200              call 00444D4E
:00420716 83C40C                  add esp, 0000000C
:00420719 8B451C                  mov eax, dword ptr [ebp+1C]
:0042071C 50                      push eax
:0042071D 8B4514                  mov eax, dword ptr [ebp+14]
:00420720 50                      push eax
:00420721 8B4510                  mov eax, dword ptr [ebp+10]
:00420724 C1E003                  shl eax, 03
:00420727 50                      push eax
:00420728 8B450C                  mov eax, dword ptr [ebp+0C]
:0042072B 50                      push eax
:0042072C 8B4508                  mov eax, dword ptr [ebp+08]
:0042072F C1E003                  shl eax, 03
:00420732 50                      push eax
:00420733 E85A530200              call 00445A92
:00420738 83C414                  add esp, 00000014
:0042073B E900000000              jmp 00420740

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042073B(U)
|
:00420740 5F                      pop edi
:00420741 5E                      pop esi
:00420742 5B                      pop ebx
:00420743 C9                      leave
:00420744 C3                      ret



* Referenced by a CALL at Address:
|:00420345   
|
:00420745 55                      push ebp
:00420746 8BEC                    mov ebp, esp
:00420748 81EC10010000            sub esp, 00000110
:0042074E 53                      push ebx
:0042074F 56                      push esi
:00420750 57                      push edi
:00420751 898DF0FEFFFF            mov dword ptr [ebp+FFFFFEF0], ecx
:00420757 C7451400000000          mov [ebp+14], 00000000
:0042075E C78574FFFFFF01000000    mov dword ptr [ebp+FFFFFF74], 00000001
:00420768 837D1030                cmp dword ptr [ebp+10], 00000030
:0042076C 0F8240000000            jb 004207B2
:00420772 837D1039                cmp dword ptr [ebp+10], 00000039
:00420776 0F8736000000            ja 004207B2
:0042077C 6A10                    push 00000010
:0042077E 8D85F4FEFFFF            lea eax, dword ptr [ebp+FFFFFEF4]
:00420784 50                      push eax
:00420785 8B4510                  mov eax, dword ptr [ebp+10]
:00420788 83E830                  sub eax, 00000030
:0042078B C1E004                  shl eax, 04
:0042078E 0578124500              add eax, 00451278
:00420793 50                      push eax
:00420794 E8B46C0200              call 0044744D
:00420799 83C40C                  add esp, 0000000C
:0042079C C78574FFFFFF00000000    mov dword ptr [ebp+FFFFFF74], 00000000
:004207A6 C745FC01000000          mov [ebp-04], 00000001
:004207AD E965000000              jmp 00420817

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042076C(C), :00420776(C)
|
:004207B2 8B85F0FEFFFF            mov eax, dword ptr [ebp+FFFFFEF0]
:004207B8 33C9                    xor ecx, ecx
:004207BA 8A08                    mov cl, byte ptr [eax]
:004207BC F6C120                  test cl, 20
:004207BF 0F840C000000            je 004207D1
:004207C5 C745FC02000000          mov [ebp-04], 00000002
:004207CC E946000000              jmp 00420817

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004207BF(C)
|
:004207D1 817D1000020000          cmp dword ptr [ebp+10], 00000200
:004207D8 0F831F000000            jnb 004207FD
:004207DE C745FC01000000          mov [ebp-04], 00000001
:004207E5 8D85F4FEFFFF            lea eax, dword ptr [ebp+FFFFFEF4]
:004207EB 50                      push eax
:004207EC 8B4510                  mov eax, dword ptr [ebp+10]
:004207EF 50                      push eax
:004207F0 E8F7560200              call 00445EEC
:004207F5 83C408                  add esp, 00000008
:004207F8 E91A000000              jmp 00420817

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004207D8(C)
|
:004207FD C745FC02000000          mov [ebp-04], 00000002
:00420804 8D85F4FEFFFF            lea eax, dword ptr [ebp+FFFFFEF4]
:0042080A 50                      push eax
:0042080B 8B4510                  mov eax, dword ptr [ebp+10]
:0042080E 50                      push eax
:0042080F E8C4550200              call 00445DD8
:00420814 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004207AD(U), :004207CC(U), :004207F8(U)
|
:00420817 83BD74FFFFFF01          cmp dword ptr [ebp+FFFFFF74], 00000001
:0042081E 0F8513000000            jne 00420837
:00420824 8B45FC                  mov eax, dword ptr [ebp-04]
:00420827 50                      push eax
:00420828 8D85F4FEFFFF            lea eax, dword ptr [ebp+FFFFFEF4]
:0042082E 50                      push eax
:0042082F E84D010000              call 00420981
:00420834 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042081E(C)
|
:00420837 C745F810000000          mov [ebp-08], 00000010
:0042083E 8B85F0FEFFFF            mov eax, dword ptr [ebp+FFFFFEF0]
:00420844 83783100                cmp dword ptr [eax+31], 00000000
:00420848 0F8455000000            je 004208A3
:0042084E 8B45FC                  mov eax, dword ptr [ebp-04]
:00420851 50                      push eax
:00420852 8D8578FFFFFF            lea eax, dword ptr [ebp+FFFFFF78]
:00420858 50                      push eax
:00420859 8D85F4FEFFFF            lea eax, dword ptr [ebp+FFFFFEF4]
:0042085F 50                      push eax
:00420860 E8F0FBFFFF              call 00420455
:00420865 83C40C                  add esp, 0000000C
:00420868 6A00                    push 00000000
:0042086A 8B85F0FEFFFF            mov eax, dword ptr [ebp+FFFFFEF0]
:00420870 8B401F                  mov eax, dword ptr [eax+1F]
:00420873 50                      push eax
:00420874 6A04                    push 00000004
:00420876 E8D3440200              call 00444D4E
:0042087B 83C40C                  add esp, 0000000C
:0042087E 8D8578FFFFFF            lea eax, dword ptr [ebp+FFFFFF78]
:00420884 50                      push eax
:00420885 8B45F8                  mov eax, dword ptr [ebp-08]
:00420888 50                      push eax
:00420889 8B45FC                  mov eax, dword ptr [ebp-04]
:0042088C C1E003                  shl eax, 03
:0042088F 50                      push eax
:00420890 8B450C                  mov eax, dword ptr [ebp+0C]
:00420893 50                      push eax
:00420894 8B4508                  mov eax, dword ptr [ebp+08]
:00420897 C1E003                  shl eax, 03
:0042089A 50                      push eax
:0042089B E8F2510200              call 00445A92
:004208A0 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420848(C)
|
:004208A3 8B85F0FEFFFF            mov eax, dword ptr [ebp+FFFFFEF0]
:004208A9 33C9                    xor ecx, ecx
:004208AB 8A4802                  mov cl, byte ptr [eax+02]
:004208AE 85C9                    test ecx, ecx
:004208B0 0F854B000000            jne 00420901
:004208B6 6A00                    push 00000000
:004208B8 8B85F0FEFFFF            mov eax, dword ptr [ebp+FFFFFEF0]
:004208BE 33C9                    xor ecx, ecx
:004208C0 8A4801                  mov cl, byte ptr [eax+01]
:004208C3 51                      push ecx
:004208C4 8B85F0FEFFFF            mov eax, dword ptr [ebp+FFFFFEF0]
:004208CA 33C9                    xor ecx, ecx
:004208CC 8A08                    mov cl, byte ptr [eax]
:004208CE 51                      push ecx
:004208CF E87A440200              call 00444D4E
:004208D4 83C40C                  add esp, 0000000C
:004208D7 8D85F4FEFFFF            lea eax, dword ptr [ebp+FFFFFEF4]
:004208DD 50                      push eax
:004208DE 8B45F8                  mov eax, dword ptr [ebp-08]
:004208E1 50                      push eax
:004208E2 8B45FC                  mov eax, dword ptr [ebp-04]
:004208E5 C1E003                  shl eax, 03
:004208E8 50                      push eax
:004208E9 8B450C                  mov eax, dword ptr [ebp+0C]
:004208EC 50                      push eax
:004208ED 8B4508                  mov eax, dword ptr [ebp+08]
:004208F0 C1E003                  shl eax, 03
:004208F3 50                      push eax
:004208F4 E899510200              call 00445A92
:004208F9 83C414                  add esp, 00000014
:004208FC E947000000              jmp 00420948

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004208B0(C)
|
:00420901 8B85F0FEFFFF            mov eax, dword ptr [ebp+FFFFFEF0]
:00420907 33C9                    xor ecx, ecx
:00420909 8A4802                  mov cl, byte ptr [eax+02]
:0042090C 51                      push ecx
:0042090D 8B85F0FEFFFF            mov eax, dword ptr [ebp+FFFFFEF0]
:00420913 33C9                    xor ecx, ecx
:00420915 8A4801                  mov cl, byte ptr [eax+01]
:00420918 51                      push ecx
:00420919 6A00                    push 00000000
:0042091B E82E440200              call 00444D4E
:00420920 83C40C                  add esp, 0000000C
:00420923 8D85F4FEFFFF            lea eax, dword ptr [ebp+FFFFFEF4]
:00420929 50                      push eax
:0042092A 8B45F8                  mov eax, dword ptr [ebp-08]
:0042092D 50                      push eax
:0042092E 8B45FC                  mov eax, dword ptr [ebp-04]
:00420931 C1E003                  shl eax, 03
:00420934 50                      push eax
:00420935 8B450C                  mov eax, dword ptr [ebp+0C]
:00420938 50                      push eax
:00420939 8B4508                  mov eax, dword ptr [ebp+08]
:0042093C C1E003                  shl eax, 03
:0042093F 50                      push eax
:00420940 E84D510200              call 00445A92
:00420945 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004208FC(U)
|
:00420948 8B85F0FEFFFF            mov eax, dword ptr [ebp+FFFFFEF0]
:0042094E 33C9                    xor ecx, ecx
:00420950 8A4802                  mov cl, byte ptr [eax+02]
:00420953 51                      push ecx
:00420954 8B85F0FEFFFF            mov eax, dword ptr [ebp+FFFFFEF0]
:0042095A 33C9                    xor ecx, ecx
:0042095C 8A4801                  mov cl, byte ptr [eax+01]
:0042095F 51                      push ecx
:00420960 8B85F0FEFFFF            mov eax, dword ptr [ebp+FFFFFEF0]
:00420966 33C9                    xor ecx, ecx
:00420968 8A08                    mov cl, byte ptr [eax]
:0042096A 51                      push ecx
:0042096B E8DE430200              call 00444D4E
:00420970 83C40C                  add esp, 0000000C
:00420973 33C0                    xor eax, eax
:00420975 E900000000              jmp 0042097A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420975(U)
|
:0042097A 5F                      pop edi
:0042097B 5E                      pop esi
:0042097C 5B                      pop ebx
:0042097D C9                      leave
:0042097E C21000                  ret 0010



* Referenced by a CALL at Address:
|:0042082F   
|
:00420981 55                      push ebp
:00420982 8BEC                    mov ebp, esp
:00420984 83EC08                  sub esp, 00000008
:00420987 53                      push ebx
:00420988 56                      push esi
:00420989 57                      push edi
:0042098A 837D0C01                cmp dword ptr [ebp+0C], 00000001
:0042098E 0F8505000000            jne 00420999
:00420994 E98D000000              jmp 00420A26

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042098E(C)
|
:00420999 8B4508                  mov eax, dword ptr [ebp+08]
:0042099C 8945FC                  mov dword ptr [ebp-04], eax
:0042099F C745F800000000          mov [ebp-08], 00000000
:004209A6 E906000000              jmp 004209B1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420A1C(U)
|
:004209AB FF45F8                  inc [ebp-08]
:004209AE FF45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004209A6(U)
|
:004209B1 8B450C                  mov eax, dword ptr [ebp+0C]
:004209B4 C1E004                  shl eax, 04
:004209B7 3B45F8                  cmp eax, dword ptr [ebp-08]
:004209BA 0F8E61000000            jle 00420A21
:004209C0 8B45FC                  mov eax, dword ptr [ebp-04]
:004209C3 33C9                    xor ecx, ecx
:004209C5 8A08                    mov cl, byte ptr [eax]
:004209C7 8D044D00000000          lea eax, dword ptr [2*ecx+00000000]
:004209CE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004209D1 0A01                    or al, byte ptr [ecx]
:004209D3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004209D6 8801                    mov byte ptr [ecx], al
:004209D8 837D0C01                cmp dword ptr [ebp+0C], 00000001
:004209DC 0F843A000000            je 00420A1C
:004209E2 8B45F8                  mov eax, dword ptr [ebp-08]
:004209E5 99                      cdq
:004209E6 33C2                    xor eax, edx
:004209E8 2BC2                    sub eax, edx
:004209EA 83E001                  and eax, 00000001
:004209ED 33C2                    xor eax, edx
:004209EF 2BC2                    sub eax, edx
:004209F1 0F8525000000            jne 00420A1C
:004209F7 8B45FC                  mov eax, dword ptr [ebp-04]
:004209FA 33C9                    xor ecx, ecx
:004209FC 8A4801                  mov cl, byte ptr [eax+01]
:004209FF F6C180                  test cl, 80
:00420A02 0F8414000000            je 00420A1C
:00420A08 8B45FC                  mov eax, dword ptr [ebp-04]
:00420A0B 33C9                    xor ecx, ecx
:00420A0D 8A08                    mov cl, byte ptr [eax]
:00420A0F 80C901                  or cl, 01
:00420A12 8B45FC                  mov eax, dword ptr [ebp-04]
:00420A15 8808                    mov byte ptr [eax], cl
:00420A17 E900000000              jmp 00420A1C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004209DC(C), :004209F1(C), :00420A02(C), :00420A17(U)
|
:00420A1C E98AFFFFFF              jmp 004209AB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004209BA(C)
|
:00420A21 E900000000              jmp 00420A26

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00420994(U), :00420A21(U)
|
:00420A26 5F                      pop edi
:00420A27 5E                      pop esi
:00420A28 5B                      pop ebx
:00420A29 C9                      leave
:00420A2A C3                      ret



* Referenced by a CALL at Addresses:
|:00420A9A   , :00420B0C   
|
:00420A2B 55                      push ebp
:00420A2C 8BEC                    mov ebp, esp
:00420A2E 83EC08                  sub esp, 00000008
:00420A31 53                      push ebx
:00420A32 56                      push esi
:00420A33 57                      push edi
:00420A34 C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420A75(U)
|
:00420A3B 8B450C                  mov eax, dword ptr [ebp+0C]
:00420A3E 33C9                    xor ecx, ecx
:00420A40 8A08                    mov cl, byte ptr [eax]
:00420A42 85C9                    test ecx, ecx
:00420A44 0F8430000000            je 00420A7A
:00420A4A 8B450C                  mov eax, dword ptr [ebp+0C]
:00420A4D 8945F8                  mov dword ptr [ebp-08], eax
:00420A50 FF450C                  inc [ebp+0C]
:00420A53 6A00                    push 00000000
:00420A55 8B45F8                  mov eax, dword ptr [ebp-08]
:00420A58 8A00                    mov al, byte ptr [eax]
:00420A5A 50                      push eax
:00420A5B 8B4D08                  mov ecx, dword ptr [ebp+08]
:00420A5E E8D9F4FFFF              call 0041FF3C
:00420A63 8945FC                  mov dword ptr [ebp-04], eax
:00420A66 837DFC00                cmp dword ptr [ebp-04], 00000000
:00420A6A 0F8405000000            je 00420A75
:00420A70 E905000000              jmp 00420A7A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420A6A(C)
|
:00420A75 E9C1FFFFFF              jmp 00420A3B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00420A44(C), :00420A70(U)
|
:00420A7A 8B45FC                  mov eax, dword ptr [ebp-04]
:00420A7D E900000000              jmp 00420A82

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420A7D(U)
|
:00420A82 5F                      pop edi
:00420A83 5E                      pop esi
:00420A84 5B                      pop ebx
:00420A85 C9                      leave
:00420A86 C3                      ret



* Referenced by a CALL at Addresses:
|:0040F537   , :0040F61F   , :004267C7   , :0042681C   , :00426887   
|:004268D9   , :00435DFA   , :00438F0A   , :0043F11D   
|
:00420A87 55                      push ebp
:00420A88 8BEC                    mov ebp, esp
:00420A8A 53                      push ebx
:00420A8B 56                      push esi
:00420A8C 57                      push edi
:00420A8D E805650000              call 00426F97
:00420A92 8B450C                  mov eax, dword ptr [ebp+0C]
:00420A95 50                      push eax
:00420A96 8B4508                  mov eax, dword ptr [ebp+08]
:00420A99 50                      push eax
:00420A9A E88CFFFFFF              call 00420A2B
:00420A9F 83C408                  add esp, 00000008
:00420AA2 E810650000              call 00426FB7
:00420AA7 E900000000              jmp 00420AAC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420AA7(U)
|
:00420AAC 5F                      pop edi
:00420AAD 5E                      pop esi
:00420AAE 5B                      pop ebx
:00420AAF C9                      leave
:00420AB0 C3                      ret


:00420AB1 55                      push ebp
:00420AB2 8BEC                    mov ebp, esp
:00420AB4 83EC08                  sub esp, 00000008
:00420AB7 53                      push ebx
:00420AB8 56                      push esi
:00420AB9 57                      push edi
:00420ABA 8B4510                  mov eax, dword ptr [ebp+10]
:00420ABD 50                      push eax
:00420ABE E8E7680200              call 004473AA
:00420AC3 83C404                  add esp, 00000004
:00420AC6 8945F8                  mov dword ptr [ebp-08], eax
:00420AC9 8B450C                  mov eax, dword ptr [ebp+0C]
:00420ACC 3945F8                  cmp dword ptr [ebp-08], eax
:00420ACF 0F8311000000            jnb 00420AE6
:00420AD5 8B450C                  mov eax, dword ptr [ebp+0C]
:00420AD8 2B45F8                  sub eax, dword ptr [ebp-08]
:00420ADB C1E801                  shr eax, 01
:00420ADE 8945FC                  mov dword ptr [ebp-04], eax
:00420AE1 E907000000              jmp 00420AED

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420ACF(C)
|
:00420AE6 C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420AE1(U)
|
:00420AED 8B4508                  mov eax, dword ptr [ebp+08]
:00420AF0 8B4003                  mov eax, dword ptr [eax+03]
:00420AF3 0345FC                  add eax, dword ptr [ebp-04]
:00420AF6 50                      push eax
:00420AF7 8B4D08                  mov ecx, dword ptr [ebp+08]
:00420AFA E87FF0FFFF              call 0041FB7E
:00420AFF E893640000              call 00426F97
:00420B04 8B4510                  mov eax, dword ptr [ebp+10]
:00420B07 50                      push eax
:00420B08 8B4508                  mov eax, dword ptr [ebp+08]
:00420B0B 50                      push eax
:00420B0C E81AFFFFFF              call 00420A2B
:00420B11 83C408                  add esp, 00000008
:00420B14 E89E640000              call 00426FB7
:00420B19 E900000000              jmp 00420B1E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420B19(U)
|
:00420B1E 5F                      pop edi
:00420B1F 5E                      pop esi
:00420B20 5B                      pop ebx
:00420B21 C9                      leave
:00420B22 C3                      ret



* Referenced by a CALL at Addresses:
|:004011D6   , :00401276   , :00403317   , :004034A0   , :0040A488   
|:0040CF48   , :0040D054   , :0040F589   , :0040FA68   , :00410969   
|:004109A9   , :004109E1   , :00410A2B   , :004139C3   , :00416743   
|:00416CFE   , :004218A3   , :00424CD7   , :00426C05   , :004296FB   
|:00429712   , :0042974A   , :00429768   , :004297B6   , :0042AA96   
|:0042AAC0   , :0042C191   , :0042C1C5   , :0042C1FC   , :0042C239   
|:0042C9A8   , :0042CCD5   , :004343C0   , :00434427   , :004346B1   
|:004348DD   , :00434A82   , :00434AE1   , :004352FF   , :004353CC   
|:00435A0B   , :0043601D   , :0043604F   , :0043608A   , :004360A2   
|:004360D4   , :00436B85   , :00436BA0   , :00436BD6   , :00436BEC   
|:0043795B   , :00437B27   , :00437C5B   , :004383CE   , :00438970   
|:004393A6   , :00439D48   , :00439FB5   , :0043A011   , :0043A06B   
|:0043AF17   , :0043BBF5   , :0043CA07   , :0043E2E4   , :0043E359   
|:0043E3C4   , :0043E6C8   , :0043F0E4   , :0043F347   , :0043F385   
|:0043F4BE   , :0043F5FE   , :0043F621   , :0043F644   , :0043F69C   
|:0043F6CC   , :0043F870   , :0043F8A5   , :0043F8DB   , :0043F910   
|:0043F94A   , :0043F983   , :0043FA88   , :0043FAD8   , :0043FB28   
|:004401BE   , :0044062D   , :00443C67   , :00443DD9   , :00443F41   
|:00443F7A   
|
:00420B23 55                      push ebp
:00420B24 8BEC                    mov ebp, esp
:00420B26 53                      push ebx
:00420B27 56                      push esi
:00420B28 57                      push edi
:00420B29 E869640000              call 00426F97
:00420B2E 8D450C                  lea eax, dword ptr [ebp+0C]
:00420B31 50                      push eax
:00420B32 E83AEAFFFF              call 0041F571
:00420B37 83C404                  add esp, 00000004
:00420B3A E878640000              call 00426FB7
:00420B3F E900000000              jmp 00420B44

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420B3F(U)
|
:00420B44 5F                      pop edi
:00420B45 5E                      pop esi
:00420B46 5B                      pop ebx
:00420B47 C9                      leave
:00420B48 C3                      ret


:00420B49 CC                      int 03
:00420B4A CC                      int 03
:00420B4B CC                      int 03
:00420B4C CC                      int 03
:00420B4D CC                      int 03
:00420B4E CC                      int 03
:00420B4F CC                      int 03

* Referenced by a CALL at Addresses:
|:0041F63E   , :00420098   , :00420111   , :0042015E   
|
:00420B50 55                      push ebp
:00420B51 8BEC                    mov ebp, esp
:00420B53 53                      push ebx
:00420B54 56                      push esi
:00420B55 57                      push edi
:00420B56 33C0                    xor eax, eax
:00420B58 8A4508                  mov al, byte ptr [ebp+08]
:00420B5B 83F830                  cmp eax, 00000030
:00420B5E 0F8C18000000            jl 00420B7C
:00420B64 33C0                    xor eax, eax
:00420B66 8A4508                  mov al, byte ptr [ebp+08]
:00420B69 83F839                  cmp eax, 00000039
:00420B6C 0F8F0A000000            jg 00420B7C
:00420B72 B801000000              mov eax, 00000001
:00420B77 E902000000              jmp 00420B7E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00420B5E(C), :00420B6C(C)
|
:00420B7C 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420B77(U)
|
:00420B7E E900000000              jmp 00420B83

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420B7E(U)
|
:00420B83 5F                      pop edi
:00420B84 5E                      pop esi
:00420B85 5B                      pop ebx
:00420B86 C9                      leave
:00420B87 C3                      ret


:00420B88 CC                      int 03
:00420B89 CC                      int 03
:00420B8A CC                      int 03
:00420B8B CC                      int 03
:00420B8C CC                      int 03
:00420B8D CC                      int 03
:00420B8E CC                      int 03
:00420B8F CC                      int 03

* Referenced by a CALL at Addresses:
|:0041F6C7   , :004200BC   , :00420135   , :00420182   
|
:00420B90 55                      push ebp
:00420B91 8BEC                    mov ebp, esp
:00420B93 53                      push ebx
:00420B94 56                      push esi
:00420B95 57                      push edi
:00420B96 33C0                    xor eax, eax
:00420B98 8A4508                  mov al, byte ptr [ebp+08]
:00420B9B 83F861                  cmp eax, 00000061
:00420B9E 0F8C1B000000            jl 00420BBF
:00420BA4 33C0                    xor eax, eax
:00420BA6 8A4508                  mov al, byte ptr [ebp+08]
:00420BA9 83F87A                  cmp eax, 0000007A
:00420BAC 0F8F0D000000            jg 00420BBF
:00420BB2 33C0                    xor eax, eax
:00420BB4 8A4508                  mov al, byte ptr [ebp+08]
:00420BB7 83E820                  sub eax, 00000020
:00420BBA E903000000              jmp 00420BC2

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00420B9E(C), :00420BAC(C)
|
:00420BBF 8A4508                  mov al, byte ptr [ebp+08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420BBA(U)
|
:00420BC2 E900000000              jmp 00420BC7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420BC2(U)
|
:00420BC7 5F                      pop edi
:00420BC8 5E                      pop esi
:00420BC9 5B                      pop ebx
:00420BCA C9                      leave
:00420BCB C3                      ret


:00420BCC CC                      int 03
:00420BCD CC                      int 03
:00420BCE CC                      int 03
:00420BCF CC                      int 03

* Referenced by a CALL at Addresses:
|:00420C5F   , :004259AB   
|
:00420BD0 55                      push ebp
:00420BD1 8BEC                    mov ebp, esp
:00420BD3 83EC08                  sub esp, 00000008
:00420BD6 53                      push ebx
:00420BD7 56                      push esi
:00420BD8 57                      push edi
:00420BD9 894DF8                  mov dword ptr [ebp-08], ecx
:00420BDC C745FC00000000          mov [ebp-04], 00000000
:00420BE3 E903000000              jmp 00420BEB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420C3A(U)
|
:00420BE8 FF45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420BE3(U)
|
:00420BEB 837DFC06                cmp dword ptr [ebp-04], 00000006
:00420BEF 0F834A000000            jnb 00420C3F
:00420BF5 8B45FC                  mov eax, dword ptr [ebp-04]
:00420BF8 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00420BFB C7048100000000          mov dword ptr [ecx+4*eax], 00000000
:00420C02 8B45FC                  mov eax, dword ptr [ebp-04]
:00420C05 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00420C08 C744811800000000        mov [ecx+4*eax+18], 00000000
:00420C10 8B45FC                  mov eax, dword ptr [ebp-04]
:00420C13 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00420C16 C744813000000000        mov [ecx+4*eax+30], 00000000
:00420C1E 8B45FC                  mov eax, dword ptr [ebp-04]
:00420C21 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00420C24 C744814800000000        mov [ecx+4*eax+48], 00000000
:00420C2C 8B45FC                  mov eax, dword ptr [ebp-04]
:00420C2F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00420C32 C744816000000000        mov [ecx+4*eax+60], 00000000
:00420C3A E9A9FFFFFF              jmp 00420BE8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420BEF(C)
|
:00420C3F 8B45F8                  mov eax, dword ptr [ebp-08]
:00420C42 C6407800                mov [eax+78], 00
:00420C46 E900000000              jmp 00420C4B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420C46(U)
|
:00420C4B 5F                      pop edi
:00420C4C 5E                      pop esi
:00420C4D 5B                      pop ebx
:00420C4E C9                      leave
:00420C4F C3                      ret



* Referenced by a CALL at Address:
|:00421E0A   
|
:00420C50 55                      push ebp
:00420C51 8BEC                    mov ebp, esp
:00420C53 83EC04                  sub esp, 00000004
:00420C56 53                      push ebx
:00420C57 56                      push esi
:00420C58 57                      push edi
:00420C59 894DFC                  mov dword ptr [ebp-04], ecx
:00420C5C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00420C5F E86CFFFFFF              call 00420BD0
:00420C64 8B45FC                  mov eax, dword ptr [ebp-04]
:00420C67 C7407900000000          mov [eax+79], 00000000
:00420C6E E900000000              jmp 00420C73

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420C6E(U)
|
:00420C73 8B45FC                  mov eax, dword ptr [ebp-04]
:00420C76 5F                      pop edi
:00420C77 5E                      pop esi
:00420C78 5B                      pop ebx
:00420C79 C9                      leave
:00420C7A C3                      ret



* Referenced by a CALL at Addresses:
|:00420DE6   , :00420E1E   , :00420E3F   
|
:00420C7B 55                      push ebp
:00420C7C 8BEC                    mov ebp, esp
:00420C7E 83EC0C                  sub esp, 0000000C
:00420C81 53                      push ebx
:00420C82 56                      push esi
:00420C83 57                      push edi
:00420C84 894DF4                  mov dword ptr [ebp-0C], ecx
:00420C87 8B4510                  mov eax, dword ptr [ebp+10]
:00420C8A 034508                  add eax, dword ptr [ebp+08]
:00420C8D 83E808                  sub eax, 00000008
:00420C90 8945F8                  mov dword ptr [ebp-08], eax
:00420C93 E8FF620000              call 00426F97
:00420C98 B940CF4600              mov ecx, 0046CF40
:00420C9D E83E84FEFF              call 004090E0
:00420CA2 8945FC                  mov dword ptr [ebp-04], eax
:00420CA5 8B45F4                  mov eax, dword ptr [ebp-0C]
:00420CA8 8B4079                  mov eax, dword ptr [eax+79]
:00420CAB C1E003                  shl eax, 03
:00420CAE 034514                  add eax, dword ptr [ebp+14]
:00420CB1 8B048520134500          mov eax, dword ptr [4*eax+00451320]
:00420CB8 0345FC                  add eax, dword ptr [ebp-04]
:00420CBB 50                      push eax
:00420CBC 6A08                    push 00000008
:00420CBE 6A08                    push 00000008
:00420CC0 8B450C                  mov eax, dword ptr [ebp+0C]
:00420CC3 50                      push eax
:00420CC4 8B4508                  mov eax, dword ptr [ebp+08]
:00420CC7 50                      push eax
:00420CC8 E8D24A0200              call 0044579F
:00420CCD 83C414                  add esp, 00000014
:00420CD0 837D2000                cmp dword ptr [ebp+20], 00000000
:00420CD4 0F844E000000            je 00420D28
:00420CDA 83450808                add dword ptr [ebp+08], 00000008
:00420CDE E904000000              jmp 00420CE7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420D1E(U)
|
:00420CE3 83450808                add dword ptr [ebp+08], 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420CDE(U)
|
:00420CE7 8B4508                  mov eax, dword ptr [ebp+08]
:00420CEA 3945F8                  cmp dword ptr [ebp-08], eax
:00420CED 0F8630000000            jbe 00420D23
:00420CF3 8B45F4                  mov eax, dword ptr [ebp-0C]
:00420CF6 8B4079                  mov eax, dword ptr [eax+79]
:00420CF9 C1E003                  shl eax, 03
:00420CFC 034518                  add eax, dword ptr [ebp+18]
:00420CFF 8B048520134500          mov eax, dword ptr [4*eax+00451320]
:00420D06 0345FC                  add eax, dword ptr [ebp-04]
:00420D09 50                      push eax
:00420D0A 6A08                    push 00000008
:00420D0C 6A08                    push 00000008
:00420D0E 8B450C                  mov eax, dword ptr [ebp+0C]
:00420D11 50                      push eax
:00420D12 8B4508                  mov eax, dword ptr [ebp+08]
:00420D15 50                      push eax
:00420D16 E8844A0200              call 0044579F
:00420D1B 83C414                  add esp, 00000014
:00420D1E E9C0FFFFFF              jmp 00420CE3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420CED(C)
|
:00420D23 E906000000              jmp 00420D2E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420CD4(C)
|
:00420D28 8B45F8                  mov eax, dword ptr [ebp-08]
:00420D2B 894508                  mov dword ptr [ebp+08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420D23(U)
|
:00420D2E 8B45F4                  mov eax, dword ptr [ebp-0C]
:00420D31 8B4079                  mov eax, dword ptr [eax+79]
:00420D34 C1E003                  shl eax, 03
:00420D37 03451C                  add eax, dword ptr [ebp+1C]
:00420D3A 8B048520134500          mov eax, dword ptr [4*eax+00451320]
:00420D41 0345FC                  add eax, dword ptr [ebp-04]
:00420D44 50                      push eax
:00420D45 6A08                    push 00000008
:00420D47 6A08                    push 00000008
:00420D49 8B450C                  mov eax, dword ptr [ebp+0C]
:00420D4C 50                      push eax
:00420D4D 8B4508                  mov eax, dword ptr [ebp+08]
:00420D50 50                      push eax
:00420D51 E8494A0200              call 0044579F
:00420D56 83C414                  add esp, 00000014
:00420D59 E859620000              call 00426FB7
:00420D5E E900000000              jmp 00420D63

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420D5E(U)
|
:00420D63 5F                      pop edi
:00420D64 5E                      pop esi
:00420D65 5B                      pop ebx
:00420D66 C9                      leave
:00420D67 C21C00                  ret 001C



* Referenced by a CALL at Addresses:
|:0040A46B   , :00420F9F   , :0042C8F2   , :00435187   , :004351A3   
|:004351C2   , :004351FA   , :00435219   , :00435242   , :00435261   
|:00437A7A   , :004381B1   , :0043976F   , :0043F010   , :0043F02F   
|:0043F04B   , :004405F5   , :00440A2B   
|
:00420D6A 55                      push ebp
:00420D6B 8BEC                    mov ebp, esp
:00420D6D 83EC08                  sub esp, 00000008
:00420D70 53                      push ebx
:00420D71 56                      push esi
:00420D72 57                      push edi
:00420D73 894DF8                  mov dword ptr [ebp-08], ecx
:00420D76 C745FC00000000          mov [ebp-04], 00000000
:00420D7D 8B4518                  mov eax, dword ptr [ebp+18]
:00420D80 50                      push eax
:00420D81 B958BC4600              mov ecx, 0046BC58
:00420D86 E895100000              call 00421E20
:00420D8B E807620000              call 00426F97
:00420D90 837D1C00                cmp dword ptr [ebp+1C], 00000000
:00420D94 0F8529000000            jne 00420DC3
:00420D9A 68FFFF0000              push 0000FFFF
:00420D9F 8B4514                  mov eax, dword ptr [ebp+14]
:00420DA2 83E810                  sub eax, 00000010
:00420DA5 50                      push eax
:00420DA6 8B4510                  mov eax, dword ptr [ebp+10]
:00420DA9 83E810                  sub eax, 00000010
:00420DAC 50                      push eax
:00420DAD 8B450C                  mov eax, dword ptr [ebp+0C]
:00420DB0 83C008                  add eax, 00000008
:00420DB3 50                      push eax
:00420DB4 8B4508                  mov eax, dword ptr [ebp+08]
:00420DB7 83C008                  add eax, 00000008
:00420DBA 50                      push eax
:00420DBB E84A640000              call 0042720A
:00420DC0 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420D94(C)
|
:00420DC3 8B4514                  mov eax, dword ptr [ebp+14]
:00420DC6 03450C                  add eax, dword ptr [ebp+0C]
:00420DC9 83E808                  sub eax, 00000008
:00420DCC 8945FC                  mov dword ptr [ebp-04], eax
:00420DCF 6A01                    push 00000001
:00420DD1 6A01                    push 00000001
:00420DD3 6A04                    push 00000004
:00420DD5 6A00                    push 00000000
:00420DD7 8B4510                  mov eax, dword ptr [ebp+10]
:00420DDA 50                      push eax
:00420DDB 8B450C                  mov eax, dword ptr [ebp+0C]
:00420DDE 50                      push eax
:00420DDF 8B4508                  mov eax, dword ptr [ebp+08]
:00420DE2 50                      push eax
:00420DE3 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00420DE6 E890FEFFFF              call 00420C7B
:00420DEB 83450C08                add dword ptr [ebp+0C], 00000008
:00420DEF E904000000              jmp 00420DF8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420E23(U)
|
:00420DF4 83450C08                add dword ptr [ebp+0C], 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420DEF(U)
|
:00420DF8 8B450C                  mov eax, dword ptr [ebp+0C]
:00420DFB 3945FC                  cmp dword ptr [ebp-04], eax
:00420DFE 0F8624000000            jbe 00420E28
:00420E04 6A00                    push 00000000
:00420E06 6A07                    push 00000007
:00420E08 68FFFF0000              push 0000FFFF
:00420E0D 6A05                    push 00000005
:00420E0F 8B4510                  mov eax, dword ptr [ebp+10]
:00420E12 50                      push eax
:00420E13 8B450C                  mov eax, dword ptr [ebp+0C]
:00420E16 50                      push eax
:00420E17 8B4508                  mov eax, dword ptr [ebp+08]
:00420E1A 50                      push eax
:00420E1B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00420E1E E858FEFFFF              call 00420C7B
:00420E23 E9CCFFFFFF              jmp 00420DF4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420DFE(C)
|
:00420E28 6A01                    push 00000001
:00420E2A 6A03                    push 00000003
:00420E2C 6A06                    push 00000006
:00420E2E 6A02                    push 00000002
:00420E30 8B4510                  mov eax, dword ptr [ebp+10]
:00420E33 50                      push eax
:00420E34 8B450C                  mov eax, dword ptr [ebp+0C]
:00420E37 50                      push eax
:00420E38 8B4508                  mov eax, dword ptr [ebp+08]
:00420E3B 50                      push eax
:00420E3C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00420E3F E837FEFFFF              call 00420C7B
:00420E44 E86E610000              call 00426FB7
:00420E49 E900000000              jmp 00420E4E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420E49(U)
|
:00420E4E 5F                      pop edi
:00420E4F 5E                      pop esi
:00420E50 5B                      pop ebx
:00420E51 C9                      leave
:00420E52 C21800                  ret 0018



* Referenced by a CALL at Address:
|:00420F81   
|
:00420E55 55                      push ebp
:00420E56 8BEC                    mov ebp, esp
:00420E58 83EC0C                  sub esp, 0000000C
:00420E5B 53                      push ebx
:00420E5C 56                      push esi
:00420E5D 57                      push edi
:00420E5E 894DF4                  mov dword ptr [ebp-0C], ecx
:00420E61 8B4508                  mov eax, dword ptr [ebp+08]
:00420E64 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00420E67 33D2                    xor edx, edx
:00420E69 8A5178                  mov dl, byte ptr [ecx+78]
:00420E6C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00420E6F 890491                  mov dword ptr [ecx+4*edx], eax
:00420E72 8B450C                  mov eax, dword ptr [ebp+0C]
:00420E75 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00420E78 33D2                    xor edx, edx
:00420E7A 8A5178                  mov dl, byte ptr [ecx+78]
:00420E7D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00420E80 89449118                mov dword ptr [ecx+4*edx+18], eax
:00420E84 8B4510                  mov eax, dword ptr [ebp+10]
:00420E87 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00420E8A 33D2                    xor edx, edx
:00420E8C 8A5178                  mov dl, byte ptr [ecx+78]
:00420E8F 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00420E92 89449130                mov dword ptr [ecx+4*edx+30], eax
:00420E96 8B4514                  mov eax, dword ptr [ebp+14]
:00420E99 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00420E9C 33D2                    xor edx, edx
:00420E9E 8A5178                  mov dl, byte ptr [ecx+78]
:00420EA1 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00420EA4 89449148                mov dword ptr [ecx+4*edx+48], eax
:00420EA8 8B4514                  mov eax, dword ptr [ebp+14]
:00420EAB 0FAF4510                imul eax, dword ptr [ebp+10]
:00420EAF 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00420EB2 33D2                    xor edx, edx
:00420EB4 8A5178                  mov dl, byte ptr [ecx+78]
:00420EB7 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00420EBA 89449160                mov dword ptr [ecx+4*edx+60], eax
:00420EBE C745FC00000000          mov [ebp-04], 00000000
:00420EC5 C745F800000000          mov [ebp-08], 00000000
:00420ECC E903000000              jmp 00420ED4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420EF2(U)
|
:00420ED1 FF45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420ECC(U)
|
:00420ED4 8B45F4                  mov eax, dword ptr [ebp-0C]
:00420ED7 33C9                    xor ecx, ecx
:00420ED9 8A4878                  mov cl, byte ptr [eax+78]
:00420EDC 3B4DFC                  cmp ecx, dword ptr [ebp-04]
:00420EDF 0F8612000000            jbe 00420EF7
:00420EE5 8B45FC                  mov eax, dword ptr [ebp-04]
:00420EE8 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00420EEB 8B448160                mov eax, dword ptr [ecx+4*eax+60]
:00420EEF 0145F8                  add dword ptr [ebp-08], eax
:00420EF2 E9DAFFFFFF              jmp 00420ED1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420EDF(C)
|
:00420EF7 8B45F4                  mov eax, dword ptr [ebp-0C]
:00420EFA 33C9                    xor ecx, ecx
:00420EFC 8A4878                  mov cl, byte ptr [eax+78]
:00420EFF 8B45F4                  mov eax, dword ptr [ebp-0C]
:00420F02 8B448860                mov eax, dword ptr [eax+4*ecx+60]
:00420F06 0345F8                  add eax, dword ptr [ebp-08]
:00420F09 3D004C0400              cmp eax, 00044C00
:00420F0E 0F8E00000000            jle 00420F14

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420F0E(C)
|
:00420F14 8B45F4                  mov eax, dword ptr [ebp-0C]
:00420F17 33C9                    xor ecx, ecx
:00420F19 8A4878                  mov cl, byte ptr [eax+78]
:00420F1C 83F906                  cmp ecx, 00000006
:00420F1F 0F8D06000000            jnl 00420F2B
:00420F25 8B45F4                  mov eax, dword ptr [ebp-0C]
:00420F28 FE4078                  inc [eax+78]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420F1F(C)
|
:00420F2B 6A04                    push 00000004
:00420F2D 6A00                    push 00000000
:00420F2F 8B45F8                  mov eax, dword ptr [ebp-08]
:00420F32 50                      push eax
:00420F33 B918E54600              mov ecx, 0046E518
:00420F38 E8E3670200              call 00447720
:00420F3D 50                      push eax
:00420F3E 8B4514                  mov eax, dword ptr [ebp+14]
:00420F41 50                      push eax
:00420F42 8B4510                  mov eax, dword ptr [ebp+10]
:00420F45 50                      push eax
:00420F46 8B450C                  mov eax, dword ptr [ebp+0C]
:00420F49 50                      push eax
:00420F4A 8B4508                  mov eax, dword ptr [ebp+08]
:00420F4D 50                      push eax
:00420F4E E893600000              call 00426FE6
:00420F53 83C414                  add esp, 00000014
:00420F56 E900000000              jmp 00420F5B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420F56(U)
|
:00420F5B 5F                      pop edi
:00420F5C 5E                      pop esi
:00420F5D 5B                      pop ebx
:00420F5E C9                      leave
:00420F5F C21000                  ret 0010



* Referenced by a CALL at Addresses:
|:0040CEF9   , :00437A57   , :004381E2   , :00438EC6   , :004392B6   
|:0043EFCE   
|
:00420F62 55                      push ebp
:00420F63 8BEC                    mov ebp, esp
:00420F65 83EC04                  sub esp, 00000004
:00420F68 53                      push ebx
:00420F69 56                      push esi
:00420F6A 57                      push edi
:00420F6B 894DFC                  mov dword ptr [ebp-04], ecx
:00420F6E 8B4514                  mov eax, dword ptr [ebp+14]
:00420F71 50                      push eax
:00420F72 8B4510                  mov eax, dword ptr [ebp+10]
:00420F75 50                      push eax
:00420F76 8B450C                  mov eax, dword ptr [ebp+0C]
:00420F79 50                      push eax
:00420F7A 8B4508                  mov eax, dword ptr [ebp+08]
:00420F7D 50                      push eax
:00420F7E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00420F81 E8CFFEFFFF              call 00420E55
:00420F86 6A00                    push 00000000
:00420F88 8B4518                  mov eax, dword ptr [ebp+18]
:00420F8B 50                      push eax
:00420F8C 8B4514                  mov eax, dword ptr [ebp+14]
:00420F8F 50                      push eax
:00420F90 8B4510                  mov eax, dword ptr [ebp+10]
:00420F93 50                      push eax
:00420F94 8B450C                  mov eax, dword ptr [ebp+0C]
:00420F97 50                      push eax
:00420F98 8B4508                  mov eax, dword ptr [ebp+08]
:00420F9B 50                      push eax
:00420F9C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00420F9F E8C6FDFFFF              call 00420D6A
:00420FA4 E900000000              jmp 00420FA9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420FA4(U)
|
:00420FA9 5F                      pop edi
:00420FAA 5E                      pop esi
:00420FAB 5B                      pop ebx
:00420FAC C9                      leave
:00420FAD C21400                  ret 0014



* Referenced by a CALL at Addresses:
|:00420FEB   , :00437DBB   
|
:00420FB0 55                      push ebp
:00420FB1 8BEC                    mov ebp, esp
:00420FB3 83EC04                  sub esp, 00000004
:00420FB6 53                      push ebx
:00420FB7 56                      push esi
:00420FB8 57                      push edi
:00420FB9 894DFC                  mov dword ptr [ebp-04], ecx
:00420FBC 8B45FC                  mov eax, dword ptr [ebp-04]
:00420FBF 33C9                    xor ecx, ecx
:00420FC1 8A4878                  mov cl, byte ptr [eax+78]
:00420FC4 85C9                    test ecx, ecx
:00420FC6 0F8E06000000            jle 00420FD2
:00420FCC 8B45FC                  mov eax, dword ptr [ebp-04]
:00420FCF FE4878                  dec [eax+78]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420FC6(C)
|
:00420FD2 E900000000              jmp 00420FD7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420FD2(U)
|
:00420FD7 5F                      pop edi
:00420FD8 5E                      pop esi
:00420FD9 5B                      pop ebx
:00420FDA C9                      leave
:00420FDB C3                      ret



* Referenced by a CALL at Addresses:
|:0040D111   , :00437D6C   , :00438A44   , :00438F26   , :004394CF   
|:0043FD2D   
|
:00420FDC 55                      push ebp
:00420FDD 8BEC                    mov ebp, esp
:00420FDF 83EC0C                  sub esp, 0000000C
:00420FE2 53                      push ebx
:00420FE3 56                      push esi
:00420FE4 57                      push edi
:00420FE5 894DF4                  mov dword ptr [ebp-0C], ecx
:00420FE8 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00420FEB E8C0FFFFFF              call 00420FB0
:00420FF0 C745FC00000000          mov [ebp-04], 00000000
:00420FF7 C745F800000000          mov [ebp-08], 00000000
:00420FFE E903000000              jmp 00421006

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421024(U)
|
:00421003 FF45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420FFE(U)
|
:00421006 8B45F4                  mov eax, dword ptr [ebp-0C]
:00421009 33C9                    xor ecx, ecx
:0042100B 8A4878                  mov cl, byte ptr [eax+78]
:0042100E 3B4DFC                  cmp ecx, dword ptr [ebp-04]
:00421011 0F8612000000            jbe 00421029
:00421017 8B45FC                  mov eax, dword ptr [ebp-04]
:0042101A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042101D 8B448160                mov eax, dword ptr [ecx+4*eax+60]
:00421021 0145F8                  add dword ptr [ebp-08], eax
:00421024 E9DAFFFFFF              jmp 00421003

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421011(C)
|
:00421029 E8695F0000              call 00426F97
:0042102E 6A04                    push 00000004
:00421030 6A00                    push 00000000
:00421032 8B45F8                  mov eax, dword ptr [ebp-08]
:00421035 50                      push eax
:00421036 B918E54600              mov ecx, 0046E518
:0042103B E8E0660200              call 00447720
:00421040 50                      push eax
:00421041 6A00                    push 00000000
:00421043 8B45F4                  mov eax, dword ptr [ebp-0C]
:00421046 33C9                    xor ecx, ecx
:00421048 8A4878                  mov cl, byte ptr [eax+78]
:0042104B 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042104E 8B448848                mov eax, dword ptr [eax+4*ecx+48]
:00421052 50                      push eax
:00421053 8B45F4                  mov eax, dword ptr [ebp-0C]
:00421056 33C9                    xor ecx, ecx
:00421058 8A4878                  mov cl, byte ptr [eax+78]
:0042105B 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042105E 8B448830                mov eax, dword ptr [eax+4*ecx+30]
:00421062 50                      push eax
:00421063 8B45F4                  mov eax, dword ptr [ebp-0C]
:00421066 33C9                    xor ecx, ecx
:00421068 8A4878                  mov cl, byte ptr [eax+78]
:0042106B 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042106E 8B448818                mov eax, dword ptr [eax+4*ecx+18]
:00421072 50                      push eax
:00421073 8B45F4                  mov eax, dword ptr [ebp-0C]
:00421076 33C9                    xor ecx, ecx
:00421078 8A4878                  mov cl, byte ptr [eax+78]
:0042107B 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042107E 8B0488                  mov eax, dword ptr [eax+4*ecx]
:00421081 50                      push eax
:00421082 E8955F0000              call 0042701C
:00421087 83C418                  add esp, 00000018
:0042108A E8285F0000              call 00426FB7
:0042108F E900000000              jmp 00421094

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042108F(U)
|
:00421094 5F                      pop edi
:00421095 5E                      pop esi
:00421096 5B                      pop ebx
:00421097 C9                      leave
:00421098 C3                      ret



* Referenced by a CALL at Addresses:
|:004382A3   , :0043C6A0   
|
:00421099 55                      push ebp
:0042109A 8BEC                    mov ebp, esp
:0042109C 83EC04                  sub esp, 00000004
:0042109F 53                      push ebx
:004210A0 56                      push esi
:004210A1 57                      push edi
:004210A2 894DFC                  mov dword ptr [ebp-04], ecx
:004210A5 6A01                    push 00000001
:004210A7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004210AA E854040000              call 00421503
:004210AF 6A03                    push 00000003
:004210B1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004210B4 E84A040000              call 00421503
:004210B9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004210BC E8F6040000              call 004215B7
:004210C1 6A00                    push 00000000
:004210C3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004210C6 E838040000              call 00421503
:004210CB E900000000              jmp 004210D0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004210CB(U)
|
:004210D0 5F                      pop edi
:004210D1 5E                      pop esi
:004210D2 5B                      pop ebx
:004210D3 C9                      leave
:004210D4 C3                      ret



* Referenced by a CALL at Addresses:
|:00438752   , :0043C6AA   
|
:004210D5 55                      push ebp
:004210D6 8BEC                    mov ebp, esp
:004210D8 83EC1C                  sub esp, 0000001C
:004210DB 53                      push ebx
:004210DC 56                      push esi
:004210DD 57                      push edi
:004210DE 894DE4                  mov dword ptr [ebp-1C], ecx
:004210E1 B988534500              mov ecx, 00455388
:004210E6 E8070CFEFF              call 00401CF2
:004210EB B988534500              mov ecx, 00455388
:004210F0 E8AB83FEFF              call 004094A0
:004210F5 8945FC                  mov dword ptr [ebp-04], eax
:004210F8 B988534500              mov ecx, 00455388
:004210FD E8BE83FEFF              call 004094C0
:00421102 8945F8                  mov dword ptr [ebp-08], eax
:00421105 8B45E4                  mov eax, dword ptr [ebp-1C]
:00421108 8B4014                  mov eax, dword ptr [eax+14]
:0042110B 8945F4                  mov dword ptr [ebp-0C], eax
:0042110E 8B45E4                  mov eax, dword ptr [ebp-1C]
:00421111 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00421114 3908                    cmp dword ptr [eax], ecx
:00421116 0F8716030000            ja 00421432
:0042111C 8B45E4                  mov eax, dword ptr [ebp-1C]
:0042111F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00421122 394804                  cmp dword ptr [eax+04], ecx
:00421125 0F8707030000            ja 00421432
:0042112B 8B45E4                  mov eax, dword ptr [ebp-1C]
:0042112E 8B00                    mov eax, dword ptr [eax]
:00421130 83C010                  add eax, 00000010
:00421133 3B45FC                  cmp eax, dword ptr [ebp-04]
:00421136 0F86F6020000            jbe 00421432
:0042113C 8B45E4                  mov eax, dword ptr [ebp-1C]
:0042113F 8B4004                  mov eax, dword ptr [eax+04]
:00421142 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00421145 034108                  add eax, dword ptr [ecx+08]
:00421148 3B45F8                  cmp eax, dword ptr [ebp-08]
:0042114B 0F86E1020000            jbe 00421432
:00421151 B988534500              mov ecx, 00455388
:00421156 E8210CFEFF              call 00401D7C
:0042115B 85C0                    test eax, eax
:0042115D 0F84CF020000            je 00421432
:00421163 8B45E4                  mov eax, dword ptr [ebp-1C]
:00421166 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00421169 394804                  cmp dword ptr [eax+04], ecx
:0042116C 0F8756000000            ja 004211C8
:00421172 8B45E4                  mov eax, dword ptr [ebp-1C]
:00421175 8B4004                  mov eax, dword ptr [eax+04]
:00421178 83C010                  add eax, 00000010
:0042117B 3B45F8                  cmp eax, dword ptr [ebp-08]
:0042117E 0F8644000000            jbe 004211C8
:00421184 8B45E4                  mov eax, dword ptr [ebp-1C]
:00421187 83781400                cmp dword ptr [eax+14], 00000000
:0042118B 0F8632000000            jbe 004211C3
:00421191 FF4DF4                  dec [ebp-0C]
:00421194 6A02                    push 00000002
:00421196 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00421199 E865030000              call 00421503
:0042119E B988534500              mov ecx, 00455388
:004211A3 E8E00AFEFF              call 00401C88
:004211A8 6A00                    push 00000000
:004211AA B994A64600              mov ecx, 0046A694
:004211AF E8707EFFFF              call 00419024
:004211B4 E82E630100              call 004374E7
:004211B9 6A01                    push 00000001
:004211BB 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004211BE E840030000              call 00421503

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042118B(C)
|
:004211C3 E96A020000              jmp 00421432

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042116C(C), :0042117E(C)
|
:004211C8 8B45E4                  mov eax, dword ptr [ebp-1C]
:004211CB 8B4004                  mov eax, dword ptr [eax+04]
:004211CE 83C010                  add eax, 00000010
:004211D1 3B45F8                  cmp eax, dword ptr [ebp-08]
:004211D4 0F874D000000            ja 00421227
:004211DA 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004211DD E86E0C0000              call 00421E50
:004211E2 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004211E5 8B4904                  mov ecx, dword ptr [ecx+04]
:004211E8 03C8                    add ecx, eax
:004211EA 3B4DF8                  cmp ecx, dword ptr [ebp-08]
:004211ED 0F8634000000            jbe 00421227
:004211F3 8B45E4                  mov eax, dword ptr [ebp-1C]
:004211F6 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004211F9 8B4914                  mov ecx, dword ptr [ecx+14]
:004211FC 39480C                  cmp dword ptr [eax+0C], ecx
:004211FF 0F820C000000            jb 00421211
:00421205 C745F400000000          mov [ebp-0C], 00000000
:0042120C E90C000000              jmp 0042121D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004211FF(C)
|
:00421211 8B45F4                  mov eax, dword ptr [ebp-0C]
:00421214 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00421217 2B410C                  sub eax, dword ptr [ecx+0C]
:0042121A 8945F4                  mov dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042120C(U)
|
:0042121D E8C5620100              call 004374E7
:00421222 E90B020000              jmp 00421432

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004211D4(C), :004211ED(C)
|
:00421227 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0042122A E8210C0000              call 00421E50
:0042122F 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00421232 8B4904                  mov ecx, dword ptr [ecx+04]
:00421235 03C8                    add ecx, eax
:00421237 3B4DF8                  cmp ecx, dword ptr [ebp-08]
:0042123A 0F87FD000000            ja 0042133D
:00421240 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00421243 E8080C0000              call 00421E50
:00421248 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0042124B 8B4904                  mov ecx, dword ptr [ecx+04]
:0042124E 03C8                    add ecx, eax
:00421250 83C110                  add ecx, 00000010
:00421253 3B4DF8                  cmp ecx, dword ptr [ebp-08]
:00421256 0F86E1000000            jbe 0042133D
:0042125C C745F000000000          mov [ebp-10], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421333(U)
|
:00421263 B988534500              mov ecx, 00455388
:00421268 E80F0BFEFF              call 00401D7C
:0042126D 85C0                    test eax, eax
:0042126F 0F84C3000000            je 00421338
:00421275 B988534500              mov ecx, 00455388
:0042127A E8730AFEFF              call 00401CF2
:0042127F B988534500              mov ecx, 00455388
:00421284 E81782FEFF              call 004094A0
:00421289 8945EC                  mov dword ptr [ebp-14], eax
:0042128C B988534500              mov ecx, 00455388
:00421291 E82A82FEFF              call 004094C0
:00421296 8945E8                  mov dword ptr [ebp-18], eax
:00421299 8B45E4                  mov eax, dword ptr [ebp-1C]
:0042129C 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0042129F 3908                    cmp dword ptr [eax], ecx
:004212A1 0F873B000000            ja 004212E2
:004212A7 8B45E4                  mov eax, dword ptr [ebp-1C]
:004212AA 8B4004                  mov eax, dword ptr [eax+04]
:004212AD 83C010                  add eax, 00000010
:004212B0 3B45E8                  cmp eax, dword ptr [ebp-18]
:004212B3 0F8729000000            ja 004212E2
:004212B9 8B45E4                  mov eax, dword ptr [ebp-1C]
:004212BC 8B00                    mov eax, dword ptr [eax]
:004212BE 83C010                  add eax, 00000010
:004212C1 3B45EC                  cmp eax, dword ptr [ebp-14]
:004212C4 0F8618000000            jbe 004212E2
:004212CA 8B45E4                  mov eax, dword ptr [ebp-1C]
:004212CD 8B4004                  mov eax, dword ptr [eax+04]
:004212D0 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004212D3 034108                  add eax, dword ptr [ecx+08]
:004212D6 83E810                  sub eax, 00000010
:004212D9 3B45E8                  cmp eax, dword ptr [ebp-18]
:004212DC 0F8705000000            ja 004212E7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004212A1(C), :004212B3(C), :004212C4(C)
|
:004212E2 E951000000              jmp 00421338

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004212DC(C)
|
:004212E7 8B45E8                  mov eax, dword ptr [ebp-18]
:004212EA 50                      push eax
:004212EB 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004212EE E89D0B0000              call 00421E90
:004212F3 8945F4                  mov dword ptr [ebp-0C], eax
:004212F6 8B45E4                  mov eax, dword ptr [ebp-1C]
:004212F9 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004212FC 394814                  cmp dword ptr [eax+14], ecx
:004212FF 0F8407000000            je 0042130C
:00421305 C745F001000000          mov [ebp-10], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004212FF(C)
|
:0042130C 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042130F 50                      push eax
:00421310 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00421313 E870010000              call 00421488
:00421318 837DF000                cmp dword ptr [ebp-10], 00000000
:0042131C 0F8411000000            je 00421333
:00421322 B988534500              mov ecx, 00455388
:00421327 E85C09FEFF              call 00401C88
:0042132C C745F000000000          mov [ebp-10], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042131C(C)
|
:00421333 E92BFFFFFF              jmp 00421263

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042126F(C), :004212E2(U)
|
:00421338 E9F5000000              jmp 00421432

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042123A(C), :00421256(C)
|
:0042133D 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00421340 E80B0B0000              call 00421E50
:00421345 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00421348 8B4904                  mov ecx, dword ptr [ecx+04]
:0042134B 03C8                    add ecx, eax
:0042134D 83C110                  add ecx, 00000010
:00421350 3B4DF8                  cmp ecx, dword ptr [ebp-08]
:00421353 0F8762000000            ja 004213BB
:00421359 8B45E4                  mov eax, dword ptr [ebp-1C]
:0042135C 8B4004                  mov eax, dword ptr [eax+04]
:0042135F 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00421362 034108                  add eax, dword ptr [ecx+08]
:00421365 83E810                  sub eax, 00000010
:00421368 3B45F8                  cmp eax, dword ptr [ebp-08]
:0042136B 0F864A000000            jbe 004213BB
:00421371 8B45E4                  mov eax, dword ptr [ebp-1C]
:00421374 8B4010                  mov eax, dword ptr [eax+10]
:00421377 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0042137A 2B410C                  sub eax, dword ptr [ecx+0C]
:0042137D 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00421380 8B490C                  mov ecx, dword ptr [ecx+0C]
:00421383 8B55E4                  mov edx, dword ptr [ebp-1C]
:00421386 034A14                  add ecx, dword ptr [edx+14]
:00421389 3BC1                    cmp eax, ecx
:0042138B 0F8714000000            ja 004213A5
:00421391 8B45E4                  mov eax, dword ptr [ebp-1C]
:00421394 8B4010                  mov eax, dword ptr [eax+10]
:00421397 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0042139A 2B410C                  sub eax, dword ptr [ecx+0C]
:0042139D 8945F4                  mov dword ptr [ebp-0C], eax
:004213A0 E90C000000              jmp 004213B1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042138B(C)
|
:004213A5 8B45E4                  mov eax, dword ptr [ebp-1C]
:004213A8 8B400C                  mov eax, dword ptr [eax+0C]
:004213AB 0345F4                  add eax, dword ptr [ebp-0C]
:004213AE 8945F4                  mov dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004213A0(U)
|
:004213B1 E831610100              call 004374E7
:004213B6 E977000000              jmp 00421432

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00421353(C), :0042136B(C)
|
:004213BB 8B45E4                  mov eax, dword ptr [ebp-1C]
:004213BE 8B4004                  mov eax, dword ptr [eax+04]
:004213C1 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004213C4 034108                  add eax, dword ptr [ecx+08]
:004213C7 83E810                  sub eax, 00000010
:004213CA 3B45F8                  cmp eax, dword ptr [ebp-08]
:004213CD 0F875F000000            ja 00421432
:004213D3 8B45E4                  mov eax, dword ptr [ebp-1C]
:004213D6 8B4004                  mov eax, dword ptr [eax+04]
:004213D9 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004213DC 034108                  add eax, dword ptr [ecx+08]
:004213DF 3B45F8                  cmp eax, dword ptr [ebp-08]
:004213E2 0F864A000000            jbe 00421432
:004213E8 8B45E4                  mov eax, dword ptr [ebp-1C]
:004213EB 8B4010                  mov eax, dword ptr [eax+10]
:004213EE 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004213F1 2B410C                  sub eax, dword ptr [ecx+0C]
:004213F4 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004213F7 3B4114                  cmp eax, dword ptr [ecx+14]
:004213FA 0F8632000000            jbe 00421432
:00421400 FF45F4                  inc [ebp-0C]
:00421403 6A04                    push 00000004
:00421405 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00421408 E8F6000000              call 00421503
:0042140D B988534500              mov ecx, 00455388
:00421412 E87108FEFF              call 00401C88
:00421417 6A00                    push 00000000
:00421419 B994A64600              mov ecx, 0046A694
:0042141E E8017CFFFF              call 00419024
:00421423 E8BF600100              call 004374E7
:00421428 6A03                    push 00000003
:0042142A 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0042142D E8D1000000              call 00421503

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00421116(C), :00421125(C), :00421136(C), :0042114B(C), :0042115D(C)
|:004211C3(U), :00421222(U), :00421338(U), :004213B6(U), :004213CD(C)
|:004213E2(C), :004213FA(C)
|
:00421432 8B45F4                  mov eax, dword ptr [ebp-0C]
:00421435 50                      push eax
:00421436 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00421439 E84A000000              call 00421488
:0042143E 8B45E4                  mov eax, dword ptr [ebp-1C]
:00421441 8B4014                  mov eax, dword ptr [eax+14]
:00421444 E900000000              jmp 00421449

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421444(U)
|
:00421449 5F                      pop edi
:0042144A 5E                      pop esi
:0042144B 5B                      pop ebx
:0042144C C9                      leave
:0042144D C3                      ret


:0042144E 55                      push ebp
:0042144F 8BEC                    mov ebp, esp
:00421451 83EC04                  sub esp, 00000004
:00421454 53                      push ebx
:00421455 56                      push esi
:00421456 57                      push edi
:00421457 894DFC                  mov dword ptr [ebp-04], ecx
:0042145A 8B45FC                  mov eax, dword ptr [ebp-04]
:0042145D 8B4D08                  mov ecx, dword ptr [ebp+08]
:00421460 394810                  cmp dword ptr [eax+10], ecx
:00421463 0F8413000000            je 0042147C
:00421469 6A00                    push 00000000
:0042146B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042146E E815000000              call 00421488
:00421473 8B4508                  mov eax, dword ptr [ebp+08]
:00421476 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00421479 894110                  mov dword ptr [ecx+10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421463(C)
|
:0042147C E900000000              jmp 00421481

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042147C(U)
|
:00421481 5F                      pop edi
:00421482 5E                      pop esi
:00421483 5B                      pop ebx
:00421484 C9                      leave
:00421485 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00421313   , :00421439   , :0042146E   , :00438298   , :0043C565   
|
:00421488 55                      push ebp
:00421489 8BEC                    mov ebp, esp
:0042148B 83EC04                  sub esp, 00000004
:0042148E 53                      push ebx
:0042148F 56                      push esi
:00421490 57                      push edi
:00421491 894DFC                  mov dword ptr [ebp-04], ecx
:00421494 8B45FC                  mov eax, dword ptr [ebp-04]
:00421497 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042149A 394814                  cmp dword ptr [eax+14], ecx
:0042149D 0F8454000000            je 004214F7
:004214A3 E8EF5A0000              call 00426F97
:004214A8 6A04                    push 00000004
:004214AA 6A00                    push 00000000
:004214AC 6880980000              push 00009880
:004214B1 B940CF4600              mov ecx, 0046CF40
:004214B6 E865620200              call 00447720
:004214BB 50                      push eax
:004214BC 6A10                    push 00000010
:004214BE 6A10                    push 00000010
:004214C0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004214C3 E888090000              call 00421E50
:004214C8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004214CB 8B4904                  mov ecx, dword ptr [ecx+04]
:004214CE 03C8                    add ecx, eax
:004214D0 51                      push ecx
:004214D1 8B45FC                  mov eax, dword ptr [ebp-04]
:004214D4 8B00                    mov eax, dword ptr [eax]
:004214D6 50                      push eax
:004214D7 E8C3420200              call 0044579F
:004214DC 83C414                  add esp, 00000014
:004214DF E8D35A0000              call 00426FB7
:004214E4 8B4508                  mov eax, dword ptr [ebp+08]
:004214E7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004214EA 894114                  mov dword ptr [ecx+14], eax
:004214ED 6A00                    push 00000000
:004214EF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004214F2 E80C000000              call 00421503

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042149D(C)
|
:004214F7 E900000000              jmp 004214FC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004214F7(U)
|
:004214FC 5F                      pop edi
:004214FD 5E                      pop esi
:004214FE 5B                      pop ebx
:004214FF C9                      leave
:00421500 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:004210AA   , :004210B4   , :004210C6   , :00421199   , :004211BE   
|:00421408   , :0042142D   , :004214F2   
|
:00421503 55                      push ebp
:00421504 8BEC                    mov ebp, esp
:00421506 83EC0C                  sub esp, 0000000C
:00421509 53                      push ebx
:0042150A 56                      push esi
:0042150B 57                      push edi
:0042150C 894DF8                  mov dword ptr [ebp-08], ecx
:0042150F 8B45F8                  mov eax, dword ptr [ebp-08]
:00421512 8B4004                  mov eax, dword ptr [eax+04]
:00421515 8945FC                  mov dword ptr [ebp-04], eax
:00421518 33C0                    xor eax, eax
:0042151A 8A4508                  mov al, byte ptr [ebp+08]
:0042151D 8945F4                  mov dword ptr [ebp-0C], eax
:00421520 E926000000              jmp 0042154B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042154F(C)
|
:00421525 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00421528 E823090000              call 00421E50
:0042152D 0145FC                  add dword ptr [ebp-04], eax
:00421530 E939000000              jmp 0042156E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421563(C)
|
:00421535 8B45F8                  mov eax, dword ptr [ebp-08]
:00421538 8B4008                  mov eax, dword ptr [eax+08]
:0042153B 83E810                  sub eax, 00000010
:0042153E 0145FC                  add dword ptr [ebp-04], eax
:00421541 E928000000              jmp 0042156E
:00421546 E923000000              jmp 0042156E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421520(U)
|
:0042154B 837DF400                cmp dword ptr [ebp-0C], 00000000
:0042154F 0F84D0FFFFFF            je 00421525
:00421555 837DF403                cmp dword ptr [ebp-0C], 00000003
:00421559 0F8C0F000000            jl 0042156E
:0042155F 837DF404                cmp dword ptr [ebp-0C], 00000004
:00421563 0F8ECCFFFFFF            jle 00421535
:00421569 E900000000              jmp 0042156E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00421530(U), :00421541(U), :00421546(U), :00421559(C), :00421569(U)
|
:0042156E E8245A0000              call 00426F97
:00421573 6A04                    push 00000004
:00421575 6A00                    push 00000000
:00421577 33C0                    xor eax, eax
:00421579 8A4508                  mov al, byte ptr [ebp+08]
:0042157C C1E008                  shl eax, 08
:0042157F 0580990000              add eax, 00009980
:00421584 50                      push eax
:00421585 B940CF4600              mov ecx, 0046CF40
:0042158A E891610200              call 00447720
:0042158F 50                      push eax
:00421590 6A10                    push 00000010
:00421592 6A10                    push 00000010
:00421594 8B45FC                  mov eax, dword ptr [ebp-04]
:00421597 50                      push eax
:00421598 8B45F8                  mov eax, dword ptr [ebp-08]
:0042159B 8B00                    mov eax, dword ptr [eax]
:0042159D 50                      push eax
:0042159E E8FC410200              call 0044579F
:004215A3 83C414                  add esp, 00000014
:004215A6 E80C5A0000              call 00426FB7
:004215AB E900000000              jmp 004215B0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004215AB(U)
|
:004215B0 5F                      pop edi
:004215B1 5E                      pop esi
:004215B2 5B                      pop ebx
:004215B3 C9                      leave
:004215B4 C20400                  ret 0004



* Referenced by a CALL at Address:
|:004210BC   
|
:004215B7 55                      push ebp
:004215B8 8BEC                    mov ebp, esp
:004215BA 83EC0C                  sub esp, 0000000C
:004215BD 53                      push ebx
:004215BE 56                      push esi
:004215BF 57                      push edi
:004215C0 894DF4                  mov dword ptr [ebp-0C], ecx
:004215C3 8B45F4                  mov eax, dword ptr [ebp-0C]
:004215C6 8B4008                  mov eax, dword ptr [eax+08]
:004215C9 83E820                  sub eax, 00000020
:004215CC C1E804                  shr eax, 04
:004215CF 8945FC                  mov dword ptr [ebp-04], eax
:004215D2 E8C0590000              call 00426F97
:004215D7 C745F800000000          mov [ebp-08], 00000000
:004215DE E903000000              jmp 004215E6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042162A(U)
|
:004215E3 FF45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004215DE(U)
|
:004215E6 8B45FC                  mov eax, dword ptr [ebp-04]
:004215E9 3945F8                  cmp dword ptr [ebp-08], eax
:004215EC 0F833D000000            jnb 0042162F
:004215F2 6A04                    push 00000004
:004215F4 6A00                    push 00000000
:004215F6 6880980000              push 00009880
:004215FB B940CF4600              mov ecx, 0046CF40
:00421600 E81B610200              call 00447720
:00421605 50                      push eax
:00421606 6A10                    push 00000010
:00421608 6A10                    push 00000010
:0042160A 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042160D 8B4004                  mov eax, dword ptr [eax+04]
:00421610 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00421613 C1E104                  shl ecx, 04
:00421616 03C1                    add eax, ecx
:00421618 83C010                  add eax, 00000010
:0042161B 50                      push eax
:0042161C 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042161F 8B00                    mov eax, dword ptr [eax]
:00421621 50                      push eax
:00421622 E878410200              call 0044579F
:00421627 83C414                  add esp, 00000014
:0042162A E9B4FFFFFF              jmp 004215E3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004215EC(C)
|
:0042162F 6A04                    push 00000004
:00421631 6A00                    push 00000000
:00421633 6880980000              push 00009880
:00421638 B940CF4600              mov ecx, 0046CF40
:0042163D E8DE600200              call 00447720
:00421642 50                      push eax
:00421643 8B45F4                  mov eax, dword ptr [ebp-0C]
:00421646 8B4008                  mov eax, dword ptr [eax+08]
:00421649 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042164C C1E104                  shl ecx, 04
:0042164F 2BC1                    sub eax, ecx
:00421651 83E820                  sub eax, 00000020
:00421654 50                      push eax
:00421655 6A10                    push 00000010
:00421657 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042165A 8B4004                  mov eax, dword ptr [eax+04]
:0042165D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00421660 C1E104                  shl ecx, 04
:00421663 03C1                    add eax, ecx
:00421665 83C010                  add eax, 00000010
:00421668 50                      push eax
:00421669 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042166C 8B00                    mov eax, dword ptr [eax]
:0042166E 50                      push eax
:0042166F E82B410200              call 0044579F
:00421674 83C414                  add esp, 00000014
:00421677 E83B590000              call 00426FB7
:0042167C E900000000              jmp 00421681

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042167C(U)
|
:00421681 5F                      pop edi
:00421682 5E                      pop esi
:00421683 5B                      pop ebx
:00421684 C9                      leave
:00421685 C3                      ret



* Referenced by a CALL at Addresses:
|:0040A516   , :0040A5F1   , :0040A6CC   , :0040A7A7   , :0040A870   
|:0040A922   , :0040A9DB   , :0040AA8F   , :0040AB1C   , :00421B99   
|:00421CFB   , :004393DD   , :004393E8   , :00439431   , :0043943C   
|:0043C554   , :0043C700   , :0043FA09   , :0043FB4C   , :00443FBE   
|
:00421686 55                      push ebp
:00421687 8BEC                    mov ebp, esp
:00421689 83EC14                  sub esp, 00000014
:0042168C 53                      push ebx
:0042168D 56                      push esi
:0042168E 57                      push edi
:0042168F 894DF0                  mov dword ptr [ebp-10], ecx
:00421692 8B45F0                  mov eax, dword ptr [ebp-10]
:00421695 8B4010                  mov eax, dword ptr [eax+10]
:00421698 50                      push eax
:00421699 E80C5D0200              call 004473AA
:0042169E 83C404                  add esp, 00000004
:004216A1 8945F4                  mov dword ptr [ebp-0C], eax
:004216A4 6A04                    push 00000004
:004216A6 B910BC4600              mov ecx, 0046BC10
:004216AB E8D1E7FFFF              call 0041FE81
:004216B0 8B45F0                  mov eax, dword ptr [ebp-10]
:004216B3 33C9                    xor ecx, ecx
:004216B5 8A4815                  mov cl, byte ptr [eax+15]
:004216B8 F6C140                  test cl, 40
:004216BB 0F8411000000            je 004216D2
:004216C1 6A04                    push 00000004
:004216C3 B910BC4600              mov ecx, 0046BC10
:004216C8 E806E6FFFF              call 0041FCD3
:004216CD E90C000000              jmp 004216DE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004216BB(C)
|
:004216D2 6A07                    push 00000007
:004216D4 B910BC4600              mov ecx, 0046BC10
:004216D9 E8F5E5FFFF              call 0041FCD3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004216CD(U)
|
:004216DE 6A00                    push 00000000
:004216E0 B910BC4600              mov ecx, 0046BC10
:004216E5 E8E6E6FFFF              call 0041FDD0
:004216EA 8B45F0                  mov eax, dword ptr [ebp-10]
:004216ED 8B4008                  mov eax, dword ptr [eax+08]
:004216F0 C1E803                  shr eax, 03
:004216F3 2B45F4                  sub eax, dword ptr [ebp-0C]
:004216F6 C1E801                  shr eax, 01
:004216F9 8945FC                  mov dword ptr [ebp-04], eax
:004216FC 8B45F0                  mov eax, dword ptr [ebp-10]
:004216FF 8B4004                  mov eax, dword ptr [eax+04]
:00421702 83C003                  add eax, 00000003
:00421705 50                      push eax
:00421706 8B45F0                  mov eax, dword ptr [ebp-10]
:00421709 8B00                    mov eax, dword ptr [eax]
:0042170B C1E803                  shr eax, 03
:0042170E 0345FC                  add eax, dword ptr [ebp-04]
:00421711 50                      push eax
:00421712 B910BC4600              mov ecx, 0046BC10
:00421717 E8EBE4FFFF              call 0041FC07
:0042171C E876580000              call 00426F97
:00421721 8B45F0                  mov eax, dword ptr [ebp-10]
:00421724 33C9                    xor ecx, ecx
:00421726 8A4815                  mov cl, byte ptr [eax+15]
:00421729 83E103                  and ecx, 00000003
:0042172C 894DEC                  mov dword ptr [ebp-14], ecx
:0042172F E92D010000              jmp 00421861
:00421734 6A04                    push 00000004
:00421736 6A00                    push 00000000
:00421738 68C09F0000              push 00009FC0
:0042173D B940CF4600              mov ecx, 0046CF40
:00421742 E8D95F0200              call 00447720
:00421747 50                      push eax
:00421748 6A14                    push 00000014
:0042174A 6A08                    push 00000008
:0042174C 8B45F0                  mov eax, dword ptr [ebp-10]
:0042174F 8B4004                  mov eax, dword ptr [eax+04]
:00421752 50                      push eax
:00421753 8B45F0                  mov eax, dword ptr [ebp-10]
:00421756 8B00                    mov eax, dword ptr [eax]
:00421758 50                      push eax
:00421759 E841400200              call 0044579F
:0042175E 83C414                  add esp, 00000014
:00421761 C745F808000000          mov [ebp-08], 00000008
:00421768 E904000000              jmp 00421771

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004217B3(U)
|
:0042176D 8345F808                add dword ptr [ebp-08], 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421768(U)
|
:00421771 8B45F0                  mov eax, dword ptr [ebp-10]
:00421774 8B4008                  mov eax, dword ptr [eax+08]
:00421777 83E808                  sub eax, 00000008
:0042177A 3B45F8                  cmp eax, dword ptr [ebp-08]
:0042177D 0F8635000000            jbe 004217B8
:00421783 6A04                    push 00000004
:00421785 6A00                    push 00000000
:00421787 68209F0000              push 00009F20
:0042178C B940CF4600              mov ecx, 0046CF40
:00421791 E88A5F0200              call 00447720
:00421796 50                      push eax
:00421797 6A14                    push 00000014
:00421799 6A08                    push 00000008
:0042179B 8B45F0                  mov eax, dword ptr [ebp-10]
:0042179E 8B4004                  mov eax, dword ptr [eax+04]
:004217A1 50                      push eax
:004217A2 8B45F0                  mov eax, dword ptr [ebp-10]
:004217A5 8B00                    mov eax, dword ptr [eax]
:004217A7 0345F8                  add eax, dword ptr [ebp-08]
:004217AA 50                      push eax
:004217AB E8EF3F0200              call 0044579F
:004217B0 83C414                  add esp, 00000014
:004217B3 E9B5FFFFFF              jmp 0042176D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042177D(C)
|
:004217B8 6A04                    push 00000004
:004217BA 6A00                    push 00000000
:004217BC 68809E0000              push 00009E80
:004217C1 B940CF4600              mov ecx, 0046CF40
:004217C6 E8555F0200              call 00447720
:004217CB 50                      push eax
:004217CC 6A14                    push 00000014
:004217CE 6A08                    push 00000008
:004217D0 8B45F0                  mov eax, dword ptr [ebp-10]
:004217D3 8B4004                  mov eax, dword ptr [eax+04]
:004217D6 50                      push eax
:004217D7 8B45F0                  mov eax, dword ptr [ebp-10]
:004217DA 8B00                    mov eax, dword ptr [eax]
:004217DC 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004217DF 034108                  add eax, dword ptr [ecx+08]
:004217E2 83E808                  sub eax, 00000008
:004217E5 50                      push eax
:004217E6 E8B43F0200              call 0044579F
:004217EB 83C414                  add esp, 00000014
:004217EE E992000000              jmp 00421885
:004217F3 E98D000000              jmp 00421885
:004217F8 6A04                    push 00000004
:004217FA 6A00                    push 00000000
:004217FC 6800640000              push 00006400
:00421801 B940CF4600              mov ecx, 0046CF40
:00421806 E8155F0200              call 00447720
:0042180B 50                      push eax
:0042180C 6A14                    push 00000014
:0042180E 6A30                    push 00000030
:00421810 8B45F0                  mov eax, dword ptr [ebp-10]
:00421813 8B4004                  mov eax, dword ptr [eax+04]
:00421816 50                      push eax
:00421817 8B45F0                  mov eax, dword ptr [ebp-10]
:0042181A 8B00                    mov eax, dword ptr [eax]
:0042181C 50                      push eax
:0042181D E87D3F0200              call 0044579F
:00421822 83C414                  add esp, 00000014
:00421825 E95B000000              jmp 00421885
:0042182A 6A04                    push 00000004
:0042182C 6A00                    push 00000000
:0042182E 68C0670000              push 000067C0
:00421833 B940CF4600              mov ecx, 0046CF40
:00421838 E8E35E0200              call 00447720
:0042183D 50                      push eax
:0042183E 6A14                    push 00000014
:00421840 6A30                    push 00000030
:00421842 8B45F0                  mov eax, dword ptr [ebp-10]
:00421845 8B4004                  mov eax, dword ptr [eax+04]
:00421848 50                      push eax
:00421849 8B45F0                  mov eax, dword ptr [ebp-10]
:0042184C 8B00                    mov eax, dword ptr [eax]
:0042184E 50                      push eax
:0042184F E84B3F0200              call 0044579F
:00421854 83C414                  add esp, 00000014
:00421857 E929000000              jmp 00421885
:0042185C E924000000              jmp 00421885

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042172F(U)
|
:00421861 837DEC03                cmp dword ptr [ebp-14], 00000003
:00421865 0F871A000000            ja 00421885
:0042186B 8B45EC                  mov eax, dword ptr [ebp-14]
:0042186E FF248575184200          jmp dword ptr [4*eax+00421875]

:00421875 34174200                DWORD 00421734
:00421879 F3174200                DWORD 004217F3
:0042187D F8174200                DWORD 004217F8
:00421881 2A184200                DWORD 0042182A



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004217EE(U), :004217F3(U), :00421825(U), :00421857(U), :0042185C(U)
|:00421865(C)
|
:00421885 8B45F0                  mov eax, dword ptr [ebp-10]
:00421888 83781000                cmp dword ptr [eax+10], 00000000
:0042188C 0F8419000000            je 004218AB
:00421892 8B45F0                  mov eax, dword ptr [ebp-10]
:00421895 8B4010                  mov eax, dword ptr [eax+10]
:00421898 50                      push eax

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:00421899 6820144500              push 00451420
:0042189E 6810BC4600              push 0046BC10
:004218A3 E87BF2FFFF              call 00420B23
:004218A8 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042188C(C)
|
:004218AB E807570000              call 00426FB7
:004218B0 E900000000              jmp 004218B5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004218B0(U)
|
:004218B5 5F                      pop edi
:004218B6 5E                      pop esi
:004218B7 5B                      pop ebx
:004218B8 C9                      leave
:004218B9 C3                      ret



* Referenced by a CALL at Addresses:
|:0040AB60   , :00421D69   , :00439462   , :00439480   , :004395A8   
|:004395C3   , :0043C56F   , :0043FBB8   , :0043FBEF   , :00443FC6   
|
:004218BA 55                      push ebp
:004218BB 8BEC                    mov ebp, esp
:004218BD 83EC18                  sub esp, 00000018
:004218C0 53                      push ebx
:004218C1 56                      push esi
:004218C2 57                      push edi
:004218C3 894DEC                  mov dword ptr [ebp-14], ecx
:004218C6 B988534500              mov ecx, 00455388
:004218CB E82204FEFF              call 00401CF2
:004218D0 B988534500              mov ecx, 00455388
:004218D5 E8C67BFEFF              call 004094A0
:004218DA 8945FC                  mov dword ptr [ebp-04], eax
:004218DD B988534500              mov ecx, 00455388
:004218E2 E8D97BFEFF              call 004094C0
:004218E7 8945F8                  mov dword ptr [ebp-08], eax
:004218EA C645F0FF                mov [ebp-10], FF
:004218EE 8B45EC                  mov eax, dword ptr [ebp-14]
:004218F1 C6401600                mov [eax+16], 00
:004218F5 B988534500              mov ecx, 00455388
:004218FA E87D04FEFF              call 00401D7C
:004218FF 85C0                    test eax, eax
:00421901 0F84FC020000            je 00421C03
:00421907 8B45EC                  mov eax, dword ptr [ebp-14]
:0042190A 33C9                    xor ecx, ecx
:0042190C 8A4815                  mov cl, byte ptr [eax+15]
:0042190F F6C140                  test cl, 40
:00421912 0F85EB020000            jne 00421C03
:00421918 8B45EC                  mov eax, dword ptr [ebp-14]
:0042191B 33C9                    xor ecx, ecx
:0042191D 8A4815                  mov cl, byte ptr [eax+15]
:00421920 F6C180                  test cl, 80
:00421923 0F8546000000            jne 0042196F
:00421929 8B45EC                  mov eax, dword ptr [ebp-14]
:0042192C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042192F 3908                    cmp dword ptr [eax], ecx
:00421931 0F87CC020000            ja 00421C03
:00421937 8B45EC                  mov eax, dword ptr [ebp-14]
:0042193A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042193D 394804                  cmp dword ptr [eax+04], ecx
:00421940 0F87BD020000            ja 00421C03
:00421946 8B45EC                  mov eax, dword ptr [ebp-14]
:00421949 8B4008                  mov eax, dword ptr [eax+08]
:0042194C 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0042194F 0301                    add eax, dword ptr [ecx]
:00421951 3B45FC                  cmp eax, dword ptr [ebp-04]
:00421954 0F86A9020000            jbe 00421C03
:0042195A 8B45EC                  mov eax, dword ptr [ebp-14]
:0042195D 8B4004                  mov eax, dword ptr [eax+04]
:00421960 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00421963 03410C                  add eax, dword ptr [ecx+0C]
:00421966 3B45F8                  cmp eax, dword ptr [ebp-08]
:00421969 0F8694020000            jbe 00421C03

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421923(C)
|
:0042196F B988534500              mov ecx, 00455388
:00421974 E80F03FEFF              call 00401C88
:00421979 8B45EC                  mov eax, dword ptr [ebp-14]
:0042197C 33C9                    xor ecx, ecx
:0042197E 8A4815                  mov cl, byte ptr [eax+15]
:00421981 83E103                  and ecx, 00000003
:00421984 894DE8                  mov dword ptr [ebp-18], ecx
:00421987 E9BD010000              jmp 00421B49
:0042198C B9A0E44600              mov ecx, 0046E4A0
:00421991 E84A77FEFF              call 004090E0
:00421996 50                      push eax
:00421997 6A10                    push 00000010
:00421999 8B45EC                  mov eax, dword ptr [ebp-14]
:0042199C 8B4008                  mov eax, dword ptr [eax+08]
:0042199F 83E810                  sub eax, 00000010
:004219A2 50                      push eax
:004219A3 8B45EC                  mov eax, dword ptr [ebp-14]
:004219A6 8B4004                  mov eax, dword ptr [eax+04]
:004219A9 83C003                  add eax, 00000003
:004219AC 50                      push eax
:004219AD 8B45EC                  mov eax, dword ptr [ebp-14]
:004219B0 8B00                    mov eax, dword ptr [eax]
:004219B2 83C008                  add eax, 00000008
:004219B5 50                      push eax
:004219B6 E8A03F0200              call 0044595B
:004219BB 83C414                  add esp, 00000014
:004219BE 6A04                    push 00000004
:004219C0 6A00                    push 00000000
:004219C2 68A0A10000              push 0000A1A0
:004219C7 B940CF4600              mov ecx, 0046CF40
:004219CC E84F5D0200              call 00447720
:004219D1 50                      push eax
:004219D2 6A14                    push 00000014
:004219D4 6A08                    push 00000008
:004219D6 8B45EC                  mov eax, dword ptr [ebp-14]
:004219D9 8B4004                  mov eax, dword ptr [eax+04]
:004219DC 50                      push eax
:004219DD 8B45EC                  mov eax, dword ptr [ebp-14]
:004219E0 8B00                    mov eax, dword ptr [eax]
:004219E2 50                      push eax
:004219E3 E8B73D0200              call 0044579F
:004219E8 83C414                  add esp, 00000014
:004219EB 6A00                    push 00000000
:004219ED B994A64600              mov ecx, 0046A694
:004219F2 E82D76FFFF              call 00419024
:004219F7 C745F408000000          mov [ebp-0C], 00000008
:004219FE E904000000              jmp 00421A07

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421A49(U)
|
:00421A03 8345F408                add dword ptr [ebp-0C], 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004219FE(U)
|
:00421A07 8B45EC                  mov eax, dword ptr [ebp-14]
:00421A0A 8B4008                  mov eax, dword ptr [eax+08]
:00421A0D 83E808                  sub eax, 00000008
:00421A10 3B45F4                  cmp eax, dword ptr [ebp-0C]
:00421A13 0F8635000000            jbe 00421A4E
:00421A19 6A04                    push 00000004
:00421A1B 6A00                    push 00000000
:00421A1D 6800A10000              push 0000A100
:00421A22 B940CF4600              mov ecx, 0046CF40
:00421A27 E8F45C0200              call 00447720
:00421A2C 50                      push eax
:00421A2D 6A14                    push 00000014
:00421A2F 6A08                    push 00000008
:00421A31 8B45EC                  mov eax, dword ptr [ebp-14]
:00421A34 8B4004                  mov eax, dword ptr [eax+04]
:00421A37 50                      push eax
:00421A38 8B45EC                  mov eax, dword ptr [ebp-14]
:00421A3B 8B00                    mov eax, dword ptr [eax]
:00421A3D 0345F4                  add eax, dword ptr [ebp-0C]
:00421A40 50                      push eax
:00421A41 E8593D0200              call 0044579F
:00421A46 83C414                  add esp, 00000014
:00421A49 E9B5FFFFFF              jmp 00421A03

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421A13(C)
|
:00421A4E 6A04                    push 00000004
:00421A50 6A00                    push 00000000
:00421A52 6860A00000              push 0000A060
:00421A57 B940CF4600              mov ecx, 0046CF40
:00421A5C E8BF5C0200              call 00447720
:00421A61 50                      push eax
:00421A62 6A14                    push 00000014
:00421A64 6A08                    push 00000008
:00421A66 8B45EC                  mov eax, dword ptr [ebp-14]
:00421A69 8B4004                  mov eax, dword ptr [eax+04]
:00421A6C 50                      push eax
:00421A6D 8B45EC                  mov eax, dword ptr [ebp-14]
:00421A70 8B4008                  mov eax, dword ptr [eax+08]
:00421A73 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00421A76 0301                    add eax, dword ptr [ecx]
:00421A78 83E808                  sub eax, 00000008
:00421A7B 50                      push eax
:00421A7C E81E3D0200              call 0044579F
:00421A81 83C414                  add esp, 00000014
:00421A84 B9A0E44600              mov ecx, 0046E4A0
:00421A89 E85276FEFF              call 004090E0
:00421A8E 50                      push eax
:00421A8F 6A0F                    push 0000000F
:00421A91 8B45EC                  mov eax, dword ptr [ebp-14]
:00421A94 8B4008                  mov eax, dword ptr [eax+08]
:00421A97 83E810                  sub eax, 00000010
:00421A9A 50                      push eax
:00421A9B 8B45EC                  mov eax, dword ptr [ebp-14]
:00421A9E 8B4004                  mov eax, dword ptr [eax+04]
:00421AA1 83C004                  add eax, 00000004
:00421AA4 50                      push eax
:00421AA5 8B45EC                  mov eax, dword ptr [ebp-14]
:00421AA8 8B00                    mov eax, dword ptr [eax]
:00421AAA 83C008                  add eax, 00000008
:00421AAD 50                      push eax
:00421AAE E8EC3C0200              call 0044579F
:00421AB3 83C414                  add esp, 00000014
:00421AB6 E9B2000000              jmp 00421B6D
:00421ABB 6A00                    push 00000000
:00421ABD B994A64600              mov ecx, 0046A694
:00421AC2 E85D75FFFF              call 00419024
:00421AC7 E93F010000              jmp 00421C0B
:00421ACC E911000000              jmp 00421AE2
:00421AD1 E997000000              jmp 00421B6D
:00421AD6 6A01                    push 00000001
:00421AD8 B994A64600              mov ecx, 0046A694
:00421ADD E84275FFFF              call 00419024

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00421ACC(U), :00421C0B(U)
|
:00421AE2 B9A0E44600              mov ecx, 0046E4A0
:00421AE7 E8F475FEFF              call 004090E0
:00421AEC 50                      push eax
:00421AED 8B45EC                  mov eax, dword ptr [ebp-14]
:00421AF0 8B400C                  mov eax, dword ptr [eax+0C]
:00421AF3 50                      push eax
:00421AF4 8B45EC                  mov eax, dword ptr [ebp-14]
:00421AF7 8B4008                  mov eax, dword ptr [eax+08]
:00421AFA 50                      push eax
:00421AFB 8B45EC                  mov eax, dword ptr [ebp-14]
:00421AFE 8B4004                  mov eax, dword ptr [eax+04]
:00421B01 50                      push eax
:00421B02 8B45EC                  mov eax, dword ptr [ebp-14]
:00421B05 8B00                    mov eax, dword ptr [eax]
:00421B07 50                      push eax
:00421B08 E84E3E0200              call 0044595B
:00421B0D 83C414                  add esp, 00000014
:00421B10 B9A0E44600              mov ecx, 0046E4A0
:00421B15 E8C675FEFF              call 004090E0
:00421B1A 50                      push eax
:00421B1B 8B45EC                  mov eax, dword ptr [ebp-14]
:00421B1E 8B400C                  mov eax, dword ptr [eax+0C]
:00421B21 50                      push eax
:00421B22 8B45EC                  mov eax, dword ptr [ebp-14]
:00421B25 8B4008                  mov eax, dword ptr [eax+08]
:00421B28 50                      push eax
:00421B29 8B45EC                  mov eax, dword ptr [ebp-14]
:00421B2C 8B4004                  mov eax, dword ptr [eax+04]
:00421B2F 40                      inc eax
:00421B30 50                      push eax
:00421B31 8B45EC                  mov eax, dword ptr [ebp-14]
:00421B34 8B00                    mov eax, dword ptr [eax]
:00421B36 50                      push eax
:00421B37 E8633C0200              call 0044579F
:00421B3C 83C414                  add esp, 00000014
:00421B3F E929000000              jmp 00421B6D
:00421B44 E924000000              jmp 00421B6D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421987(U)
|
:00421B49 837DE803                cmp dword ptr [ebp-18], 00000003
:00421B4D 0F871A000000            ja 00421B6D
:00421B53 8B45E8                  mov eax, dword ptr [ebp-18]
:00421B56 FF24855D1B4200          jmp dword ptr [4*eax+00421B5D]

:00421B5D 8C194200                DWORD 0042198C
:00421B61 8C194200                DWORD 0042198C
:00421B65 BB1A4200                DWORD 00421ABB
:00421B69 D61A4200                DWORD 00421AD6



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00421AB6(U), :00421AD1(U), :00421B3F(U), :00421B44(U), :00421B4D(C)
|
:00421B6D E875590100              call 004374E7
:00421B72 B988534500              mov ecx, 00455388
:00421B77 E87601FEFF              call 00401CF2
:00421B7C B988534500              mov ecx, 00455388
:00421B81 E81A79FEFF              call 004094A0
:00421B86 8945FC                  mov dword ptr [ebp-04], eax
:00421B89 B988534500              mov ecx, 00455388
:00421B8E E82D79FEFF              call 004094C0
:00421B93 8945F8                  mov dword ptr [ebp-08], eax
:00421B96 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00421B99 E8E8FAFFFF              call 00421686
:00421B9E 8B45EC                  mov eax, dword ptr [ebp-14]
:00421BA1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00421BA4 3908                    cmp dword ptr [eax], ecx
:00421BA6 0F8746000000            ja 00421BF2
:00421BAC 8B45EC                  mov eax, dword ptr [ebp-14]
:00421BAF 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00421BB2 394804                  cmp dword ptr [eax+04], ecx
:00421BB5 0F8737000000            ja 00421BF2
:00421BBB 8B45EC                  mov eax, dword ptr [ebp-14]
:00421BBE 8B4008                  mov eax, dword ptr [eax+08]
:00421BC1 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00421BC4 0301                    add eax, dword ptr [ecx]
:00421BC6 3B45FC                  cmp eax, dword ptr [ebp-04]
:00421BC9 0F8623000000            jbe 00421BF2
:00421BCF 8B45EC                  mov eax, dword ptr [ebp-14]
:00421BD2 8B4004                  mov eax, dword ptr [eax+04]
:00421BD5 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00421BD8 03410C                  add eax, dword ptr [ecx+0C]
:00421BDB 3B45F8                  cmp eax, dword ptr [ebp-08]
:00421BDE 0F860E000000            jbe 00421BF2
:00421BE4 8B45EC                  mov eax, dword ptr [ebp-14]
:00421BE7 8A4014                  mov al, byte ptr [eax+14]
:00421BEA 8845F0                  mov byte ptr [ebp-10], al
:00421BED E911000000              jmp 00421C03

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00421BA6(C), :00421BB5(C), :00421BC9(C), :00421BDE(C)
|
:00421BF2 B988534500              mov ecx, 00455388
:00421BF7 E88C00FEFF              call 00401C88
:00421BFC 8B45EC                  mov eax, dword ptr [ebp-14]
:00421BFF C6401601                mov [eax+16], 01

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00421901(C), :00421912(C), :00421931(C), :00421940(C), :00421954(C)
|:00421969(C), :00421BED(U)
|
:00421C03 8A45F0                  mov al, byte ptr [ebp-10]
:00421C06 E905000000              jmp 00421C10

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421AC7(U)
|
:00421C0B E9D2FEFFFF              jmp 00421AE2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421C06(U)
|
:00421C10 5F                      pop edi
:00421C11 5E                      pop esi
:00421C12 5B                      pop ebx
:00421C13 C9                      leave
:00421C14 C3                      ret



* Referenced by a CALL at Address:
|:00438408   
|
:00421C15 55                      push ebp
:00421C16 8BEC                    mov ebp, esp
:00421C18 83EC14                  sub esp, 00000014
:00421C1B 53                      push ebx
:00421C1C 56                      push esi
:00421C1D 57                      push edi
:00421C1E 894DEC                  mov dword ptr [ebp-14], ecx
:00421C21 8B45EC                  mov eax, dword ptr [ebp-14]
:00421C24 8A4001                  mov al, byte ptr [eax+01]
:00421C27 8845FC                  mov byte ptr [ebp-04], al
:00421C2A C645F400                mov [ebp-0C], 00
:00421C2E 33C0                    xor eax, eax
:00421C30 8A4514                  mov al, byte ptr [ebp+14]
:00421C33 83F801                  cmp eax, 00000001
:00421C36 0F8500000000            jne 00421C3C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421C36(C)
|
:00421C3C E856530000              call 00426F97
:00421C41 C645F800                mov [ebp-08], 00
:00421C45 E903000000              jmp 00421C4D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421D00(U)
|
:00421C4A FE45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421C45(U)
|
:00421C4D 8B45EC                  mov eax, dword ptr [ebp-14]
:00421C50 33C9                    xor ecx, ecx
:00421C52 8A08                    mov cl, byte ptr [eax]
:00421C54 33C0                    xor eax, eax
:00421C56 8A45F8                  mov al, byte ptr [ebp-08]
:00421C59 3BC8                    cmp ecx, eax
:00421C5B 0F8EA4000000            jle 00421D05
:00421C61 33C0                    xor eax, eax
:00421C63 8A4514                  mov al, byte ptr [ebp+14]
:00421C66 85C0                    test eax, eax
:00421C68 0F8511000000            jne 00421C7F
:00421C6E 33C0                    xor eax, eax
:00421C70 8A45F8                  mov al, byte ptr [ebp-08]
:00421C73 0FAF4510                imul eax, dword ptr [ebp+10]
:00421C77 8945F0                  mov dword ptr [ebp-10], eax
:00421C7A E907000000              jmp 00421C86

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421C68(C)
|
:00421C7F C745F000000000          mov [ebp-10], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421C7A(U)
|
:00421C86 33C0                    xor eax, eax
:00421C88 8A45F8                  mov al, byte ptr [ebp-08]
:00421C8B 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00421C8E 33D2                    xor edx, edx
:00421C90 8A94081A010000          mov dl, byte ptr [eax+ecx+0000011A]
:00421C97 4A                      dec edx
:00421C98 83FA01                  cmp edx, 00000001
:00421C9B 1BC0                    sbb eax, eax
:00421C9D 83E040                  and eax, 00000040
:00421CA0 50                      push eax
:00421CA1 8B45F8                  mov eax, dword ptr [ebp-08]
:00421CA4 50                      push eax
:00421CA5 33C0                    xor eax, eax
:00421CA7 8A45F8                  mov al, byte ptr [ebp-08]
:00421CAA 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00421CAD 8B4902                  mov ecx, dword ptr [ecx+02]
:00421CB0 8B0481                  mov eax, dword ptr [ecx+4*eax]
:00421CB3 50                      push eax
:00421CB4 6A14                    push 00000014
:00421CB6 33C0                    xor eax, eax
:00421CB8 8A45FC                  mov al, byte ptr [ebp-04]
:00421CBB 83C002                  add eax, 00000002
:00421CBE 50                      push eax
:00421CBF 8B45F0                  mov eax, dword ptr [ebp-10]
:00421CC2 03450C                  add eax, dword ptr [ebp+0C]
:00421CC5 50                      push eax
:00421CC6 8B4508                  mov eax, dword ptr [ebp+08]
:00421CC9 50                      push eax
:00421CCA 33C0                    xor eax, eax
:00421CCC 8A45F8                  mov al, byte ptr [ebp-08]
:00421CCF 8BC8                    mov ecx, eax
:00421CD1 8D0440                  lea eax, dword ptr [eax+2*eax]
:00421CD4 C1E003                  shl eax, 03
:00421CD7 2BC1                    sub eax, ecx
:00421CD9 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00421CDC 8D4C0806                lea ecx, dword ptr [eax+ecx+06]
:00421CE0 E8AB9FFEFF              call 0040BC90
:00421CE5 33C0                    xor eax, eax
:00421CE7 8A45F8                  mov al, byte ptr [ebp-08]
:00421CEA 8BC8                    mov ecx, eax
:00421CEC 8D0440                  lea eax, dword ptr [eax+2*eax]
:00421CEF C1E003                  shl eax, 03
:00421CF2 2BC1                    sub eax, ecx
:00421CF4 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00421CF7 8D4C0806                lea ecx, dword ptr [eax+ecx+06]
:00421CFB E886F9FFFF              call 00421686
:00421D00 E945FFFFFF              jmp 00421C4A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421C5B(C)
|
:00421D05 E8AD520000              call 00426FB7
:00421D0A E900000000              jmp 00421D0F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421D0A(U)
|
:00421D0F 5F                      pop edi
:00421D10 5E                      pop esi
:00421D11 5B                      pop ebx
:00421D12 C9                      leave
:00421D13 C21000                  ret 0010



* Referenced by a CALL at Address:
|:00438483   
|
:00421D16 55                      push ebp
:00421D17 8BEC                    mov ebp, esp
:00421D19 83EC0C                  sub esp, 0000000C
:00421D1C 53                      push ebx
:00421D1D 56                      push esi
:00421D1E 57                      push edi
:00421D1F 894DF4                  mov dword ptr [ebp-0C], ecx
:00421D22 C645F8FF                mov [ebp-08], FF
:00421D26 C745FC00000000          mov [ebp-04], 00000000
:00421D2D E903000000              jmp 00421D35

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421D71(U)
|
:00421D32 FF45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421D2D(U)
|
:00421D35 8B45F4                  mov eax, dword ptr [ebp-0C]
:00421D38 33C9                    xor ecx, ecx
:00421D3A 8A08                    mov cl, byte ptr [eax]
:00421D3C 3B4DFC                  cmp ecx, dword ptr [ebp-04]
:00421D3F 0F8631000000            jbe 00421D76
:00421D45 33C0                    xor eax, eax
:00421D47 8A45F8                  mov al, byte ptr [ebp-08]
:00421D4A 3DFF000000              cmp eax, 000000FF
:00421D4F 0F8521000000            jne 00421D76
:00421D55 8B45FC                  mov eax, dword ptr [ebp-04]
:00421D58 8BC8                    mov ecx, eax
:00421D5A 8D0440                  lea eax, dword ptr [eax+2*eax]
:00421D5D C1E003                  shl eax, 03
:00421D60 2BC1                    sub eax, ecx
:00421D62 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00421D65 8D4C0806                lea ecx, dword ptr [eax+ecx+06]
:00421D69 E84CFBFFFF              call 004218BA
:00421D6E 8845F8                  mov byte ptr [ebp-08], al
:00421D71 E9BCFFFFFF              jmp 00421D32

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00421D3F(C), :00421D4F(C)
|
:00421D76 8A45F8                  mov al, byte ptr [ebp-08]
:00421D79 E900000000              jmp 00421D7E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421D79(U)
|
:00421D7E 5F                      pop edi
:00421D7F 5E                      pop esi
:00421D80 5B                      pop ebx
:00421D81 C9                      leave
:00421D82 C3                      ret



* Referenced by a CALL at Address:
|:004384AD   
|
:00421D83 55                      push ebp
:00421D84 8BEC                    mov ebp, esp
:00421D86 83EC08                  sub esp, 00000008
:00421D89 53                      push ebx
:00421D8A 56                      push esi
:00421D8B 57                      push edi
:00421D8C 894DF8                  mov dword ptr [ebp-08], ecx
:00421D8F C745FC00000000          mov [ebp-04], 00000000
:00421D96 E903000000              jmp 00421D9E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421DD9(U)
|
:00421D9B FF45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421D96(U)
|
:00421D9E 8B45F8                  mov eax, dword ptr [ebp-08]
:00421DA1 33C9                    xor ecx, ecx
:00421DA3 8A08                    mov cl, byte ptr [eax]
:00421DA5 3B4DFC                  cmp ecx, dword ptr [ebp-04]
:00421DA8 0F8630000000            jbe 00421DDE
:00421DAE 8B45FC                  mov eax, dword ptr [ebp-04]
:00421DB1 8BC8                    mov ecx, eax
:00421DB3 8D0440                  lea eax, dword ptr [eax+2*eax]
:00421DB6 C1E003                  shl eax, 03
:00421DB9 2BC1                    sub eax, ecx
:00421DBB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00421DBE 8D4C0806                lea ecx, dword ptr [eax+ecx+06]
:00421DC2 E839010000              call 00421F00
:00421DC7 85C0                    test eax, eax
:00421DC9 0F840A000000            je 00421DD9
:00421DCF B801000000              mov eax, 00000001
:00421DD4 E90C000000              jmp 00421DE5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421DC9(C)
|
:00421DD9 E9BDFFFFFF              jmp 00421D9B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421DA8(C)
|
:00421DDE 33C0                    xor eax, eax
:00421DE0 E900000000              jmp 00421DE5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00421DD4(U), :00421DE0(U)
|
:00421DE5 5F                      pop edi
:00421DE6 5E                      pop esi
:00421DE7 5B                      pop ebx
:00421DE8 C9                      leave
:00421DE9 C3                      ret


:00421DEA 55                      push ebp
:00421DEB 8BEC                    mov ebp, esp
:00421DED 53                      push ebx
:00421DEE 56                      push esi
:00421DEF 57                      push edi
:00421DF0 E80A000000              call 00421DFF
:00421DF5 E900000000              jmp 00421DFA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421DF5(U)
|
:00421DFA 5F                      pop edi
:00421DFB 5E                      pop esi
:00421DFC 5B                      pop ebx
:00421DFD C9                      leave
:00421DFE C3                      ret



* Referenced by a CALL at Address:
|:00421DF0   
|
:00421DFF 55                      push ebp
:00421E00 8BEC                    mov ebp, esp
:00421E02 53                      push ebx
:00421E03 56                      push esi
:00421E04 57                      push edi
:00421E05 B958BC4600              mov ecx, 0046BC58
:00421E0A E841EEFFFF              call 00420C50
:00421E0F E900000000              jmp 00421E14

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421E0F(U)
|
:00421E14 5F                      pop edi
:00421E15 5E                      pop esi
:00421E16 5B                      pop ebx
:00421E17 C9                      leave
:00421E18 C3                      ret


:00421E19 CC                      int 03
:00421E1A CC                      int 03
:00421E1B CC                      int 03
:00421E1C CC                      int 03
:00421E1D CC                      int 03
:00421E1E CC                      int 03
:00421E1F CC                      int 03

* Referenced by a CALL at Address:
|:00420D86   
|
:00421E20 55                      push ebp
:00421E21 8BEC                    mov ebp, esp
:00421E23 83EC04                  sub esp, 00000004
:00421E26 53                      push ebx
:00421E27 56                      push esi
:00421E28 57                      push edi
:00421E29 894DFC                  mov dword ptr [ebp-04], ecx
:00421E2C 8B4508                  mov eax, dword ptr [ebp+08]
:00421E2F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00421E32 894179                  mov dword ptr [ecx+79], eax
:00421E35 E900000000              jmp 00421E3A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421E35(U)
|
:00421E3A 5F                      pop edi
:00421E3B 5E                      pop esi
:00421E3C 5B                      pop ebx
:00421E3D C9                      leave
:00421E3E C20400                  ret 0004


:00421E41 CC                      int 03
:00421E42 CC                      int 03
:00421E43 CC                      int 03
:00421E44 CC                      int 03
:00421E45 CC                      int 03
:00421E46 CC                      int 03
:00421E47 CC                      int 03
:00421E48 CC                      int 03
:00421E49 CC                      int 03
:00421E4A CC                      int 03
:00421E4B CC                      int 03
:00421E4C CC                      int 03
:00421E4D CC                      int 03
:00421E4E CC                      int 03
:00421E4F CC                      int 03

* Referenced by a CALL at Addresses:
|:004211DD   , :0042122A   , :00421243   , :00421340   , :004214C3   
|:00421528   
|
:00421E50 55                      push ebp
:00421E51 8BEC                    mov ebp, esp
:00421E53 83EC04                  sub esp, 00000004
:00421E56 53                      push ebx
:00421E57 56                      push esi
:00421E58 57                      push edi
:00421E59 894DFC                  mov dword ptr [ebp-04], ecx
:00421E5C 8B45FC                  mov eax, dword ptr [ebp-04]
:00421E5F 8B4008                  mov eax, dword ptr [eax+08]
:00421E62 83E830                  sub eax, 00000030
:00421E65 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00421E68 0FAF4114                imul eax, dword ptr [ecx+14]
:00421E6C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00421E6F 8B4910                  mov ecx, dword ptr [ecx+10]
:00421E72 8B55FC                  mov edx, dword ptr [ebp-04]
:00421E75 2B4A0C                  sub ecx, dword ptr [edx+0C]
:00421E78 2BD2                    sub edx, edx
:00421E7A F7F1                    div ecx
:00421E7C 83C010                  add eax, 00000010
:00421E7F E900000000              jmp 00421E84

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421E7F(U)
|
:00421E84 5F                      pop edi
:00421E85 5E                      pop esi
:00421E86 5B                      pop ebx
:00421E87 C9                      leave
:00421E88 C3                      ret


:00421E89 CC                      int 03
:00421E8A CC                      int 03
:00421E8B CC                      int 03
:00421E8C CC                      int 03
:00421E8D CC                      int 03
:00421E8E CC                      int 03
:00421E8F CC                      int 03

* Referenced by a CALL at Address:
|:004212EE   
|
:00421E90 55                      push ebp
:00421E91 8BEC                    mov ebp, esp
:00421E93 83EC08                  sub esp, 00000008
:00421E96 53                      push ebx
:00421E97 56                      push esi
:00421E98 57                      push edi
:00421E99 894DF8                  mov dword ptr [ebp-08], ecx
:00421E9C 8B4508                  mov eax, dword ptr [ebp+08]
:00421E9F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00421EA2 2B4104                  sub eax, dword ptr [ecx+04]
:00421EA5 83E810                  sub eax, 00000010
:00421EA8 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00421EAB 8B4910                  mov ecx, dword ptr [ecx+10]
:00421EAE 8B55F8                  mov edx, dword ptr [ebp-08]
:00421EB1 2B4A0C                  sub ecx, dword ptr [edx+0C]
:00421EB4 0FAFC1                  imul eax, ecx
:00421EB7 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00421EBA 8B4908                  mov ecx, dword ptr [ecx+08]
:00421EBD 83E930                  sub ecx, 00000030
:00421EC0 2BD2                    sub edx, edx
:00421EC2 F7F1                    div ecx
:00421EC4 8945FC                  mov dword ptr [ebp-04], eax
:00421EC7 8B45F8                  mov eax, dword ptr [ebp-08]
:00421ECA 8B4010                  mov eax, dword ptr [eax+10]
:00421ECD 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00421ED0 2B410C                  sub eax, dword ptr [ecx+0C]
:00421ED3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00421ED6 3BC1                    cmp eax, ecx
:00421ED8 0F8C02000000            jl 00421EE0
:00421EDE 8BC1                    mov eax, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421ED8(C)
|
:00421EE0 8945FC                  mov dword ptr [ebp-04], eax
:00421EE3 8B45FC                  mov eax, dword ptr [ebp-04]
:00421EE6 E900000000              jmp 00421EEB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421EE6(U)
|
:00421EEB 5F                      pop edi
:00421EEC 5E                      pop esi
:00421EED 5B                      pop ebx
:00421EEE C9                      leave
:00421EEF C20400                  ret 0004


:00421EF2 CC                      int 03
:00421EF3 CC                      int 03
:00421EF4 CC                      int 03
:00421EF5 CC                      int 03
:00421EF6 CC                      int 03
:00421EF7 CC                      int 03
:00421EF8 CC                      int 03
:00421EF9 CC                      int 03
:00421EFA CC                      int 03
:00421EFB CC                      int 03
:00421EFC CC                      int 03
:00421EFD CC                      int 03
:00421EFE CC                      int 03
:00421EFF CC                      int 03

* Referenced by a CALL at Address:
|:00421DC2   
|
:00421F00 55                      push ebp
:00421F01 8BEC                    mov ebp, esp
:00421F03 83EC04                  sub esp, 00000004
:00421F06 53                      push ebx
:00421F07 56                      push esi
:00421F08 57                      push edi
:00421F09 894DFC                  mov dword ptr [ebp-04], ecx
:00421F0C 8B45FC                  mov eax, dword ptr [ebp-04]
:00421F0F 33C9                    xor ecx, ecx
:00421F11 8A4816                  mov cl, byte ptr [eax+16]
:00421F14 85C9                    test ecx, ecx
:00421F16 0F840A000000            je 00421F26
:00421F1C B801000000              mov eax, 00000001
:00421F21 E902000000              jmp 00421F28

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421F16(C)
|
:00421F26 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421F21(U)
|
:00421F28 E900000000              jmp 00421F2D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421F28(U)
|
:00421F2D 5F                      pop edi
:00421F2E 5E                      pop esi
:00421F2F 5B                      pop ebx
:00421F30 C9                      leave
:00421F31 C3                      ret


:00421F32 CC                      int 03
:00421F33 CC                      int 03
:00421F34 CC                      int 03
:00421F35 CC                      int 03
:00421F36 CC                      int 03
:00421F37 CC                      int 03
:00421F38 CC                      int 03
:00421F39 CC                      int 03
:00421F3A CC                      int 03
:00421F3B CC                      int 03
:00421F3C CC                      int 03
:00421F3D CC                      int 03
:00421F3E CC                      int 03
:00421F3F CC                      int 03
:00421F40 55                      push ebp
:00421F41 8BEC                    mov ebp, esp
:00421F43 53                      push ebx
:00421F44 56                      push esi
:00421F45 57                      push edi
:00421F46 E80F000000              call 00421F5A
:00421F4B E824000000              call 00421F74
:00421F50 E900000000              jmp 00421F55

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421F50(U)
|
:00421F55 5F                      pop edi
:00421F56 5E                      pop esi
:00421F57 5B                      pop ebx
:00421F58 C9                      leave
:00421F59 C3                      ret



* Referenced by a CALL at Address:
|:00421F46   
|
:00421F5A 55                      push ebp
:00421F5B 8BEC                    mov ebp, esp
:00421F5D 53                      push ebx
:00421F5E 56                      push esi
:00421F5F 57                      push edi
:00421F60 B9D8BC4600              mov ecx, 0046BCD8
:00421F65 E8862B0000              call 00424AF0
:00421F6A E900000000              jmp 00421F6F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421F6A(U)
|
:00421F6F 5F                      pop edi
:00421F70 5E                      pop esi
:00421F71 5B                      pop ebx
:00421F72 C9                      leave
:00421F73 C3                      ret



* Referenced by a CALL at Address:
|:00421F4B   
|
:00421F74 55                      push ebp
:00421F75 8BEC                    mov ebp, esp
:00421F77 53                      push ebx
:00421F78 56                      push esi
:00421F79 57                      push edi
:00421F7A 68911F4200              push 00421F91
:00421F7F E85C5D0200              call 00447CE0
:00421F84 83C404                  add esp, 00000004
:00421F87 E900000000              jmp 00421F8C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421F87(U)
|
:00421F8C 5F                      pop edi
:00421F8D 5E                      pop esi
:00421F8E 5B                      pop ebx
:00421F8F C9                      leave
:00421F90 C3                      ret


:00421F91 55                      push ebp
:00421F92 8BEC                    mov ebp, esp
:00421F94 53                      push ebx
:00421F95 56                      push esi
:00421F96 57                      push edi
:00421F97 B9D8BC4600              mov ecx, 0046BCD8
:00421F9C E86F2B0000              call 00424B10
:00421FA1 E900000000              jmp 00421FA6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421FA1(U)
|
:00421FA6 5F                      pop edi
:00421FA7 5E                      pop esi
:00421FA8 5B                      pop ebx
:00421FA9 C9                      leave
:00421FAA C3                      ret


:00421FAB 55                      push ebp
:00421FAC 8BEC                    mov ebp, esp
:00421FAE 53                      push ebx
:00421FAF 56                      push esi
:00421FB0 57                      push edi
:00421FB1 E80A000000              call 00421FC0
:00421FB6 E900000000              jmp 00421FBB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421FB6(U)
|
:00421FBB 5F                      pop edi
:00421FBC 5E                      pop esi
:00421FBD 5B                      pop ebx
:00421FBE C9                      leave
:00421FBF C3                      ret



* Referenced by a CALL at Address:
|:00421FB1   
|
:00421FC0 55                      push ebp
:00421FC1 8BEC                    mov ebp, esp
:00421FC3 53                      push ebx
:00421FC4 56                      push esi
:00421FC5 57                      push edi
:00421FC6 B920BD4600              mov ecx, 0046BD20
:00421FCB E8A0F8FDFF              call 00401870
:00421FD0 B91CBD4600              mov ecx, 0046BD1C
:00421FD5 E896F8FDFF              call 00401870
:00421FDA E900000000              jmp 00421FDF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421FDA(U)
|
:00421FDF 5F                      pop edi
:00421FE0 5E                      pop esi
:00421FE1 5B                      pop ebx
:00421FE2 C9                      leave
:00421FE3 C3                      ret



* Referenced by a CALL at Addresses:
|:00422615   , :00422FA0   , :004230C8   , :0042D59E   , :0042D5C0   
|:0042D7EC   , :0042D861   , :0042DAEC   , :0042DB62   
|
:00421FE4 55                      push ebp
:00421FE5 8BEC                    mov ebp, esp
:00421FE7 83EC18                  sub esp, 00000018
:00421FEA 53                      push ebx
:00421FEB 56                      push esi
:00421FEC 57                      push edi
:00421FED B900FB4600              mov ecx, 0046FB00
:00421FF2 E8592B0000              call 00424B50
:00421FF7 8B5D0C                  mov ebx, dword ptr [ebp+0C]
:00421FFA 03D8                    add ebx, eax
:00421FFC 33C0                    xor eax, eax
:00421FFE A0C8FC4600              mov al, byte ptr [0046FCC8]
:00422003 0FAFD8                  imul ebx, eax
:00422006 8D1C5B                  lea ebx, dword ptr [ebx+2*ebx]
:00422009 B900FB4600              mov ecx, 0046FB00
:0042200E E81D2B0000              call 00424B30
:00422013 03D8                    add ebx, eax
:00422015 035D08                  add ebx, dword ptr [ebp+08]
:00422018 895DEC                  mov dword ptr [ebp-14], ebx
:0042201B 6A04                    push 00000004
:0042201D 6A00                    push 00000000
:0042201F 6A00                    push 00000000
:00422021 B950F94600              mov ecx, 0046F950
:00422026 E8F5560200              call 00447720
:0042202B 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0042202E 03C8                    add ecx, eax
:00422030 894DF4                  mov dword ptr [ebp-0C], ecx
:00422033 33C0                    xor eax, eax
:00422035 A0C8FC4600              mov al, byte ptr [0046FCC8]
:0042203A 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042203D 83E803                  sub eax, 00000003
:00422040 8945F8                  mov dword ptr [ebp-08], eax
:00422043 C1650804                shl dword ptr [ebp+08], 04
:00422047 C1650C04                shl dword ptr [ebp+0C], 04
:0042204B 83450808                add dword ptr [ebp+08], 00000008
:0042204F 83450C30                add dword ptr [ebp+0C], 00000030
:00422053 68B0010000              push 000001B0
:00422058 6878020000              push 00000278
:0042205D 6A30                    push 00000030
:0042205F 6A08                    push 00000008
:00422061 E8372D0200              call 00444D9D
:00422066 83C410                  add esp, 00000010
:00422069 E8294F0000              call 00426F97
:0042206E C745F000000000          mov [ebp-10], 00000000
:00422075 E90F000000              jmp 00422089

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422126(U)
|
:0042207A FF45F0                  inc [ebp-10]
:0042207D 8B45F8                  mov eax, dword ptr [ebp-08]
:00422080 0145F4                  add dword ptr [ebp-0C], eax
:00422083 8B45F8                  mov eax, dword ptr [ebp-08]
:00422086 0145EC                  add dword ptr [ebp-14], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422075(U)
|
:00422089 837DF003                cmp dword ptr [ebp-10], 00000003
:0042208D 0F8398000000            jnb 0042212B
:00422093 C745E800000000          mov [ebp-18], 00000000
:0042209A E909000000              jmp 004220A8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422121(U)
|
:0042209F FF45E8                  inc [ebp-18]
:004220A2 FF45F4                  inc [ebp-0C]
:004220A5 FF45EC                  inc [ebp-14]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042209A(U)
|
:004220A8 837DE803                cmp dword ptr [ebp-18], 00000003
:004220AC 0F8374000000            jnb 00422126
:004220B2 833D5836450000          cmp dword ptr [00453658], 00000000
:004220B9 0F841D000000            je 004220DC
:004220BF 6A04                    push 00000004
:004220C1 6A00                    push 00000000
:004220C3 8B45EC                  mov eax, dword ptr [ebp-14]
:004220C6 C1E008                  shl eax, 08
:004220C9 50                      push eax
:004220CA B980F94600              mov ecx, 0046F980
:004220CF E84C560200              call 00447720
:004220D4 8945FC                  mov dword ptr [ebp-04], eax
:004220D7 E91F000000              jmp 004220FB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004220B9(C)
|
:004220DC 6A04                    push 00000004
:004220DE 6A00                    push 00000000
:004220E0 6A00                    push 00000000
:004220E2 B9E8E44600              mov ecx, 0046E4E8
:004220E7 E834560200              call 00447720
:004220EC 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004220EF 33D2                    xor edx, edx
:004220F1 8A11                    mov dl, byte ptr [ecx]
:004220F3 C1E208                  shl edx, 08
:004220F6 03C2                    add eax, edx
:004220F8 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004220D7(U)
|
:004220FB 6A00                    push 00000000
:004220FD 8B45FC                  mov eax, dword ptr [ebp-04]
:00422100 50                      push eax
:00422101 6A10                    push 00000010
:00422103 6A10                    push 00000010
:00422105 8B45F0                  mov eax, dword ptr [ebp-10]
:00422108 C1E004                  shl eax, 04
:0042210B 03450C                  add eax, dword ptr [ebp+0C]
:0042210E 50                      push eax
:0042210F 8B45E8                  mov eax, dword ptr [ebp-18]
:00422112 C1E004                  shl eax, 04
:00422115 034508                  add eax, dword ptr [ebp+08]
:00422118 50                      push eax
:00422119 E897B10100              call 0043D2B5
:0042211E 83C418                  add esp, 00000018
:00422121 E979FFFFFF              jmp 0042209F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004220AC(C)
|
:00422126 E94FFFFFFF              jmp 0042207A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042208D(C)
|
:0042212B E8874E0000              call 00426FB7
:00422130 68B8010000              push 000001B8
:00422135 6880020000              push 00000280
:0042213A 6A00                    push 00000000
:0042213C 6A00                    push 00000000
:0042213E E85A2C0200              call 00444D9D
:00422143 83C410                  add esp, 00000010
:00422146 E900000000              jmp 0042214B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422146(U)
|
:0042214B 5F                      pop edi
:0042214C 5E                      pop esi
:0042214D 5B                      pop ebx
:0042214E C9                      leave
:0042214F C3                      ret



* Referenced by a CALL at Addresses:
|:00419381   , :00424236   
|
:00422150 55                      push ebp
:00422151 8BEC                    mov ebp, esp
:00422153 83EC04                  sub esp, 00000004
:00422156 53                      push ebx
:00422157 56                      push esi
:00422158 57                      push edi
:00422159 C645FC00                mov [ebp-04], 00
:0042215D 33C0                    xor eax, eax
:0042215F 8A4508                  mov al, byte ptr [ebp+08]
:00422162 83F803                  cmp eax, 00000003
:00422165 0F8C0E000000            jl 00422179
:0042216B 33C0                    xor eax, eax
:0042216D 8A4508                  mov al, byte ptr [ebp+08]
:00422170 83F805                  cmp eax, 00000005
:00422173 0F8E1C000000            jle 00422195

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422165(C)
|
:00422179 33C0                    xor eax, eax
:0042217B 8A4508                  mov al, byte ptr [ebp+08]
:0042217E 83F80F                  cmp eax, 0000000F
:00422181 0F8C17000000            jl 0042219E
:00422187 33C0                    xor eax, eax
:00422189 8A4508                  mov al, byte ptr [ebp+08]
:0042218C 83F811                  cmp eax, 00000011
:0042218F 0F8F09000000            jg 0042219E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422173(C)
|
:00422195 C645FC03                mov [ebp-04], 03
:00422199 E96A000000              jmp 00422208

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00422181(C), :0042218F(C)
|
:0042219E 33C0                    xor eax, eax
:004221A0 8A4508                  mov al, byte ptr [ebp+08]
:004221A3 83F80C                  cmp eax, 0000000C
:004221A6 0F8C17000000            jl 004221C3
:004221AC 33C0                    xor eax, eax
:004221AE 8A4508                  mov al, byte ptr [ebp+08]
:004221B1 83F80E                  cmp eax, 0000000E
:004221B4 0F8F09000000            jg 004221C3
:004221BA C645FC04                mov [ebp-04], 04
:004221BE E945000000              jmp 00422208

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004221A6(C), :004221B4(C)
|
:004221C3 33C0                    xor eax, eax
:004221C5 8A4508                  mov al, byte ptr [ebp+08]
:004221C8 83F819                  cmp eax, 00000019
:004221CB 0F8C17000000            jl 004221E8
:004221D1 33C0                    xor eax, eax
:004221D3 8A4508                  mov al, byte ptr [ebp+08]
:004221D6 83F81A                  cmp eax, 0000001A
:004221D9 0F8F09000000            jg 004221E8
:004221DF C645FC02                mov [ebp-04], 02
:004221E3 E920000000              jmp 00422208

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004221CB(C), :004221D9(C)
|
:004221E8 33C0                    xor eax, eax
:004221EA 8A4508                  mov al, byte ptr [ebp+08]
:004221ED 83F817                  cmp eax, 00000017
:004221F0 0F840E000000            je 00422204
:004221F6 33C0                    xor eax, eax
:004221F8 8A4508                  mov al, byte ptr [ebp+08]
:004221FB 83F818                  cmp eax, 00000018
:004221FE 0F8504000000            jne 00422208

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004221F0(C)
|
:00422204 C645FC01                mov [ebp-04], 01

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00422199(U), :004221BE(U), :004221E3(U), :004221FE(C)
|
:00422208 8A45FC                  mov al, byte ptr [ebp-04]
:0042220B E900000000              jmp 00422210

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042220B(U)
|
:00422210 5F                      pop edi
:00422211 5E                      pop esi
:00422212 5B                      pop ebx
:00422213 C9                      leave
:00422214 C3                      ret



* Referenced by a CALL at Addresses:
|:004227B1   , :00422952   , :004247B2   , :004247F2   
|
:00422215 55                      push ebp
:00422216 8BEC                    mov ebp, esp
:00422218 83EC14                  sub esp, 00000014
:0042221B 53                      push ebx
:0042221C 56                      push esi
:0042221D 57                      push edi
:0042221E 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00422221 E84AF6FDFF              call 00401870
:00422226 33C0                    xor eax, eax
:00422228 8A450C                  mov al, byte ptr [ebp+0C]
:0042222B 83F803                  cmp eax, 00000003
:0042222E 0F8C0C000000            jl 00422240
:00422234 C745F000090000          mov [ebp-10], 00000900
:0042223B E907000000              jmp 00422247

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042222E(C)
|
:00422240 C745F000000000          mov [ebp-10], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042223B(U)
|
:00422247 8B450C                  mov eax, dword ptr [ebp+0C]
:0042224A 50                      push eax
:0042224B E88A000000              call 004222DA
:00422250 83C404                  add esp, 00000004
:00422253 33C0                    xor eax, eax
:00422255 8A4508                  mov al, byte ptr [ebp+08]
:00422258 8BC8                    mov ecx, eax
:0042225A 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042225D C1E003                  shl eax, 03
:00422260 2BC1                    sub eax, ecx
:00422262 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00422268 E8936FFEFF              call 00409200
:0042226D 668B00                  mov ax, word ptr [eax]
:00422270 50                      push eax
:00422271 8D45EC                  lea eax, dword ptr [ebp-14]
:00422274 50                      push eax
:00422275 E8AA840100              call 0043A724
:0042227A 83C408                  add esp, 00000008
:0042227D 50                      push eax
:0042227E 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00422281 E80AF6FDFF              call 00401890
:00422286 33C0                    xor eax, eax
:00422288 8A45FC                  mov al, byte ptr [ebp-04]
:0042228B C1E004                  shl eax, 04
:0042228E 83C008                  add eax, 00000008
:00422291 8945F8                  mov dword ptr [ebp-08], eax
:00422294 33C0                    xor eax, eax
:00422296 8A45FD                  mov al, byte ptr [ebp-03]
:00422299 C1E004                  shl eax, 04
:0042229C 83C030                  add eax, 00000030
:0042229F 8945F4                  mov dword ptr [ebp-0C], eax
:004222A2 6A04                    push 00000004
:004222A4 6A04                    push 00000004
:004222A6 6A00                    push 00000000
:004222A8 8B45F0                  mov eax, dword ptr [ebp-10]
:004222AB 0500990400              add eax, 00049900
:004222B0 50                      push eax
:004222B1 B9E8E44600              mov ecx, 0046E4E8
:004222B6 E865540200              call 00447720
:004222BB 50                      push eax
:004222BC 6A30                    push 00000030
:004222BE 6A30                    push 00000030
:004222C0 8B45F4                  mov eax, dword ptr [ebp-0C]
:004222C3 50                      push eax
:004222C4 8B45F8                  mov eax, dword ptr [ebp-08]
:004222C7 50                      push eax
:004222C8 E8E8AF0100              call 0043D2B5
:004222CD 83C418                  add esp, 00000018
:004222D0 E900000000              jmp 004222D5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004222D0(U)
|
:004222D5 5F                      pop edi
:004222D6 5E                      pop esi
:004222D7 5B                      pop ebx
:004222D8 C9                      leave
:004222D9 C3                      ret



* Referenced by a CALL at Addresses:
|:0042224B   , :004245C8   , :00424822   
|
:004222DA 55                      push ebp
:004222DB 8BEC                    mov ebp, esp
:004222DD 83EC04                  sub esp, 00000004
:004222E0 53                      push ebx
:004222E1 56                      push esi
:004222E2 57                      push edi
:004222E3 33C0                    xor eax, eax
:004222E5 8A4508                  mov al, byte ptr [ebp+08]
:004222E8 8945FC                  mov dword ptr [ebp-04], eax
:004222EB E95A000000              jmp 0042234A
:004222F0 6A28                    push 00000028
:004222F2 B994A64600              mov ecx, 0046A694
:004222F7 E8286DFFFF              call 00419024
:004222FC E971000000              jmp 00422372
:00422301 6A29                    push 00000029
:00422303 B994A64600              mov ecx, 0046A694
:00422308 E8176DFFFF              call 00419024
:0042230D E960000000              jmp 00422372
:00422312 6A18                    push 00000018
:00422314 B994A64600              mov ecx, 0046A694
:00422319 E8066DFFFF              call 00419024
:0042231E E94F000000              jmp 00422372
:00422323 6A15                    push 00000015
:00422325 B994A64600              mov ecx, 0046A694
:0042232A E8F56CFFFF              call 00419024
:0042232F E93E000000              jmp 00422372
:00422334 6A17                    push 00000017
:00422336 B994A64600              mov ecx, 0046A694
:0042233B E8E46CFFFF              call 00419024
:00422340 E92D000000              jmp 00422372
:00422345 E928000000              jmp 00422372

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004222EB(U)
|
:0042234A 837DFC04                cmp dword ptr [ebp-04], 00000004
:0042234E 0F871E000000            ja 00422372
:00422354 8B45FC                  mov eax, dword ptr [ebp-04]
:00422357 FF24855E234200          jmp dword ptr [4*eax+0042235E]

:0042235E F0224200                DWORD 004222F0
:00422362 01234200                DWORD 00422301
:00422366 12234200                DWORD 00422312
:0042236A 23234200                DWORD 00422323
:0042236E 34234200                DWORD 00422334



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004222FC(U), :0042230D(U), :0042231E(U), :0042232F(U), :00422340(U)
|:00422345(U), :0042234E(C)
|
:00422372 E900000000              jmp 00422377
:00422377 5F                      pop edi
:00422378 5E                      pop esi
:00422379 5B                      pop ebx
:0042237A C9                      leave
:0042237B C3                      ret



* Referenced by a CALL at Address:
|:00424589   
|
:0042237C 55                      push ebp
:0042237D 8BEC                    mov ebp, esp
:0042237F 81EC24010000            sub esp, 00000124
:00422385 53                      push ebx
:00422386 56                      push esi
:00422387 57                      push edi
:00422388 898DE0FEFFFF            mov dword ptr [ebp+FFFFFEE0], ecx
:0042238E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00422391 E83ABFFFFF              call 0041E2D0
:00422396 50                      push eax
:00422397 E8856E0000              call 00429221
:0042239C 83C404                  add esp, 00000004
:0042239F 8845F4                  mov byte ptr [ebp-0C], al
:004223A2 8B4D08                  mov ecx, dword ptr [ebp+08]
:004223A5 E8C6270000              call 00424B70
:004223AA 8845FC                  mov byte ptr [ebp-04], al
:004223AD 8B4D08                  mov ecx, dword ptr [ebp+08]
:004223B0 E81BBFFFFF              call 0041E2D0
:004223B5 8845F8                  mov byte ptr [ebp-08], al
:004223B8 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:004223BE 33C9                    xor ecx, ecx
:004223C0 8A4810                  mov cl, byte ptr [eax+10]
:004223C3 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:004223C9 33D2                    xor edx, edx
:004223CB 8A540138                mov dl, byte ptr [ecx+eax+38]
:004223CF 33C0                    xor eax, eax
:004223D1 8A45F8                  mov al, byte ptr [ebp-08]
:004223D4 3BD0                    cmp edx, eax
:004223D6 0F850C000000            jne 004223E8
:004223DC C745F000000000          mov [ebp-10], 00000000
:004223E3 E907000000              jmp 004223EF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004223D6(C)
|
:004223E8 C745F000090000          mov [ebp-10], 00000900

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004223E3(U)
|
:004223EF 6A10                    push 00000010
:004223F1 8B4D08                  mov ecx, dword ptr [ebp+08]
:004223F4 E8576DFEFF              call 00409150
:004223F9 85C0                    test eax, eax
:004223FB 0F8480000000            je 00422481
:00422401 B998FC4600              mov ecx, 0046FC98
:00422406 E885270000              call 00424B90
:0042240B 33C9                    xor ecx, ecx
:0042240D 8AC8                    mov cl, al
:0042240F 85C9                    test ecx, ecx
:00422411 0F850C000000            jne 00422423
:00422417 C745E800000000          mov [ebp-18], 00000000
:0042241E E907000000              jmp 0042242A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422411(C)
|
:00422423 C745E800090000          mov [ebp-18], 00000900

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042241E(U)
|
:0042242A 6800090000              push 00000900
:0042242F 6A04                    push 00000004
:00422431 6A00                    push 00000000
:00422433 6800F10000              push 0000F100
:00422438 B968F94600              mov ecx, 0046F968
:0042243D E8DE520200              call 00447720
:00422442 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00422445 03C8                    add ecx, eax
:00422447 51                      push ecx
:00422448 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042244B E8D06DFEFF              call 00409220
:00422450 83F801                  cmp eax, 00000001
:00422453 1BDB                    sbb ebx, ebx
:00422455 81E300120000            and ebx, 00001200
:0042245B 6A04                    push 00000004
:0042245D 6A00                    push 00000000
:0042245F 6800040300              push 00030400
:00422464 B9E8E44600              mov ecx, 0046E4E8
:00422469 E8B2520200              call 00447720
:0042246E 03D8                    add ebx, eax
:00422470 035DE8                  add ebx, dword ptr [ebp-18]
:00422473 53                      push ebx
:00422474 E8D44F0200              call 0044744D
:00422479 83C40C                  add esp, 0000000C
:0042247C E90F010000              jmp 00422590

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004223FB(C)
|
:00422481 33C0                    xor eax, eax
:00422483 8A45FC                  mov al, byte ptr [ebp-04]
:00422486 8985DCFEFFFF            mov dword ptr [ebp+FFFFFEDC], eax
:0042248C E922000000              jmp 004224B3

* Possible StringData Ref from Data Obj ->"B:CHR_BB.E2"
                                  |
:00422491 C745EC98354500          mov [ebp-14], 00453598
:00422498 E940000000              jmp 004224DD

* Possible StringData Ref from Data Obj ->"B:CHR_BF.E2"
                                  |
:0042249D C745EC78354500          mov [ebp-14], 00453578
:004224A4 E934000000              jmp 004224DD
:004224A9 E92F000000              jmp 004224DD
:004224AE E92A000000              jmp 004224DD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042248C(U)
|
:004224B3 83BDDCFEFFFF03          cmp dword ptr [ebp+FFFFFEDC], 00000003
:004224BA 0F871D000000            ja 004224DD
:004224C0 8B85DCFEFFFF            mov eax, dword ptr [ebp+FFFFFEDC]
:004224C6 FF2485CD244200          jmp dword ptr [4*eax+004224CD]

:004224CD 91244200                DWORD 00422491
:004224D1 A9244200                DWORD 004224A9
:004224D5 9D244200                DWORD 0042249D
:004224D9 A9244200                DWORD 004224A9



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00422498(U), :004224A4(U), :004224A9(U), :004224AE(U), :004224BA(C)
|
:004224DD 33C0                    xor eax, eax
:004224DF 8A45FC                  mov al, byte ptr [ebp-04]
:004224E2 85C0                    test eax, eax
:004224E4 0F840E000000            je 004224F8
:004224EA 33C0                    xor eax, eax
:004224EC 8A45FC                  mov al, byte ptr [ebp-04]
:004224EF 83F802                  cmp eax, 00000002
:004224F2 0F8554000000            jne 0042254C
:004224F8 8D8DE4FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE4]
:004224FE E86D71FEFF              call 00409670
:00422503 8B45EC                  mov eax, dword ptr [ebp-14]
:00422506 50                      push eax
:00422507 8D8DE4FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE4]
:0042250D E8FD4F0000              call 0042750F
:00422512 6A04                    push 00000004
:00422514 6A00                    push 00000000
:00422516 6800F10000              push 0000F100
:0042251B B968F94600              mov ecx, 0046F968
:00422520 E8FB510200              call 00447720
:00422525 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00422528 03C8                    add ecx, eax
:0042252A 51                      push ecx
:0042252B 33C0                    xor eax, eax
:0042252D 8A45F4                  mov al, byte ptr [ebp-0C]
:00422530 50                      push eax
:00422531 8D8DE4FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE4]
:00422537 E845510000              call 00427681
:0042253C 8D8DE4FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE4]
:00422542 E8D96EFEFF              call 00409420
:00422547 E944000000              jmp 00422590

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004224F2(C)
|
:0042254C 6800090000              push 00000900
:00422551 6A04                    push 00000004
:00422553 6A00                    push 00000000
:00422555 6800F10000              push 0000F100
:0042255A B968F94600              mov ecx, 0046F968
:0042255F E8BC510200              call 00447720
:00422564 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00422567 03C8                    add ecx, eax
:00422569 51                      push ecx
:0042256A 6A04                    push 00000004
:0042256C 6A00                    push 00000000
:0042256E 6A00                    push 00000000
:00422570 B980E34600              mov ecx, 0046E380
:00422575 E8A6510200              call 00447720
:0042257A 33C9                    xor ecx, ecx
:0042257C 8A4DF8                  mov cl, byte ptr [ebp-08]
:0042257F 8D0CC9                  lea ecx, dword ptr [ecx+8*ecx]
:00422582 C1E108                  shl ecx, 08
:00422585 03C1                    add eax, ecx
:00422587 50                      push eax
:00422588 E8C04E0200              call 0044744D
:0042258D 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042247C(U), :00422547(U)
|
:00422590 E900000000              jmp 00422595

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422590(U)
|
:00422595 5F                      pop edi
:00422596 5E                      pop esi
:00422597 5B                      pop ebx
:00422598 C9                      leave
:00422599 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00422804   , :004228C0   , :0042459B   
|
:0042259C 55                      push ebp
:0042259D 8BEC                    mov ebp, esp
:0042259F 83EC18                  sub esp, 00000018
:004225A2 53                      push ebx
:004225A3 56                      push esi
:004225A4 57                      push edi
:004225A5 894DE8                  mov dword ptr [ebp-18], ecx
:004225A8 8D4DFC                  lea ecx, dword ptr [ebp-04]
:004225AB E8C0F2FDFF              call 00401870
:004225B0 8B45E8                  mov eax, dword ptr [ebp-18]
:004225B3 33C9                    xor ecx, ecx
:004225B5 8A4810                  mov cl, byte ptr [eax+10]
:004225B8 8B45E8                  mov eax, dword ptr [ebp-18]
:004225BB 33DB                    xor ebx, ebx
:004225BD 8A5C0138                mov bl, byte ptr [ecx+eax+38]
:004225C1 8B4D08                  mov ecx, dword ptr [ebp+08]
:004225C4 E807BDFFFF              call 0041E2D0
:004225C9 33C9                    xor ecx, ecx
:004225CB 8AC8                    mov cl, al
:004225CD 3BD9                    cmp ebx, ecx
:004225CF 0F850C000000            jne 004225E1
:004225D5 C745F000000000          mov [ebp-10], 00000000
:004225DC E907000000              jmp 004225E8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004225CF(C)
|
:004225E1 C745F000090000          mov [ebp-10], 00000900

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004225DC(U)
|
:004225E8 8B4D08                  mov ecx, dword ptr [ebp+08]
:004225EB E8106CFEFF              call 00409200
:004225F0 668B00                  mov ax, word ptr [eax]
:004225F3 50                      push eax
:004225F4 8D45EC                  lea eax, dword ptr [ebp-14]
:004225F7 50                      push eax
:004225F8 E827810100              call 0043A724
:004225FD 83C408                  add esp, 00000008
:00422600 50                      push eax
:00422601 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00422604 E887F2FDFF              call 00401890
:00422609 33C0                    xor eax, eax
:0042260B 8A45FD                  mov al, byte ptr [ebp-03]
:0042260E 50                      push eax
:0042260F 33C0                    xor eax, eax
:00422611 8A45FC                  mov al, byte ptr [ebp-04]
:00422614 50                      push eax
:00422615 E8CAF9FFFF              call 00421FE4
:0042261A 83C408                  add esp, 00000008
:0042261D 33C0                    xor eax, eax
:0042261F 8A45FC                  mov al, byte ptr [ebp-04]
:00422622 C1E004                  shl eax, 04
:00422625 83C008                  add eax, 00000008
:00422628 8945F8                  mov dword ptr [ebp-08], eax
:0042262B 33C0                    xor eax, eax
:0042262D 8A45FD                  mov al, byte ptr [ebp-03]
:00422630 83C003                  add eax, 00000003
:00422633 C1E004                  shl eax, 04
:00422636 8945F4                  mov dword ptr [ebp-0C], eax
:00422639 E859490000              call 00426F97
:0042263E 6A04                    push 00000004
:00422640 6A04                    push 00000004
:00422642 6A00                    push 00000000
:00422644 6800F10000              push 0000F100
:00422649 B968F94600              mov ecx, 0046F968
:0042264E E8CD500200              call 00447720
:00422653 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00422656 03C8                    add ecx, eax
:00422658 51                      push ecx
:00422659 6A30                    push 00000030
:0042265B 6A30                    push 00000030
:0042265D 8B45F4                  mov eax, dword ptr [ebp-0C]
:00422660 50                      push eax
:00422661 8B45F8                  mov eax, dword ptr [ebp-08]
:00422664 50                      push eax
:00422665 E84BAC0100              call 0043D2B5
:0042266A 83C418                  add esp, 00000018
:0042266D E845490000              call 00426FB7
:00422672 E900000000              jmp 00422677

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422672(U)
|
:00422677 5F                      pop edi
:00422678 5E                      pop esi
:00422679 5B                      pop ebx
:0042267A C9                      leave
:0042267B C20400                  ret 0004



* Referenced by a CALL at Address:
|:004232AE   
|
:0042267E 55                      push ebp
:0042267F 8BEC                    mov ebp, esp
:00422681 83EC10                  sub esp, 00000010
:00422684 53                      push ebx
:00422685 56                      push esi
:00422686 57                      push edi
:00422687 894DF0                  mov dword ptr [ebp-10], ecx
:0042268A 8B45F0                  mov eax, dword ptr [ebp-10]
:0042268D 83C03A                  add eax, 0000003A
:00422690 8945F4                  mov dword ptr [ebp-0C], eax
:00422693 6A04                    push 00000004
:00422695 6A00                    push 00000000
:00422697 6800E10000              push 0000E100
:0042269C B968F94600              mov ecx, 0046F968
:004226A1 E87A500200              call 00447720
:004226A6 50                      push eax
:004226A7 6A40                    push 00000040
:004226A9 6A40                    push 00000040
:004226AB 8B450C                  mov eax, dword ptr [ebp+0C]
:004226AE 50                      push eax
:004226AF 8B4508                  mov eax, dword ptr [ebp+08]
:004226B2 50                      push eax
:004226B3 E873AC0100              call 0043D32B
:004226B8 83C414                  add esp, 00000014
:004226BB C745F800000000          mov [ebp-08], 00000000
:004226C2 E903000000              jmp 004226CA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422988(U)
|
:004226C7 FF45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004226C2(U)
|
:004226CA 8B45F0                  mov eax, dword ptr [ebp-10]
:004226CD 33C9                    xor ecx, ecx
:004226CF 8A4818                  mov cl, byte ptr [eax+18]
:004226D2 41                      inc ecx
:004226D3 3B4DF8                  cmp ecx, dword ptr [ebp-08]
:004226D6 0F86B1020000            jbe 0042298D
:004226DC 33C0                    xor eax, eax
:004226DE A0BDFC4600              mov al, byte ptr [0046FCBD]
:004226E3 83C003                  add eax, 00000003
:004226E6 50                      push eax
:004226E7 B9B0FA4600              mov ecx, 0046FAB0
:004226EC E8BF6AFEFF              call 004091B0
:004226F1 8B45F0                  mov eax, dword ptr [ebp-10]
:004226F4 8A4019                  mov al, byte ptr [eax+19]
:004226F7 50                      push eax
:004226F8 8B45F0                  mov eax, dword ptr [ebp-10]
:004226FB 8A4018                  mov al, byte ptr [eax+18]
:004226FE 50                      push eax
:004226FF 8B45F8                  mov eax, dword ptr [ebp-08]
:00422702 50                      push eax
:00422703 E8AD0A0000              call 004231B5
:00422708 83C40C                  add esp, 0000000C
:0042270B 8945FC                  mov dword ptr [ebp-04], eax
:0042270E E884480000              call 00426F97
:00422713 6A00                    push 00000000
:00422715 6A04                    push 00000004
:00422717 6A00                    push 00000000
:00422719 6800E10000              push 0000E100
:0042271E B968F94600              mov ecx, 0046F968
:00422723 E8F84F0200              call 00447720
:00422728 50                      push eax
:00422729 6A40                    push 00000040
:0042272B 6A40                    push 00000040
:0042272D 8B450C                  mov eax, dword ptr [ebp+0C]
:00422730 50                      push eax
:00422731 8B4508                  mov eax, dword ptr [ebp+08]
:00422734 50                      push eax
:00422735 E87BAB0100              call 0043D2B5
:0042273A 83C418                  add esp, 00000018
:0042273D 8B45F0                  mov eax, dword ptr [ebp-10]
:00422740 33C9                    xor ecx, ecx
:00422742 8A4818                  mov cl, byte ptr [eax+18]
:00422745 49                      dec ecx
:00422746 3B4DF8                  cmp ecx, dword ptr [ebp-08]
:00422749 0F876A000000            ja 004227B9
:0042274F 8B45F0                  mov eax, dword ptr [ebp-10]
:00422752 33C9                    xor ecx, ecx
:00422754 8A4815                  mov cl, byte ptr [eax+15]
:00422757 83F903                  cmp ecx, 00000003
:0042275A 0F8D59000000            jnl 004227B9
:00422760 6A00                    push 00000000
:00422762 8B45F0                  mov eax, dword ptr [ebp-10]
:00422765 33C9                    xor ecx, ecx
:00422767 8A4811                  mov cl, byte ptr [eax+11]
:0042276A 8B45F0                  mov eax, dword ptr [ebp-10]
:0042276D 8A440138                mov al, byte ptr [ecx+eax+38]
:00422771 50                      push eax
:00422772 E8E5080000              call 0042305C
:00422777 83C408                  add esp, 00000008
:0042277A 8B45F0                  mov eax, dword ptr [ebp-10]
:0042277D 33C9                    xor ecx, ecx
:0042277F 8A4818                  mov cl, byte ptr [eax+18]
:00422782 8B45F8                  mov eax, dword ptr [ebp-08]
:00422785 2BD2                    sub edx, edx
:00422787 F7F1                    div ecx
:00422789 8B45F0                  mov eax, dword ptr [ebp-10]
:0042278C 33C9                    xor ecx, ecx
:0042278E 8A4818                  mov cl, byte ptr [eax+18]
:00422791 49                      dec ecx
:00422792 3BD1                    cmp edx, ecx
:00422794 0F851F000000            jne 004227B9
:0042279A 8B45F0                  mov eax, dword ptr [ebp-10]
:0042279D 8A4015                  mov al, byte ptr [eax+15]
:004227A0 50                      push eax
:004227A1 8B45F0                  mov eax, dword ptr [ebp-10]
:004227A4 33C9                    xor ecx, ecx
:004227A6 8A4811                  mov cl, byte ptr [eax+11]
:004227A9 8B45F0                  mov eax, dword ptr [ebp-10]
:004227AC 8A440138                mov al, byte ptr [ecx+eax+38]
:004227B0 50                      push eax
:004227B1 E85FFAFFFF              call 00422215
:004227B6 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00422749(C), :0042275A(C), :00422794(C)
|
:004227B9 8B45F0                  mov eax, dword ptr [ebp-10]
:004227BC 33C9                    xor ecx, ecx
:004227BE 8A4818                  mov cl, byte ptr [eax+18]
:004227C1 3B4DF8                  cmp ecx, dword ptr [ebp-08]
:004227C4 0F8628000000            jbe 004227F2
:004227CA 8B45F0                  mov eax, dword ptr [ebp-10]
:004227CD 8A4018                  mov al, byte ptr [eax+18]
:004227D0 50                      push eax
:004227D1 8B45FC                  mov eax, dword ptr [ebp-04]
:004227D4 50                      push eax
:004227D5 8B45F0                  mov eax, dword ptr [ebp-10]
:004227D8 33C9                    xor ecx, ecx
:004227DA 8A4810                  mov cl, byte ptr [eax+10]
:004227DD 8B45F0                  mov eax, dword ptr [ebp-10]
:004227E0 8A440138                mov al, byte ptr [ecx+eax+38]
:004227E4 50                      push eax
:004227E5 E820070000              call 00422F0A
:004227EA 83C40C                  add esp, 0000000C
:004227ED E917000000              jmp 00422809

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004227C4(C)
|
:004227F2 8B45F0                  mov eax, dword ptr [ebp-10]
:004227F5 33C9                    xor ecx, ecx
:004227F7 8A4810                  mov cl, byte ptr [eax+10]
:004227FA 8B45F0                  mov eax, dword ptr [ebp-10]
:004227FD 8B0488                  mov eax, dword ptr [eax+4*ecx]
:00422800 50                      push eax
:00422801 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00422804 E893FDFFFF              call 0042259C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004227ED(U)
|
:00422809 E8A9470000              call 00426FB7
:0042280E E8B54B0100              call 004373C8
:00422813 8B45F0                  mov eax, dword ptr [ebp-10]
:00422816 33C9                    xor ecx, ecx
:00422818 8A4815                  mov cl, byte ptr [eax+15]
:0042281B 83F903                  cmp ecx, 00000003
:0042281E 0F8D2A000000            jnl 0042284E
:00422824 8B45F0                  mov eax, dword ptr [ebp-10]
:00422827 33C9                    xor ecx, ecx
:00422829 8A4818                  mov cl, byte ptr [eax+18]
:0042282C 8B45F8                  mov eax, dword ptr [ebp-08]
:0042282F 2BD2                    sub edx, edx
:00422831 F7F1                    div ecx
:00422833 8B45F0                  mov eax, dword ptr [ebp-10]
:00422836 33C9                    xor ecx, ecx
:00422838 8A4818                  mov cl, byte ptr [eax+18]
:0042283B 49                      dec ecx
:0042283C 3BD1                    cmp edx, ecx
:0042283E 0F850A000000            jne 0042284E
:00422844 6A02                    push 00000002
:00422846 E8704D0100              call 004375BB
:0042284B 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042281E(C), :0042283E(C)
|
:0042284E 8B45F0                  mov eax, dword ptr [ebp-10]
:00422851 33C9                    xor ecx, ecx
:00422853 8A4818                  mov cl, byte ptr [eax+18]
:00422856 8B45F8                  mov eax, dword ptr [ebp-08]
:00422859 2BD2                    sub edx, edx
:0042285B F7F1                    div ecx
:0042285D 8B45F0                  mov eax, dword ptr [ebp-10]
:00422860 33C9                    xor ecx, ecx
:00422862 8A4818                  mov cl, byte ptr [eax+18]
:00422865 49                      dec ecx
:00422866 3BD1                    cmp edx, ecx
:00422868 0F851A010000            jne 00422988
:0042286E 8B45F0                  mov eax, dword ptr [ebp-10]
:00422871 33C9                    xor ecx, ecx
:00422873 8A4815                  mov cl, byte ptr [eax+15]
:00422876 83F903                  cmp ecx, 00000003
:00422879 0F8C09010000            jl 00422988
:0042287F E813470000              call 00426F97
:00422884 6A00                    push 00000000
:00422886 6A04                    push 00000004
:00422888 6A00                    push 00000000
:0042288A 6800E10000              push 0000E100
:0042288F B968F94600              mov ecx, 0046F968
:00422894 E8874E0200              call 00447720
:00422899 50                      push eax
:0042289A 6A40                    push 00000040
:0042289C 6A40                    push 00000040
:0042289E 8B450C                  mov eax, dword ptr [ebp+0C]
:004228A1 50                      push eax
:004228A2 8B4508                  mov eax, dword ptr [ebp+08]
:004228A5 50                      push eax
:004228A6 E80AAA0100              call 0043D2B5
:004228AB 83C418                  add esp, 00000018
:004228AE 8B45F0                  mov eax, dword ptr [ebp-10]
:004228B1 33C9                    xor ecx, ecx
:004228B3 8A4810                  mov cl, byte ptr [eax+10]
:004228B6 8B45F0                  mov eax, dword ptr [ebp-10]
:004228B9 8B0488                  mov eax, dword ptr [eax+4*ecx]
:004228BC 50                      push eax
:004228BD 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004228C0 E8D7FCFFFF              call 0042259C
:004228C5 E8ED460000              call 00426FB7
:004228CA 8B45F0                  mov eax, dword ptr [ebp-10]
:004228CD 33C9                    xor ecx, ecx
:004228CF 8A4810                  mov cl, byte ptr [eax+10]
:004228D2 8B45F0                  mov eax, dword ptr [ebp-10]
:004228D5 8B0C88                  mov ecx, dword ptr [eax+4*ecx]
:004228D8 E893220000              call 00424B70
:004228DD 50                      push eax
:004228DE 8B45F0                  mov eax, dword ptr [ebp-10]
:004228E1 33C9                    xor ecx, ecx
:004228E3 8A4815                  mov cl, byte ptr [eax+15]
:004228E6 83E903                  sub ecx, 00000003
:004228E9 51                      push ecx
:004228EA 8B45F0                  mov eax, dword ptr [ebp-10]
:004228ED 33C9                    xor ecx, ecx
:004228EF 8A4811                  mov cl, byte ptr [eax+11]
:004228F2 8B45F0                  mov eax, dword ptr [ebp-10]
:004228F5 8A440138                mov al, byte ptr [ecx+eax+38]
:004228F9 50                      push eax
:004228FA 8B45F0                  mov eax, dword ptr [ebp-10]
:004228FD 33C9                    xor ecx, ecx
:004228FF 8A4810                  mov cl, byte ptr [eax+10]
:00422902 8B45F0                  mov eax, dword ptr [ebp-10]
:00422905 8A440138                mov al, byte ptr [ecx+eax+38]
:00422909 50                      push eax
:0042290A E88A000000              call 00422999
:0042290F 83C410                  add esp, 00000010
:00422912 6A02                    push 00000002
:00422914 E8414B0100              call 0043745A
:00422919 83C404                  add esp, 00000004
:0042291C E876460000              call 00426F97
:00422921 6A00                    push 00000000
:00422923 8B45F0                  mov eax, dword ptr [ebp-10]
:00422926 33C9                    xor ecx, ecx
:00422928 8A4811                  mov cl, byte ptr [eax+11]
:0042292B 8B45F0                  mov eax, dword ptr [ebp-10]
:0042292E 8A440138                mov al, byte ptr [ecx+eax+38]
:00422932 50                      push eax
:00422933 E824070000              call 0042305C
:00422938 83C408                  add esp, 00000008
:0042293B 8B45F0                  mov eax, dword ptr [ebp-10]
:0042293E 8A4015                  mov al, byte ptr [eax+15]
:00422941 50                      push eax
:00422942 8B45F0                  mov eax, dword ptr [ebp-10]
:00422945 33C9                    xor ecx, ecx
:00422947 8A4811                  mov cl, byte ptr [eax+11]
:0042294A 8B45F0                  mov eax, dword ptr [ebp-10]
:0042294D 8A440138                mov al, byte ptr [ecx+eax+38]
:00422951 50                      push eax
:00422952 E8BEF8FFFF              call 00422215
:00422957 83C408                  add esp, 00000008
:0042295A E858460000              call 00426FB7
:0042295F E8644A0100              call 004373C8
:00422964 6A02                    push 00000002
:00422966 E8504C0100              call 004375BB
:0042296B 83C404                  add esp, 00000004
:0042296E 6A00                    push 00000000
:00422970 8B45F0                  mov eax, dword ptr [ebp-10]
:00422973 33C9                    xor ecx, ecx
:00422975 8A4811                  mov cl, byte ptr [eax+11]
:00422978 8B45F0                  mov eax, dword ptr [ebp-10]
:0042297B 8A440138                mov al, byte ptr [ecx+eax+38]
:0042297F 50                      push eax
:00422980 E8D7060000              call 0042305C
:00422985 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00422868(C), :00422879(C)
|
:00422988 E93AFDFFFF              jmp 004226C7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004226D6(C)
|
:0042298D E900000000              jmp 00422992

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042298D(U)
|
:00422992 5F                      pop edi
:00422993 5E                      pop esi
:00422994 5B                      pop ebx
:00422995 C9                      leave
:00422996 C20800                  ret 0008



* Referenced by a CALL at Address:
|:0042290A   
|
:00422999 55                      push ebp
:0042299A 8BEC                    mov ebp, esp
:0042299C 83EC30                  sub esp, 00000030
:0042299F 53                      push ebx
:004229A0 56                      push esi
:004229A1 57                      push edi
:004229A2 33C0                    xor eax, eax
:004229A4 8A4508                  mov al, byte ptr [ebp+08]
:004229A7 8BC8                    mov ecx, eax
:004229A9 8D0440                  lea eax, dword ptr [eax+2*eax]
:004229AC C1E003                  shl eax, 03
:004229AF 2BC1                    sub eax, ecx
:004229B1 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004229B7 E84468FEFF              call 00409200
:004229BC 668B00                  mov ax, word ptr [eax]
:004229BF 668945F8                mov word ptr [ebp-08], ax
:004229C3 33C0                    xor eax, eax
:004229C5 8A450C                  mov al, byte ptr [ebp+0C]
:004229C8 8BC8                    mov ecx, eax
:004229CA 8D0440                  lea eax, dword ptr [eax+2*eax]
:004229CD C1E003                  shl eax, 03
:004229D0 2BC1                    sub eax, ecx
:004229D2 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004229D8 E82368FEFF              call 00409200
:004229DD 668B00                  mov ax, word ptr [eax]
:004229E0 668945F0                mov word ptr [ebp-10], ax
:004229E4 33C0                    xor eax, eax
:004229E6 8A4514                  mov al, byte ptr [ebp+14]
:004229E9 83F801                  cmp eax, 00000001
:004229EC 0F850C000000            jne 004229FE
:004229F2 C745D401000000          mov [ebp-2C], 00000001
:004229F9 E921000000              jmp 00422A1F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004229EC(C)
|
:004229FE 33C0                    xor eax, eax
:00422A00 8A4514                  mov al, byte ptr [ebp+14]
:00422A03 83F803                  cmp eax, 00000003
:00422A06 0F850C000000            jne 00422A18
:00422A0C C745D4FFFFFFFF          mov [ebp-2C], FFFFFFFF
:00422A13 E907000000              jmp 00422A1F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422A06(C)
|
:00422A18 C745D400000000          mov [ebp-2C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004229F9(U), :00422A13(U)
|
:00422A1F 33C0                    xor eax, eax
:00422A21 8A4514                  mov al, byte ptr [ebp+14]
:00422A24 83F802                  cmp eax, 00000002
:00422A27 0F850C000000            jne 00422A39
:00422A2D C745D001000000          mov [ebp-30], 00000001
:00422A34 E920000000              jmp 00422A59

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422A27(C)
|
:00422A39 33C0                    xor eax, eax
:00422A3B 8A4514                  mov al, byte ptr [ebp+14]
:00422A3E 85C0                    test eax, eax
:00422A40 0F850C000000            jne 00422A52
:00422A46 C745D0FFFFFFFF          mov [ebp-30], FFFFFFFF
:00422A4D E907000000              jmp 00422A59

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422A40(C)
|
:00422A52 C745D000000000          mov [ebp-30], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00422A34(U), :00422A4D(U)
|
:00422A59 33DB                    xor ebx, ebx
:00422A5B 8A5DF8                  mov bl, byte ptr [ebp-08]
:00422A5E 8D1C5B                  lea ebx, dword ptr [ebx+2*ebx]
:00422A61 B900FB4600              mov ecx, 0046FB00
:00422A66 E8C5200000              call 00424B30
:00422A6B 2BD8                    sub ebx, eax
:00422A6D 035DD4                  add ebx, dword ptr [ebp-2C]
:00422A70 C1E304                  shl ebx, 04
:00422A73 83C308                  add ebx, 00000008
:00422A76 895DFC                  mov dword ptr [ebp-04], ebx
:00422A79 33DB                    xor ebx, ebx
:00422A7B 8A5DF9                  mov bl, byte ptr [ebp-07]
:00422A7E 8D1C5B                  lea ebx, dword ptr [ebx+2*ebx]
:00422A81 83C303                  add ebx, 00000003
:00422A84 B900FB4600              mov ecx, 0046FB00
:00422A89 E8C2200000              call 00424B50
:00422A8E 2BD8                    sub ebx, eax
:00422A90 035DD0                  add ebx, dword ptr [ebp-30]
:00422A93 C1E304                  shl ebx, 04
:00422A96 895DE8                  mov dword ptr [ebp-18], ebx
:00422A99 33DB                    xor ebx, ebx
:00422A9B 8A5DF0                  mov bl, byte ptr [ebp-10]
:00422A9E 8D1C5B                  lea ebx, dword ptr [ebx+2*ebx]
:00422AA1 B900FB4600              mov ecx, 0046FB00
:00422AA6 E885200000              call 00424B30
:00422AAB 2BD8                    sub ebx, eax
:00422AAD 2B5DD4                  sub ebx, dword ptr [ebp-2C]
:00422AB0 C1E304                  shl ebx, 04
:00422AB3 83C308                  add ebx, 00000008
:00422AB6 895DF4                  mov dword ptr [ebp-0C], ebx
:00422AB9 33DB                    xor ebx, ebx
:00422ABB 8A5DF1                  mov bl, byte ptr [ebp-0F]
:00422ABE 8D1C5B                  lea ebx, dword ptr [ebx+2*ebx]
:00422AC1 83C303                  add ebx, 00000003
:00422AC4 B900FB4600              mov ecx, 0046FB00
:00422AC9 E882200000              call 00424B50
:00422ACE 2BD8                    sub ebx, eax
:00422AD0 2B5DD0                  sub ebx, dword ptr [ebp-30]
:00422AD3 C1E304                  shl ebx, 04
:00422AD6 895DE0                  mov dword ptr [ebp-20], ebx
:00422AD9 6A08                    push 00000008
:00422ADB E848480200              call 00447328
:00422AE0 83C404                  add esp, 00000004
:00422AE3 8BD8                    mov ebx, eax
:00422AE5 C1EB02                  shr ebx, 02
:00422AE8 6A08                    push 00000008
:00422AEA E839480200              call 00447328
:00422AEF 83C404                  add esp, 00000004
:00422AF2 0FAFD8                  imul ebx, eax
:00422AF5 8BC3                    mov eax, ebx
:00422AF7 03DB                    add ebx, ebx
:00422AF9 2BD8                    sub ebx, eax
:00422AFB F7DB                    neg ebx
:00422AFD 895DEC                  mov dword ptr [ebp-14], ebx
:00422B00 6A08                    push 00000008
:00422B02 E821480200              call 00447328
:00422B07 83C404                  add esp, 00000004
:00422B0A 8BD8                    mov ebx, eax
:00422B0C C1EB02                  shr ebx, 02
:00422B0F 6A08                    push 00000008
:00422B11 E812480200              call 00447328
:00422B16 83C404                  add esp, 00000004
:00422B19 0FAFD8                  imul ebx, eax
:00422B1C 8BC3                    mov eax, ebx
:00422B1E 03DB                    add ebx, ebx
:00422B20 2BD8                    sub ebx, eax
:00422B22 F7DB                    neg ebx
:00422B24 895DDC                  mov dword ptr [ebp-24], ebx
:00422B27 6A08                    push 00000008
:00422B29 E8FA470200              call 00447328
:00422B2E 83C404                  add esp, 00000004
:00422B31 8BD8                    mov ebx, eax
:00422B33 C1EB02                  shr ebx, 02
:00422B36 6A08                    push 00000008
:00422B38 E8EB470200              call 00447328
:00422B3D 83C404                  add esp, 00000004
:00422B40 0FAFD8                  imul ebx, eax
:00422B43 8BC3                    mov eax, ebx
:00422B45 03DB                    add ebx, ebx
:00422B47 2BD8                    sub ebx, eax
:00422B49 F7DB                    neg ebx
:00422B4B 895DE4                  mov dword ptr [ebp-1C], ebx
:00422B4E 6A08                    push 00000008
:00422B50 E8D3470200              call 00447328
:00422B55 83C404                  add esp, 00000004
:00422B58 8BD8                    mov ebx, eax
:00422B5A C1EB02                  shr ebx, 02
:00422B5D 6A08                    push 00000008
:00422B5F E8C4470200              call 00447328
:00422B64 83C404                  add esp, 00000004
:00422B67 0FAFD8                  imul ebx, eax
:00422B6A 8BC3                    mov eax, ebx
:00422B6C 03DB                    add ebx, ebx
:00422B6E 2BD8                    sub ebx, eax
:00422B70 F7DB                    neg ebx
:00422B72 895DD8                  mov dword ptr [ebp-28], ebx
:00422B75 33C0                    xor eax, eax
:00422B77 8A4510                  mov al, byte ptr [ebp+10]
:00422B7A 85C0                    test eax, eax
:00422B7C 0F8511000000            jne 00422B93
:00422B82 6A13                    push 00000013
:00422B84 B994A64600              mov ecx, 0046A694
:00422B89 E89664FFFF              call 00419024
:00422B8E E90C000000              jmp 00422B9F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422B7C(C)
|
:00422B93 6A16                    push 00000016
:00422B95 B994A64600              mov ecx, 0046A694
:00422B9A E88564FFFF              call 00419024

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422B8E(U)
|
:00422B9F 8B4510                  mov eax, dword ptr [ebp+10]
:00422BA2 50                      push eax
:00422BA3 8B45D8                  mov eax, dword ptr [ebp-28]
:00422BA6 0345E0                  add eax, dword ptr [ebp-20]
:00422BA9 50                      push eax
:00422BAA 8B45E4                  mov eax, dword ptr [ebp-1C]
:00422BAD 0345F4                  add eax, dword ptr [ebp-0C]
:00422BB0 50                      push eax
:00422BB1 8B45DC                  mov eax, dword ptr [ebp-24]
:00422BB4 0345E8                  add eax, dword ptr [ebp-18]
:00422BB7 50                      push eax
:00422BB8 8B45EC                  mov eax, dword ptr [ebp-14]
:00422BBB 0345FC                  add eax, dword ptr [ebp-04]
:00422BBE 50                      push eax
:00422BBF E80D000000              call 00422BD1
:00422BC4 83C414                  add esp, 00000014
:00422BC7 E900000000              jmp 00422BCC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422BC7(U)
|
:00422BCC 5F                      pop edi
:00422BCD 5E                      pop esi
:00422BCE 5B                      pop ebx
:00422BCF C9                      leave
:00422BD0 C3                      ret



* Referenced by a CALL at Address:
|:00422BBF   
|
:00422BD1 55                      push ebp
:00422BD2 8BEC                    mov ebp, esp
:00422BD4 83EC24                  sub esp, 00000024
:00422BD7 53                      push ebx
:00422BD8 56                      push esi
:00422BD9 57                      push edi
:00422BDA 8B4510                  mov eax, dword ptr [ebp+10]
:00422BDD 2B4508                  sub eax, dword ptr [ebp+08]
:00422BE0 8945FC                  mov dword ptr [ebp-04], eax
:00422BE3 8B4514                  mov eax, dword ptr [ebp+14]
:00422BE6 2B450C                  sub eax, dword ptr [ebp+0C]
:00422BE9 8945F0                  mov dword ptr [ebp-10], eax
:00422BEC 8B45FC                  mov eax, dword ptr [ebp-04]
:00422BEF 0FAF45FC                imul eax, dword ptr [ebp-04]
:00422BF3 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00422BF6 0FAF4DF0                imul ecx, dword ptr [ebp-10]
:00422BFA 3BC1                    cmp eax, ecx
:00422BFC 0F8E82010000            jle 00422D84
:00422C02 8B45F0                  mov eax, dword ptr [ebp-10]
:00422C05 C1E002                  shl eax, 02
:00422C08 8D0480                  lea eax, dword ptr [eax+4*eax]
:00422C0B 8D0480                  lea eax, dword ptr [eax+4*eax]
:00422C0E 99                      cdq
:00422C0F F77DFC                  idiv [ebp-04]
:00422C12 8945E8                  mov dword ptr [ebp-18], eax
:00422C15 837DFC00                cmp dword ptr [ebp-04], 00000000
:00422C19 0F8E0C000000            jle 00422C2B
:00422C1F C745F808000000          mov [ebp-08], 00000008
:00422C26 E907000000              jmp 00422C32

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422C19(C)
|
:00422C2B C745F8F8FFFFFF          mov [ebp-08], FFFFFFF8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422C26(U)
|
:00422C32 33C0                    xor eax, eax
:00422C34 8A4518                  mov al, byte ptr [ebp+18]
:00422C37 85C0                    test eax, eax
:00422C39 0F8531000000            jne 00422C70
:00422C3F 33DB                    xor ebx, ebx
:00422C41 837DF800                cmp dword ptr [ebp-08], 00000000
:00422C45 0F9EC3                  setle bl
:00422C48 4B                      dec ebx
:00422C49 83E3FE                  and ebx, FFFFFFFE
:00422C4C 8D5CDB1B                lea ebx, dword ptr [ebx+8*ebx+1B]
:00422C50 C1E308                  shl ebx, 08
:00422C53 6A04                    push 00000004
:00422C55 6A00                    push 00000000
:00422C57 6800AB0400              push 0004AB00
:00422C5C B9E8E44600              mov ecx, 0046E4E8
:00422C61 E8BA4A0200              call 00447720
:00422C66 03D8                    add ebx, eax
:00422C68 895DE4                  mov dword ptr [ebp-1C], ebx
:00422C6B E916000000              jmp 00422C86

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422C39(C)
|
:00422C70 6A04                    push 00000004
:00422C72 6A00                    push 00000000
:00422C74 6800CF0400              push 0004CF00
:00422C79 B9E8E44600              mov ecx, 0046E4E8
:00422C7E E89D4A0200              call 00447720
:00422C83 8945E4                  mov dword ptr [ebp-1C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422C6B(U)
|
:00422C86 C745E000000000          mov [ebp-20], 00000000
:00422C8D E906000000              jmp 00422C98

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422D7A(U)
|
:00422C92 8B45F8                  mov eax, dword ptr [ebp-08]
:00422C95 0145E0                  add dword ptr [ebp-20], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422C8D(U)
|
:00422C98 837DF800                cmp dword ptr [ebp-08], 00000000
:00422C9C 0F8E16000000            jle 00422CB8
:00422CA2 8B45E0                  mov eax, dword ptr [ebp-20]
:00422CA5 3945FC                  cmp dword ptr [ebp-04], eax
:00422CA8 0F8D0A000000            jnl 00422CB8
:00422CAE E9CC000000              jmp 00422D7F
:00422CB3 E91B000000              jmp 00422CD3

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00422C9C(C), :00422CA8(C)
|
:00422CB8 837DF800                cmp dword ptr [ebp-08], 00000000
:00422CBC 0F8D11000000            jnl 00422CD3
:00422CC2 8B45E0                  mov eax, dword ptr [ebp-20]
:00422CC5 3945FC                  cmp dword ptr [ebp-04], eax
:00422CC8 0F8E05000000            jle 00422CD3
:00422CCE E9AC000000              jmp 00422D7F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00422CB3(U), :00422CBC(C), :00422CC8(C)
|
:00422CD3 6A01                    push 00000001
:00422CD5 B9B0FA4600              mov ecx, 0046FAB0
:00422CDA E8D164FEFF              call 004091B0
:00422CDF E8B3420000              call 00426F97
:00422CE4 8B45E0                  mov eax, dword ptr [ebp-20]
:00422CE7 0FAF45E8                imul eax, dword ptr [ebp-18]
:00422CEB B964000000              mov ecx, 00000064
:00422CF0 99                      cdq
:00422CF1 F7F9                    idiv ecx
:00422CF3 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00422CF6 03C8                    add ecx, eax
:00422CF8 894DEC                  mov dword ptr [ebp-14], ecx
:00422CFB 6A04                    push 00000004
:00422CFD 6A00                    push 00000000
:00422CFF 68A0860100              push 000186A0
:00422D04 B968F94600              mov ecx, 0046F968
:00422D09 E8124A0200              call 00447720
:00422D0E 50                      push eax
:00422D0F 6A30                    push 00000030
:00422D11 6A30                    push 00000030
:00422D13 8B45EC                  mov eax, dword ptr [ebp-14]
:00422D16 50                      push eax
:00422D17 8B4508                  mov eax, dword ptr [ebp+08]
:00422D1A 0345E0                  add eax, dword ptr [ebp-20]
:00422D1D 50                      push eax
:00422D1E E808A60100              call 0043D32B
:00422D23 83C414                  add esp, 00000014
:00422D26 6A04                    push 00000004
:00422D28 8B45E4                  mov eax, dword ptr [ebp-1C]
:00422D2B 50                      push eax
:00422D2C 6A30                    push 00000030
:00422D2E 6A30                    push 00000030
:00422D30 8B45EC                  mov eax, dword ptr [ebp-14]
:00422D33 50                      push eax
:00422D34 8B4508                  mov eax, dword ptr [ebp+08]
:00422D37 0345E0                  add eax, dword ptr [ebp-20]
:00422D3A 50                      push eax
:00422D3B E875A50100              call 0043D2B5
:00422D40 83C418                  add esp, 00000018
:00422D43 E86F420000              call 00426FB7
:00422D48 E87B460100              call 004373C8
:00422D4D 6A00                    push 00000000
:00422D4F 6A04                    push 00000004
:00422D51 6A00                    push 00000000
:00422D53 68A0860100              push 000186A0
:00422D58 B968F94600              mov ecx, 0046F968
:00422D5D E8BE490200              call 00447720
:00422D62 50                      push eax
:00422D63 6A30                    push 00000030
:00422D65 6A30                    push 00000030
:00422D67 8B45EC                  mov eax, dword ptr [ebp-14]
:00422D6A 50                      push eax
:00422D6B 8B4508                  mov eax, dword ptr [ebp+08]
:00422D6E 0345E0                  add eax, dword ptr [ebp-20]
:00422D71 50                      push eax
:00422D72 E83EA50100              call 0043D2B5
:00422D77 83C418                  add esp, 00000018
:00422D7A E913FFFFFF              jmp 00422C92

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00422CAE(U), :00422CCE(U)
|
:00422D7F E97C010000              jmp 00422F00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422BFC(C)
|
:00422D84 8B45FC                  mov eax, dword ptr [ebp-04]
:00422D87 C1E002                  shl eax, 02
:00422D8A 8D0480                  lea eax, dword ptr [eax+4*eax]
:00422D8D 8D0480                  lea eax, dword ptr [eax+4*eax]
:00422D90 99                      cdq
:00422D91 F77DF0                  idiv [ebp-10]
:00422D94 8945E8                  mov dword ptr [ebp-18], eax
:00422D97 837DF000                cmp dword ptr [ebp-10], 00000000
:00422D9B 0F8E0C000000            jle 00422DAD
:00422DA1 C745F808000000          mov [ebp-08], 00000008
:00422DA8 E907000000              jmp 00422DB4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422D9B(C)
|
:00422DAD C745F8F8FFFFFF          mov [ebp-08], FFFFFFF8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422DA8(U)
|
:00422DB4 33C0                    xor eax, eax
:00422DB6 8A4518                  mov al, byte ptr [ebp+18]
:00422DB9 85C0                    test eax, eax
:00422DBB 0F8530000000            jne 00422DF1
:00422DC1 33DB                    xor ebx, ebx
:00422DC3 837DF800                cmp dword ptr [ebp-08], 00000000
:00422DC7 0F9EC3                  setle bl
:00422DCA 4B                      dec ebx
:00422DCB 83E302                  and ebx, 00000002
:00422DCE 8D1CDB                  lea ebx, dword ptr [ebx+8*ebx]
:00422DD1 C1E308                  shl ebx, 08
:00422DD4 6A04                    push 00000004
:00422DD6 6A00                    push 00000000
:00422DD8 6800AB0400              push 0004AB00
:00422DDD B9E8E44600              mov ecx, 0046E4E8
:00422DE2 E839490200              call 00447720
:00422DE7 03D8                    add ebx, eax
:00422DE9 895DE4                  mov dword ptr [ebp-1C], ebx
:00422DEC E916000000              jmp 00422E07

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422DBB(C)
|
:00422DF1 6A04                    push 00000004
:00422DF3 6A00                    push 00000000
:00422DF5 6800CF0400              push 0004CF00
:00422DFA B9E8E44600              mov ecx, 0046E4E8
:00422DFF E81C490200              call 00447720
:00422E04 8945E4                  mov dword ptr [ebp-1C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422DEC(U)
|
:00422E07 C745DC00000000          mov [ebp-24], 00000000
:00422E0E E906000000              jmp 00422E19

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422EFB(U)
|
:00422E13 8B45F8                  mov eax, dword ptr [ebp-08]
:00422E16 0145DC                  add dword ptr [ebp-24], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422E0E(U)
|
:00422E19 837DF800                cmp dword ptr [ebp-08], 00000000
:00422E1D 0F8E16000000            jle 00422E39
:00422E23 8B45F0                  mov eax, dword ptr [ebp-10]
:00422E26 3945DC                  cmp dword ptr [ebp-24], eax
:00422E29 0F8E0A000000            jle 00422E39
:00422E2F E9CC000000              jmp 00422F00
:00422E34 E91B000000              jmp 00422E54

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00422E1D(C), :00422E29(C)
|
:00422E39 837DF800                cmp dword ptr [ebp-08], 00000000
:00422E3D 0F8D11000000            jnl 00422E54
:00422E43 8B45F0                  mov eax, dword ptr [ebp-10]
:00422E46 3945DC                  cmp dword ptr [ebp-24], eax
:00422E49 0F8D05000000            jnl 00422E54
:00422E4F E9AC000000              jmp 00422F00

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00422E34(U), :00422E3D(C), :00422E49(C)
|
:00422E54 6A01                    push 00000001
:00422E56 B9B0FA4600              mov ecx, 0046FAB0
:00422E5B E85063FEFF              call 004091B0
:00422E60 E832410000              call 00426F97
:00422E65 8B45DC                  mov eax, dword ptr [ebp-24]
:00422E68 0FAF45E8                imul eax, dword ptr [ebp-18]
:00422E6C B964000000              mov ecx, 00000064
:00422E71 99                      cdq
:00422E72 F7F9                    idiv ecx
:00422E74 8B4D08                  mov ecx, dword ptr [ebp+08]
:00422E77 03C8                    add ecx, eax
:00422E79 894DF4                  mov dword ptr [ebp-0C], ecx
:00422E7C 6A04                    push 00000004
:00422E7E 6A00                    push 00000000
:00422E80 68A0860100              push 000186A0
:00422E85 B968F94600              mov ecx, 0046F968
:00422E8A E891480200              call 00447720
:00422E8F 50                      push eax
:00422E90 6A30                    push 00000030
:00422E92 6A30                    push 00000030
:00422E94 8B450C                  mov eax, dword ptr [ebp+0C]
:00422E97 0345DC                  add eax, dword ptr [ebp-24]
:00422E9A 50                      push eax
:00422E9B 8B45F4                  mov eax, dword ptr [ebp-0C]
:00422E9E 50                      push eax
:00422E9F E887A40100              call 0043D32B
:00422EA4 83C414                  add esp, 00000014
:00422EA7 6A04                    push 00000004
:00422EA9 8B45E4                  mov eax, dword ptr [ebp-1C]
:00422EAC 50                      push eax
:00422EAD 6A30                    push 00000030
:00422EAF 6A30                    push 00000030
:00422EB1 8B450C                  mov eax, dword ptr [ebp+0C]
:00422EB4 0345DC                  add eax, dword ptr [ebp-24]
:00422EB7 50                      push eax
:00422EB8 8B45F4                  mov eax, dword ptr [ebp-0C]
:00422EBB 50                      push eax
:00422EBC E8F4A30100              call 0043D2B5
:00422EC1 83C418                  add esp, 00000018
:00422EC4 E8EE400000              call 00426FB7
:00422EC9 E8FA440100              call 004373C8
:00422ECE 6A00                    push 00000000
:00422ED0 6A04                    push 00000004
:00422ED2 6A00                    push 00000000
:00422ED4 68A0860100              push 000186A0
:00422ED9 B968F94600              mov ecx, 0046F968
:00422EDE E83D480200              call 00447720
:00422EE3 50                      push eax
:00422EE4 6A30                    push 00000030
:00422EE6 6A30                    push 00000030
:00422EE8 8B450C                  mov eax, dword ptr [ebp+0C]
:00422EEB 0345DC                  add eax, dword ptr [ebp-24]
:00422EEE 50                      push eax
:00422EEF 8B45F4                  mov eax, dword ptr [ebp-0C]
:00422EF2 50                      push eax
:00422EF3 E8BDA30100              call 0043D2B5
:00422EF8 83C418                  add esp, 00000018
:00422EFB E913FFFFFF              jmp 00422E13

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00422D7F(U), :00422E2F(U), :00422E4F(U)
|
:00422F00 E900000000              jmp 00422F05

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422F00(U)
|
:00422F05 5F                      pop edi
:00422F06 5E                      pop esi
:00422F07 5B                      pop ebx
:00422F08 C9                      leave
:00422F09 C3                      ret



* Referenced by a CALL at Address:
|:004227E5   
|
:00422F0A 55                      push ebp
:00422F0B 8BEC                    mov ebp, esp
:00422F0D 83EC10                  sub esp, 00000010
:00422F10 53                      push ebx
:00422F11 56                      push esi
:00422F12 57                      push edi
:00422F13 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00422F16 E855E9FDFF              call 00401870
:00422F1B 33C0                    xor eax, eax
:00422F1D 8A4508                  mov al, byte ptr [ebp+08]
:00422F20 8BC8                    mov ecx, eax
:00422F22 8D0440                  lea eax, dword ptr [eax+2*eax]
:00422F25 C1E003                  shl eax, 03
:00422F28 2BC1                    sub eax, ecx
:00422F2A 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00422F30 E8CB62FEFF              call 00409200
:00422F35 668B00                  mov ax, word ptr [eax]
:00422F38 50                      push eax
:00422F39 8D45F0                  lea eax, dword ptr [ebp-10]
:00422F3C 50                      push eax
:00422F3D E8E2770100              call 0043A724
:00422F42 83C408                  add esp, 00000008
:00422F45 50                      push eax
:00422F46 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00422F49 E842E9FDFF              call 00401890
:00422F4E 33C0                    xor eax, eax
:00422F50 8A45FC                  mov al, byte ptr [ebp-04]
:00422F53 C1E004                  shl eax, 04
:00422F56 83C008                  add eax, 00000008
:00422F59 8945F8                  mov dword ptr [ebp-08], eax
:00422F5C 33C0                    xor eax, eax
:00422F5E 8A45FD                  mov al, byte ptr [ebp-03]
:00422F61 C1E004                  shl eax, 04
:00422F64 83C030                  add eax, 00000030
:00422F67 8945F4                  mov dword ptr [ebp-0C], eax
:00422F6A 8B4510                  mov eax, dword ptr [ebp+10]
:00422F6D 50                      push eax
:00422F6E 33C0                    xor eax, eax
:00422F70 8A4508                  mov al, byte ptr [ebp+08]
:00422F73 8BC8                    mov ecx, eax
:00422F75 8D0440                  lea eax, dword ptr [eax+2*eax]
:00422F78 C1E003                  shl eax, 03
:00422F7B 2BC1                    sub eax, ecx
:00422F7D 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00422F83 E8E81B0000              call 00424B70
:00422F88 50                      push eax
:00422F89 E856000000              call 00422FE4
:00422F8E 83C408                  add esp, 00000008
:00422F91 01450C                  add dword ptr [ebp+0C], eax
:00422F94 33C0                    xor eax, eax
:00422F96 8A45FD                  mov al, byte ptr [ebp-03]
:00422F99 50                      push eax
:00422F9A 33C0                    xor eax, eax
:00422F9C 8A45FC                  mov al, byte ptr [ebp-04]
:00422F9F 50                      push eax
:00422FA0 E83FF0FFFF              call 00421FE4
:00422FA5 83C408                  add esp, 00000008
:00422FA8 6A04                    push 00000004
:00422FAA 6A04                    push 00000004
:00422FAC 6A00                    push 00000000
:00422FAE 6A00                    push 00000000
:00422FB0 B968F94600              mov ecx, 0046F968
:00422FB5 E866470200              call 00447720
:00422FBA 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00422FBD 03C8                    add ecx, eax
:00422FBF 51                      push ecx
:00422FC0 6A40                    push 00000040
:00422FC2 6A40                    push 00000040
:00422FC4 8B45F4                  mov eax, dword ptr [ebp-0C]
:00422FC7 83E808                  sub eax, 00000008
:00422FCA 50                      push eax
:00422FCB 8B45F8                  mov eax, dword ptr [ebp-08]
:00422FCE 83E808                  sub eax, 00000008
:00422FD1 50                      push eax
:00422FD2 E8DEA20100              call 0043D2B5
:00422FD7 83C418                  add esp, 00000018
:00422FDA E900000000              jmp 00422FDF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422FDA(U)
|
:00422FDF 5F                      pop edi
:00422FE0 5E                      pop esi
:00422FE1 5B                      pop ebx
:00422FE2 C9                      leave
:00422FE3 C3                      ret



* Referenced by a CALL at Address:
|:00422F89   
|
:00422FE4 55                      push ebp
:00422FE5 8BEC                    mov ebp, esp
:00422FE7 83EC08                  sub esp, 00000008
:00422FEA 53                      push ebx
:00422FEB 56                      push esi
:00422FEC 57                      push edi
:00422FED 33C0                    xor eax, eax
:00422FEF 8A4508                  mov al, byte ptr [ebp+08]
:00422FF2 8945F8                  mov dword ptr [ebp-08], eax
:00422FF5 E931000000              jmp 0042302B
:00422FFA 33C0                    xor eax, eax
:00422FFC 8A450C                  mov al, byte ptr [ebp+0C]
:00422FFF C1E00D                  shl eax, 0D
:00423002 8945FC                  mov dword ptr [ebp-04], eax
:00423005 E945000000              jmp 0042304F
:0042300A 33C0                    xor eax, eax
:0042300C 8A450C                  mov al, byte ptr [ebp+0C]
:0042300F C1E00C                  shl eax, 0C
:00423012 8945FC                  mov dword ptr [ebp-04], eax
:00423015 E935000000              jmp 0042304F
:0042301A C745FC00000000          mov [ebp-04], 00000000
:00423021 E929000000              jmp 0042304F
:00423026 E924000000              jmp 0042304F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422FF5(U)
|
:0042302B 837DF803                cmp dword ptr [ebp-08], 00000003
:0042302F 0F871A000000            ja 0042304F
:00423035 8B45F8                  mov eax, dword ptr [ebp-08]
:00423038 FF24853F304200          jmp dword ptr [4*eax+0042303F]

:0042303F FA2F4200                DWORD 00422FFA
:00423043 0A304200                DWORD 0042300A
:00423047 1A304200                DWORD 0042301A
:0042304B 0A304200                DWORD 0042300A



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00423005(U), :00423015(U), :00423021(U), :00423026(U), :0042302F(C)
|
:0042304F 8B45FC                  mov eax, dword ptr [ebp-04]
:00423052 E900000000              jmp 00423057

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423052(U)
|
:00423057 5F                      pop edi
:00423058 5E                      pop esi
:00423059 5B                      pop ebx
:0042305A C9                      leave
:0042305B C3                      ret



* Referenced by a CALL at Addresses:
|:00422772   , :00422933   , :00422980   , :00423481   , :004234B8   
|:0042479D   , :004247D3   , :0042480E   
|
:0042305C 55                      push ebp
:0042305D 8BEC                    mov ebp, esp
:0042305F 83EC14                  sub esp, 00000014
:00423062 53                      push ebx
:00423063 56                      push esi
:00423064 57                      push edi
:00423065 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00423068 E803E8FDFF              call 00401870
:0042306D 33C0                    xor eax, eax
:0042306F 8A4508                  mov al, byte ptr [ebp+08]
:00423072 8BC8                    mov ecx, eax
:00423074 8D0440                  lea eax, dword ptr [eax+2*eax]
:00423077 C1E003                  shl eax, 03
:0042307A 2BC1                    sub eax, ecx
:0042307C 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00423082 E87961FEFF              call 00409200
:00423087 668B00                  mov ax, word ptr [eax]
:0042308A 50                      push eax
:0042308B 8D45EC                  lea eax, dword ptr [ebp-14]
:0042308E 50                      push eax
:0042308F E890760100              call 0043A724
:00423094 83C408                  add esp, 00000008
:00423097 50                      push eax
:00423098 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0042309B E8F0E7FDFF              call 00401890
:004230A0 33C0                    xor eax, eax
:004230A2 8A45FC                  mov al, byte ptr [ebp-04]
:004230A5 C1E004                  shl eax, 04
:004230A8 83C008                  add eax, 00000008
:004230AB 8945F8                  mov dword ptr [ebp-08], eax
:004230AE 33C0                    xor eax, eax
:004230B0 8A45FD                  mov al, byte ptr [ebp-03]
:004230B3 C1E004                  shl eax, 04
:004230B6 83C030                  add eax, 00000030
:004230B9 8945F4                  mov dword ptr [ebp-0C], eax
:004230BC 33C0                    xor eax, eax
:004230BE 8A45FD                  mov al, byte ptr [ebp-03]
:004230C1 50                      push eax
:004230C2 33C0                    xor eax, eax
:004230C4 8A45FC                  mov al, byte ptr [ebp-04]
:004230C7 50                      push eax
:004230C8 E817EFFFFF              call 00421FE4
:004230CD 83C408                  add esp, 00000008
:004230D0 6A10                    push 00000010
:004230D2 33C0                    xor eax, eax
:004230D4 8A4508                  mov al, byte ptr [ebp+08]
:004230D7 8BC8                    mov ecx, eax
:004230D9 8D0440                  lea eax, dword ptr [eax+2*eax]
:004230DC C1E003                  shl eax, 03
:004230DF 2BC1                    sub eax, ecx
:004230E1 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004230E7 E86460FEFF              call 00409150
:004230EC 85C0                    test eax, eax
:004230EE 0F853A000000            jne 0042312E
:004230F4 6A04                    push 00000004
:004230F6 6A04                    push 00000004
:004230F8 6A00                    push 00000000
:004230FA 6800900000              push 00009000
:004230FF B968F94600              mov ecx, 0046F968
:00423104 E817460200              call 00447720
:00423109 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0042310C 8D0CC9                  lea ecx, dword ptr [ecx+8*ecx]
:0042310F C1E108                  shl ecx, 08
:00423112 03C1                    add eax, ecx
:00423114 50                      push eax
:00423115 6A30                    push 00000030
:00423117 6A30                    push 00000030
:00423119 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042311C 50                      push eax
:0042311D 8B45F8                  mov eax, dword ptr [ebp-08]
:00423120 50                      push eax
:00423121 E88FA10100              call 0043D2B5
:00423126 83C418                  add esp, 00000018
:00423129 E97D000000              jmp 004231AB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004230EE(C)
|
:0042312E B998FC4600              mov ecx, 0046FC98
:00423133 E8581A0000              call 00424B90
:00423138 33C9                    xor ecx, ecx
:0042313A 8AC8                    mov cl, al
:0042313C 85C9                    test ecx, ecx
:0042313E 0F850C000000            jne 00423150
:00423144 C745F000000000          mov [ebp-10], 00000000
:0042314B E907000000              jmp 00423157

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042313E(C)
|
:00423150 C745F000090000          mov [ebp-10], 00000900

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042314B(U)
|
:00423157 6A04                    push 00000004
:00423159 33C0                    xor eax, eax
:0042315B 8A4508                  mov al, byte ptr [ebp+08]
:0042315E 8BC8                    mov ecx, eax
:00423160 8D0440                  lea eax, dword ptr [eax+2*eax]
:00423163 C1E003                  shl eax, 03
:00423166 2BC1                    sub eax, ecx
:00423168 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0042316E E8AD60FEFF              call 00409220
:00423173 83F801                  cmp eax, 00000001
:00423176 1BDB                    sbb ebx, ebx
:00423178 81E300120000            and ebx, 00001200
:0042317E 6A04                    push 00000004
:00423180 6A00                    push 00000000
:00423182 6800040300              push 00030400
:00423187 B9E8E44600              mov ecx, 0046E4E8
:0042318C E88F450200              call 00447720
:00423191 03D8                    add ebx, eax
:00423193 035DF0                  add ebx, dword ptr [ebp-10]
:00423196 53                      push ebx
:00423197 6A30                    push 00000030
:00423199 6A30                    push 00000030
:0042319B 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042319E 50                      push eax
:0042319F 8B45F8                  mov eax, dword ptr [ebp-08]
:004231A2 50                      push eax
:004231A3 E80DA10100              call 0043D2B5
:004231A8 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423129(U)
|
:004231AB E900000000              jmp 004231B0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004231AB(U)
|
:004231B0 5F                      pop edi
:004231B1 5E                      pop esi
:004231B2 5B                      pop ebx
:004231B3 C9                      leave
:004231B4 C3                      ret



* Referenced by a CALL at Address:
|:00422703   
|
:004231B5 55                      push ebp
:004231B6 8BEC                    mov ebp, esp
:004231B8 83EC08                  sub esp, 00000008
:004231BB 53                      push ebx
:004231BC 56                      push esi
:004231BD 57                      push edi
:004231BE C745FC00000000          mov [ebp-04], 00000000
:004231C5 33C9                    xor ecx, ecx
:004231C7 8A4D0C                  mov cl, byte ptr [ebp+0C]
:004231CA 8B4508                  mov eax, dword ptr [ebp+08]
:004231CD 2BD2                    sub edx, edx
:004231CF F7F1                    div ecx
:004231D1 8955F8                  mov dword ptr [ebp-08], edx
:004231D4 E937000000              jmp 00423210

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423214(C)
|
:004231D9 C745FC00100000          mov [ebp-04], 00001000
:004231E0 E944000000              jmp 00423229

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042321E(C)
|
:004231E5 33C0                    xor eax, eax
:004231E7 8A4510                  mov al, byte ptr [ebp+10]
:004231EA 83F802                  cmp eax, 00000002
:004231ED 0F850C000000            jne 004231FF
:004231F3 C745FC00200000          mov [ebp-04], 00002000
:004231FA E907000000              jmp 00423206

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004231ED(C)
|
:004231FF C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004231FA(U)
|
:00423206 E91E000000              jmp 00423229
:0042320B E919000000              jmp 00423229

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004231D4(U)
|
:00423210 837DF801                cmp dword ptr [ebp-08], 00000001
:00423214 0F84BFFFFFFF            je 004231D9
:0042321A 837DF802                cmp dword ptr [ebp-08], 00000002
:0042321E 0F84C1FFFFFF            je 004231E5
:00423224 E900000000              jmp 00423229

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004231E0(U), :00423206(U), :0042320B(U), :00423224(U)
|
:00423229 8B45FC                  mov eax, dword ptr [ebp-04]
:0042322C E900000000              jmp 00423231

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042322C(U)
|
:00423231 5F                      pop edi
:00423232 5E                      pop esi
:00423233 5B                      pop ebx
:00423234 C9                      leave
:00423235 C3                      ret



* Referenced by a CALL at Addresses:
|:0043EB8C   , :0043EBCC   
|
:00423236 55                      push ebp
:00423237 8BEC                    mov ebp, esp
:00423239 83EC1C                  sub esp, 0000001C
:0042323C 53                      push ebx
:0042323D 56                      push esi
:0042323E 57                      push edi
:0042323F 894DE4                  mov dword ptr [ebp-1C], ecx
:00423242 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00423245 E826E6FDFF              call 00401870
:0042324A 8B45E4                  mov eax, dword ptr [ebp-1C]
:0042324D 33C9                    xor ecx, ecx
:0042324F 8A4810                  mov cl, byte ptr [eax+10]
:00423252 8B45E4                  mov eax, dword ptr [ebp-1C]
:00423255 8B0C88                  mov ecx, dword ptr [eax+4*ecx]
:00423258 E8A35FFEFF              call 00409200
:0042325D 668B00                  mov ax, word ptr [eax]
:00423260 50                      push eax
:00423261 8D45E8                  lea eax, dword ptr [ebp-18]
:00423264 50                      push eax
:00423265 E8BA740100              call 0043A724
:0042326A 83C408                  add esp, 00000008
:0042326D 50                      push eax
:0042326E 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00423271 E81AE6FDFF              call 00401890
:00423276 33C0                    xor eax, eax
:00423278 8A45FC                  mov al, byte ptr [ebp-04]
:0042327B C1E004                  shl eax, 04
:0042327E 8945F8                  mov dword ptr [ebp-08], eax
:00423281 33C0                    xor eax, eax
:00423283 8A45FD                  mov al, byte ptr [ebp-03]
:00423286 83C003                  add eax, 00000003
:00423289 C1E004                  shl eax, 04
:0042328C 83E808                  sub eax, 00000008
:0042328F 8945F4                  mov dword ptr [ebp-0C], eax
:00423292 8B45E4                  mov eax, dword ptr [ebp-1C]
:00423295 33C9                    xor ecx, ecx
:00423297 8A4812                  mov cl, byte ptr [eax+12]
:0042329A 83F901                  cmp ecx, 00000001
:0042329D 0F8515000000            jne 004232B8
:004232A3 8B45F4                  mov eax, dword ptr [ebp-0C]
:004232A6 50                      push eax
:004232A7 8B45F8                  mov eax, dword ptr [ebp-08]
:004232AA 50                      push eax
:004232AB 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004232AE E8CBF3FFFF              call 0042267E
:004232B3 E985000000              jmp 0042333D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042329D(C)
|
:004232B8 8B45E4                  mov eax, dword ptr [ebp-1C]
:004232BB 33C9                    xor ecx, ecx
:004232BD 8A4812                  mov cl, byte ptr [eax+12]
:004232C0 83F902                  cmp ecx, 00000002
:004232C3 0F8411000000            je 004232DA
:004232C9 8B45E4                  mov eax, dword ptr [ebp-1C]
:004232CC 33C9                    xor ecx, ecx
:004232CE 8A4812                  mov cl, byte ptr [eax+12]
:004232D1 83F903                  cmp ecx, 00000003
:004232D4 0F8563000000            jne 0042333D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004232C3(C)
|
:004232DA 8B45E4                  mov eax, dword ptr [ebp-1C]
:004232DD 33C9                    xor ecx, ecx
:004232DF 8A4812                  mov cl, byte ptr [eax+12]
:004232E2 83F902                  cmp ecx, 00000002
:004232E5 0F8516000000            jne 00423301
:004232EB 8B45E4                  mov eax, dword ptr [ebp-1C]
:004232EE 33C9                    xor ecx, ecx
:004232F0 8A4813                  mov cl, byte ptr [eax+13]
:004232F3 C1E904                  shr ecx, 04
:004232F6 80E101                  and cl, 01
:004232F9 884DF0                  mov byte ptr [ebp-10], cl
:004232FC E90E000000              jmp 0042330F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004232E5(C)
|
:00423301 8B45E4                  mov eax, dword ptr [ebp-1C]
:00423304 33C9                    xor ecx, ecx
:00423306 8A4813                  mov cl, byte ptr [eax+13]
:00423309 C1F904                  sar ecx, 04
:0042330C 884DF0                  mov byte ptr [ebp-10], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004232FC(U)
|
:0042330F 8B45E4                  mov eax, dword ptr [ebp-1C]
:00423312 33C9                    xor ecx, ecx
:00423314 8A4813                  mov cl, byte ptr [eax+13]
:00423317 80E10F                  and cl, 0F
:0042331A 884DEC                  mov byte ptr [ebp-14], cl
:0042331D 8B45EC                  mov eax, dword ptr [ebp-14]
:00423320 50                      push eax
:00423321 8B45F0                  mov eax, dword ptr [ebp-10]
:00423324 50                      push eax
:00423325 8B45E4                  mov eax, dword ptr [ebp-1C]
:00423328 33C9                    xor ecx, ecx
:0042332A 8A4811                  mov cl, byte ptr [eax+11]
:0042332D 8B45E4                  mov eax, dword ptr [ebp-1C]
:00423330 8A440138                mov al, byte ptr [ecx+eax+38]
:00423334 50                      push eax
:00423335 E80D000000              call 00423347
:0042333A 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004232B3(U), :004232D4(C)
|
:0042333D E900000000              jmp 00423342

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042333D(U)
|
:00423342 5F                      pop edi
:00423343 5E                      pop esi
:00423344 5B                      pop ebx
:00423345 C9                      leave
:00423346 C3                      ret



* Referenced by a CALL at Address:
|:00423335   
|
:00423347 55                      push ebp
:00423348 8BEC                    mov ebp, esp
:0042334A 83EC24                  sub esp, 00000024
:0042334D 53                      push ebx
:0042334E 56                      push esi
:0042334F 57                      push edi
:00423350 33C0                    xor eax, eax
:00423352 8A4508                  mov al, byte ptr [ebp+08]
:00423355 8BC8                    mov ecx, eax
:00423357 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042335A C1E003                  shl eax, 03
:0042335D 2BC1                    sub eax, ecx
:0042335F 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00423365 E8965EFEFF              call 00409200
:0042336A 668B00                  mov ax, word ptr [eax]
:0042336D 50                      push eax
:0042336E 8D45FC                  lea eax, dword ptr [ebp-04]
:00423371 50                      push eax
:00423372 E8AD730100              call 0043A724
:00423377 83C408                  add esp, 00000008
:0042337A 33C0                    xor eax, eax
:0042337C 8A45FC                  mov al, byte ptr [ebp-04]
:0042337F C1E004                  shl eax, 04
:00423382 83C008                  add eax, 00000008
:00423385 8945F4                  mov dword ptr [ebp-0C], eax
:00423388 33C0                    xor eax, eax
:0042338A 8A45FD                  mov al, byte ptr [ebp-03]
:0042338D 83C003                  add eax, 00000003
:00423390 C1E004                  shl eax, 04
:00423393 8945F0                  mov dword ptr [ebp-10], eax
:00423396 33C0                    xor eax, eax
:00423398 8A450C                  mov al, byte ptr [ebp+0C]
:0042339B 85C0                    test eax, eax
:0042339D 0F8509000000            jne 004233AC
:004233A3 C645F802                mov [ebp-08], 02
:004233A7 E904000000              jmp 004233B0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042339D(C)
|
:004233AC C645F808                mov [ebp-08], 08

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004233A7(U)
|
:004233B0 33C0                    xor eax, eax
:004233B2 8A450C                  mov al, byte ptr [ebp+0C]
:004233B5 85C0                    test eax, eax
:004233B7 0F8509000000            jne 004233C6
:004233BD C645E004                mov [ebp-20], 04
:004233C1 E904000000              jmp 004233CA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004233B7(C)
|
:004233C6 C645E008                mov [ebp-20], 08

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004233C1(U)
|
:004233CA 33C0                    xor eax, eax
:004233CC 8A450C                  mov al, byte ptr [ebp+0C]
:004233CF 85C0                    test eax, eax
:004233D1 0F850C000000            jne 004233E3
:004233D7 C745E806000000          mov [ebp-18], 00000006
:004233DE E907000000              jmp 004233EA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004233D1(C)
|
:004233E3 C745E803000000          mov [ebp-18], 00000003

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004233DE(U)
|
:004233EA 33C0                    xor eax, eax
:004233EC 8A450C                  mov al, byte ptr [ebp+0C]
:004233EF 85C0                    test eax, eax
:004233F1 0F850C000000            jne 00423403
:004233F7 C745DC00430300          mov [ebp-24], 00034300
:004233FE E907000000              jmp 0042340A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004233F1(C)
|
:00423403 C745DC00790300          mov [ebp-24], 00037900

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004233FE(U)
|
:0042340A 33C0                    xor eax, eax
:0042340C 8A4510                  mov al, byte ptr [ebp+10]
:0042340F 33C9                    xor ecx, ecx
:00423411 8A4DF8                  mov cl, byte ptr [ebp-08]
:00423414 0FAFC1                  imul eax, ecx
:00423417 8D04C0                  lea eax, dword ptr [eax+8*eax]
:0042341A C1E008                  shl eax, 08
:0042341D 0145DC                  add dword ptr [ebp-24], eax
:00423420 C645EC00                mov [ebp-14], 00
:00423424 E903000000              jmp 0042342C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004234AD(U)
|
:00423429 FE45EC                  inc [ebp-14]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423424(U)
|
:0042342C 33C0                    xor eax, eax
:0042342E 8A45E0                  mov al, byte ptr [ebp-20]
:00423431 33C9                    xor ecx, ecx
:00423433 8A4DEC                  mov cl, byte ptr [ebp-14]
:00423436 3BC1                    cmp eax, ecx
:00423438 0F8E74000000            jle 004234B2
:0042343E 8B45E8                  mov eax, dword ptr [ebp-18]
:00423441 50                      push eax
:00423442 B9B0FA4600              mov ecx, 0046FAB0
:00423447 E8645DFEFF              call 004091B0
:0042344C E8463B0000              call 00426F97
:00423451 33C0                    xor eax, eax
:00423453 8A45EC                  mov al, byte ptr [ebp-14]
:00423456 33C9                    xor ecx, ecx
:00423458 8A4DF8                  mov cl, byte ptr [ebp-08]
:0042345B 99                      cdq
:0042345C F7F9                    idiv ecx
:0042345E 8D1CD2                  lea ebx, dword ptr [edx+8*edx]
:00423461 C1E308                  shl ebx, 08
:00423464 6A04                    push 00000004
:00423466 6A00                    push 00000000
:00423468 8B45DC                  mov eax, dword ptr [ebp-24]
:0042346B 50                      push eax
:0042346C B9E8E44600              mov ecx, 0046E4E8
:00423471 E8AA420200              call 00447720
:00423476 03D8                    add ebx, eax
:00423478 895DE4                  mov dword ptr [ebp-1C], ebx
:0042347B 6A00                    push 00000000
:0042347D 8B4508                  mov eax, dword ptr [ebp+08]
:00423480 50                      push eax
:00423481 E8D6FBFFFF              call 0042305C
:00423486 83C408                  add esp, 00000008
:00423489 6A04                    push 00000004
:0042348B 8B45E4                  mov eax, dword ptr [ebp-1C]
:0042348E 50                      push eax
:0042348F 6A30                    push 00000030
:00423491 6A30                    push 00000030
:00423493 8B45F0                  mov eax, dword ptr [ebp-10]
:00423496 50                      push eax
:00423497 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042349A 50                      push eax
:0042349B E8159E0100              call 0043D2B5
:004234A0 83C418                  add esp, 00000018
:004234A3 E80F3B0000              call 00426FB7
:004234A8 E81B3F0100              call 004373C8
:004234AD E977FFFFFF              jmp 00423429

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423438(C)
|
:004234B2 6A00                    push 00000000
:004234B4 8B4508                  mov eax, dword ptr [ebp+08]
:004234B7 50                      push eax
:004234B8 E89FFBFFFF              call 0042305C
:004234BD 83C408                  add esp, 00000008
:004234C0 E900000000              jmp 004234C5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004234C0(U)
|
:004234C5 5F                      pop edi
:004234C6 5E                      pop esi
:004234C7 5B                      pop ebx
:004234C8 C9                      leave
:004234C9 C3                      ret



* Referenced by a CALL at Address:
|:0043EB71   
|
:004234CA 55                      push ebp
:004234CB 8BEC                    mov ebp, esp
:004234CD B824110000              mov eax, 00001124
:004234D2 E8694F0200              call 00448440
:004234D7 53                      push ebx
:004234D8 56                      push esi
:004234D9 57                      push edi
:004234DA 898DDCEEFFFF            mov dword ptr [ebp+FFFFEEDC], ecx
:004234E0 8B85DCEEFFFF            mov eax, dword ptr [ebp+FFFFEEDC]
:004234E6 33C9                    xor ecx, ecx
:004234E8 8A4810                  mov cl, byte ptr [eax+10]
:004234EB 8B85DCEEFFFF            mov eax, dword ptr [ebp+FFFFEEDC]
:004234F1 8A440138                mov al, byte ptr [ecx+eax+38]
:004234F5 8845F0                  mov byte ptr [ebp-10], al
:004234F8 8B45F0                  mov eax, dword ptr [ebp-10]
:004234FB 50                      push eax
:004234FC E8205D0000              call 00429221
:00423501 83C404                  add esp, 00000004
:00423504 8845F4                  mov byte ptr [ebp-0C], al
:00423507 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0042350D E85E61FEFF              call 00409670

* Possible StringData Ref from Data Obj ->"B:CHR_ATT.E2"
                                  |
:00423512 6868354500              push 00453568
:00423517 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0042351D E8ED3F0000              call 0042750F
:00423522 6A04                    push 00000004
:00423524 6A00                    push 00000000
:00423526 6A00                    push 00000000
:00423528 B968F94600              mov ecx, 0046F968
:0042352D E8EE410200              call 00447720
:00423532 50                      push eax
:00423533 33C0                    xor eax, eax
:00423535 8A45F4                  mov al, byte ptr [ebp-0C]
:00423538 50                      push eax
:00423539 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0042353F E83D410000              call 00427681
:00423544 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0042354A E8D15EFEFF              call 00409420
:0042354F 33C0                    xor eax, eax
:00423551 8A45F0                  mov al, byte ptr [ebp-10]
:00423554 8BC8                    mov ecx, eax
:00423556 8D0440                  lea eax, dword ptr [eax+2*eax]
:00423559 C1E003                  shl eax, 03
:0042355C 2BC1                    sub eax, ecx
:0042355E 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00423564 E807160000              call 00424B70
:00423569 33C9                    xor ecx, ecx
:0042356B 8AC8                    mov cl, al
:0042356D 83F901                  cmp ecx, 00000001
:00423570 0F8503010000            jne 00423679
:00423576 C785E8EEFFFF00000000    mov dword ptr [ebp+FFFFEEE8], 00000000
:00423580 E906000000              jmp 0042358B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423674(U)
|
:00423585 FF85E8EEFFFF            inc dword ptr [ebp+FFFFEEE8]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423580(U)
|
:0042358B 8B85DCEEFFFF            mov eax, dword ptr [ebp+FFFFEEDC]
:00423591 33C9                    xor ecx, ecx
:00423593 8A4818                  mov cl, byte ptr [eax+18]
:00423596 3B8DE8EEFFFF            cmp ecx, dword ptr [ebp+FFFFEEE8]
:0042359C 0F86D7000000            jbe 00423679
:004235A2 8B85DCEEFFFF            mov eax, dword ptr [ebp+FFFFEEDC]
:004235A8 33DB                    xor ebx, ebx
:004235AA 8A5818                  mov bl, byte ptr [eax+18]
:004235AD 039DE8EEFFFF            add ebx, dword ptr [ebp+FFFFEEE8]
:004235B3 C1E30C                  shl ebx, 0C
:004235B6 6A04                    push 00000004
:004235B8 6A00                    push 00000000
:004235BA 6A00                    push 00000000
:004235BC B968F94600              mov ecx, 0046F968
:004235C1 E85A410200              call 00447720
:004235C6 03D8                    add ebx, eax
:004235C8 895DF8                  mov dword ptr [ebp-08], ebx
:004235CB 8D852BEFFFFF            lea eax, dword ptr [ebp+FFFFEF2B]
:004235D1 8945FC                  mov dword ptr [ebp-04], eax
:004235D4 C785E4EEFFFF00000000    mov dword ptr [ebp+FFFFEEE4], 00000000
:004235DE E906000000              jmp 004235E9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423634(U)
|
:004235E3 FF85E4EEFFFF            inc dword ptr [ebp+FFFFEEE4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004235DE(U)
|
:004235E9 83BDE4EEFFFF40          cmp dword ptr [ebp+FFFFEEE4], 00000040
:004235F0 0F8343000000            jnb 00423639
:004235F6 C785E0EEFFFF00000000    mov dword ptr [ebp+FFFFEEE0], 00000000
:00423600 E906000000              jmp 0042360B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423628(U)
|
:00423605 FF85E0EEFFFF            inc dword ptr [ebp+FFFFEEE0]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423600(U)
|
:0042360B 83BDE0EEFFFF40          cmp dword ptr [ebp+FFFFEEE0], 00000040
:00423612 0F8315000000            jnb 0042362D
:00423618 8B45F8                  mov eax, dword ptr [ebp-08]
:0042361B 8A00                    mov al, byte ptr [eax]
:0042361D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00423620 8801                    mov byte ptr [ecx], al
:00423622 FF45F8                  inc [ebp-08]
:00423625 FF4DFC                  dec [ebp-04]
:00423628 E9D8FFFFFF              jmp 00423605

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423612(C)
|
:0042362D 8145FC80000000          add dword ptr [ebp-04], 00000080
:00423634 E9AAFFFFFF              jmp 004235E3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004235F0(C)
|
:00423639 6800100000              push 00001000
:0042363E 8B85DCEEFFFF            mov eax, dword ptr [ebp+FFFFEEDC]
:00423644 33DB                    xor ebx, ebx
:00423646 8A5818                  mov bl, byte ptr [eax+18]
:00423649 039DE8EEFFFF            add ebx, dword ptr [ebp+FFFFEEE8]
:0042364F C1E30C                  shl ebx, 0C
:00423652 6A04                    push 00000004
:00423654 6A00                    push 00000000
:00423656 6A00                    push 00000000
:00423658 B968F94600              mov ecx, 0046F968
:0042365D E8BE400200              call 00447720
:00423662 03D8                    add ebx, eax
:00423664 53                      push ebx
:00423665 8D85ECEEFFFF            lea eax, dword ptr [ebp+FFFFEEEC]
:0042366B 50                      push eax
:0042366C E8DC3D0200              call 0044744D
:00423671 83C40C                  add esp, 0000000C
:00423674 E90CFFFFFF              jmp 00423585

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00423570(C), :0042359C(C)
|
:00423679 E900000000              jmp 0042367E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423679(U)
|
:0042367E 5F                      pop edi
:0042367F 5E                      pop esi
:00423680 5B                      pop ebx
:00423681 C9                      leave
:00423682 C3                      ret



* Referenced by a CALL at Addresses:
|:004244F6   , :0043EB82   , :0043EBC2   
|
:00423683 55                      push ebp
:00423684 8BEC                    mov ebp, esp
:00423686 81EC0C010000            sub esp, 0000010C
:0042368C 53                      push ebx
:0042368D 56                      push esi
:0042368E 57                      push edi
:0042368F 898DF4FEFFFF            mov dword ptr [ebp+FFFFFEF4], ecx
:00423695 8D8DF8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF8]
:0042369B E8D05FFEFF              call 00409670
:004236A0 817D08FF000000          cmp dword ptr [ebp+08], 000000FF
:004236A7 0F851A000000            jne 004236C7
:004236AD 8B85F4FEFFFF            mov eax, dword ptr [ebp+FFFFFEF4]
:004236B3 33C9                    xor ecx, ecx
:004236B5 8A4811                  mov cl, byte ptr [eax+11]
:004236B8 8B85F4FEFFFF            mov eax, dword ptr [ebp+FFFFFEF4]
:004236BE 33D2                    xor edx, edx
:004236C0 8A540138                mov dl, byte ptr [ecx+eax+38]
:004236C4 895508                  mov dword ptr [ebp+08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004236A7(C)
|
:004236C7 8B4508                  mov eax, dword ptr [ebp+08]
:004236CA 50                      push eax
:004236CB E8515B0000              call 00429221
:004236D0 83C404                  add esp, 00000004
:004236D3 33C9                    xor ecx, ecx
:004236D5 8AC8                    mov cl, al
:004236D7 83C14F                  add ecx, 0000004F
:004236DA 884DFC                  mov byte ptr [ebp-04], cl

* Possible StringData Ref from Data Obj ->"B:CHR_ATT.E2"
                                  |
:004236DD 6868354500              push 00453568
:004236E2 8D8DF8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF8]
:004236E8 E8223E0000              call 0042750F
:004236ED 6A04                    push 00000004
:004236EF 6A00                    push 00000000
:004236F1 68A0860100              push 000186A0
:004236F6 B968F94600              mov ecx, 0046F968
:004236FB E820400200              call 00447720
:00423700 50                      push eax
:00423701 33C0                    xor eax, eax
:00423703 8A45FC                  mov al, byte ptr [ebp-04]
:00423706 50                      push eax
:00423707 8D8DF8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF8]
:0042370D E86F3F0000              call 00427681
:00423712 8D8DF8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF8]
:00423718 E8035DFEFF              call 00409420
:0042371D 6800090000              push 00000900
:00423722 6A04                    push 00000004
:00423724 6A00                    push 00000000
:00423726 6800900000              push 00009000
:0042372B B968F94600              mov ecx, 0046F968
:00423730 E8EB3F0200              call 00447720
:00423735 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00423738 8D0CC9                  lea ecx, dword ptr [ecx+8*ecx]
:0042373B C1E108                  shl ecx, 08
:0042373E 03C1                    add eax, ecx
:00423740 50                      push eax
:00423741 6A04                    push 00000004
:00423743 6A00                    push 00000000
:00423745 68A0860100              push 000186A0
:0042374A B968F94600              mov ecx, 0046F968
:0042374F E8CC3F0200              call 00447720
:00423754 50                      push eax
:00423755 E8F33C0200              call 0044744D
:0042375A 83C40C                  add esp, 0000000C
:0042375D E900000000              jmp 00423762

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042375D(U)
|
:00423762 5F                      pop edi
:00423763 5E                      pop esi
:00423764 5B                      pop ebx
:00423765 C9                      leave
:00423766 C20800                  ret 0008



* Referenced by a CALL at Address:
|:00423966   
|
:00423769 55                      push ebp
:0042376A 8BEC                    mov ebp, esp
:0042376C 83EC04                  sub esp, 00000004
:0042376F 53                      push ebx
:00423770 56                      push esi
:00423771 57                      push edi
:00423772 894DFC                  mov dword ptr [ebp-04], ecx
:00423775 8B45FC                  mov eax, dword ptr [ebp-04]
:00423778 33C9                    xor ecx, ecx
:0042377A 8A4813                  mov cl, byte ptr [eax+13]
:0042377D 83F901                  cmp ecx, 00000001
:00423780 0F8505000000            jne 0042378B
:00423786 E91F010000              jmp 004238AA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423780(C)
|
:0042378B 8B45FC                  mov eax, dword ptr [ebp-04]
:0042378E 33C9                    xor ecx, ecx
:00423790 8A4810                  mov cl, byte ptr [eax+10]
:00423793 8B45FC                  mov eax, dword ptr [ebp-04]
:00423796 837C882224              cmp dword ptr [eax+4*ecx+22], 00000024
:0042379B 0F8577000000            jne 00423818
:004237A1 6A10                    push 00000010
:004237A3 8B45FC                  mov eax, dword ptr [ebp-04]
:004237A6 33C9                    xor ecx, ecx
:004237A8 8A4811                  mov cl, byte ptr [eax+11]
:004237AB 8B45FC                  mov eax, dword ptr [ebp-04]
:004237AE 8B0C88                  mov ecx, dword ptr [eax+4*ecx]
:004237B1 E89A59FEFF              call 00409150
:004237B6 85C0                    test eax, eax
:004237B8 0F855A000000            jne 00423818
:004237BE 6A00                    push 00000000
:004237C0 6A02                    push 00000002
:004237C2 6A02                    push 00000002
:004237C4 8B45FC                  mov eax, dword ptr [ebp-04]
:004237C7 33C9                    xor ecx, ecx
:004237C9 8A4811                  mov cl, byte ptr [eax+11]
:004237CC 8B45FC                  mov eax, dword ptr [ebp-04]
:004237CF 8A440138                mov al, byte ptr [ecx+eax+38]
:004237D3 50                      push eax
:004237D4 8B45FC                  mov eax, dword ptr [ebp-04]
:004237D7 33C9                    xor ecx, ecx
:004237D9 8A4810                  mov cl, byte ptr [eax+10]
:004237DC 8B45FC                  mov eax, dword ptr [ebp-04]
:004237DF 8A440138                mov al, byte ptr [ecx+eax+38]
:004237E3 50                      push eax
:004237E4 E832EAFDFF              call 0040221B
:004237E9 83C414                  add esp, 00000014
:004237EC 85C0                    test eax, eax
:004237EE 0F8424000000            je 00423818
:004237F4 6A01                    push 00000001
:004237F6 6A10                    push 00000010
:004237F8 6A03                    push 00000003
:004237FA 8B45FC                  mov eax, dword ptr [ebp-04]
:004237FD 33C9                    xor ecx, ecx
:004237FF 8A4811                  mov cl, byte ptr [eax+11]
:00423802 8B45FC                  mov eax, dword ptr [ebp-04]
:00423805 8B0C88                  mov ecx, dword ptr [eax+4*ecx]
:00423808 E82359FEFF              call 00409130
:0042380D 50                      push eax
:0042380E B988C04600              mov ecx, 0046C088
:00423813 E8F3510000              call 00428A0B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042379B(C), :004237B8(C), :004237EE(C)
|
:00423818 8B45FC                  mov eax, dword ptr [ebp-04]
:0042381B 33C9                    xor ecx, ecx
:0042381D 8A4810                  mov cl, byte ptr [eax+10]
:00423820 8B45FC                  mov eax, dword ptr [ebp-04]
:00423823 837C882225              cmp dword ptr [eax+4*ecx+22], 00000025
:00423828 0F8577000000            jne 004238A5
:0042382E 6A20                    push 00000020
:00423830 8B45FC                  mov eax, dword ptr [ebp-04]
:00423833 33C9                    xor ecx, ecx
:00423835 8A4811                  mov cl, byte ptr [eax+11]
:00423838 8B45FC                  mov eax, dword ptr [ebp-04]
:0042383B 8B0C88                  mov ecx, dword ptr [eax+4*ecx]
:0042383E E80D59FEFF              call 00409150
:00423843 85C0                    test eax, eax
:00423845 0F855A000000            jne 004238A5
:0042384B 6A00                    push 00000000
:0042384D 6A02                    push 00000002
:0042384F 6A02                    push 00000002
:00423851 8B45FC                  mov eax, dword ptr [ebp-04]
:00423854 33C9                    xor ecx, ecx
:00423856 8A4811                  mov cl, byte ptr [eax+11]
:00423859 8B45FC                  mov eax, dword ptr [ebp-04]
:0042385C 8A440138                mov al, byte ptr [ecx+eax+38]
:00423860 50                      push eax
:00423861 8B45FC                  mov eax, dword ptr [ebp-04]
:00423864 33C9                    xor ecx, ecx
:00423866 8A4810                  mov cl, byte ptr [eax+10]
:00423869 8B45FC                  mov eax, dword ptr [ebp-04]
:0042386C 8A440138                mov al, byte ptr [ecx+eax+38]
:00423870 50                      push eax
:00423871 E8A5E9FDFF              call 0040221B
:00423876 83C414                  add esp, 00000014
:00423879 85C0                    test eax, eax
:0042387B 0F8424000000            je 004238A5
:00423881 6A01                    push 00000001
:00423883 6A20                    push 00000020
:00423885 6A03                    push 00000003
:00423887 8B45FC                  mov eax, dword ptr [ebp-04]
:0042388A 33C9                    xor ecx, ecx
:0042388C 8A4811                  mov cl, byte ptr [eax+11]
:0042388F 8B45FC                  mov eax, dword ptr [ebp-04]
:00423892 8B0C88                  mov ecx, dword ptr [eax+4*ecx]
:00423895 E89658FEFF              call 00409130
:0042389A 50                      push eax
:0042389B B988C04600              mov ecx, 0046C088
:004238A0 E866510000              call 00428A0B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00423828(C), :00423845(C), :0042387B(C)
|
:004238A5 E900000000              jmp 004238AA

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00423786(U), :004238A5(U)
|
:004238AA 5F                      pop edi
:004238AB 5E                      pop esi
:004238AC 5B                      pop ebx
:004238AD C9                      leave
:004238AE C3                      ret



* Referenced by a CALL at Addresses:
|:004246A8   , :00424754   
|
:004238AF 55                      push ebp
:004238B0 8BEC                    mov ebp, esp
:004238B2 83EC14                  sub esp, 00000014
:004238B5 53                      push ebx
:004238B6 56                      push esi
:004238B7 57                      push edi
:004238B8 894DEC                  mov dword ptr [ebp-14], ecx
:004238BB 8B45EC                  mov eax, dword ptr [ebp-14]
:004238BE 33C9                    xor ecx, ecx
:004238C0 8A4810                  mov cl, byte ptr [eax+10]
:004238C3 8B45EC                  mov eax, dword ptr [ebp-14]
:004238C6 8B0C88                  mov ecx, dword ptr [eax+4*ecx]
:004238C9 E86258FEFF              call 00409130
:004238CE 8D0440                  lea eax, dword ptr [eax+2*eax]
:004238D1 03C0                    add eax, eax
:004238D3 8D04C0                  lea eax, dword ptr [eax+8*eax]
:004238D6 05E8564500              add eax, 004556E8
:004238DB 8945F4                  mov dword ptr [ebp-0C], eax
:004238DE 8B45EC                  mov eax, dword ptr [ebp-14]
:004238E1 33C9                    xor ecx, ecx
:004238E3 8A4811                  mov cl, byte ptr [eax+11]
:004238E6 8B45EC                  mov eax, dword ptr [ebp-14]
:004238E9 8B0C88                  mov ecx, dword ptr [eax+4*ecx]
:004238EC E83F58FEFF              call 00409130
:004238F1 8D0440                  lea eax, dword ptr [eax+2*eax]
:004238F4 03C0                    add eax, eax
:004238F6 8D04C0                  lea eax, dword ptr [eax+8*eax]
:004238F9 05E8564500              add eax, 004556E8
:004238FE 8945F8                  mov dword ptr [ebp-08], eax
:00423901 C745FC00000000          mov [ebp-04], 00000000
:00423908 C745F000000000          mov [ebp-10], 00000000
:0042390F 8B45EC                  mov eax, dword ptr [ebp-14]
:00423912 33C9                    xor ecx, ecx
:00423914 8A4812                  mov cl, byte ptr [eax+12]
:00423917 83F901                  cmp ecx, 00000001
:0042391A 0F8599000000            jne 004239B9
:00423920 6A01                    push 00000001
:00423922 8B45F8                  mov eax, dword ptr [ebp-08]
:00423925 50                      push eax
:00423926 8B45EC                  mov eax, dword ptr [ebp-14]
:00423929 33C9                    xor ecx, ecx
:0042392B 8A4810                  mov cl, byte ptr [eax+10]
:0042392E 8B45EC                  mov eax, dword ptr [ebp-14]
:00423931 8B0C88                  mov ecx, dword ptr [eax+4*ecx]
:00423934 E8746B0000              call 0042A4AD
:00423939 8945FC                  mov dword ptr [ebp-04], eax
:0042393C 837D0801                cmp dword ptr [ebp+08], 00000001
:00423940 0F8311000000            jnb 00423957
:00423946 8B45EC                  mov eax, dword ptr [ebp-14]
:00423949 33C9                    xor ecx, ecx
:0042394B 8A4813                  mov cl, byte ptr [eax+13]
:0042394E 83F901                  cmp ecx, 00000001
:00423951 0F850C000000            jne 00423963

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423940(C)
|
:00423957 8B45FC                  mov eax, dword ptr [ebp-04]
:0042395A 99                      cdq
:0042395B 2BC2                    sub eax, edx
:0042395D C1F801                  sar eax, 01
:00423960 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423951(C)
|
:00423963 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00423966 E8FEFDFFFF              call 00423769
:0042396B 837DFC00                cmp dword ptr [ebp-04], 00000000
:0042396F 0F8E3F000000            jle 004239B4
:00423975 8B45EC                  mov eax, dword ptr [ebp-14]
:00423978 33C9                    xor ecx, ecx
:0042397A 8A4810                  mov cl, byte ptr [eax+10]
:0042397D 8B45EC                  mov eax, dword ptr [ebp-14]
:00423980 8B0C88                  mov ecx, dword ptr [eax+4*ecx]
:00423983 E80E6A0000              call 0042A396
:00423988 33DB                    xor ebx, ebx
:0042398A 8AD8                    mov bl, al
:0042398C 6A64                    push 00000064
:0042398E E895390200              call 00447328
:00423993 83C404                  add esp, 00000004
:00423996 3BD8                    cmp ebx, eax
:00423998 0F8616000000            jbe 004239B4
:0042399E 8B45FC                  mov eax, dword ptr [ebp-04]
:004239A1 8D0440                  lea eax, dword ptr [eax+2*eax]
:004239A4 99                      cdq
:004239A5 2BC2                    sub eax, edx
:004239A7 C1F801                  sar eax, 01
:004239AA 8945FC                  mov dword ptr [ebp-04], eax
:004239AD C745F001000000          mov [ebp-10], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042396F(C), :00423998(C)
|
:004239B4 E969000000              jmp 00423A22

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042391A(C)
|
:004239B9 8B45EC                  mov eax, dword ptr [ebp-14]
:004239BC 33C9                    xor ecx, ecx
:004239BE 8A4812                  mov cl, byte ptr [eax+12]
:004239C1 83F902                  cmp ecx, 00000002
:004239C4 0F8526000000            jne 004239F0
:004239CA 8B45EC                  mov eax, dword ptr [ebp-14]
:004239CD 8A4013                  mov al, byte ptr [eax+13]
:004239D0 50                      push eax
:004239D1 8B45F8                  mov eax, dword ptr [ebp-08]
:004239D4 50                      push eax
:004239D5 8B45EC                  mov eax, dword ptr [ebp-14]
:004239D8 33C9                    xor ecx, ecx
:004239DA 8A4810                  mov cl, byte ptr [eax+10]
:004239DD 8B45EC                  mov eax, dword ptr [ebp-14]
:004239E0 8B0C88                  mov ecx, dword ptr [eax+4*ecx]
:004239E3 E8F94DFEFF              call 004087E1
:004239E8 8945FC                  mov dword ptr [ebp-04], eax
:004239EB E932000000              jmp 00423A22

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004239C4(C)
|
:004239F0 8B45EC                  mov eax, dword ptr [ebp-14]
:004239F3 33C9                    xor ecx, ecx
:004239F5 8A4812                  mov cl, byte ptr [eax+12]
:004239F8 83F903                  cmp ecx, 00000003
:004239FB 0F8521000000            jne 00423A22
:00423A01 8B45EC                  mov eax, dword ptr [ebp-14]
:00423A04 8A4013                  mov al, byte ptr [eax+13]
:00423A07 50                      push eax
:00423A08 8B45F8                  mov eax, dword ptr [ebp-08]
:00423A0B 50                      push eax
:00423A0C 8B45EC                  mov eax, dword ptr [ebp-14]
:00423A0F 33C9                    xor ecx, ecx
:00423A11 8A4810                  mov cl, byte ptr [eax+10]
:00423A14 8B45EC                  mov eax, dword ptr [ebp-14]
:00423A17 8B0C88                  mov ecx, dword ptr [eax+4*ecx]
:00423A1A E8E84EFEFF              call 00408907
:00423A1F 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004239B4(U), :004239EB(U), :004239FB(C)
|
:00423A22 837DFC00                cmp dword ptr [ebp-04], 00000000
:00423A26 0F8E92000000            jle 00423ABE
:00423A2C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00423A2F E84C58FEFF              call 00409280
:00423A34 33C9                    xor ecx, ecx
:00423A36 8AC8                    mov cl, al
:00423A38 51                      push ecx
:00423A39 E8EA380200              call 00447328
:00423A3E 83C404                  add esp, 00000004
:00423A41 8BD8                    mov ebx, eax
:00423A43 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00423A46 E83558FEFF              call 00409280
:00423A4B 33C9                    xor ecx, ecx
:00423A4D 8AC8                    mov cl, al
:00423A4F 51                      push ecx
:00423A50 E8D3380200              call 00447328
:00423A55 83C404                  add esp, 00000004
:00423A58 3BD8                    cmp ebx, eax
:00423A5A 0F820A000000            jb 00423A6A
:00423A60 837DF001                cmp dword ptr [ebp-10], 00000001
:00423A64 0F8526000000            jne 00423A90

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423A5A(C)
|
:00423A6A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00423A6D E80E58FEFF              call 00409280
:00423A72 33C9                    xor ecx, ecx
:00423A74 8AC8                    mov cl, al
:00423A76 51                      push ecx
:00423A77 E8AC380200              call 00447328
:00423A7C 83C404                  add esp, 00000004
:00423A7F B906000000              mov ecx, 00000006
:00423A84 2BD2                    sub edx, edx
:00423A86 F7F1                    div ecx
:00423A88 0155FC                  add dword ptr [ebp-04], edx
:00423A8B E92E000000              jmp 00423ABE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423A64(C)
|
:00423A90 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00423A93 E8E857FEFF              call 00409280
:00423A98 33C9                    xor ecx, ecx
:00423A9A 8AC8                    mov cl, al
:00423A9C 51                      push ecx
:00423A9D E886380200              call 00447328
:00423AA2 83C404                  add esp, 00000004
:00423AA5 B906000000              mov ecx, 00000006
:00423AAA 2BD2                    sub edx, edx
:00423AAC F7F1                    div ecx
:00423AAE 52                      push edx
:00423AAF 8B45FC                  mov eax, dword ptr [ebp-04]
:00423AB2 50                      push eax
:00423AB3 E813380200              call 004472CB
:00423AB8 83C408                  add esp, 00000008
:00423ABB 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00423A26(C), :00423A8B(U)
|
:00423ABE 8B45EC                  mov eax, dword ptr [ebp-14]
:00423AC1 33C9                    xor ecx, ecx
:00423AC3 8A4811                  mov cl, byte ptr [eax+11]
:00423AC6 8B45EC                  mov eax, dword ptr [ebp-14]
:00423AC9 8B0C88                  mov ecx, dword ptr [eax+4*ecx]
:00423ACC E84F57FEFF              call 00409220
:00423AD1 83F801                  cmp eax, 00000001
:00423AD4 0F854A000000            jne 00423B24
:00423ADA B9D0A64600              mov ecx, 0046A6D0
:00423ADF E8CC7FFEFF              call 0040BAB0
:00423AE4 85C0                    test eax, eax
:00423AE6 0F8511000000            jne 00423AFD
:00423AEC 8B45FC                  mov eax, dword ptr [ebp-04]
:00423AEF C1E003                  shl eax, 03
:00423AF2 B90A000000              mov ecx, 0000000A
:00423AF7 99                      cdq
:00423AF8 F7F9                    idiv ecx
:00423AFA 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423AE6(C)
|
:00423AFD B9D0A64600              mov ecx, 0046A6D0
:00423B02 E8A97FFEFF              call 0040BAB0
:00423B07 83F802                  cmp eax, 00000002
:00423B0A 0F8514000000            jne 00423B24
:00423B10 8B45FC                  mov eax, dword ptr [ebp-04]
:00423B13 8D0440                  lea eax, dword ptr [eax+2*eax]
:00423B16 C1E002                  shl eax, 02
:00423B19 B90A000000              mov ecx, 0000000A
:00423B1E 99                      cdq
:00423B1F F7F9                    idiv ecx
:00423B21 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00423AD4(C), :00423B0A(C)
|
:00423B24 837DF001                cmp dword ptr [ebp-10], 00000001
:00423B28 0F852D000000            jne 00423B5B
:00423B2E 837DFC00                cmp dword ptr [ebp-04], 00000000
:00423B32 0F8E23000000            jle 00423B5B
:00423B38 8B45EC                  mov eax, dword ptr [ebp-14]
:00423B3B 33C9                    xor ecx, ecx
:00423B3D 8A4810                  mov cl, byte ptr [eax+10]
:00423B40 8B45EC                  mov eax, dword ptr [ebp-14]
:00423B43 8B0C88                  mov ecx, dword ptr [eax+4*ecx]
:00423B46 E8355AFEFF              call 00409580
:00423B4B 50                      push eax

* Possible StringData Ref from Data Obj ->"%sȫһ"
                                  |
:00423B4C 681C184500              push 0045181C
:00423B51 6A00                    push 00000000
:00423B53 E8DD530100              call 00438F35
:00423B58 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00423B28(C), :00423B32(C)
|
:00423B5B 8B45EC                  mov eax, dword ptr [ebp-14]
:00423B5E 33C9                    xor ecx, ecx
:00423B60 8A4811                  mov cl, byte ptr [eax+11]
:00423B63 8B45EC                  mov eax, dword ptr [ebp-14]
:00423B66 8B44881A                mov eax, dword ptr [eax+4*ecx+1A]
:00423B6A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00423B6D 3BC1                    cmp eax, ecx
:00423B6F 0F8C02000000            jl 00423B77
:00423B75 8BC1                    mov eax, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423B6F(C)
|
:00423B77 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00423B7A 89412A                  mov dword ptr [ecx+2A], eax
:00423B7D E900000000              jmp 00423B82

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423B7D(U)
|
:00423B82 5F                      pop edi
:00423B83 5E                      pop esi
:00423B84 5B                      pop ebx
:00423B85 C9                      leave
:00423B86 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:004246B0   , :0042475C   
|
:00423B89 55                      push ebp
:00423B8A 8BEC                    mov ebp, esp
:00423B8C 83EC10                  sub esp, 00000010
:00423B8F 53                      push ebx
:00423B90 56                      push esi
:00423B91 57                      push edi
:00423B92 894DF0                  mov dword ptr [ebp-10], ecx
:00423B95 8B45F0                  mov eax, dword ptr [ebp-10]
:00423B98 33C9                    xor ecx, ecx
:00423B9A 8A4810                  mov cl, byte ptr [eax+10]
:00423B9D 8B45F0                  mov eax, dword ptr [ebp-10]
:00423BA0 8B4C8808                mov ecx, dword ptr [eax+4*ecx+08]
:00423BA4 E8D756FEFF              call 00409280
:00423BA9 33C9                    xor ecx, ecx
:00423BAB 8AC8                    mov cl, al
:00423BAD 894DF4                  mov dword ptr [ebp-0C], ecx
:00423BB0 8B45F0                  mov eax, dword ptr [ebp-10]
:00423BB3 33C9                    xor ecx, ecx
:00423BB5 8A4811                  mov cl, byte ptr [eax+11]
:00423BB8 8B45F0                  mov eax, dword ptr [ebp-10]
:00423BBB 8B4C8808                mov ecx, dword ptr [eax+4*ecx+08]
:00423BBF E8BC56FEFF              call 00409280
:00423BC4 33C9                    xor ecx, ecx
:00423BC6 8AC8                    mov cl, al
:00423BC8 894DF8                  mov dword ptr [ebp-08], ecx
:00423BCB 8B45F0                  mov eax, dword ptr [ebp-10]
:00423BCE 33C9                    xor ecx, ecx
:00423BD0 8A4810                  mov cl, byte ptr [eax+10]
:00423BD3 8B45F0                  mov eax, dword ptr [ebp-10]
:00423BD6 8B0C88                  mov ecx, dword ptr [eax+4*ecx]
:00423BD9 E84256FEFF              call 00409220
:00423BDE 85C0                    test eax, eax
:00423BE0 0F8505000000            jne 00423BEB
:00423BE6 E9DD000000              jmp 00423CC8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423BE0(C)
|
:00423BEB 8B45F4                  mov eax, dword ptr [ebp-0C]
:00423BEE 3945F8                  cmp dword ptr [ebp-08], eax
:00423BF1 0F830C000000            jnb 00423C03
:00423BF7 C745FC04000000          mov [ebp-04], 00000004
:00423BFE E90E000000              jmp 00423C11

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423BF1(C)
|
:00423C03 8B45F8                  mov eax, dword ptr [ebp-08]
:00423C06 2B45F4                  sub eax, dword ptr [ebp-0C]
:00423C09 03C0                    add eax, eax
:00423C0B 83C006                  add eax, 00000006
:00423C0E 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423BFE(U)
|
:00423C11 837DFC10                cmp dword ptr [ebp-04], 00000010
:00423C15 0F8C07000000            jl 00423C22
:00423C1B C745FC10000000          mov [ebp-04], 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423C15(C)
|
:00423C22 8B45FC                  mov eax, dword ptr [ebp-04]
:00423C25 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00423C28 89412E                  mov dword ptr [ecx+2E], eax
:00423C2B C745FC00000000          mov [ebp-04], 00000000
:00423C32 8B45F0                  mov eax, dword ptr [ebp-10]
:00423C35 33C9                    xor ecx, ecx
:00423C37 8A4811                  mov cl, byte ptr [eax+11]
:00423C3A 8B45F0                  mov eax, dword ptr [ebp-10]
:00423C3D 8B44881A                mov eax, dword ptr [eax+4*ecx+1A]
:00423C41 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00423C44 2B412A                  sub eax, dword ptr [ecx+2A]
:00423C47 0F8559000000            jne 00423CA6
:00423C4D 8B45F0                  mov eax, dword ptr [ebp-10]
:00423C50 33C9                    xor ecx, ecx
:00423C52 8A4811                  mov cl, byte ptr [eax+11]
:00423C55 8B45F0                  mov eax, dword ptr [ebp-10]
:00423C58 8B0C88                  mov ecx, dword ptr [eax+4*ecx]
:00423C5B E870A6FFFF              call 0041E2D0
:00423C60 33C9                    xor ecx, ecx
:00423C62 8AC8                    mov cl, al
:00423C64 83F90F                  cmp ecx, 0000000F
:00423C67 0F850C000000            jne 00423C79
:00423C6D C745FC30000000          mov [ebp-04], 00000030
:00423C74 E92D000000              jmp 00423CA6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423C67(C)
|
:00423C79 8B45F4                  mov eax, dword ptr [ebp-0C]
:00423C7C 3945F8                  cmp dword ptr [ebp-08], eax
:00423C7F 0F860C000000            jbe 00423C91
:00423C85 C745FC20000000          mov [ebp-04], 00000020
:00423C8C E915000000              jmp 00423CA6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423C7F(C)
|
:00423C91 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00423C94 2B4DF8                  sub ecx, dword ptr [ebp-08]
:00423C97 83C102                  add ecx, 00000002
:00423C9A B840000000              mov eax, 00000040
:00423C9F 2BD2                    sub edx, edx
:00423CA1 F7F1                    div ecx
:00423CA3 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00423C47(C), :00423C74(U), :00423C8C(U)
|
:00423CA6 8B45FC                  mov eax, dword ptr [ebp-04]
:00423CA9 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00423CAC 894132                  mov dword ptr [ecx+32], eax
:00423CAF 8B45F0                  mov eax, dword ptr [ebp-10]
:00423CB2 83782A00                cmp dword ptr [eax+2A], 00000000
:00423CB6 0F8507000000            jne 00423CC3
:00423CBC 8B45F0                  mov eax, dword ptr [ebp-10]
:00423CBF C1682E02                shr dword ptr [eax+2E], 02

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423CB6(C)
|
:00423CC3 E900000000              jmp 00423CC8

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00423BE6(U), :00423CC3(U)
|
:00423CC8 5F                      pop edi
:00423CC9 5E                      pop esi
:00423CCA 5B                      pop ebx
:00423CCB C9                      leave
:00423CCC C3                      ret



* Referenced by a CALL at Address:
|:00424876   
|
:00423CCD 55                      push ebp
:00423CCE 8BEC                    mov ebp, esp
:00423CD0 83EC04                  sub esp, 00000004
:00423CD3 53                      push ebx
:00423CD4 56                      push esi
:00423CD5 57                      push edi
:00423CD6 894DFC                  mov dword ptr [ebp-04], ecx
:00423CD9 8B45FC                  mov eax, dword ptr [ebp-04]
:00423CDC 33C9                    xor ecx, ecx
:00423CDE 8A4813                  mov cl, byte ptr [eax+13]
:00423CE1 83F901                  cmp ecx, 00000001
:00423CE4 0F8516000000            jne 00423D00
:00423CEA 8B45FC                  mov eax, dword ptr [ebp-04]
:00423CED 33C9                    xor ecx, ecx
:00423CEF 8A4814                  mov cl, byte ptr [eax+14]
:00423CF2 80E1BF                  and cl, BF
:00423CF5 8B45FC                  mov eax, dword ptr [ebp-04]
:00423CF8 884814                  mov byte ptr [eax+14], cl
:00423CFB E922000000              jmp 00423D22

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423CE4(C)
|
:00423D00 8B45FC                  mov eax, dword ptr [ebp-04]
:00423D03 33C9                    xor ecx, ecx
:00423D05 8A4812                  mov cl, byte ptr [eax+12]
:00423D08 83F901                  cmp ecx, 00000001
:00423D0B 0F8511000000            jne 00423D22
:00423D11 8B45FC                  mov eax, dword ptr [ebp-04]
:00423D14 33C9                    xor ecx, ecx
:00423D16 8A4814                  mov cl, byte ptr [eax+14]
:00423D19 80C940                  or cl, 40
:00423D1C 8B45FC                  mov eax, dword ptr [ebp-04]
:00423D1F 884814                  mov byte ptr [eax+14], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00423CFB(U), :00423D0B(C)
|
:00423D22 8B45FC                  mov eax, dword ptr [ebp-04]
:00423D25 33C9                    xor ecx, ecx
:00423D27 8A4811                  mov cl, byte ptr [eax+11]
:00423D2A 8B45FC                  mov eax, dword ptr [ebp-04]
:00423D2D 8B44881A                mov eax, dword ptr [eax+4*ecx+1A]
:00423D31 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00423D34 2B412A                  sub eax, dword ptr [ecx+2A]
:00423D37 0F8511000000            jne 00423D4E
:00423D3D 8B45FC                  mov eax, dword ptr [ebp-04]
:00423D40 33C9                    xor ecx, ecx
:00423D42 8A4814                  mov cl, byte ptr [eax+14]
:00423D45 80E1BF                  and cl, BF
:00423D48 8B45FC                  mov eax, dword ptr [ebp-04]
:00423D4B 884814                  mov byte ptr [eax+14], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423D37(C)
|
:00423D4E 6A10                    push 00000010
:00423D50 8B45FC                  mov eax, dword ptr [ebp-04]
:00423D53 33C9                    xor ecx, ecx
:00423D55 8A4811                  mov cl, byte ptr [eax+11]
:00423D58 8B45FC                  mov eax, dword ptr [ebp-04]
:00423D5B 8B0C88                  mov ecx, dword ptr [eax+4*ecx]
:00423D5E E8ED53FEFF              call 00409150
:00423D63 85C0                    test eax, eax
:00423D65 0F8411000000            je 00423D7C
:00423D6B 8B45FC                  mov eax, dword ptr [ebp-04]
:00423D6E 33C9                    xor ecx, ecx
:00423D70 8A4814                  mov cl, byte ptr [eax+14]
:00423D73 80E1BF                  and cl, BF
:00423D76 8B45FC                  mov eax, dword ptr [ebp-04]
:00423D79 884814                  mov byte ptr [eax+14], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423D65(C)
|
:00423D7C E900000000              jmp 00423D81

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423D7C(U)
|
:00423D81 5F                      pop edi
:00423D82 5E                      pop esi
:00423D83 5B                      pop ebx
:00423D84 C9                      leave
:00423D85 C3                      ret



* Referenced by a CALL at Addresses:
|:004246B8   , :0042482D   
|
:00423D86 55                      push ebp
:00423D87 8BEC                    mov ebp, esp
:00423D89 83EC08                  sub esp, 00000008
:00423D8C 53                      push ebx
:00423D8D 56                      push esi
:00423D8E 57                      push edi
:00423D8F 894DF8                  mov dword ptr [ebp-08], ecx
:00423D92 6A04                    push 00000004
:00423D94 B910BC4600              mov ecx, 0046BC10
:00423D99 E8E3C0FFFF              call 0041FE81
:00423D9E 6A07                    push 00000007
:00423DA0 B910BC4600              mov ecx, 0046BC10
:00423DA5 E829BFFFFF              call 0041FCD3
:00423DAA 6A00                    push 00000000
:00423DAC B910BC4600              mov ecx, 0046BC10
:00423DB1 E81AC0FFFF              call 0041FDD0
:00423DB6 8B45F8                  mov eax, dword ptr [ebp-08]
:00423DB9 83782A00                cmp dword ptr [eax+2A], 00000000
:00423DBD 0F8528000000            jne 00423DEB
:00423DC3 8B45F8                  mov eax, dword ptr [ebp-08]
:00423DC6 33C9                    xor ecx, ecx
:00423DC8 8A4811                  mov cl, byte ptr [eax+11]
:00423DCB 8B45F8                  mov eax, dword ptr [ebp-08]
:00423DCE 8B0C88                  mov ecx, dword ptr [eax+4*ecx]
:00423DD1 E8AA57FEFF              call 00409580
:00423DD6 50                      push eax

* Possible StringData Ref from Data Obj ->"%sû˺"
                                  |
:00423DD7 682C184500              push 0045182C
:00423DDC 6A00                    push 00000000
:00423DDE E852510100              call 00438F35
:00423DE3 83C40C                  add esp, 0000000C
:00423DE6 E923010000              jmp 00423F0E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423DBD(C)
|
:00423DEB B9D0A64600              mov ecx, 0046A6D0
:00423DF0 E88B53FEFF              call 00409180
:00423DF5 F6C401                  test ah, 01
:00423DF8 0F8548000000            jne 00423E46
:00423DFE C745FC00000000          mov [ebp-04], 00000000
:00423E05 E903000000              jmp 00423E0D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423E3C(U)
|
:00423E0A FF45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423E05(U)
|
:00423E0D 837DFC03                cmp dword ptr [ebp-04], 00000003
:00423E11 0F832A000000            jnb 00423E41
:00423E17 6A07                    push 00000007
:00423E19 8B45F8                  mov eax, dword ptr [ebp-08]
:00423E1C 8B402A                  mov eax, dword ptr [eax+2A]
:00423E1F 50                      push eax
:00423E20 8B45F8                  mov eax, dword ptr [ebp-08]
:00423E23 33C9                    xor ecx, ecx
:00423E25 8A4811                  mov cl, byte ptr [eax+11]
:00423E28 8B45F8                  mov eax, dword ptr [ebp-08]
:00423E2B 8B0C88                  mov ecx, dword ptr [eax+4*ecx]
:00423E2E E89DA4FFFF              call 0041E2D0
:00423E33 50                      push eax
:00423E34 E82A5D0100              call 00439B63
:00423E39 83C40C                  add esp, 0000000C
:00423E3C E9C9FFFFFF              jmp 00423E0A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423E11(C)
|
:00423E41 E9C8000000              jmp 00423F0E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423DF8(C)
|
:00423E46 33C0                    xor eax, eax
:00423E48 A0BDFC4600              mov al, byte ptr [0046FCBD]
:00423E4D 03C0                    add eax, eax
:00423E4F 83C006                  add eax, 00000006
:00423E52 50                      push eax
:00423E53 B9B0FA4600              mov ecx, 0046FAB0
:00423E58 E85353FEFF              call 004091B0
:00423E5D 8B45F8                  mov eax, dword ptr [ebp-08]
:00423E60 33C9                    xor ecx, ecx
:00423E62 8A4810                  mov cl, byte ptr [eax+10]
:00423E65 8B45F8                  mov eax, dword ptr [ebp-08]
:00423E68 8A440138                mov al, byte ptr [ecx+eax+38]
:00423E6C 50                      push eax
:00423E6D 66A120BD4600            mov ax, word ptr [0046BD20]
:00423E73 50                      push eax
:00423E74 E8AD5F0100              call 00439E26
:00423E79 83C408                  add esp, 00000008
:00423E7C 8B45F8                  mov eax, dword ptr [ebp-08]
:00423E7F 33C9                    xor ecx, ecx
:00423E81 8A4811                  mov cl, byte ptr [eax+11]
:00423E84 8B45F8                  mov eax, dword ptr [ebp-08]
:00423E87 8A440138                mov al, byte ptr [ecx+eax+38]
:00423E8B 50                      push eax
:00423E8C 66A11CBD4600            mov ax, word ptr [0046BD1C]
:00423E92 50                      push eax
:00423E93 E88E5F0100              call 00439E26
:00423E98 83C408                  add esp, 00000008
:00423E9B E828350100              call 004373C8
:00423EA0 6A01                    push 00000001
:00423EA2 E814370100              call 004375BB
:00423EA7 83C404                  add esp, 00000004
:00423EAA 33C0                    xor eax, eax
:00423EAC A0BDFC4600              mov al, byte ptr [0046FCBD]
:00423EB1 03C0                    add eax, eax
:00423EB3 83C006                  add eax, 00000006
:00423EB6 50                      push eax
:00423EB7 B9B0FA4600              mov ecx, 0046FAB0
:00423EBC E8EF52FEFF              call 004091B0
:00423EC1 6A00                    push 00000000
:00423EC3 8B45F8                  mov eax, dword ptr [ebp-08]
:00423EC6 8B402A                  mov eax, dword ptr [eax+2A]
:00423EC9 50                      push eax
:00423ECA 8B45F8                  mov eax, dword ptr [ebp-08]
:00423ECD 33C9                    xor ecx, ecx
:00423ECF 8A4811                  mov cl, byte ptr [eax+11]
:00423ED2 8B45F8                  mov eax, dword ptr [ebp-08]
:00423ED5 8A440138                mov al, byte ptr [ecx+eax+38]
:00423ED9 50                      push eax
:00423EDA 66A11CBD4600            mov ax, word ptr [0046BD1C]
:00423EE0 50                      push eax
:00423EE1 E888620100              call 0043A16E
:00423EE6 83C410                  add esp, 00000010
:00423EE9 E8DA340100              call 004373C8
:00423EEE 6A01                    push 00000001
:00423EF0 E8C6360100              call 004375BB
:00423EF5 83C404                  add esp, 00000004
:00423EF8 6A09                    push 00000009
:00423EFA 6A21                    push 00000021
:00423EFC A01DBD4600              mov al, byte ptr [0046BD1D]
:00423F01 50                      push eax
:00423F02 6A06                    push 00000006
:00423F04 B900FB4600              mov ecx, 0046FB00
:00423F09 E81F6C0100              call 0043AB2D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00423DE6(U), :00423E41(U)
|
:00423F0E B994A64600              mov ecx, 0046A694
:00423F13 E88051FFFF              call 00419098
:00423F18 8B45F8                  mov eax, dword ptr [ebp-08]
:00423F1B 33C9                    xor ecx, ecx
:00423F1D 8A4812                  mov cl, byte ptr [eax+12]
:00423F20 83F902                  cmp ecx, 00000002
:00423F23 0F8531000000            jne 00423F5A
:00423F29 8B45F8                  mov eax, dword ptr [ebp-08]
:00423F2C 83782A00                cmp dword ptr [eax+2A], 00000000
:00423F30 0F8524000000            jne 00423F5A
:00423F36 8B45F8                  mov eax, dword ptr [ebp-08]
:00423F39 33C9                    xor ecx, ecx
:00423F3B 8A4810                  mov cl, byte ptr [eax+10]
:00423F3E 8B45F8                  mov eax, dword ptr [ebp-08]
:00423F41 8B4C8808                mov ecx, dword ptr [eax+4*ecx+08]
:00423F45 E89655FEFF              call 004094E0
:00423F4A 50                      push eax

* Possible StringData Ref from Data Obj ->"%sĲʧˣ"
                                  |
:00423F4B 6840184500              push 00451840
:00423F50 6A00                    push 00000000
:00423F52 E8DE4F0100              call 00438F35
:00423F57 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00423F23(C), :00423F30(C)
|
:00423F5A E900000000              jmp 00423F5F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423F5A(U)
|
:00423F5F 5F                      pop edi
:00423F60 5E                      pop esi
:00423F61 5B                      pop ebx
:00423F62 C9                      leave
:00423F63 C3                      ret



* Referenced by a CALL at Addresses:
|:004246C0   , :00424835   
|
:00423F64 55                      push ebp
:00423F65 8BEC                    mov ebp, esp
:00423F67 83EC04                  sub esp, 00000004
:00423F6A 53                      push ebx
:00423F6B 56                      push esi
:00423F6C 57                      push edi
:00423F6D 894DFC                  mov dword ptr [ebp-04], ecx
:00423F70 8B45FC                  mov eax, dword ptr [ebp-04]
:00423F73 33C9                    xor ecx, ecx
:00423F75 8A4811                  mov cl, byte ptr [eax+11]
:00423F78 8B45FC                  mov eax, dword ptr [ebp-04]
:00423F7B 8B44881A                mov eax, dword ptr [eax+4*ecx+1A]
:00423F7F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00423F82 2B412A                  sub eax, dword ptr [ecx+2A]
:00423F85 50                      push eax
:00423F86 8B45FC                  mov eax, dword ptr [ebp-04]
:00423F89 33C9                    xor ecx, ecx
:00423F8B 8A4811                  mov cl, byte ptr [eax+11]
:00423F8E 8B45FC                  mov eax, dword ptr [ebp-04]
:00423F91 8B0C88                  mov ecx, dword ptr [eax+4*ecx]
:00423F94 E848640000              call 0042A3E1
:00423F99 6A01                    push 00000001
:00423F9B 8B45FC                  mov eax, dword ptr [ebp-04]
:00423F9E 33C9                    xor ecx, ecx
:00423FA0 8A4810                  mov cl, byte ptr [eax+10]
:00423FA3 8B45FC                  mov eax, dword ptr [ebp-04]
:00423FA6 8B4C8808                mov ecx, dword ptr [eax+4*ecx+08]
:00423FAA E83156FEFF              call 004095E0
:00423FAF 33C9                    xor ecx, ecx
:00423FB1 8AC8                    mov cl, al
:00423FB3 8B45FC                  mov eax, dword ptr [ebp-04]
:00423FB6 03482E                  add ecx, dword ptr [eax+2E]
:00423FB9 8B45FC                  mov eax, dword ptr [ebp-04]
:00423FBC 034832                  add ecx, dword ptr [eax+32]
:00423FBF 51                      push ecx
:00423FC0 8B45FC                  mov eax, dword ptr [ebp-04]
:00423FC3 33C9                    xor ecx, ecx
:00423FC5 8A4810                  mov cl, byte ptr [eax+10]
:00423FC8 8B45FC                  mov eax, dword ptr [ebp-04]
:00423FCB 8B4C8808                mov ecx, dword ptr [eax+4*ecx+08]
:00423FCF E8F891FEFF              call 0040D1CC
:00423FD4 8B45FC                  mov eax, dword ptr [ebp-04]
:00423FD7 33C9                    xor ecx, ecx
:00423FD9 8A4811                  mov cl, byte ptr [eax+11]
:00423FDC 8B45FC                  mov eax, dword ptr [ebp-04]
:00423FDF 8B0C88                  mov ecx, dword ptr [eax+4*ecx]
:00423FE2 E8DB9E0000              call 0042DEC2
:00423FE7 85C0                    test eax, eax
:00423FE9 0F8413000000            je 00424002
:00423FEF 8B45FC                  mov eax, dword ptr [ebp-04]
:00423FF2 33C9                    xor ecx, ecx
:00423FF4 8A4811                  mov cl, byte ptr [eax+11]
:00423FF7 8B45FC                  mov eax, dword ptr [ebp-04]
:00423FFA 8B0C88                  mov ecx, dword ptr [eax+4*ecx]
:00423FFD E85B7A0000              call 0042BA5D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423FE9(C)
|
:00424002 E900000000              jmp 00424007

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424002(U)
|
:00424007 5F                      pop edi
:00424008 5E                      pop esi
:00424009 5B                      pop ebx
:0042400A C9                      leave
:0042400B C3                      ret



* Referenced by a CALL at Addresses:
|:00424430   , :00424748   , :0042486E   
|
:0042400C 55                      push ebp
:0042400D 8BEC                    mov ebp, esp
:0042400F 83EC08                  sub esp, 00000008
:00424012 53                      push ebx
:00424013 56                      push esi
:00424014 57                      push edi
:00424015 894DF8                  mov dword ptr [ebp-08], ecx
:00424018 8A4510                  mov al, byte ptr [ebp+10]
:0042401B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042401E 884112                  mov byte ptr [ecx+12], al
:00424021 8A4514                  mov al, byte ptr [ebp+14]
:00424024 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00424027 884113                  mov byte ptr [ecx+13], al
:0042402A 8B45F8                  mov eax, dword ptr [ebp-08]
:0042402D C6401401                mov [eax+14], 01
:00424031 33C0                    xor eax, eax
:00424033 8A4508                  mov al, byte ptr [ebp+08]
:00424036 8BC8                    mov ecx, eax
:00424038 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042403B C1E003                  shl eax, 03
:0042403E 2BC1                    sub eax, ecx
:00424040 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00424046 E8D551FEFF              call 00409220
:0042404B 85C0                    test eax, eax
:0042404D 0F8446000000            je 00424099
:00424053 33C0                    xor eax, eax
:00424055 8A4508                  mov al, byte ptr [ebp+08]
:00424058 8BC8                    mov ecx, eax
:0042405A 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042405D C1E003                  shl eax, 03
:00424060 2BC1                    sub eax, ecx
:00424062 0598C04600              add eax, 0046C098
:00424067 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042406A 8901                    mov dword ptr [ecx], eax
:0042406C 8B45F8                  mov eax, dword ptr [ebp-08]
:0042406F C6401000                mov [eax+10], 00
:00424073 33C0                    xor eax, eax
:00424075 8A450C                  mov al, byte ptr [ebp+0C]
:00424078 8BC8                    mov ecx, eax
:0042407A 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042407D C1E003                  shl eax, 03
:00424080 2BC1                    sub eax, ecx
:00424082 0598C04600              add eax, 0046C098
:00424087 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042408A 894104                  mov dword ptr [ecx+04], eax
:0042408D 8B45F8                  mov eax, dword ptr [ebp-08]
:00424090 C6401101                mov [eax+11], 01
:00424094 E941000000              jmp 004240DA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042404D(C)
|
:00424099 33C0                    xor eax, eax
:0042409B 8A4508                  mov al, byte ptr [ebp+08]
:0042409E 8BC8                    mov ecx, eax
:004240A0 8D0440                  lea eax, dword ptr [eax+2*eax]
:004240A3 C1E003                  shl eax, 03
:004240A6 2BC1                    sub eax, ecx
:004240A8 0598C04600              add eax, 0046C098
:004240AD 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004240B0 894104                  mov dword ptr [ecx+04], eax
:004240B3 8B45F8                  mov eax, dword ptr [ebp-08]
:004240B6 C6401001                mov [eax+10], 01
:004240BA 33C0                    xor eax, eax
:004240BC 8A450C                  mov al, byte ptr [ebp+0C]
:004240BF 8BC8                    mov ecx, eax
:004240C1 8D0440                  lea eax, dword ptr [eax+2*eax]
:004240C4 C1E003                  shl eax, 03
:004240C7 2BC1                    sub eax, ecx
:004240C9 0598C04600              add eax, 0046C098
:004240CE 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004240D1 8901                    mov dword ptr [ecx], eax
:004240D3 8B45F8                  mov eax, dword ptr [ebp-08]
:004240D6 C6401100                mov [eax+11], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424094(U)
|
:004240DA C745FC00000000          mov [ebp-04], 00000000
:004240E1 E903000000              jmp 004240E9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042414D(U)
|
:004240E6 FF45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004240E1(U)
|
:004240E9 837DFC02                cmp dword ptr [ebp-04], 00000002
:004240ED 0F835F000000            jnb 00424152
:004240F3 8B45FC                  mov eax, dword ptr [ebp-04]
:004240F6 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004240F9 8B0C81                  mov ecx, dword ptr [ecx+4*eax]
:004240FC E82F50FEFF              call 00409130
:00424101 8D0440                  lea eax, dword ptr [eax+2*eax]
:00424104 03C0                    add eax, eax
:00424106 8D04C0                  lea eax, dword ptr [eax+8*eax]
:00424109 05E8564500              add eax, 004556E8
:0042410E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00424111 8B55F8                  mov edx, dword ptr [ebp-08]
:00424114 89448A08                mov dword ptr [edx+4*ecx+08], eax
:00424118 8B45FC                  mov eax, dword ptr [ebp-04]
:0042411B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042411E 8B0C81                  mov ecx, dword ptr [ecx+4*eax]
:00424121 E88A56FEFF              call 004097B0
:00424126 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00424129 8B55F8                  mov edx, dword ptr [ebp-08]
:0042412C 89448A1A                mov dword ptr [edx+4*ecx+1A], eax
:00424130 8B45FC                  mov eax, dword ptr [ebp-04]
:00424133 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00424136 8B4C8108                mov ecx, dword ptr [ecx+4*eax+08]
:0042413A E89151FEFF              call 004092D0
:0042413F 33C9                    xor ecx, ecx
:00424141 8AC8                    mov cl, al
:00424143 8B45FC                  mov eax, dword ptr [ebp-04]
:00424146 8B55F8                  mov edx, dword ptr [ebp-08]
:00424149 894C8222                mov dword ptr [edx+4*eax+22], ecx
:0042414D E994FFFFFF              jmp 004240E6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004240ED(C)
|
:00424152 8B45F8                  mov eax, dword ptr [ebp-08]
:00424155 33C9                    xor ecx, ecx
:00424157 8A4810                  mov cl, byte ptr [eax+10]
:0042415A 8B45F8                  mov eax, dword ptr [ebp-08]
:0042415D 8B0C88                  mov ecx, dword ptr [eax+4*ecx]
:00424160 E831620000              call 0042A396
:00424165 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00424168 33D2                    xor edx, edx
:0042416A 8A5110                  mov dl, byte ptr [ecx+10]
:0042416D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00424170 88440A36                mov byte ptr [edx+ecx+36], al
:00424174 8B45F8                  mov eax, dword ptr [ebp-08]
:00424177 33C9                    xor ecx, ecx
:00424179 8A4811                  mov cl, byte ptr [eax+11]
:0042417C 8B45F8                  mov eax, dword ptr [ebp-08]
:0042417F 8B0C88                  mov ecx, dword ptr [eax+4*ecx]
:00424182 E80F620000              call 0042A396
:00424187 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042418A 33D2                    xor edx, edx
:0042418C 8A5111                  mov dl, byte ptr [ecx+11]
:0042418F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00424192 88440A36                mov byte ptr [edx+ecx+36], al
:00424196 8A4508                  mov al, byte ptr [ebp+08]
:00424199 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042419C 33D2                    xor edx, edx
:0042419E 8A5110                  mov dl, byte ptr [ecx+10]
:004241A1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004241A4 88440A38                mov byte ptr [edx+ecx+38], al
:004241A8 8A450C                  mov al, byte ptr [ebp+0C]
:004241AB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004241AE 33D2                    xor edx, edx
:004241B0 8A5111                  mov dl, byte ptr [ecx+11]
:004241B3 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004241B6 88440A38                mov byte ptr [edx+ecx+38], al
:004241BA 8B45F8                  mov eax, dword ptr [ebp-08]
:004241BD 33C9                    xor ecx, ecx
:004241BF 8A4810                  mov cl, byte ptr [eax+10]
:004241C2 8B45F8                  mov eax, dword ptr [ebp-08]
:004241C5 8A440138                mov al, byte ptr [ecx+eax+38]
:004241C9 50                      push eax
:004241CA E864010000              call 00424333
:004241CF 83C404                  add esp, 00000004
:004241D2 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004241D5 884117                  mov byte ptr [ecx+17], al
:004241D8 8B45F8                  mov eax, dword ptr [ebp-08]
:004241DB 33C9                    xor ecx, ecx
:004241DD 8A4810                  mov cl, byte ptr [eax+10]
:004241E0 8B45F8                  mov eax, dword ptr [ebp-08]
:004241E3 8B0488                  mov eax, dword ptr [eax+4*ecx]
:004241E6 50                      push eax
:004241E7 E8F5500000              call 004292E1
:004241EC 83C404                  add esp, 00000004
:004241EF 33C9                    xor ecx, ecx
:004241F1 8AC8                    mov cl, al
:004241F3 8A81B8174500            mov al, byte ptr [ecx+004517B8]
:004241F9 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004241FC 884118                  mov byte ptr [ecx+18], al
:004241FF 8B45F8                  mov eax, dword ptr [ebp-08]
:00424202 33C9                    xor ecx, ecx
:00424204 8A4810                  mov cl, byte ptr [eax+10]
:00424207 8B45F8                  mov eax, dword ptr [ebp-08]
:0042420A 8B0488                  mov eax, dword ptr [eax+4*ecx]
:0042420D 50                      push eax
:0042420E E8CE500000              call 004292E1
:00424213 83C404                  add esp, 00000004
:00424216 33C9                    xor ecx, ecx
:00424218 8AC8                    mov cl, al
:0042421A 8A81E8174500            mov al, byte ptr [ecx+004517E8]
:00424220 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00424223 884119                  mov byte ptr [ecx+19], al
:00424226 8B45F8                  mov eax, dword ptr [ebp-08]
:00424229 33C9                    xor ecx, ecx
:0042422B 8A4810                  mov cl, byte ptr [eax+10]
:0042422E 8B45F8                  mov eax, dword ptr [ebp-08]
:00424231 8B448822                mov eax, dword ptr [eax+4*ecx+22]
:00424235 50                      push eax
:00424236 E815DFFFFF              call 00422150
:0042423B 83C404                  add esp, 00000004
:0042423E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00424241 884115                  mov byte ptr [ecx+15], al
:00424244 B9D0A64600              mov ecx, 0046A6D0
:00424249 E8324FFEFF              call 00409180
:0042424E F6C401                  test ah, 01
:00424251 0F8410000000            je 00424267
:00424257 8B450C                  mov eax, dword ptr [ebp+0C]
:0042425A 50                      push eax
:0042425B 8B4508                  mov eax, dword ptr [ebp+08]
:0042425E 50                      push eax
:0042425F E82D000000              call 00424291
:00424264 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424251(C)
|
:00424267 8B45F8                  mov eax, dword ptr [ebp-08]
:0042426A C7402A00000000          mov [eax+2A], 00000000
:00424271 8B45F8                  mov eax, dword ptr [ebp-08]
:00424274 C7402E00000000          mov [eax+2E], 00000000
:0042427B 8B45F8                  mov eax, dword ptr [ebp-08]
:0042427E C7403200000000          mov [eax+32], 00000000
:00424285 E900000000              jmp 0042428A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424285(U)
|
:0042428A 5F                      pop edi
:0042428B 5E                      pop esi
:0042428C 5B                      pop ebx
:0042428D C9                      leave
:0042428E C21000                  ret 0010



* Referenced by a CALL at Address:
|:0042425F   
|
:00424291 55                      push ebp
:00424292 8BEC                    mov ebp, esp
:00424294 83EC04                  sub esp, 00000004
:00424297 53                      push ebx
:00424298 56                      push esi
:00424299 57                      push edi
:0042429A 8B450C                  mov eax, dword ptr [ebp+0C]
:0042429D 50                      push eax
:0042429E 8D45FC                  lea eax, dword ptr [ebp-04]
:004242A1 50                      push eax
:004242A2 E81A5B0100              call 00439DC1
:004242A7 83C408                  add esp, 00000008
:004242AA 50                      push eax
:004242AB B91CBD4600              mov ecx, 0046BD1C
:004242B0 E8DBD5FDFF              call 00401890
:004242B5 33C0                    xor eax, eax
:004242B7 8A450C                  mov al, byte ptr [ebp+0C]
:004242BA 8BC8                    mov ecx, eax
:004242BC 8D0440                  lea eax, dword ptr [eax+2*eax]
:004242BF C1E003                  shl eax, 03
:004242C2 2BC1                    sub eax, ecx
:004242C4 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004242CA E8514FFEFF              call 00409220
:004242CF 85C0                    test eax, eax
:004242D1 0F840C000000            je 004242E3
:004242D7 C6051CBD46000E          mov byte ptr [0046BD1C], 0E
:004242DE E907000000              jmp 004242EA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004242D1(C)
|
:004242E3 C6051CBD46002A          mov byte ptr [0046BD1C], 2A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004242DE(U)
|
:004242EA 33C0                    xor eax, eax
:004242EC 8A4508                  mov al, byte ptr [ebp+08]
:004242EF 8BC8                    mov ecx, eax
:004242F1 8D0440                  lea eax, dword ptr [eax+2*eax]
:004242F4 C1E003                  shl eax, 03
:004242F7 2BC1                    sub eax, ecx
:004242F9 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004242FF E81C4FFEFF              call 00409220
:00424304 85C0                    test eax, eax
:00424306 0F840C000000            je 00424318
:0042430C C60520BD46000E          mov byte ptr [0046BD20], 0E
:00424313 E907000000              jmp 0042431F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424306(C)
|
:00424318 C60520BD46002A          mov byte ptr [0046BD20], 2A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424313(U)
|
:0042431F A01DBD4600              mov al, byte ptr [0046BD1D]
:00424324 A221BD4600              mov byte ptr [0046BD21], al
:00424329 E900000000              jmp 0042432E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424329(U)
|
:0042432E 5F                      pop edi
:0042432F 5E                      pop esi
:00424330 5B                      pop ebx
:00424331 C9                      leave
:00424332 C3                      ret



* Referenced by a CALL at Address:
|:004241CA   
|
:00424333 55                      push ebp
:00424334 8BEC                    mov ebp, esp
:00424336 83EC08                  sub esp, 00000008
:00424339 53                      push ebx
:0042433A 56                      push esi
:0042433B 57                      push edi
:0042433C 33C0                    xor eax, eax
:0042433E 8A4508                  mov al, byte ptr [ebp+08]
:00424341 8BC8                    mov ecx, eax
:00424343 8D0440                  lea eax, dword ptr [eax+2*eax]
:00424346 C1E003                  shl eax, 03
:00424349 2BC1                    sub eax, ecx
:0042434B 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00424351 E84A4FFEFF              call 004092A0
:00424356 33C9                    xor ecx, ecx
:00424358 8AC8                    mov cl, al
:0042435A 894DF8                  mov dword ptr [ebp-08], ecx
:0042435D E944000000              jmp 004243A6
:00424362 C645FC00                mov [ebp-04], 00
:00424366 E990000000              jmp 004243FB
:0042436B C645FC01                mov [ebp-04], 01
:0042436F E987000000              jmp 004243FB
:00424374 C645FC02                mov [ebp-04], 02
:00424378 E97E000000              jmp 004243FB
:0042437D C645FC03                mov [ebp-04], 03
:00424381 E975000000              jmp 004243FB
:00424386 C645FC04                mov [ebp-04], 04
:0042438A E96C000000              jmp 004243FB
:0042438F C645FC05                mov [ebp-04], 05
:00424393 E963000000              jmp 004243FB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004243AE(C)
|
:00424398 C645FCFF                mov [ebp-04], FF
:0042439C E95A000000              jmp 004243FB
:004243A1 E955000000              jmp 004243FB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042435D(U)
|
:004243A6 836DF80D                sub dword ptr [ebp-08], 0000000D
:004243AA 837DF818                cmp dword ptr [ebp-08], 00000018
:004243AE 0F87E4FFFFFF            ja 00424398
:004243B4 8B45F8                  mov eax, dword ptr [ebp-08]
:004243B7 33C9                    xor ecx, ecx
:004243B9 8A88E2434200            mov cl, byte ptr [eax+004243E2]
:004243BF FF248DC6434200          jmp dword ptr [4*ecx+004243C6]

:004243C6 86434200                DWORD 00424386
:004243CA 8F434200                DWORD 0042438F
:004243CE 62434200                DWORD 00424362
:004243D2 6B434200                DWORD 0042436B
:004243D6 7D434200                DWORD 0042437D
:004243DA 74434200                DWORD 00424374
:004243DE 98434200                DWORD 00424398


:004243E2 0001                    add byte ptr [ecx], al
:004243E4 06                      push es
:004243E5 06                      push es
:004243E6 06                      push es
:004243E7 06                      push es
:004243E8 06                      push es
:004243E9 06                      push es
:004243EA 06                      push es
:004243EB 06                      push es
:004243EC 06                      push es
:004243ED 06                      push es
:004243EE 0203                    add al, byte ptr [ebx]
:004243F0 06                      push es
:004243F1 06                      push es
:004243F2 06                      push es
:004243F3 06                      push es
:004243F4 06                      push es
:004243F5 06                      push es
:004243F6 06                      push es
:004243F7 06                      push es
:004243F8 06                      push es
:004243F9 0405                    add al, 05

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00424366(U), :0042436F(U), :00424378(U), :00424381(U), :0042438A(U)
|:00424393(U), :0042439C(U), :004243A1(U)
|
:004243FB 8A45FC                  mov al, byte ptr [ebp-04]
:004243FE E900000000              jmp 00424403

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004243FE(U)
|
:00424403 5F                      pop edi
:00424404 5E                      pop esi
:00424405 5B                      pop ebx
:00424406 C9                      leave
:00424407 C3                      ret



* Referenced by a CALL at Addresses:
|:0040461A   , :0040472D   , :0041B6C7   , :0041DA6D   , :00424A28   
|:00424A92   
|
:00424408 55                      push ebp
:00424409 8BEC                    mov ebp, esp
:0042440B 83EC28                  sub esp, 00000028
:0042440E 53                      push ebx
:0042440F 56                      push esi
:00424410 57                      push edi
:00424411 894DD8                  mov dword ptr [ebp-28], ecx
:00424414 8B45D8                  mov eax, dword ptr [ebp-28]
:00424417 83C03A                  add eax, 0000003A
:0042441A 8945F8                  mov dword ptr [ebp-08], eax
:0042441D 8B4514                  mov eax, dword ptr [ebp+14]
:00424420 50                      push eax
:00424421 8B4510                  mov eax, dword ptr [ebp+10]
:00424424 50                      push eax
:00424425 8B450C                  mov eax, dword ptr [ebp+0C]
:00424428 50                      push eax
:00424429 8B4508                  mov eax, dword ptr [ebp+08]
:0042442C 50                      push eax
:0042442D 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00424430 E8D7FBFFFF              call 0042400C
:00424435 C745F400000000          mov [ebp-0C], 00000000
:0042443C E903000000              jmp 00424444

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424459(U)
|
:00424441 FF45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042443C(U)
|
:00424444 837DF409                cmp dword ptr [ebp-0C], 00000009
:00424448 0F8310000000            jnb 0042445E
:0042444E 8B45F4                  mov eax, dword ptr [ebp-0C]
:00424451 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00424454 C644083AFF              mov [eax+ecx+3A], FF
:00424459 E9E3FFFFFF              jmp 00424441

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424448(C)
|
:0042445E 8B45D8                  mov eax, dword ptr [ebp-28]
:00424461 33C9                    xor ecx, ecx
:00424463 8A4817                  mov cl, byte ptr [eax+17]
:00424466 81F9FF000000            cmp ecx, 000000FF
:0042446C 0F848E000000            je 00424500
:00424472 8B45D8                  mov eax, dword ptr [ebp-28]
:00424475 33C9                    xor ecx, ecx
:00424477 8A4812                  mov cl, byte ptr [eax+12]
:0042447A 83F901                  cmp ecx, 00000001
:0042447D 0F857D000000            jne 00424500
:00424483 8B45D8                  mov eax, dword ptr [ebp-28]
:00424486 33C9                    xor ecx, ecx
:00424488 8A4813                  mov cl, byte ptr [eax+13]
:0042448B 83F901                  cmp ecx, 00000001
:0042448E 0F846C000000            je 00424500
:00424494 8B45D8                  mov eax, dword ptr [ebp-28]
:00424497 83C03A                  add eax, 0000003A
:0042449A 50                      push eax
:0042449B 8B45D8                  mov eax, dword ptr [ebp-28]
:0042449E 8A4017                  mov al, byte ptr [eax+17]
:004244A1 50                      push eax
:004244A2 8B450C                  mov eax, dword ptr [ebp+0C]
:004244A5 50                      push eax
:004244A6 8B45D8                  mov eax, dword ptr [ebp-28]
:004244A9 33C9                    xor ecx, ecx
:004244AB 8A4810                  mov cl, byte ptr [eax+10]
:004244AE 8B45D8                  mov eax, dword ptr [ebp-28]
:004244B1 8B0C88                  mov ecx, dword ptr [eax+4*ecx]
:004244B4 E87590FFFF              call 0041D52E
:004244B9 8945F8                  mov dword ptr [ebp-08], eax
:004244BC 8B45F8                  mov eax, dword ptr [ebp-08]
:004244BF 8945F0                  mov dword ptr [ebp-10], eax
:004244C2 C745EC01000000          mov [ebp-14], 00000001
:004244C9 E906000000              jmp 004244D4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004244FB(U)
|
:004244CE FF45F0                  inc [ebp-10]
:004244D1 FF45EC                  inc [ebp-14]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004244C9(U)
|
:004244D4 8B45F0                  mov eax, dword ptr [ebp-10]
:004244D7 33C9                    xor ecx, ecx
:004244D9 8A08                    mov cl, byte ptr [eax]
:004244DB 81F9FF000000            cmp ecx, 000000FF
:004244E1 0F8419000000            je 00424500
:004244E7 8B45EC                  mov eax, dword ptr [ebp-14]
:004244EA 50                      push eax
:004244EB 8B45F0                  mov eax, dword ptr [ebp-10]
:004244EE 33C9                    xor ecx, ecx
:004244F0 8A08                    mov cl, byte ptr [eax]
:004244F2 51                      push ecx
:004244F3 8B4DD8                  mov ecx, dword ptr [ebp-28]
:004244F6 E888F1FFFF              call 00423683
:004244FB E9CEFFFFFF              jmp 004244CE

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042446C(C), :0042447D(C), :0042448E(C), :004244E1(C)
|
:00424500 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00424503 E868D3FDFF              call 00401870
:00424508 8B45D8                  mov eax, dword ptr [ebp-28]
:0042450B 33C9                    xor ecx, ecx
:0042450D 8A4811                  mov cl, byte ptr [eax+11]
:00424510 8B45D8                  mov eax, dword ptr [ebp-28]
:00424513 8B0C88                  mov ecx, dword ptr [eax+4*ecx]
:00424516 E8E54CFEFF              call 00409200
:0042451B 50                      push eax
:0042451C 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0042451F E86CD3FDFF              call 00401890
:00424524 8B45FD                  mov eax, dword ptr [ebp-03]
:00424527 50                      push eax
:00424528 8B45FC                  mov eax, dword ptr [ebp-04]
:0042452B 50                      push eax
:0042452C B900FB4600              mov ecx, 0046FB00
:00424531 E8B26C0100              call 0043B1E8
:00424536 8B45D8                  mov eax, dword ptr [ebp-28]
:00424539 33C9                    xor ecx, ecx
:0042453B 8A4812                  mov cl, byte ptr [eax+12]
:0042453E 83F901                  cmp ecx, 00000001
:00424541 0F85ED000000            jne 00424634
:00424547 33C0                    xor eax, eax
:00424549 A0BDFC4600              mov al, byte ptr [0046FCBD]
:0042454E 03C0                    add eax, eax
:00424550 83C004                  add eax, 00000004
:00424553 50                      push eax
:00424554 B9B0FA4600              mov ecx, 0046FAB0
:00424559 E8524CFEFF              call 004091B0
:0042455E E8342A0000              call 00426F97
:00424563 C745F400000000          mov [ebp-0C], 00000000
:0042456A E903000000              jmp 00424572

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004245A0(U)
|
:0042456F FF45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042456A(U)
|
:00424572 837DF402                cmp dword ptr [ebp-0C], 00000002
:00424576 0F8329000000            jnb 004245A5
:0042457C 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042457F 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00424582 8B0481                  mov eax, dword ptr [ecx+4*eax]
:00424585 50                      push eax
:00424586 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00424589 E8EEDDFFFF              call 0042237C
:0042458E 8B45F4                  mov eax, dword ptr [ebp-0C]
:00424591 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00424594 8B0481                  mov eax, dword ptr [ecx+4*eax]
:00424597 50                      push eax
:00424598 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0042459B E8FCDFFFFF              call 0042259C
:004245A0 E9CAFFFFFF              jmp 0042456F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424576(C)
|
:004245A5 E80D2A0000              call 00426FB7
:004245AA E8192E0100              call 004373C8
:004245AF B9D0A64600              mov ecx, 0046A6D0
:004245B4 E8C74BFEFF              call 00409180
:004245B9 A8F0                    test al, F0
:004245BB 0F8414000000            je 004245D5
:004245C1 8B45D8                  mov eax, dword ptr [ebp-28]
:004245C4 8A4015                  mov al, byte ptr [eax+15]
:004245C7 50                      push eax
:004245C8 E80DDDFFFF              call 004222DA
:004245CD 83C404                  add esp, 00000004
:004245D0 E95A000000              jmp 0042462F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004245BB(C)
|
:004245D5 8B45D8                  mov eax, dword ptr [ebp-28]
:004245D8 33C9                    xor ecx, ecx
:004245DA 8A4810                  mov cl, byte ptr [eax+10]
:004245DD 8B45D8                  mov eax, dword ptr [ebp-28]
:004245E0 8B0C88                  mov ecx, dword ptr [eax+4*ecx]
:004245E3 E8184CFEFF              call 00409200
:004245E8 668B00                  mov ax, word ptr [eax]
:004245EB 668945E8                mov word ptr [ebp-18], ax
:004245EF 6A00                    push 00000000
:004245F1 6A08                    push 00000008
:004245F3 33C0                    xor eax, eax
:004245F5 8A45E9                  mov al, byte ptr [ebp-17]
:004245F8 8D0440                  lea eax, dword ptr [eax+2*eax]
:004245FB 33C9                    xor ecx, ecx
:004245FD 8A4DFD                  mov cl, byte ptr [ebp-03]
:00424600 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:00424603 03C1                    add eax, ecx
:00424605 99                      cdq
:00424606 2BC2                    sub eax, edx
:00424608 C1F801                  sar eax, 01
:0042460B 50                      push eax
:0042460C 33C0                    xor eax, eax
:0042460E 8A45E8                  mov al, byte ptr [ebp-18]
:00424611 8D0440                  lea eax, dword ptr [eax+2*eax]
:00424614 33C9                    xor ecx, ecx
:00424616 8A4DFC                  mov cl, byte ptr [ebp-04]
:00424619 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:0042461C 03C1                    add eax, ecx
:0042461E 99                      cdq
:0042461F 2BC2                    sub eax, edx
:00424621 C1F801                  sar eax, 01
:00424624 50                      push eax
:00424625 B900FB4600              mov ecx, 0046FB00
:0042462A E811A40100              call 0043EA40

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004245D0(U)
|
:0042462F E96F000000              jmp 004246A3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424541(C)
|
:00424634 8B45D8                  mov eax, dword ptr [ebp-28]
:00424637 33C9                    xor ecx, ecx
:00424639 8A4812                  mov cl, byte ptr [eax+12]
:0042463C 83F902                  cmp ecx, 00000002
:0042463F 0F8411000000            je 00424656
:00424645 8B45D8                  mov eax, dword ptr [ebp-28]
:00424648 33C9                    xor ecx, ecx
:0042464A 8A4812                  mov cl, byte ptr [eax+12]
:0042464D 83F903                  cmp ecx, 00000003
:00424650 0F854D000000            jne 004246A3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042463F(C)
|
:00424656 8B45D8                  mov eax, dword ptr [ebp-28]
:00424659 33C9                    xor ecx, ecx
:0042465B 8A4811                  mov cl, byte ptr [eax+11]
:0042465E 8B45D8                  mov eax, dword ptr [ebp-28]
:00424661 8B0C88                  mov ecx, dword ptr [eax+4*ecx]
:00424664 E8974BFEFF              call 00409200
:00424669 668B00                  mov ax, word ptr [eax]
:0042466C 668945E4                mov word ptr [ebp-1C], ax
:00424670 8B45D8                  mov eax, dword ptr [ebp-28]
:00424673 33C9                    xor ecx, ecx
:00424675 8A4813                  mov cl, byte ptr [eax+13]
:00424678 C1E904                  shr ecx, 04
:0042467B 80E101                  and cl, 01
:0042467E 884DE0                  mov byte ptr [ebp-20], cl
:00424681 6A00                    push 00000000
:00424683 8B45E0                  mov eax, dword ptr [ebp-20]
:00424686 50                      push eax
:00424687 33C0                    xor eax, eax
:00424689 8A45E5                  mov al, byte ptr [ebp-1B]
:0042468C 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042468F 50                      push eax
:00424690 33C0                    xor eax, eax
:00424692 8A45E4                  mov al, byte ptr [ebp-1C]
:00424695 8D0440                  lea eax, dword ptr [eax+2*eax]
:00424698 50                      push eax
:00424699 B900FB4600              mov ecx, 0046FB00
:0042469E E89DA30100              call 0043EA40

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042462F(U), :00424650(C)
|
:004246A3 6A00                    push 00000000
:004246A5 8B4DD8                  mov ecx, dword ptr [ebp-28]
:004246A8 E802F2FFFF              call 004238AF
:004246AD 8B4DD8                  mov ecx, dword ptr [ebp-28]
:004246B0 E8D4F4FFFF              call 00423B89
:004246B5 8B4DD8                  mov ecx, dword ptr [ebp-28]
:004246B8 E8C9F6FFFF              call 00423D86
:004246BD 8B4DD8                  mov ecx, dword ptr [ebp-28]
:004246C0 E89FF8FFFF              call 00423F64
:004246C5 8B45D8                  mov eax, dword ptr [ebp-28]
:004246C8 33C9                    xor ecx, ecx
:004246CA 8A4817                  mov cl, byte ptr [eax+17]
:004246CD 81F9FF000000            cmp ecx, 000000FF
:004246D3 0F849A010000            je 00424873
:004246D9 8B45D8                  mov eax, dword ptr [ebp-28]
:004246DC 33C9                    xor ecx, ecx
:004246DE 8A4812                  mov cl, byte ptr [eax+12]
:004246E1 83F901                  cmp ecx, 00000001
:004246E4 0F8589010000            jne 00424873
:004246EA 8B45D8                  mov eax, dword ptr [ebp-28]
:004246ED 33C9                    xor ecx, ecx
:004246EF 8A4813                  mov cl, byte ptr [eax+13]
:004246F2 83F901                  cmp ecx, 00000001
:004246F5 0F8478010000            je 00424873
:004246FB 8B45D8                  mov eax, dword ptr [ebp-28]
:004246FE 33C9                    xor ecx, ecx
:00424700 8A4811                  mov cl, byte ptr [eax+11]
:00424703 8B45D8                  mov eax, dword ptr [ebp-28]
:00424706 8B0C88                  mov ecx, dword ptr [eax+4*ecx]
:00424709 E8B1770000              call 0042BEBF
:0042470E C745DC01000000          mov [ebp-24], 00000001
:00424715 E906000000              jmp 00424720

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424856(U)
|
:0042471A FF45F8                  inc [ebp-08]
:0042471D FF45DC                  inc [ebp-24]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424715(U)
|
:00424720 8B45F8                  mov eax, dword ptr [ebp-08]
:00424723 33C9                    xor ecx, ecx
:00424725 8A08                    mov cl, byte ptr [eax]
:00424727 81F9FF000000            cmp ecx, 000000FF
:0042472D 0F8428010000            je 0042485B
:00424733 8B4514                  mov eax, dword ptr [ebp+14]
:00424736 50                      push eax
:00424737 8B4510                  mov eax, dword ptr [ebp+10]
:0042473A 50                      push eax
:0042473B 8B45F8                  mov eax, dword ptr [ebp-08]
:0042473E 8A00                    mov al, byte ptr [eax]
:00424740 50                      push eax
:00424741 8B4508                  mov eax, dword ptr [ebp+08]
:00424744 50                      push eax
:00424745 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00424748 E8BFF8FFFF              call 0042400C
:0042474D 8B45DC                  mov eax, dword ptr [ebp-24]
:00424750 50                      push eax
:00424751 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00424754 E856F1FFFF              call 004238AF
:00424759 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0042475C E828F4FFFF              call 00423B89
:00424761 B9D0A64600              mov ecx, 0046A6D0
:00424766 E8154AFEFF              call 00409180
:0042476B A8F0                    test al, F0
:0042476D 0F85A8000000            jne 0042481B
:00424773 6A02                    push 00000002
:00424775 E8E02C0100              call 0043745A
:0042477A 83C404                  add esp, 00000004
:0042477D E815280000              call 00426F97
:00424782 8B45D8                  mov eax, dword ptr [ebp-28]
:00424785 33C9                    xor ecx, ecx
:00424787 8A4815                  mov cl, byte ptr [eax+15]
:0042478A 83F903                  cmp ecx, 00000003
:0042478D 0F8D2C000000            jnl 004247BF
:00424793 8B45DC                  mov eax, dword ptr [ebp-24]
:00424796 50                      push eax
:00424797 8B45F8                  mov eax, dword ptr [ebp-08]
:0042479A 8A00                    mov al, byte ptr [eax]
:0042479C 50                      push eax
:0042479D E8BAE8FFFF              call 0042305C
:004247A2 83C408                  add esp, 00000008
:004247A5 8B45D8                  mov eax, dword ptr [ebp-28]
:004247A8 8A4015                  mov al, byte ptr [eax+15]
:004247AB 50                      push eax
:004247AC 8B45F8                  mov eax, dword ptr [ebp-08]
:004247AF 8A00                    mov al, byte ptr [eax]
:004247B1 50                      push eax
:004247B2 E85EDAFFFF              call 00422215
:004247B7 83C408                  add esp, 00000008
:004247BA E93B000000              jmp 004247FA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042478D(C)
|
:004247BF 8B45DC                  mov eax, dword ptr [ebp-24]
:004247C2 50                      push eax
:004247C3 8B45D8                  mov eax, dword ptr [ebp-28]
:004247C6 33C9                    xor ecx, ecx
:004247C8 8A4811                  mov cl, byte ptr [eax+11]
:004247CB 8B45D8                  mov eax, dword ptr [ebp-28]
:004247CE 8A440138                mov al, byte ptr [ecx+eax+38]
:004247D2 50                      push eax
:004247D3 E884E8FFFF              call 0042305C
:004247D8 83C408                  add esp, 00000008
:004247DB 8B45D8                  mov eax, dword ptr [ebp-28]
:004247DE 8A4015                  mov al, byte ptr [eax+15]
:004247E1 50                      push eax
:004247E2 8B45D8                  mov eax, dword ptr [ebp-28]
:004247E5 33C9                    xor ecx, ecx
:004247E7 8A4811                  mov cl, byte ptr [eax+11]
:004247EA 8B45D8                  mov eax, dword ptr [ebp-28]
:004247ED 8A440138                mov al, byte ptr [ecx+eax+38]
:004247F1 50                      push eax
:004247F2 E81EDAFFFF              call 00422215
:004247F7 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004247BA(U)
|
:004247FA E8B8270000              call 00426FB7
:004247FF E8C42B0100              call 004373C8
:00424804 8B45DC                  mov eax, dword ptr [ebp-24]
:00424807 50                      push eax
:00424808 8B45F8                  mov eax, dword ptr [ebp-08]
:0042480B 8A00                    mov al, byte ptr [eax]
:0042480D 50                      push eax
:0042480E E849E8FFFF              call 0042305C
:00424813 83C408                  add esp, 00000008
:00424816 E90F000000              jmp 0042482A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042476D(C)
|
:0042481B 8B45D8                  mov eax, dword ptr [ebp-28]
:0042481E 8A4015                  mov al, byte ptr [eax+15]
:00424821 50                      push eax
:00424822 E8B3DAFFFF              call 004222DA
:00424827 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424816(U)
|
:0042482A 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0042482D E854F5FFFF              call 00423D86
:00424832 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00424835 E82AF7FFFF              call 00423F64
:0042483A 8B45F8                  mov eax, dword ptr [ebp-08]
:0042483D 33C9                    xor ecx, ecx
:0042483F 8A08                    mov cl, byte ptr [eax]
:00424841 8BC1                    mov eax, ecx
:00424843 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:00424846 C1E103                  shl ecx, 03
:00424849 2BC8                    sub ecx, eax
:0042484B 8D8998C04600            lea ecx, dword ptr [ecx+0046C098]
:00424851 E869760000              call 0042BEBF
:00424856 E9BFFEFFFF              jmp 0042471A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042472D(C)
|
:0042485B 8B4514                  mov eax, dword ptr [ebp+14]
:0042485E 50                      push eax
:0042485F 8B4510                  mov eax, dword ptr [ebp+10]
:00424862 50                      push eax
:00424863 8B450C                  mov eax, dword ptr [ebp+0C]
:00424866 50                      push eax
:00424867 8B4508                  mov eax, dword ptr [ebp+08]
:0042486A 50                      push eax
:0042486B 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0042486E E899F7FFFF              call 0042400C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004246D3(C), :004246E4(C), :004246F5(C)
|
:00424873 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00424876 E852F4FFFF              call 00423CCD
:0042487B 8B45D8                  mov eax, dword ptr [ebp-28]
:0042487E 8A4012                  mov al, byte ptr [eax+12]
:00424881 50                      push eax
:00424882 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00424885 E80C000000              call 00424896
:0042488A E900000000              jmp 0042488F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042488A(U)
|
:0042488F 5F                      pop edi
:00424890 5E                      pop esi
:00424891 5B                      pop ebx
:00424892 C9                      leave
:00424893 C21000                  ret 0010



* Referenced by a CALL at Address:
|:00424885   
|
:00424896 55                      push ebp
:00424897 8BEC                    mov ebp, esp
:00424899 83EC18                  sub esp, 00000018
:0042489C 53                      push ebx
:0042489D 56                      push esi
:0042489E 57                      push edi
:0042489F 894DE8                  mov dword ptr [ebp-18], ecx
:004248A2 33C0                    xor eax, eax
:004248A4 8A4508                  mov al, byte ptr [ebp+08]
:004248A7 83F801                  cmp eax, 00000001
:004248AA 0F85EC010000            jne 00424A9C
:004248B0 8B45E8                  mov eax, dword ptr [ebp-18]
:004248B3 33C9                    xor ecx, ecx
:004248B5 8A4811                  mov cl, byte ptr [eax+11]
:004248B8 8B45E8                  mov eax, dword ptr [ebp-18]
:004248BB 8B0C88                  mov ecx, dword ptr [eax+4*ecx]
:004248BE E85D49FEFF              call 00409220
:004248C3 8945F8                  mov dword ptr [ebp-08], eax
:004248C6 C745EC00000000          mov [ebp-14], 00000000
:004248CD 8B45E8                  mov eax, dword ptr [ebp-18]
:004248D0 33C9                    xor ecx, ecx
:004248D2 8A4811                  mov cl, byte ptr [eax+11]
:004248D5 8B45E8                  mov eax, dword ptr [ebp-18]
:004248D8 8B0C88                  mov ecx, dword ptr [eax+4*ecx]
:004248DB E88E5A0000              call 0042A36E
:004248E0 8845F0                  mov byte ptr [ebp-10], al
:004248E3 8B45E8                  mov eax, dword ptr [ebp-18]
:004248E6 33C9                    xor ecx, ecx
:004248E8 8A4811                  mov cl, byte ptr [eax+11]
:004248EB 8B45E8                  mov eax, dword ptr [ebp-18]
:004248EE 8B0C88                  mov ecx, dword ptr [eax+4*ecx]
:004248F1 E80A49FEFF              call 00409200
:004248F6 668B00                  mov ax, word ptr [eax]
:004248F9 668945FC                mov word ptr [ebp-04], ax
:004248FD 8B45E8                  mov eax, dword ptr [ebp-18]
:00424900 33C9                    xor ecx, ecx
:00424902 8A4810                  mov cl, byte ptr [eax+10]
:00424905 8B45E8                  mov eax, dword ptr [ebp-18]
:00424908 8B0C88                  mov ecx, dword ptr [eax+4*ecx]
:0042490B E8C099FFFF              call 0041E2D0
:00424910 A2BCA64600              mov byte ptr [0046A6BC], al
:00424915 6A00                    push 00000000
:00424917 8B45F8                  mov eax, dword ptr [ebp-08]
:0042491A F7D0                    not eax
:0042491C 50                      push eax
:0042491D 8B45F0                  mov eax, dword ptr [ebp-10]
:00424920 50                      push eax
:00424921 8D45FC                  lea eax, dword ptr [ebp-04]
:00424924 50                      push eax
:00424925 8B45E8                  mov eax, dword ptr [ebp-18]
:00424928 33C9                    xor ecx, ecx
:0042492A 8A4811                  mov cl, byte ptr [eax+11]
:0042492D 8BC1                    mov eax, ecx
:0042492F 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:00424932 C1E103                  shl ecx, 03
:00424935 2BC8                    sub ecx, eax
:00424937 8D8998C04600            lea ecx, dword ptr [ecx+0046C098]
:0042493D E88F4EFFFF              call 004197D1
:00424942 8845F4                  mov byte ptr [ebp-0C], al
:00424945 33C0                    xor eax, eax
:00424947 8A45F4                  mov al, byte ptr [ebp-0C]
:0042494A 33C9                    xor ecx, ecx
:0042494C 8A0DBCA64600            mov cl, byte ptr [0046A6BC]
:00424952 3BC1                    cmp eax, ecx
:00424954 0F8507000000            jne 00424961
:0042495A C745EC01000000          mov [ebp-14], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424954(C)
|
:00424961 8B45E8                  mov eax, dword ptr [ebp-18]
:00424964 33C9                    xor ecx, ecx
:00424966 8A4810                  mov cl, byte ptr [eax+10]
:00424969 8B45E8                  mov eax, dword ptr [ebp-18]
:0042496C 33D2                    xor edx, edx
:0042496E 8A540136                mov dl, byte ptr [ecx+eax+36]
:00424972 8B45E8                  mov eax, dword ptr [ebp-18]
:00424975 33C9                    xor ecx, ecx
:00424977 8A4811                  mov cl, byte ptr [eax+11]
:0042497A 8B45E8                  mov eax, dword ptr [ebp-18]
:0042497D 33DB                    xor ebx, ebx
:0042497F 8A5C0136                mov bl, byte ptr [ecx+eax+36]
:00424983 3BD3                    cmp edx, ebx
:00424985 0F8CA2000000            jl 00424A2D
:0042498B 833D1818450000          cmp dword ptr [00451818], 00000000
:00424992 0F8595000000            jne 00424A2D
:00424998 8B45E8                  mov eax, dword ptr [ebp-18]
:0042499B 33C9                    xor ecx, ecx
:0042499D 8A4810                  mov cl, byte ptr [eax+10]
:004249A0 8B45E8                  mov eax, dword ptr [ebp-18]
:004249A3 33DB                    xor ebx, ebx
:004249A5 8A5C0136                mov bl, byte ptr [ecx+eax+36]
:004249A9 8B45E8                  mov eax, dword ptr [ebp-18]
:004249AC 33C9                    xor ecx, ecx
:004249AE 8A4811                  mov cl, byte ptr [eax+11]
:004249B1 8B45E8                  mov eax, dword ptr [ebp-18]
:004249B4 33D2                    xor edx, edx
:004249B6 8A540136                mov dl, byte ptr [ecx+eax+36]
:004249BA 2BDA                    sub ebx, edx
:004249BC 43                      inc ebx
:004249BD 6A0F                    push 0000000F
:004249BF E864290200              call 00447328
:004249C4 83C404                  add esp, 00000004
:004249C7 3BD8                    cmp ebx, eax
:004249C9 0F865E000000            jbe 00424A2D
:004249CF C7051818450001000000    mov dword ptr [00451818], 00000001
:004249D9 8B45E8                  mov eax, dword ptr [ebp-18]
:004249DC 33C9                    xor ecx, ecx
:004249DE 8A4811                  mov cl, byte ptr [eax+11]
:004249E1 8B45E8                  mov eax, dword ptr [ebp-18]
:004249E4 8B0C88                  mov ecx, dword ptr [eax+4*ecx]
:004249E7 E8C44DFEFF              call 004097B0
:004249EC 85C0                    test eax, eax
:004249EE 0F8439000000            je 00424A2D
:004249F4 8B45E8                  mov eax, dword ptr [ebp-18]
:004249F7 8A4013                  mov al, byte ptr [eax+13]
:004249FA 50                      push eax
:004249FB 6A01                    push 00000001
:004249FD 8B45E8                  mov eax, dword ptr [ebp-18]
:00424A00 33C9                    xor ecx, ecx
:00424A02 8A4811                  mov cl, byte ptr [eax+11]
:00424A05 8B45E8                  mov eax, dword ptr [ebp-18]
:00424A08 8B0C88                  mov ecx, dword ptr [eax+4*ecx]
:00424A0B E8C098FFFF              call 0041E2D0
:00424A10 50                      push eax
:00424A11 8B45E8                  mov eax, dword ptr [ebp-18]
:00424A14 33C9                    xor ecx, ecx
:00424A16 8A4810                  mov cl, byte ptr [eax+10]
:00424A19 8B45E8                  mov eax, dword ptr [ebp-18]
:00424A1C 8B0C88                  mov ecx, dword ptr [eax+4*ecx]
:00424A1F E8AC98FFFF              call 0041E2D0
:00424A24 50                      push eax
:00424A25 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00424A28 E8DBF9FFFF              call 00424408

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00424985(C), :00424992(C), :004249C9(C), :004249EE(C)
|
:00424A2D C7051818450000000000    mov dword ptr [00451818], 00000000
:00424A37 8B45E8                  mov eax, dword ptr [ebp-18]
:00424A3A 33C9                    xor ecx, ecx
:00424A3C 8A4814                  mov cl, byte ptr [eax+14]
:00424A3F F6C140                  test cl, 40
:00424A42 0F844F000000            je 00424A97
:00424A48 8B45E8                  mov eax, dword ptr [ebp-18]
:00424A4B 33C9                    xor ecx, ecx
:00424A4D 8A4813                  mov cl, byte ptr [eax+13]
:00424A50 83F901                  cmp ecx, 00000001
:00424A53 0F843E000000            je 00424A97
:00424A59 837DEC00                cmp dword ptr [ebp-14], 00000000
:00424A5D 0F8434000000            je 00424A97
:00424A63 6A01                    push 00000001
:00424A65 6A01                    push 00000001
:00424A67 8B45E8                  mov eax, dword ptr [ebp-18]
:00424A6A 33C9                    xor ecx, ecx
:00424A6C 8A4810                  mov cl, byte ptr [eax+10]
:00424A6F 8B45E8                  mov eax, dword ptr [ebp-18]
:00424A72 8B0C88                  mov ecx, dword ptr [eax+4*ecx]
:00424A75 E85698FFFF              call 0041E2D0
:00424A7A 50                      push eax
:00424A7B 8B45E8                  mov eax, dword ptr [ebp-18]
:00424A7E 33C9                    xor ecx, ecx
:00424A80 8A4811                  mov cl, byte ptr [eax+11]
:00424A83 8B45E8                  mov eax, dword ptr [ebp-18]
:00424A86 8B0C88                  mov ecx, dword ptr [eax+4*ecx]
:00424A89 E84298FFFF              call 0041E2D0
:00424A8E 50                      push eax
:00424A8F 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00424A92 E871F9FFFF              call 00424408

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00424A42(C), :00424A53(C), :00424A5D(C)
|
:00424A97 E92F000000              jmp 00424ACB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004248AA(C)
|
:00424A9C 33C0                    xor eax, eax
:00424A9E 8A4508                  mov al, byte ptr [ebp+08]
:00424AA1 83F802                  cmp eax, 00000002
:00424AA4 0F840E000000            je 00424AB8
:00424AAA 33C0                    xor eax, eax
:00424AAC 8A4508                  mov al, byte ptr [ebp+08]
:00424AAF 83F803                  cmp eax, 00000003
:00424AB2 0F8513000000            jne 00424ACB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424AA4(C)
|
:00424AB8 8B45E8                  mov eax, dword ptr [ebp-18]
:00424ABB 33C9                    xor ecx, ecx
:00424ABD 8A4811                  mov cl, byte ptr [eax+11]
:00424AC0 8B45E8                  mov eax, dword ptr [ebp-18]
:00424AC3 8B0C88                  mov ecx, dword ptr [eax+4*ecx]
:00424AC6 E8F4730000              call 0042BEBF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00424A97(U), :00424AB2(C)
|
:00424ACB 8B45E8                  mov eax, dword ptr [ebp-18]
:00424ACE 33C9                    xor ecx, ecx
:00424AD0 8A4814                  mov cl, byte ptr [eax+14]
:00424AD3 80E1FE                  and cl, FE
:00424AD6 8B45E8                  mov eax, dword ptr [ebp-18]
:00424AD9 884814                  mov byte ptr [eax+14], cl
:00424ADC E900000000              jmp 00424AE1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424ADC(U)
|
:00424AE1 5F                      pop edi
:00424AE2 5E                      pop esi
:00424AE3 5B                      pop ebx
:00424AE4 C9                      leave
:00424AE5 C20400                  ret 0004


:00424AE8 CC                      int 03
:00424AE9 CC                      int 03
:00424AEA CC                      int 03
:00424AEB CC                      int 03
:00424AEC CC                      int 03
:00424AED CC                      int 03
:00424AEE CC                      int 03
:00424AEF CC                      int 03

* Referenced by a CALL at Address:
|:00421F65   
|
:00424AF0 55                      push ebp
:00424AF1 8BEC                    mov ebp, esp
:00424AF3 83EC04                  sub esp, 00000004
:00424AF6 53                      push ebx
:00424AF7 56                      push esi
:00424AF8 57                      push edi
:00424AF9 894DFC                  mov dword ptr [ebp-04], ecx
:00424AFC E900000000              jmp 00424B01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424AFC(U)
|
:00424B01 8B45FC                  mov eax, dword ptr [ebp-04]
:00424B04 5F                      pop edi
:00424B05 5E                      pop esi
:00424B06 5B                      pop ebx
:00424B07 C9                      leave
:00424B08 C3                      ret


:00424B09 CC                      int 03
:00424B0A CC                      int 03
:00424B0B CC                      int 03
:00424B0C CC                      int 03
:00424B0D CC                      int 03
:00424B0E CC                      int 03
:00424B0F CC                      int 03

* Referenced by a CALL at Address:
|:00421F9C   
|
:00424B10 55                      push ebp
:00424B11 8BEC                    mov ebp, esp
:00424B13 83EC04                  sub esp, 00000004
:00424B16 53                      push ebx
:00424B17 56                      push esi
:00424B18 57                      push edi
:00424B19 894DFC                  mov dword ptr [ebp-04], ecx
:00424B1C E900000000              jmp 00424B21

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424B1C(U)
|
:00424B21 5F                      pop edi
:00424B22 5E                      pop esi
:00424B23 5B                      pop ebx
:00424B24 C9                      leave
:00424B25 C3                      ret


:00424B26 CC                      int 03
:00424B27 CC                      int 03
:00424B28 CC                      int 03
:00424B29 CC                      int 03
:00424B2A CC                      int 03
:00424B2B CC                      int 03
:00424B2C CC                      int 03
:00424B2D CC                      int 03
:00424B2E CC                      int 03
:00424B2F CC                      int 03

* Referenced by a CALL at Addresses:
|:0042200E   , :00422A66   , :00422AA6   , :0042BF0B   , :0042BF87   
|:0042CB5C   , :0042CD12   , :0042D461   , :0042DAE4   , :00439B9A   
|:00439C1B   , :00439C4A   , :0043A742   , :0043B0E2   , :0043E885   
|:0043EA54   
|
:00424B30 55                      push ebp
:00424B31 8BEC                    mov ebp, esp
:00424B33 83EC04                  sub esp, 00000004
:00424B36 53                      push ebx
:00424B37 56                      push esi
:00424B38 57                      push edi
:00424B39 894DFC                  mov dword ptr [ebp-04], ecx
:00424B3C 8B45FC                  mov eax, dword ptr [ebp-04]
:00424B3F 8B4010                  mov eax, dword ptr [eax+10]
:00424B42 E900000000              jmp 00424B47

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424B42(U)
|
:00424B47 5F                      pop edi
:00424B48 5E                      pop esi
:00424B49 5B                      pop ebx
:00424B4A C9                      leave
:00424B4B C3                      ret


:00424B4C CC                      int 03
:00424B4D CC                      int 03
:00424B4E CC                      int 03
:00424B4F CC                      int 03

* Referenced by a CALL at Addresses:
|:00421FF2   , :00422A89   , :00422AC9   , :00427DE5   , :0042BEF3   
|:0042BF94   , :0042CB76   , :0042CD22   , :0042D47C   , :0042DAD4   
|:00439BB1   , :0043A759   , :0043B0ED   , :0043E8B2   , :0043EA6C   
|
:00424B50 55                      push ebp
:00424B51 8BEC                    mov ebp, esp
:00424B53 83EC04                  sub esp, 00000004
:00424B56 53                      push ebx
:00424B57 56                      push esi
:00424B58 57                      push edi
:00424B59 894DFC                  mov dword ptr [ebp-04], ecx
:00424B5C 8B45FC                  mov eax, dword ptr [ebp-04]
:00424B5F 8B4014                  mov eax, dword ptr [eax+14]
:00424B62 E900000000              jmp 00424B67

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424B62(U)
|
:00424B67 5F                      pop edi
:00424B68 5E                      pop esi
:00424B69 5B                      pop ebx
:00424B6A C9                      leave
:00424B6B C3                      ret


:00424B6C CC                      int 03
:00424B6D CC                      int 03
:00424B6E CC                      int 03
:00424B6F CC                      int 03

* Referenced by a CALL at Addresses:
|:004223A5   , :004228D8   , :00422F83   , :00423564   
|
:00424B70 55                      push ebp
:00424B71 8BEC                    mov ebp, esp
:00424B73 83EC04                  sub esp, 00000004
:00424B76 53                      push ebx
:00424B77 56                      push esi
:00424B78 57                      push edi
:00424B79 894DFC                  mov dword ptr [ebp-04], ecx
:00424B7C 8B45FC                  mov eax, dword ptr [ebp-04]
:00424B7F 8A400E                  mov al, byte ptr [eax+0E]
:00424B82 E900000000              jmp 00424B87

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424B82(U)
|
:00424B87 5F                      pop edi
:00424B88 5E                      pop esi
:00424B89 5B                      pop ebx
:00424B8A C9                      leave
:00424B8B C3                      ret


:00424B8C CC                      int 03
:00424B8D CC                      int 03
:00424B8E CC                      int 03
:00424B8F CC                      int 03

* Referenced by a CALL at Addresses:
|:00422406   , :00423133   , :0042CD4E   , :0043D5F3   , :0043D9A3   
|
:00424B90 55                      push ebp
:00424B91 8BEC                    mov ebp, esp
:00424B93 83EC04                  sub esp, 00000004
:00424B96 53                      push ebx
:00424B97 56                      push esi
:00424B98 57                      push edi
:00424B99 894DFC                  mov dword ptr [ebp-04], ecx
:00424B9C 8B45FC                  mov eax, dword ptr [ebp-04]
:00424B9F 8A4005                  mov al, byte ptr [eax+05]
:00424BA2 E900000000              jmp 00424BA7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424BA2(U)
|
:00424BA7 5F                      pop edi
:00424BA8 5E                      pop esi
:00424BA9 5B                      pop ebx
:00424BAA C9                      leave
:00424BAB C3                      ret


:00424BAC CC                      int 03
:00424BAD CC                      int 03
:00424BAE CC                      int 03
:00424BAF CC                      int 03

* Referenced by a CALL at Address:
|:0042551D   
|
:00424BB0 55                      push ebp
:00424BB1 8BEC                    mov ebp, esp
:00424BB3 83EC04                  sub esp, 00000004
:00424BB6 53                      push ebx
:00424BB7 56                      push esi
:00424BB8 57                      push edi
:00424BB9 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00424BBC E82F48FEFF              call 004093F0
:00424BC1 A1442F4500              mov eax, dword ptr [00452F44]
:00424BC6 50                      push eax

* Possible StringData Ref from Data Obj ->"C:MARK.E2"
                                  |
:00424BC7 68F82B4500              push 00452BF8
:00424BCC 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00424BCF E8E3290200              call 004475B7
:00424BD4 6800C80000              push 0000C800
:00424BD9 B940CF4600              mov ecx, 0046CF40
:00424BDE E8FD44FEFF              call 004090E0
:00424BE3 50                      push eax
:00424BE4 6A00                    push 00000000
:00424BE6 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00424BE9 E86248FEFF              call 00409450
:00424BEE 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00424BF1 E82A48FEFF              call 00409420
:00424BF6 E900000000              jmp 00424BFB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424BF6(U)
|
:00424BFB 5F                      pop edi
:00424BFC 5E                      pop esi
:00424BFD 5B                      pop ebx
:00424BFE C9                      leave
:00424BFF C3                      ret



* Referenced by a CALL at Address:
|:00424C8E   
|
:00424C00 55                      push ebp
:00424C01 8BEC                    mov ebp, esp
:00424C03 53                      push ebx
:00424C04 56                      push esi
:00424C05 57                      push edi
:00424C06 B980F94600              mov ecx, 0046F980
:00424C0B E8792A0200              call 00447689
:00424C10 B9E8E44600              mov ecx, 0046E4E8
:00424C15 E86F2A0200              call 00447689
:00424C1A B9D0E44600              mov ecx, 0046E4D0
:00424C1F E8652A0200              call 00447689
:00424C24 B918E54600              mov ecx, 0046E518
:00424C29 E85B2A0200              call 00447689
:00424C2E B950F94600              mov ecx, 0046F950
:00424C33 E8512A0200              call 00447689
:00424C38 B980E34600              mov ecx, 0046E380
:00424C3D E8472A0200              call 00447689
:00424C42 E900000000              jmp 00424C47

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424C42(U)
|
:00424C47 5F                      pop edi
:00424C48 5E                      pop esi
:00424C49 5B                      pop ebx
:00424C4A C9                      leave
:00424C4B C3                      ret



* Referenced by a CALL at Addresses:
|:00424CE9   , :004251D5   
|
:00424C4C 55                      push ebp
:00424C4D 8BEC                    mov ebp, esp
:00424C4F 53                      push ebx
:00424C50 56                      push esi
:00424C51 57                      push edi
:00424C52 B968F94600              mov ecx, 0046F968
:00424C57 E82D2A0200              call 00447689
:00424C5C B938F94600              mov ecx, 0046F938
:00424C61 E8232A0200              call 00447689
:00424C66 B9A0E44600              mov ecx, 0046E4A0
:00424C6B E8192A0200              call 00447689
:00424C70 B940CF4600              mov ecx, 0046CF40
:00424C75 E80F2A0200              call 00447689
:00424C7A B900E54600              mov ecx, 0046E500
:00424C7F E8052A0200              call 00447689
:00424C84 B9B8E44600              mov ecx, 0046E4B8
:00424C89 E8FB290200              call 00447689
:00424C8E E86DFFFFFF              call 00424C00
:00424C93 E900000000              jmp 00424C98

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424C93(U)
|
:00424C98 5F                      pop edi
:00424C99 5E                      pop esi
:00424C9A 5B                      pop ebx
:00424C9B C9                      leave
:00424C9C C3                      ret



* Referenced by a CALL at Addresses:
|:00424D2A   , :00424D50   , :00424D76   , :00424D9C   , :00424DC2   
|:00424DE8   , :00424E41   , :00424E67   , :00424E8D   , :00424EB3   
|:00424ED9   , :00424EFF   , :00424F1E   
|
:00424C9D 55                      push ebp
:00424C9E 8BEC                    mov ebp, esp
:00424CA0 53                      push ebx
:00424CA1 56                      push esi
:00424CA2 57                      push edi
:00424CA3 6A00                    push 00000000
:00424CA5 6A00                    push 00000000
:00424CA7 B910BC4600              mov ecx, 0046BC10
:00424CAC E856AFFFFF              call 0041FC07
:00424CB1 6A07                    push 00000007
:00424CB3 B910BC4600              mov ecx, 0046BC10
:00424CB8 E816B0FFFF              call 0041FCD3
:00424CBD 6A00                    push 00000000
:00424CBF B910BC4600              mov ecx, 0046BC10
:00424CC4 E807B1FFFF              call 0041FDD0
:00424CC9 8B4508                  mov eax, dword ptr [ebp+08]
:00424CCC 50                      push eax

* Possible StringData Ref from Data Obj ->"岻(%s)
"
                                  |
:00424CCD 68BC194500              push 004519BC
:00424CD2 6810BC4600              push 0046BC10
:00424CD7 E847BEFFFF              call 00420B23
:00424CDC 83C40C                  add esp, 0000000C
:00424CDF E825280100              call 00437509
:00424CE4 E879230000              call 00427062
:00424CE9 E85EFFFFFF              call 00424C4C
:00424CEE 6A01                    push 00000001
:00424CF0 6A00                    push 00000000
:00424CF2 B938534700              mov ecx, 00475338
:00424CF7 E80C2D0200              call 00447A08
:00424CFC E900000000              jmp 00424D01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424CFC(U)
|
:00424D01 5F                      pop edi
:00424D02 5E                      pop esi
:00424D03 5B                      pop ebx
:00424D04 C9                      leave
:00424D05 C3                      ret



* Referenced by a CALL at Address:
|:00424F26   
|
:00424D06 55                      push ebp
:00424D07 8BEC                    mov ebp, esp
:00424D09 53                      push ebx
:00424D0A 56                      push esi
:00424D0B 57                      push edi
:00424D0C 6A01                    push 00000001
:00424D0E 6880022800              push 00280280
:00424D13 B980F94600              mov ecx, 0046F980
:00424D18 E826290200              call 00447643
:00424D1D 85C0                    test eax, eax
:00424D1F 0F850D000000            jne 00424D32

* Possible StringData Ref from Data Obj ->"N"
                                  |
:00424D25 68CC194500              push 004519CC
:00424D2A E86EFFFFFF              call 00424C9D
:00424D2F 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424D1F(C)
|
:00424D32 6A01                    push 00000001
:00424D34 6800000500              push 00050000
:00424D39 B9E8E44600              mov ecx, 0046E4E8
:00424D3E E800290200              call 00447643
:00424D43 85C0                    test eax, eax
:00424D45 0F850D000000            jne 00424D58

* Possible StringData Ref from Data Obj ->"A"
                                  |
:00424D4B 68D0194500              push 004519D0
:00424D50 E848FFFFFF              call 00424C9D
:00424D55 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424D45(C)
|
:00424D58 6A01                    push 00000001
:00424D5A 68007E0900              push 00097E00
:00424D5F B9D0E44600              mov ecx, 0046E4D0
:00424D64 E8DA280200              call 00447643
:00424D69 85C0                    test eax, eax
:00424D6B 0F850D000000            jne 00424D7E

* Possible StringData Ref from Data Obj ->"B"
                                  |
:00424D71 68D4194500              push 004519D4
:00424D76 E822FFFFFF              call 00424C9D
:00424D7B 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424D6B(C)
|
:00424D7E 6A01                    push 00000001
:00424D80 68004C0400              push 00044C00
:00424D85 B918E54600              mov ecx, 0046E518
:00424D8A E8B4280200              call 00447643
:00424D8F 85C0                    test eax, eax
:00424D91 0F850D000000            jne 00424DA4

* Possible StringData Ref from Data Obj ->"E"
                                  |
:00424D97 68D8194500              push 004519D8
:00424D9C E8FCFEFFFF              call 00424C9D
:00424DA1 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424D91(C)
|
:00424DA4 6A01                    push 00000001
:00424DA6 6800900100              push 00019000
:00424DAB B950F94600              mov ecx, 0046F950
:00424DB0 E88E280200              call 00447643
:00424DB5 85C0                    test eax, eax
:00424DB7 0F850D000000            jne 00424DCA

* Possible StringData Ref from Data Obj ->"D"
                                  |
:00424DBD 68DC194500              push 004519DC
:00424DC2 E8D6FEFFFF              call 00424C9D
:00424DC7 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424DB7(C)
|
:00424DCA 6A01                    push 00000001
:00424DCC 6800E80300              push 0003E800
:00424DD1 B980E34600              mov ecx, 0046E380
:00424DD6 E868280200              call 00447643
:00424DDB 85C0                    test eax, eax
:00424DDD 0F850D000000            jne 00424DF0

* Possible StringData Ref from Data Obj ->"F"
                                  |
:00424DE3 68E0194500              push 004519E0
:00424DE8 E8B0FEFFFF              call 00424C9D
:00424DED 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424DDD(C)
|
:00424DF0 6A01                    push 00000001
:00424DF2 6800E80300              push 0003E800
:00424DF7 B998F94600              mov ecx, 0046F998
:00424DFC E842280200              call 00447643
:00424E01 85C0                    test eax, eax
:00424E03 0F850A000000            jne 00424E13
:00424E09 C7059C2B4500FF000000    mov dword ptr [00452B9C], 000000FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424E03(C)
|
:00424E13 E900000000              jmp 00424E18

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424E13(U)
|
:00424E18 5F                      pop edi
:00424E19 5E                      pop esi
:00424E1A 5B                      pop ebx
:00424E1B C9                      leave
:00424E1C C3                      ret



* Referenced by a CALL at Address:
|:00425518   
|
:00424E1D 55                      push ebp
:00424E1E 8BEC                    mov ebp, esp
:00424E20 53                      push ebx
:00424E21 56                      push esi
:00424E22 57                      push edi
:00424E23 6A01                    push 00000001
:00424E25 6800000200              push 00020000
:00424E2A B968F94600              mov ecx, 0046F968
:00424E2F E80F280200              call 00447643
:00424E34 85C0                    test eax, eax
:00424E36 0F850D000000            jne 00424E49

* Possible StringData Ref from Data Obj ->"C"
                                  |
:00424E3C 68E4194500              push 004519E4
:00424E41 E857FEFFFF              call 00424C9D
:00424E46 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424E36(C)
|
:00424E49 6A01                    push 00000001
:00424E4B 6800C80000              push 0000C800
:00424E50 B940CF4600              mov ecx, 0046CF40
:00424E55 E8E9270200              call 00447643
:00424E5A 85C0                    test eax, eax
:00424E5C 0F850D000000            jne 00424E6F

* Possible StringData Ref from Data Obj ->"G"
                                  |
:00424E62 68E8194500              push 004519E8
:00424E67 E831FEFFFF              call 00424C9D
:00424E6C 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424E5C(C)
|
:00424E6F 6A01                    push 00000001
:00424E71 6800500000              push 00005000
:00424E76 B9A0E44600              mov ecx, 0046E4A0
:00424E7B E8C3270200              call 00447643
:00424E80 85C0                    test eax, eax
:00424E82 0F850D000000            jne 00424E95

* Possible StringData Ref from Data Obj ->"H"
                                  |
:00424E88 68EC194500              push 004519EC
:00424E8D E80BFEFFFF              call 00424C9D
:00424E92 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424E82(C)
|
:00424E95 6A01                    push 00000001
:00424E97 68C0150000              push 000015C0
:00424E9C B938F94600              mov ecx, 0046F938
:00424EA1 E89D270200              call 00447643
:00424EA6 85C0                    test eax, eax
:00424EA8 0F850D000000            jne 00424EBB

* Possible StringData Ref from Data Obj ->"I"
                                  |
:00424EAE 68F0194500              push 004519F0
:00424EB3 E8E5FDFFFF              call 00424C9D
:00424EB8 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424EA8(C)
|
:00424EBB 6A01                    push 00000001
:00424EBD 6800180000              push 00001800
:00424EC2 B900E54600              mov ecx, 0046E500
:00424EC7 E877270200              call 00447643
:00424ECC 85C0                    test eax, eax
:00424ECE 0F850D000000            jne 00424EE1

* Possible StringData Ref from Data Obj ->"J"
                                  |
:00424ED4 68F4194500              push 004519F4
:00424ED9 E8BFFDFFFF              call 00424C9D
:00424EDE 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424ECE(C)
|
:00424EE1 6A01                    push 00000001
:00424EE3 6800500000              push 00005000
:00424EE8 B9B8E44600              mov ecx, 0046E4B8
:00424EED E851270200              call 00447643
:00424EF2 85C0                    test eax, eax
:00424EF4 0F850D000000            jne 00424F07

* Possible StringData Ref from Data Obj ->"K"
                                  |
:00424EFA 68F8194500              push 004519F8
:00424EFF E899FDFFFF              call 00424C9D
:00424F04 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424EF4(C)
|
:00424F07 B9B0C44600              mov ecx, 0046C4B0
:00424F0C E84F100000              call 00425F60
:00424F11 85C0                    test eax, eax
:00424F13 0F850D000000            jne 00424F26

* Possible StringData Ref from Data Obj ->"event"
                                  |
:00424F19 68FC194500              push 004519FC
:00424F1E E87AFDFFFF              call 00424C9D
:00424F23 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424F13(C)
|
:00424F26 E8DBFDFFFF              call 00424D06
:00424F2B E900000000              jmp 00424F30

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424F2B(U)
|
:00424F30 5F                      pop edi
:00424F31 5E                      pop esi
:00424F32 5B                      pop ebx
:00424F33 C9                      leave
:00424F34 C3                      ret



* Referenced by a CALL at Address:
|:00425545   
|
:00424F35 55                      push ebp
:00424F36 8BEC                    mov ebp, esp
:00424F38 83EC0C                  sub esp, 0000000C
:00424F3B 53                      push ebx
:00424F3C 56                      push esi
:00424F3D 57                      push edi
:00424F3E 8D4DF4                  lea ecx, dword ptr [ebp-0C]
:00424F41 E8AA44FEFF              call 004093F0
:00424F46 B938F94600              mov ecx, 0046F938
:00424F4B E89041FEFF              call 004090E0
:00424F50 8945FC                  mov dword ptr [ebp-04], eax
:00424F53 C745F800000000          mov [ebp-08], 00000000
:00424F5A E907000000              jmp 00424F66

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424F87(U)
|
:00424F5F FF45F8                  inc [ebp-08]
:00424F62 8345FC20                add dword ptr [ebp-04], 00000020

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424F5A(U)
|
:00424F66 837DF857                cmp dword ptr [ebp-08], 00000057
:00424F6A 0F8D1C000000            jnl 00424F8C
:00424F70 8B45FC                  mov eax, dword ptr [ebp-04]
:00424F73 50                      push eax
:00424F74 8B45F8                  mov eax, dword ptr [ebp-08]
:00424F77 8B048560184500          mov eax, dword ptr [4*eax+00451860]
:00424F7E 50                      push eax
:00424F7F E81A0F0200              call 00445E9E
:00424F84 83C408                  add esp, 00000008
:00424F87 E9D3FFFFFF              jmp 00424F5F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424F6A(C)
|
:00424F8C A1442F4500              mov eax, dword ptr [00452F44]
:00424F91 50                      push eax

* Possible StringData Ref from Data Obj ->"C:FONT.E2"
                                  |
:00424F92 68082C4500              push 00452C08
:00424F97 8D4DF4                  lea ecx, dword ptr [ebp-0C]
:00424F9A E818260200              call 004475B7
:00424F9F B918E54600              mov ecx, 0046E518
:00424FA4 E83741FEFF              call 004090E0
:00424FA9 8945FC                  mov dword ptr [ebp-04], eax
:00424FAC 68E00A0000              push 00000AE0
:00424FB1 8B45FC                  mov eax, dword ptr [ebp-04]
:00424FB4 50                      push eax
:00424FB5 6A00                    push 00000000
:00424FB7 8D4DF4                  lea ecx, dword ptr [ebp-0C]
:00424FBA E89144FEFF              call 00409450
:00424FBF 8D4DF4                  lea ecx, dword ptr [ebp-0C]
:00424FC2 E85944FEFF              call 00409420
:00424FC7 C745F800000000          mov [ebp-08], 00000000
:00424FCE E907000000              jmp 00424FDA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424FFB(U)
|
:00424FD3 FF45F8                  inc [ebp-08]
:00424FD6 8345FC20                add dword ptr [ebp-04], 00000020

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424FCE(U)
|
:00424FDA 837DF857                cmp dword ptr [ebp-08], 00000057
:00424FDE 0F8D1C000000            jnl 00425000
:00424FE4 8B45FC                  mov eax, dword ptr [ebp-04]
:00424FE7 50                      push eax
:00424FE8 8B45F8                  mov eax, dword ptr [ebp-08]
:00424FEB 8B048560184500          mov eax, dword ptr [4*eax+00451860]
:00424FF2 50                      push eax
:00424FF3 E8A60E0200              call 00445E9E
:00424FF8 83C408                  add esp, 00000008
:00424FFB E9D3FFFFFF              jmp 00424FD3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424FDE(C)
|
:00425000 E900000000              jmp 00425005

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425000(U)
|
:00425005 5F                      pop edi
:00425006 5E                      pop esi
:00425007 5B                      pop ebx
:00425008 C9                      leave
:00425009 C3                      ret



* Referenced by a CALL at Address:
|:004251D0   
|
:0042500A 55                      push ebp
:0042500B 8BEC                    mov ebp, esp
:0042500D 83EC08                  sub esp, 00000008
:00425010 53                      push ebx
:00425011 56                      push esi
:00425012 57                      push edi
:00425013 B938F94600              mov ecx, 0046F938
:00425018 E8C340FEFF              call 004090E0
:0042501D 8945FC                  mov dword ptr [ebp-04], eax
:00425020 C745F800000000          mov [ebp-08], 00000000
:00425027 E907000000              jmp 00425033

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425054(U)
|
:0042502C FF45F8                  inc [ebp-08]
:0042502F 8345FC20                add dword ptr [ebp-04], 00000020

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425027(U)
|
:00425033 837DF857                cmp dword ptr [ebp-08], 00000057
:00425037 0F8D1C000000            jnl 00425059
:0042503D 8B45FC                  mov eax, dword ptr [ebp-04]
:00425040 50                      push eax
:00425041 8B45F8                  mov eax, dword ptr [ebp-08]
:00425044 8B048560184500          mov eax, dword ptr [4*eax+00451860]
:0042504B 50                      push eax
:0042504C E8870D0200              call 00445DD8
:00425051 83C408                  add esp, 00000008
:00425054 E9D3FFFFFF              jmp 0042502C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425037(C)
|
:00425059 E900000000              jmp 0042505E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425059(U)
|
:0042505E 5F                      pop edi
:0042505F 5E                      pop esi
:00425060 5B                      pop ebx
:00425061 C9                      leave
:00425062 C3                      ret



* Referenced by a CALL at Address:
|:0042554A   
|
:00425063 55                      push ebp
:00425064 8BEC                    mov ebp, esp
:00425066 53                      push ebx
:00425067 56                      push esi
:00425068 57                      push edi

* Possible StringData Ref from Data Obj ->"C:KAO.E2"
                                  |
:00425069 68382C4500              push 00452C38
:0042506E B938CE4600              mov ecx, 0046CE38
:00425073 E897240000              call 0042750F

* Possible StringData Ref from Data Obj ->"C:MMAP.E2"
                                  |
:00425078 68582C4500              push 00452C58
:0042507D B998E34600              mov ecx, 0046E398
:00425082 E888240000              call 0042750F
:00425087 E900000000              jmp 0042508C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425087(U)
|
:0042508C 5F                      pop edi
:0042508D 5E                      pop esi
:0042508E 5B                      pop ebx
:0042508F C9                      leave
:00425090 C3                      ret


:00425091 55                      push ebp
:00425092 8BEC                    mov ebp, esp
:00425094 53                      push ebx
:00425095 56                      push esi
:00425096 57                      push edi
:00425097 B938CE4600              mov ecx, 0046CE38
:0042509C E87F43FEFF              call 00409420
:004250A1 B998E34600              mov ecx, 0046E398
:004250A6 E87543FEFF              call 00409420
:004250AB E900000000              jmp 004250B0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004250AB(U)
|
:004250B0 5F                      pop edi
:004250B1 5E                      pop esi
:004250B2 5B                      pop ebx
:004250B3 C9                      leave
:004250B4 C3                      ret



* Referenced by a CALL at Address:
|:004251AD   
|
:004250B5 55                      push ebp
:004250B6 8BEC                    mov ebp, esp
:004250B8 83EC0C                  sub esp, 0000000C
:004250BB 53                      push ebx
:004250BC 56                      push esi
:004250BD 57                      push edi

* Possible StringData Ref from Data Obj ->"C:1999end.pal"
                                  |
:004250BE 68C82B4500              push 00452BC8
:004250C3 E8F71C0000              call 00426DBF
:004250C8 83C404                  add esp, 00000004
:004250CB B990A64600              mov ecx, 0046A690
:004250D0 E81B3EFFFF              call 00418EF0
:004250D5 E80D240100              call 004374E7
:004250DA 8D4DF4                  lea ecx, dword ptr [ebp-0C]
:004250DD E80E43FEFF              call 004093F0
:004250E2 A1442F4500              mov eax, dword ptr [00452F44]
:004250E7 50                      push eax

* Possible StringData Ref from Data Obj ->"C:MARK.E2"
                                  |
:004250E8 68F82B4500              push 00452BF8
:004250ED 8D4DF4                  lea ecx, dword ptr [ebp-0C]
:004250F0 E8C2240200              call 004475B7
:004250F5 68004C0400              push 00044C00
:004250FA B918E54600              mov ecx, 0046E518
:004250FF E8DC3FFEFF              call 004090E0
:00425104 50                      push eax
:00425105 6870B50000              push 0000B570
:0042510A 8D4DF4                  lea ecx, dword ptr [ebp-0C]
:0042510D E83E43FEFF              call 00409450
:00425112 8D4DF4                  lea ecx, dword ptr [ebp-0C]
:00425115 E80643FEFF              call 00409420
:0042511A E8DF1B0000              call 00426CFE
:0042511F E8731E0000              call 00426F97
:00425124 E8391F0000              call 00427062
:00425129 A198D44500              mov eax, dword ptr [0045D498]
:0042512E 50                      push eax

* Reference To: USER32.GetMenu, Ord:0101h
                                  |
:0042512F FF1580744700            Call dword ptr [00477480]
:00425135 8945FC                  mov dword ptr [ebp-04], eax
:00425138 8B45FC                  mov eax, dword ptr [ebp-04]
:0042513B 50                      push eax

* Reference To: USER32.GetMenuItemCount, Ord:0105h
                                  |
:0042513C FF1578744700            Call dword ptr [00477478]
:00425142 8945F8                  mov dword ptr [ebp-08], eax
:00425145 837DF801                cmp dword ptr [ebp-08], 00000001
:00425149 0F8514000000            jne 00425163
:0042514F 6A00                    push 00000000
:00425151 E803090000              call 00425A59
:00425156 83C404                  add esp, 00000004
:00425159 6A00                    push 00000000
:0042515B E86B090000              call 00425ACB
:00425160 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425149(C)
|
:00425163 B918E54600              mov ecx, 0046E518
:00425168 E8733FFEFF              call 004090E0
:0042516D 50                      push eax
:0042516E 68B8010000              push 000001B8
:00425173 6880020000              push 00000280
:00425178 6A00                    push 00000000
:0042517A 6A00                    push 00000000
:0042517C E81E060200              call 0044579F
:00425181 83C414                  add esp, 00000014
:00425184 E82E1E0000              call 00426FB7
:00425189 E8EF1D0000              call 00426F7D
:0042518E 6A02                    push 00000002
:00425190 E89A240100              call 0043762F
:00425195 83C404                  add esp, 00000004
:00425198 E8E01A0000              call 00426C7D
:0042519D E900000000              jmp 004251A2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042519D(U)
|
:004251A2 5F                      pop edi
:004251A3 5E                      pop esi
:004251A4 5B                      pop ebx
:004251A5 C9                      leave
:004251A6 C3                      ret



* Referenced by a CALL at Addresses:
|:004251F8   , :00425869   , :00425F42   
|
:004251A7 55                      push ebp
:004251A8 8BEC                    mov ebp, esp
:004251AA 53                      push ebx
:004251AB 56                      push esi
:004251AC 57                      push edi
:004251AD E803FFFFFF              call 004250B5
:004251B2 B990A64600              mov ecx, 0046A690
:004251B7 E8343DFFFF              call 00418EF0
:004251BC B994A64600              mov ecx, 0046A694
:004251C1 E8D23EFFFF              call 00419098
:004251C6 E8331B0000              call 00426CFE
:004251CB E8921E0000              call 00427062
:004251D0 E835FEFFFF              call 0042500A
:004251D5 E872FAFFFF              call 00424C4C
:004251DA 6A01                    push 00000001
:004251DC 6A00                    push 00000000
:004251DE B938534700              mov ecx, 00475338
:004251E3 E820280200              call 00447A08
:004251E8 E900000000              jmp 004251ED

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004251E8(U)
|
:004251ED 5F                      pop edi
:004251EE 5E                      pop esi
:004251EF 5B                      pop ebx
:004251F0 C9                      leave
:004251F1 C3                      ret



* Referenced by a CALL at Address:
|:0040E2B9   
|
:004251F2 55                      push ebp
:004251F3 8BEC                    mov ebp, esp
:004251F5 53                      push ebx
:004251F6 56                      push esi
:004251F7 57                      push edi
:004251F8 E8AAFFFFFF              call 004251A7
:004251FD E900000000              jmp 00425202

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004251FD(U)
|
:00425202 5F                      pop edi
:00425203 5E                      pop esi
:00425204 5B                      pop ebx
:00425205 C9                      leave
:00425206 C3                      ret



* Referenced by a CALL at Addresses:
|:0040ABA6   , :00425540   
|
:00425207 55                      push ebp
:00425208 8BEC                    mov ebp, esp
:0042520A 83EC04                  sub esp, 00000004
:0042520D 53                      push ebx
:0042520E 56                      push esi
:0042520F 57                      push edi
:00425210 C745FC02340000          mov [ebp-04], 00003402
:00425217 8B45FC                  mov eax, dword ptr [ebp-04]
:0042521A 50                      push eax
:0042521B B9D0A64600              mov ecx, 0046A6D0
:00425220 E82B68FEFF              call 0040BA50
:00425225 E900000000              jmp 0042522A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425225(U)
|
:0042522A 5F                      pop edi
:0042522B 5E                      pop esi
:0042522C 5B                      pop ebx
:0042522D C9                      leave
:0042522E C3                      ret


:0042522F 55                      push ebp
:00425230 8BEC                    mov ebp, esp
:00425232 83EC1C                  sub esp, 0000001C
:00425235 53                      push ebx
:00425236 56                      push esi
:00425237 57                      push edi
:00425238 8B4508                  mov eax, dword ptr [ebp+08]
:0042523B 8945FC                  mov dword ptr [ebp-04], eax
:0042523E E92A010000              jmp 0042536D
:00425243 8B450C                  mov eax, dword ptr [ebp+0C]
:00425246 8945F8                  mov dword ptr [ebp-08], eax
:00425249 E919000000              jmp 00425267
:0042524E E919000000              jmp 0042526C
:00425253 E914000000              jmp 0042526C
:00425258 E90F000000              jmp 0042526C
:0042525D E90A000000              jmp 0042526C
:00425262 E905000000              jmp 0042526C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425249(U)
|
:00425267 E900000000              jmp 0042526C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042524E(U), :00425253(U), :00425258(U), :0042525D(U), :00425262(U)
|:00425267(U)
|
:0042526C E933010000              jmp 004253A4
:00425271 8B450C                  mov eax, dword ptr [ebp+0C]
:00425274 8945F4                  mov dword ptr [ebp-0C], eax
:00425277 E90F000000              jmp 0042528B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042528F(C)
|
:0042527C E829B9FEFF              call 00410BAA
:00425281 E914000000              jmp 0042529A
:00425286 E90F000000              jmp 0042529A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425277(U)
|
:0042528B 837DF403                cmp dword ptr [ebp-0C], 00000003
:0042528F 0F84E7FFFFFF            je 0042527C
:00425295 E900000000              jmp 0042529A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00425281(U), :00425286(U), :00425295(U)
|
:0042529A E905010000              jmp 004253A4
:0042529F E900010000              jmp 004253A4
:004252A4 8B450C                  mov eax, dword ptr [ebp+0C]
:004252A7 8945F0                  mov dword ptr [ebp-10], eax
:004252AA E91B000000              jmp 004252CA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004252D8(C)
|
:004252AF 33C0                    xor eax, eax
:004252B1 8A450C                  mov al, byte ptr [ebp+0C]
:004252B4 48                      dec eax
:004252B5 50                      push eax
:004252B6 B9D0A64600              mov ecx, 0046A6D0
:004252BB E83067FEFF              call 0040B9F0
:004252C0 E91E000000              jmp 004252E3
:004252C5 E919000000              jmp 004252E3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004252AA(U)
|
:004252CA 837DF001                cmp dword ptr [ebp-10], 00000001
:004252CE 0F8C0F000000            jl 004252E3
:004252D4 837DF004                cmp dword ptr [ebp-10], 00000004
:004252D8 0F8ED1FFFFFF            jle 004252AF
:004252DE E900000000              jmp 004252E3

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004252C0(U), :004252C5(U), :004252CE(C), :004252DE(U)
|
:004252E3 E9BC000000              jmp 004253A4
:004252E8 8B450C                  mov eax, dword ptr [ebp+0C]
:004252EB 8945EC                  mov dword ptr [ebp-14], eax
:004252EE E914000000              jmp 00425307

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042530B(C)
|
:004252F3 E87EB7FEFF              call 00410A76
:004252F8 E919000000              jmp 00425316
:004252FD E914000000              jmp 00425316
:00425302 E90F000000              jmp 00425316

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004252EE(U)
|
:00425307 837DEC01                cmp dword ptr [ebp-14], 00000001
:0042530B 0F84E2FFFFFF            je 004252F3
:00425311 E900000000              jmp 00425316

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004252F8(U), :004252FD(U), :00425302(U), :00425311(U)
|
:00425316 E989000000              jmp 004253A4
:0042531B 8B450C                  mov eax, dword ptr [ebp+0C]
:0042531E 8945E8                  mov dword ptr [ebp-18], eax
:00425321 E90F000000              jmp 00425335
:00425326 E90F000000              jmp 0042533A
:0042532B E90A000000              jmp 0042533A
:00425330 E905000000              jmp 0042533A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425321(U)
|
:00425335 E900000000              jmp 0042533A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00425326(U), :0042532B(U), :00425330(U), :00425335(U)
|
:0042533A E965000000              jmp 004253A4
:0042533F 8B450C                  mov eax, dword ptr [ebp+0C]
:00425342 8945E4                  mov dword ptr [ebp-1C], eax
:00425345 E90F000000              jmp 00425359
:0042534A E90F000000              jmp 0042535E
:0042534F E90A000000              jmp 0042535E
:00425354 E905000000              jmp 0042535E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425345(U)
|
:00425359 E900000000              jmp 0042535E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042534A(U), :0042534F(U), :00425354(U), :00425359(U)
|
:0042535E E941000000              jmp 004253A4
:00425363 E93C000000              jmp 004253A4
:00425368 E937000000              jmp 004253A4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042523E(U)
|
:0042536D 816DFC81000000          sub dword ptr [ebp-04], 00000081
:00425374 837DFC06                cmp dword ptr [ebp-04], 00000006
:00425378 0F8726000000            ja 004253A4
:0042537E 8B45FC                  mov eax, dword ptr [ebp-04]
:00425381 FF248588534200          jmp dword ptr [4*eax+00425388]

:00425388 43524200                DWORD 00425243
:0042538C 71524200                DWORD 00425271
:00425390 9F524200                DWORD 0042529F
:00425394 A4524200                DWORD 004252A4
:00425398 E8524200                DWORD 004252E8
:0042539C 1B534200                DWORD 0042531B
:004253A0 3F534200                DWORD 0042533F



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042526C(U), :0042529A(U), :0042529F(U), :004252E3(U), :00425316(U)
|:0042533A(U), :0042535E(U), :00425363(U), :00425368(U), :00425378(C)
|
:004253A4 E900000000              jmp 004253A9
:004253A9 5F                      pop edi
:004253AA 5E                      pop esi
:004253AB 5B                      pop ebx
:004253AC C9                      leave
:004253AD C3                      ret



* Referenced by a CALL at Address:
|:004258DF   
|
:004253AE 55                      push ebp
:004253AF 8BEC                    mov ebp, esp
:004253B1 83EC04                  sub esp, 00000004
:004253B4 53                      push ebx
:004253B5 56                      push esi
:004253B6 57                      push edi
:004253B7 8D4DFC                  lea ecx, dword ptr [ebp-04]
:004253BA E83140FEFF              call 004093F0

* Possible StringData Ref from Data Obj ->"C:press.pal"
                                  |
:004253BF 68D82B4500              push 00452BD8
:004253C4 E8F6190000              call 00426DBF
:004253C9 83C404                  add esp, 00000004
:004253CC A1442F4500              mov eax, dword ptr [00452F44]
:004253D1 50                      push eax

* Possible StringData Ref from Data Obj ->"C:MARK.E2"
                                  |
:004253D2 68F82B4500              push 00452BF8
:004253D7 8D4DFC                  lea ecx, dword ptr [ebp-04]
:004253DA E8D8210200              call 004475B7
:004253DF 68004C0400              push 00044C00
:004253E4 B918E54600              mov ecx, 0046E518
:004253E9 E8F23CFEFF              call 004090E0
:004253EE 50                      push eax
:004253EF 68704D0900              push 00094D70
:004253F4 8D4DFC                  lea ecx, dword ptr [ebp-04]
:004253F7 E85440FEFF              call 00409450
:004253FC 8D4DFC                  lea ecx, dword ptr [ebp-04]
:004253FF E81C40FEFF              call 00409420
:00425404 E8F5180000              call 00426CFE
:00425409 E8891B0000              call 00426F97
:0042540E E84F1C0000              call 00427062
:00425413 B918E54600              mov ecx, 0046E518
:00425418 E8C33CFEFF              call 004090E0
:0042541D 50                      push eax
:0042541E 68B8010000              push 000001B8
:00425423 6880020000              push 00000280
:00425428 6A00                    push 00000000
:0042542A 6A00                    push 00000000
:0042542C E86E030200              call 0044579F
:00425431 83C414                  add esp, 00000014
:00425434 E87E1B0000              call 00426FB7
:00425439 E83F1B0000              call 00426F7D
:0042543E 6A02                    push 00000002
:00425440 E8EA210100              call 0043762F
:00425445 83C404                  add esp, 00000004
:00425448 E830180000              call 00426C7D

* Possible StringData Ref from Data Obj ->"C:acertwp.pal"
                                  |
:0042544D 68B82B4500              push 00452BB8
:00425452 E868190000              call 00426DBF
:00425457 83C404                  add esp, 00000004
:0042545A A1442F4500              mov eax, dword ptr [00452F44]
:0042545F 50                      push eax

* Possible StringData Ref from Data Obj ->"C:MARK.E2"
                                  |
:00425460 68F82B4500              push 00452BF8
:00425465 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00425468 E84A210200              call 004475B7
:0042546D 68004C0400              push 00044C00
:00425472 B918E54600              mov ecx, 0046E518
:00425477 E8643CFEFF              call 004090E0
:0042547C 50                      push eax
:0042547D 6870010500              push 00050170
:00425482 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00425485 E8C63FFEFF              call 00409450
:0042548A 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0042548D E88E3FFEFF              call 00409420
:00425492 E867180000              call 00426CFE
:00425497 E8FB1A0000              call 00426F97
:0042549C E8C11B0000              call 00427062
:004254A1 B918E54600              mov ecx, 0046E518
:004254A6 E8353CFEFF              call 004090E0
:004254AB 50                      push eax
:004254AC 68B8010000              push 000001B8
:004254B1 6880020000              push 00000280
:004254B6 6A00                    push 00000000
:004254B8 6A00                    push 00000000
:004254BA E8E0020200              call 0044579F
:004254BF 83C414                  add esp, 00000014
:004254C2 E8F01A0000              call 00426FB7
:004254C7 E8B11A0000              call 00426F7D
:004254CC 6A02                    push 00000002
:004254CE E85C210100              call 0043762F
:004254D3 83C404                  add esp, 00000004
:004254D6 E8A2170000              call 00426C7D
:004254DB E900000000              jmp 004254E0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004254DB(U)
|
:004254E0 5F                      pop edi
:004254E1 5E                      pop esi
:004254E2 5B                      pop ebx
:004254E3 C9                      leave
:004254E4 C3                      ret



* Referenced by a CALL at Address:
|:00425F38   
|
:004254E5 55                      push ebp
:004254E6 8BEC                    mov ebp, esp
:004254E8 83EC04                  sub esp, 00000004
:004254EB 53                      push ebx
:004254EC 56                      push esi
:004254ED 57                      push edi
:004254EE 6A00                    push 00000000
:004254F0 E8D6050000              call 00425ACB
:004254F5 83C404                  add esp, 00000004
:004254F8 C745FC00AA4600          mov [ebp-04], 0046AA00
:004254FF 6A00                    push 00000000
:00425501 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00425504 E817C3FDFF              call 00401820
:00425509 B938534700              mov ecx, 00475338
:0042550E E8FC230200              call 0044790F
:00425513 E87C1E0100              call 00437394
:00425518 E800F9FFFF              call 00424E1D
:0042551D E88EF6FFFF              call 00424BB0
:00425522 B988534500              mov ecx, 00455388
:00425527 E803C7FDFF              call 00401C2F
:0042552C 6A01                    push 00000001
:0042552E E83A210100              call 0043766D
:00425533 83C404                  add esp, 00000004
:00425536 6A00                    push 00000000
:00425538 E84B090000              call 00425E88
:0042553D 83C404                  add esp, 00000004
:00425540 E8C2FCFFFF              call 00425207
:00425545 E8EBF9FFFF              call 00424F35
:0042554A E814FBFFFF              call 00425063
:0042554F 6A00                    push 00000000
:00425551 E8C41D0200              call 0044731A
:00425556 83C404                  add esp, 00000004
:00425559 E82D0D0000              call 0042628B
:0042555E E900000000              jmp 00425563

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042555E(U)
|
:00425563 5F                      pop edi
:00425564 5E                      pop esi
:00425565 5B                      pop ebx
:00425566 C9                      leave
:00425567 C3                      ret



* Referenced by a CALL at Address:
|:00425965   
|
:00425568 55                      push ebp
:00425569 8BEC                    mov ebp, esp
:0042556B 83EC1C                  sub esp, 0000001C
:0042556E 53                      push ebx
:0042556F 56                      push esi
:00425570 57                      push edi
:00425571 C745F800AA4600          mov [ebp-08], 0046AA00
:00425578 C645FC00                mov [ebp-04], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004257FC(U)
|
:0042557C B958BC4600              mov ecx, 0046BC58
:00425581 E8EA0A0000              call 00426070
:00425586 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00425589 E8C2C2FDFF              call 00401850
:0042558E 33C9                    xor ecx, ecx
:00425590 8AC8                    mov cl, al
:00425592 80E10F                  and cl, 0F
:00425595 884DEC                  mov byte ptr [ebp-14], cl
:00425598 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042559B E8E0A7FEFF              call 0040FD80
:004255A0 33C9                    xor ecx, ecx
:004255A2 8AC8                    mov cl, al
:004255A4 33C0                    xor eax, eax
:004255A6 8A45EC                  mov al, byte ptr [ebp-14]
:004255A9 C1E00C                  shl eax, 0C
:004255AC 0BC8                    or ecx, eax
:004255AE 51                      push ecx
:004255AF 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004255B2 E879C3FDFF              call 00401930
:004255B7 33C9                    xor ecx, ecx
:004255B9 8AC8                    mov cl, al
:004255BB 51                      push ecx
:004255BC B9B0C44600              mov ecx, 0046C4B0
:004255C1 E849A40000              call 0042FA0F
:004255C6 C745F000000000          mov [ebp-10], 00000000
:004255CD 6A00                    push 00000000
:004255CF E8B4080000              call 00425E88
:004255D4 83C404                  add esp, 00000004
:004255D7 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004255DA E871C2FDFF              call 00401850
:004255DF 8845EC                  mov byte ptr [ebp-14], al
:004255E2 33C0                    xor eax, eax
:004255E4 8A45EC                  mov al, byte ptr [ebp-14]
:004255E7 83E803                  sub eax, 00000003
:004255EA 83F801                  cmp eax, 00000001
:004255ED 1BC0                    sbb eax, eax
:004255EF F7D8                    neg eax
:004255F1 50                      push eax
:004255F2 E862040000              call 00425A59
:004255F7 83C404                  add esp, 00000004
:004255FA 6A00                    push 00000000
:004255FC E8CA040000              call 00425ACB
:00425601 83C404                  add esp, 00000004
:00425604 33C0                    xor eax, eax
:00425606 8A45FC                  mov al, byte ptr [ebp-04]
:00425609 83F801                  cmp eax, 00000001
:0042560C 0F840A000000            je 0042561C
:00425612 E800BCFDFF              call 00401217
:00425617 E833C1FDFF              call 0040174F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042560C(C)
|
:0042561C 33C0                    xor eax, eax
:0042561E 8A45EC                  mov al, byte ptr [ebp-14]
:00425621 83E00F                  and eax, 0000000F
:00425624 8945E8                  mov dword ptr [ebp-18], eax
:00425627 E989010000              jmp 004257B5
:0042562C E8A321FFFF              call 004177D4
:00425631 E9B7010000              jmp 004257ED
:00425636 681A090000              push 0000091A
:0042563B E801040000              call 00425A41
:00425640 83C404                  add esp, 00000004
:00425643 E88C21FFFF              call 004177D4
:00425648 0FB7C0                  movzx eax, ax
:0042564B 8945F0                  mov dword ptr [ebp-10], eax
:0042564E E99A010000              jmp 004257ED
:00425653 6824090000              push 00000924
:00425658 E8E4030000              call 00425A41
:0042565D 83C404                  add esp, 00000004
:00425660 E815A4FEFF              call 0040FA7A
:00425665 8945F0                  mov dword ptr [ebp-10], eax
:00425668 E980010000              jmp 004257ED
:0042566D 682E090000              push 0000092E
:00425672 E8CA030000              call 00425A41
:00425677 83C404                  add esp, 00000004
:0042567A E81A9AFEFF              call 0040F099
:0042567F 8945F0                  mov dword ptr [ebp-10], eax
:00425682 E966010000              jmp 004257ED
:00425687 C7057853450000000000    mov dword ptr [00455378], 00000000
:00425691 68300C0000              push 00000C30
:00425696 E8A6030000              call 00425A41
:0042569B 83C404                  add esp, 00000004
:0042569E C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425787(U)
|
:004256A5 6A01                    push 00000001
:004256A7 E86E1C0200              call 0044731A
:004256AC 83C404                  add esp, 00000004
:004256AF B998FC4600              mov ecx, 0046FC98
:004256B4 E838DE0100              call 004434F1
:004256B9 33C9                    xor ecx, ecx
:004256BB 8AC8                    mov cl, al
:004256BD 894DE4                  mov dword ptr [ebp-1C], ecx
:004256C0 E94A000000              jmp 0042570F
:004256C5 834DF020                or dword ptr [ebp-10], 00000020
:004256C9 E96C000000              jmp 0042573A
:004256CE C745F401000000          mov [ebp-0C], 00000001
:004256D5 E960000000              jmp 0042573A
:004256DA 834DF040                or dword ptr [ebp-10], 00000040
:004256DE E957000000              jmp 0042573A
:004256E3 834DF008                or dword ptr [ebp-10], 00000008
:004256E7 E94E000000              jmp 0042573A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425716(C)
|
:004256EC E8F9BDFDFF              call 004014EA
:004256F1 6A00                    push 00000000
:004256F3 E861030000              call 00425A59
:004256F8 83C404                  add esp, 00000004
:004256FB 6A00                    push 00000000
:004256FD E8C9030000              call 00425ACB
:00425702 83C404                  add esp, 00000004
:00425705 E930000000              jmp 0042573A
:0042570A E92B000000              jmp 0042573A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004256C0(U)
|
:0042570F FF4DE4                  dec [ebp-1C]
:00425712 837DE404                cmp dword ptr [ebp-1C], 00000004
:00425716 0F87D0FFFFFF            ja 004256EC
:0042571C 8B45E4                  mov eax, dword ptr [ebp-1C]
:0042571F FF248526574200          jmp dword ptr [4*eax+00425726]

:00425726 CE564200                DWORD 004256CE
:0042572A EC564200                DWORD 004256EC
:0042572E C5564200                DWORD 004256C5
:00425732 DA564200                DWORD 004256DA
:00425736 E3564200                DWORD 004256E3



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004256C9(U), :004256D5(U), :004256DE(U), :004256E7(U), :00425705(U)
|:0042570A(U)
|
:0042573A 837DF401                cmp dword ptr [ebp-0C], 00000001
:0042573E 0F852A000000            jne 0042576E
:00425744 B900E54600              mov ecx, 0046E500
:00425749 E89239FEFF              call 004090E0
:0042574E 50                      push eax
:0042574F B9B0C44600              mov ecx, 0046C4B0
:00425754 E86D960000              call 0042EDC6
:00425759 50                      push eax
:0042575A E85D46FEFF              call 00409DBC
:0042575F 83C404                  add esp, 00000004
:00425762 C745F400000000          mov [ebp-0C], 00000000
:00425769 E919000000              jmp 00425787
:0042576E F645F008                test [ebp-10], 08
:00425772 0F850A000000            jne 00425782
:00425778 B9B0C44600              mov ecx, 0046C4B0
:0042577D E83E080000              call 00425FC0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425772(C)
|
:00425782 E905000000              jmp 0042578C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425769(U)
|
:00425787 E919FFFFFF              jmp 004256A5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425782(U)
|
:0042578C E88DB8FDFF              call 0040101E
:00425791 33C9                    xor ecx, ecx
:00425793 8AC8                    mov cl, al
:00425795 83F903                  cmp ecx, 00000003
:00425798 0F8509000000            jne 004257A7
:0042579E C645FC01                mov [ebp-04], 01
:004257A2 E904000000              jmp 004257AB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425798(C)
|
:004257A7 C645FC00                mov [ebp-04], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004257A2(U)
|
:004257AB E93D000000              jmp 004257ED
:004257B0 E938000000              jmp 004257ED

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425627(U)
|
:004257B5 837DE808                cmp dword ptr [ebp-18], 00000008
:004257B9 0F872E000000            ja 004257ED
:004257BF 8B45E8                  mov eax, dword ptr [ebp-18]
:004257C2 FF2485C9574200          jmp dword ptr [4*eax+004257C9]

:004257C9 53564200                DWORD 00425653
:004257CD 6D564200                DWORD 0042566D
:004257D1 36564200                DWORD 00425636
:004257D5 87564200                DWORD 00425687
:004257D9 ED574200                DWORD 004257ED
:004257DD ED574200                DWORD 004257ED
:004257E1 2C564200                DWORD 0042562C
:004257E5 2C564200                DWORD 0042562C
:004257E9 2C564200                DWORD 0042562C



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00425631(U), :0042564E(U), :00425668(U), :00425682(U), :004257AB(U)
|:004257B0(U), :004257B9(C)
|
:004257ED F645F06C                test [ebp-10], 6C
:004257F1 0F8405000000            je 004257FC
:004257F7 E905000000              jmp 00425801

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004257F1(C)
|
:004257FC E97BFDFFFF              jmp 0042557C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004257F7(U)
|
:00425801 8B45F0                  mov eax, dword ptr [ebp-10]
:00425804 E900000000              jmp 00425809

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425804(U)
|
:00425809 5F                      pop edi
:0042580A 5E                      pop esi
:0042580B 5B                      pop ebx
:0042580C C9                      leave
:0042580D C3                      ret



* Referenced by a CALL at Address:
|:004258DA   
|
:0042580E 55                      push ebp
:0042580F 8BEC                    mov ebp, esp
:00425811 83EC0C                  sub esp, 0000000C
:00425814 53                      push ebx
:00425815 56                      push esi
:00425816 57                      push edi

* Possible StringData Ref from Data Obj ->"롺־ for Windows95Ḷ́
"
                                        ->"밴ԡť"
                                  |
:00425817 C745F4041A4500          mov [ebp-0C], 00451A04

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042586E(U)
|
:0042581E 6A01                    push 00000001

* Reference To: KERNEL32.SetErrorMode, Ord:01F2h
                                  |
:00425820 FF1520734700            Call dword ptr [00477320]
:00425826 E8370E0000              call 00426662
:0042582B 8945FC                  mov dword ptr [ebp-04], eax
:0042582E 837DFCFF                cmp dword ptr [ebp-04], FFFFFFFF
:00425832 0F8405000000            je 0042583D
:00425838 E936000000              jmp 00425873

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425832(C)
|
:0042583D 6A00                    push 00000000

* Reference To: KERNEL32.SetErrorMode, Ord:01F2h
                                  |
:0042583F FF1520734700            Call dword ptr [00477320]
:00425845 6A35                    push 00000035

* Possible StringData Ref from Data Obj ->"־ for Windows95"
                                  |
:00425847 68481A4500              push 00451A48
:0042584C 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042584F 50                      push eax
:00425850 A198D44500              mov eax, dword ptr [0045D498]
:00425855 50                      push eax

* Reference To: USER32.MessageBoxA, Ord:0188h
                                  |
:00425856 FF151C744700            Call dword ptr [0047741C]
:0042585C 8945F8                  mov dword ptr [ebp-08], eax
:0042585F 837DF802                cmp dword ptr [ebp-08], 00000002
:00425863 0F8505000000            jne 0042586E
:00425869 E839F9FFFF              call 004251A7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425863(C)
|
:0042586E E9ABFFFFFF              jmp 0042581E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425838(U)
|
:00425873 E900000000              jmp 00425878

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425873(U)
|
:00425878 5F                      pop edi
:00425879 5E                      pop esi
:0042587A 5B                      pop ebx
:0042587B C9                      leave
:0042587C C3                      ret



* Referenced by a CALL at Address:
|:004259D0   
|
:0042587D 55                      push ebp
:0042587E 8BEC                    mov ebp, esp
:00425880 53                      push ebx
:00425881 56                      push esi
:00425882 57                      push edi
:00425883 B994A64600              mov ecx, 0046A694
:00425888 E80B38FFFF              call 00419098
:0042588D B990A64600              mov ecx, 0046A690
:00425892 E85936FFFF              call 00418EF0
:00425897 E84B1C0100              call 004374E7
:0042589C E85D140000              call 00426CFE
:004258A1 E8BC170000              call 00427062
:004258A6 6A00                    push 00000000
:004258A8 6A00                    push 00000000
:004258AA 6A00                    push 00000000
:004258AC 6A49                    push 00000049
:004258AE E853100000              call 00426906
:004258B3 83C410                  add esp, 00000010
:004258B6 6A01                    push 00000001
:004258B8 E8911D0100              call 0043764E
:004258BD 83C404                  add esp, 00000004
:004258C0 E900000000              jmp 004258C5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004258C0(U)
|
:004258C5 5F                      pop edi
:004258C6 5E                      pop esi
:004258C7 5B                      pop ebx
:004258C8 C9                      leave
:004258C9 C3                      ret



* Referenced by a CALL at Address:
|:00425F3D   
|
:004258CA 55                      push ebp
:004258CB 8BEC                    mov ebp, esp
:004258CD 83EC08                  sub esp, 00000008
:004258D0 53                      push ebx
:004258D1 56                      push esi
:004258D2 57                      push edi
:004258D3 C745FC00000000          mov [ebp-04], 00000000
:004258DA E82FFFFFFF              call 0042580E
:004258DF E8CAFAFFFF              call 004253AE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425A32(U)
|
:004258E4 B9B0C44600              mov ecx, 0046C4B0
:004258E9 E8778B0000              call 0042E465
:004258EE 6A01                    push 00000001
:004258F0 68B8010000              push 000001B8
:004258F5 6880020000              push 00000280
:004258FA E8720C0200              call 00446571
:004258FF 83C40C                  add esp, 0000000C
:00425902 E8935EFEFF              call 0040B79A
:00425907 8945F8                  mov dword ptr [ebp-08], eax
:0042590A C7057853450000000000    mov dword ptr [00455378], 00000000
:00425914 817DF8FFFF0000          cmp dword ptr [ebp-08], 0000FFFF
:0042591B 0F8416010000            je 00425A37
:00425921 B9B0C44600              mov ecx, 0046C4B0
:00425926 E83D880000              call 0042E168
:0042592B 6A01                    push 00000001
:0042592D E8EA120000              call 00426C1C
:00425932 83C404                  add esp, 00000004
:00425935 837DF800                cmp dword ptr [ebp-08], 00000000
:00425939 0F8526000000            jne 00425965

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425960(U)
|
:0042593F 68FF000000              push 000000FF
:00425944 6A00                    push 00000000
:00425946 E85B92FEFF              call 0040EBA6
:0042594B 83C408                  add esp, 00000008
:0042594E F6057853450002          test byte ptr [00455378], 02
:00425955 0F8405000000            je 00425960
:0042595B E905000000              jmp 00425965

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425955(C)
|
:00425960 E9DAFFFFFF              jmp 0042593F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00425939(C), :0042595B(U), :004259B0(U)
|
:00425965 E8FEFBFFFF              call 00425568
:0042596A 8945FC                  mov dword ptr [ebp-04], eax
:0042596D C745F8FF000000          mov [ebp-08], 000000FF
:00425974 F645FC44                test [ebp-04], 44
:00425978 0F8405000000            je 00425983
:0042597E E932000000              jmp 004259B5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425978(C)
|
:00425983 F645FC20                test [ebp-04], 20
:00425987 0F8405000000            je 00425992
:0042598D E923000000              jmp 004259B5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425987(C)
|
:00425992 F645FC08                test [ebp-04], 08
:00425996 0F8414000000            je 004259B0
:0042599C B9B0C44600              mov ecx, 0046C4B0
:004259A1 E8C2870000              call 0042E168
:004259A6 B958BC4600              mov ecx, 0046BC58
:004259AB E820B2FFFF              call 00420BD0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425996(C)
|
:004259B0 E9B0FFFFFF              jmp 00425965

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042597E(U), :0042598D(U)
|
:004259B5 6AFF                    push FFFFFFFF
:004259B7 E885000000              call 00425A41
:004259BC 83C404                  add esp, 00000004
:004259BF F645FC04                test [ebp-04], 04
:004259C3 0F8416000000            je 004259DF
:004259C9 C745F800000000          mov [ebp-08], 00000000
:004259D0 E8A8FEFFFF              call 0042587D
:004259D5 E962000000              jmp 00425A3C
:004259DA E958000000              jmp 00425A37

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004259C3(C)
|
:004259DF F645FC60                test [ebp-04], 60
:004259E3 0F844E000000            je 00425A37

* Possible StringData Ref from Data Obj ->"һ"
                                  |
:004259E9 68641A4500              push 00451A64
:004259EE 6A06                    push 00000006
:004259F0 E840350100              call 00438F35
:004259F5 83C408                  add esp, 00000008
:004259F8 85C0                    test eax, eax
:004259FA 0F8437000000            je 00425A37
:00425A00 B990A64600              mov ecx, 0046A690
:00425A05 E8E634FFFF              call 00418EF0
:00425A0A E8EF120000              call 00426CFE
:00425A0F E84E160000              call 00427062
:00425A14 6A01                    push 00000001
:00425A16 E8521C0100              call 0043766D
:00425A1B 83C404                  add esp, 00000004
:00425A1E 6A00                    push 00000000
:00425A20 E834000000              call 00425A59
:00425A25 83C404                  add esp, 00000004
:00425A28 6A00                    push 00000000
:00425A2A E89C000000              call 00425ACB
:00425A2F 83C404                  add esp, 00000004
:00425A32 E9ADFEFFFF              jmp 004258E4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042591B(C), :004259DA(U), :004259E3(C), :004259FA(C)
|
:00425A37 E900000000              jmp 00425A3C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004259D5(U), :00425A37(U)
|
:00425A3C 5F                      pop edi
:00425A3D 5E                      pop esi
:00425A3E 5B                      pop ebx
:00425A3F C9                      leave
:00425A40 C3                      ret



* Referenced by a CALL at Addresses:
|:0042563B   , :00425658   , :00425672   , :00425696   , :004259B7   
|:00433AB6   , :00436CEA   , :00436F0C   
|
:00425A41 55                      push ebp
:00425A42 8BEC                    mov ebp, esp
:00425A44 53                      push ebx
:00425A45 56                      push esi
:00425A46 57                      push edi
:00425A47 8B4508                  mov eax, dword ptr [ebp+08]
:00425A4A A3A02B4500              mov dword ptr [00452BA0], eax
:00425A4F E900000000              jmp 00425A54

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425A4F(U)
|
:00425A54 5F                      pop edi
:00425A55 5E                      pop esi
:00425A56 5B                      pop ebx
:00425A57 C9                      leave
:00425A58 C3                      ret



* Referenced by a CALL at Addresses:
|:0040F19B   , :00425151   , :004255F2   , :004256F3   , :00425A20   
|:004408F3   , :00443727   
|
:00425A59 55                      push ebp
:00425A5A 8BEC                    mov ebp, esp
:00425A5C 83EC08                  sub esp, 00000008
:00425A5F 53                      push ebx
:00425A60 56                      push esi
:00425A61 57                      push edi
:00425A62 A198D44500              mov eax, dword ptr [0045D498]
:00425A67 50                      push eax

* Reference To: USER32.GetMenu, Ord:0101h
                                  |
:00425A68 FF1580744700            Call dword ptr [00477480]
:00425A6E 8945FC                  mov dword ptr [ebp-04], eax

* Possible StringData Ref from Data Obj ->"APPMENU"
                                  |
:00425A71 B8741A4500              mov eax, 00451A74

* Possible Reference to Menu: HEXMENU 
                                  |
:00425A76 B97C1A4500              mov ecx, 00451A7C
:00425A7B 33D2                    xor edx, edx
:00425A7D 837D0800                cmp dword ptr [ebp+08], 00000000
:00425A81 0F94C2                  sete dl
:00425A84 4A                      dec edx
:00425A85 2BC8                    sub ecx, eax
:00425A87 23D1                    and edx, ecx
:00425A89 03D0                    add edx, eax
:00425A8B 52                      push edx
:00425A8C A1E8D24500              mov eax, dword ptr [0045D2E8]
:00425A91 50                      push eax

* Reference To: USER32.LoadMenuA, Ord:0172h
                                  |
:00425A92 FF1568744700            Call dword ptr [00477468]
:00425A98 8945F8                  mov dword ptr [ebp-08], eax
:00425A9B 8B45F8                  mov eax, dword ptr [ebp-08]
:00425A9E 50                      push eax
:00425A9F A198D44500              mov eax, dword ptr [0045D498]
:00425AA4 50                      push eax

* Reference To: USER32.SetMenu, Ord:01E7h
                                  |
:00425AA5 FF156C744700            Call dword ptr [0047746C]
:00425AAB A198D44500              mov eax, dword ptr [0045D498]
:00425AB0 50                      push eax

* Reference To: USER32.DrawMenuBar, Ord:00A0h
                                  |
:00425AB1 FF1518744700            Call dword ptr [00477418]
:00425AB7 8B45FC                  mov eax, dword ptr [ebp-04]
:00425ABA 50                      push eax

* Reference To: USER32.DestroyMenu, Ord:0085h
                                  |
:00425ABB FF1514744700            Call dword ptr [00477414]
:00425AC1 E900000000              jmp 00425AC6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425AC1(U)
|
:00425AC6 5F                      pop edi
:00425AC7 5E                      pop esi
:00425AC8 5B                      pop ebx
:00425AC9 C9                      leave
:00425ACA C3                      ret



* Referenced by a CALL at Addresses:
|:0040F087   , :0040F0C7   , :0040F1AA   , :00411577   , :0042515B   
|:004254F0   , :004255FC   , :004256FD   , :00425A2A   , :00435889   
|:00436EBF   , :004408FD   , :00442D2A   , :00442F19   , :00443099   
|:004430DB   , :00443136   , :00443731   
|
:00425ACB 55                      push ebp
:00425ACC 8BEC                    mov ebp, esp
:00425ACE 83EC14                  sub esp, 00000014
:00425AD1 53                      push ebx
:00425AD2 56                      push esi
:00425AD3 57                      push edi
:00425AD4 A198D44500              mov eax, dword ptr [0045D498]
:00425AD9 50                      push eax

* Reference To: USER32.GetMenu, Ord:0101h
                                  |
:00425ADA FF1580744700            Call dword ptr [00477480]
:00425AE0 8945F4                  mov dword ptr [ebp-0C], eax
:00425AE3 8B45F4                  mov eax, dword ptr [ebp-0C]
:00425AE6 50                      push eax

* Reference To: USER32.GetMenuItemCount, Ord:0105h
                                  |
:00425AE7 FF1578744700            Call dword ptr [00477478]
:00425AED 8945F0                  mov dword ptr [ebp-10], eax
:00425AF0 837D0800                cmp dword ptr [ebp+08], 00000000
:00425AF4 0F840C000000            je 00425B06
:00425AFA C745F800040000          mov [ebp-08], 00000400
:00425B01 E907000000              jmp 00425B0D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425AF4(C)
|
:00425B06 C745F801040000          mov [ebp-08], 00000401

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425B01(U)
|
:00425B0D E80CB5FDFF              call 0040101E
:00425B12 33C9                    xor ecx, ecx
:00425B14 8AC8                    mov cl, al
:00425B16 83F903                  cmp ecx, 00000003
:00425B19 0F8474000000            je 00425B93
:00425B1F C745EC00000000          mov [ebp-14], 00000000
:00425B26 E903000000              jmp 00425B2E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425B4A(U)
|
:00425B2B FF45EC                  inc [ebp-14]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425B26(U)
|
:00425B2E 837DEC05                cmp dword ptr [ebp-14], 00000005
:00425B32 0F8317000000            jnb 00425B4F
:00425B38 8B45F8                  mov eax, dword ptr [ebp-08]
:00425B3B 50                      push eax
:00425B3C 8B45EC                  mov eax, dword ptr [ebp-14]
:00425B3F 50                      push eax
:00425B40 8B45F4                  mov eax, dword ptr [ebp-0C]
:00425B43 50                      push eax

* Reference To: USER32.EnableMenuItem, Ord:00A9h
                                  |
:00425B44 FF15E0734700            Call dword ptr [004773E0]
:00425B4A E9DCFFFFFF              jmp 00425B2B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425B32(C)
|
:00425B4F 6A01                    push 00000001
:00425B51 8B45F4                  mov eax, dword ptr [ebp-0C]
:00425B54 50                      push eax

* Reference To: USER32.GetSubMenu, Ord:011Fh
                                  |
:00425B55 FF15E4734700            Call dword ptr [004773E4]
:00425B5B 8945FC                  mov dword ptr [ebp-04], eax
:00425B5E C745EC00000000          mov [ebp-14], 00000000
:00425B65 E903000000              jmp 00425B6D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425B89(U)
|
:00425B6A FF45EC                  inc [ebp-14]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425B65(U)
|
:00425B6D 837DEC06                cmp dword ptr [ebp-14], 00000006
:00425B71 0F8317000000            jnb 00425B8E
:00425B77 8B45F8                  mov eax, dword ptr [ebp-08]
:00425B7A 50                      push eax
:00425B7B 8B45EC                  mov eax, dword ptr [ebp-14]
:00425B7E 50                      push eax
:00425B7F 8B45FC                  mov eax, dword ptr [ebp-04]
:00425B82 50                      push eax

* Reference To: USER32.EnableMenuItem, Ord:00A9h
                                  |
:00425B83 FF15E0734700            Call dword ptr [004773E0]
:00425B89 E9DCFFFFFF              jmp 00425B6A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425B71(C)
|
:00425B8E E930000000              jmp 00425BC3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425B19(C)
|
:00425B93 C745EC00000000          mov [ebp-14], 00000000
:00425B9A E903000000              jmp 00425BA2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425BBE(U)
|
:00425B9F FF45EC                  inc [ebp-14]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425B9A(U)
|
:00425BA2 837DEC05                cmp dword ptr [ebp-14], 00000005
:00425BA6 0F8317000000            jnb 00425BC3
:00425BAC 8B45F8                  mov eax, dword ptr [ebp-08]
:00425BAF 50                      push eax
:00425BB0 8B45EC                  mov eax, dword ptr [ebp-14]
:00425BB3 50                      push eax
:00425BB4 8B45F4                  mov eax, dword ptr [ebp-0C]
:00425BB7 50                      push eax

* Reference To: USER32.EnableMenuItem, Ord:00A9h
                                  |
:00425BB8 FF15E0734700            Call dword ptr [004773E0]
:00425BBE E9DCFFFFFF              jmp 00425B9F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00425B8E(U), :00425BA6(C)
|
:00425BC3 A198D44500              mov eax, dword ptr [0045D498]
:00425BC8 50                      push eax

* Reference To: USER32.DrawMenuBar, Ord:00A0h
                                  |
:00425BC9 FF1518744700            Call dword ptr [00477418]
:00425BCF E900000000              jmp 00425BD4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425BCF(U)
|
:00425BD4 5F                      pop edi
:00425BD5 5E                      pop esi
:00425BD6 5B                      pop ebx
:00425BD7 C9                      leave
:00425BD8 C3                      ret



* Referenced by a CALL at Addresses:
|:00435543   , :00436D8E   
|
:00425BD9 55                      push ebp
:00425BDA 8BEC                    mov ebp, esp
:00425BDC 83EC10                  sub esp, 00000010
:00425BDF 53                      push ebx
:00425BE0 56                      push esi
:00425BE1 57                      push edi
:00425BE2 A198D44500              mov eax, dword ptr [0045D498]
:00425BE7 50                      push eax

* Reference To: USER32.GetMenu, Ord:0101h
                                  |
:00425BE8 FF1580744700            Call dword ptr [00477480]
:00425BEE 8945F8                  mov dword ptr [ebp-08], eax
:00425BF1 8B45F8                  mov eax, dword ptr [ebp-08]
:00425BF4 50                      push eax

* Reference To: USER32.GetMenuItemCount, Ord:0105h
                                  |
:00425BF5 FF1578744700            Call dword ptr [00477478]
:00425BFB 8945F4                  mov dword ptr [ebp-0C], eax
:00425BFE C745F000000000          mov [ebp-10], 00000000
:00425C05 E903000000              jmp 00425C0D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425C46(U)
|
:00425C0A FF45F0                  inc [ebp-10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425C05(U)
|
:00425C0D 837DF005                cmp dword ptr [ebp-10], 00000005
:00425C11 0F8334000000            jnb 00425C4B
:00425C17 837DF003                cmp dword ptr [ebp-10], 00000003
:00425C1B 0F820C000000            jb 00425C2D
:00425C21 C745FC00040000          mov [ebp-04], 00000400
:00425C28 E907000000              jmp 00425C34

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425C1B(C)
|
:00425C2D C745FC01040000          mov [ebp-04], 00000401

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425C28(U)
|
:00425C34 8B45FC                  mov eax, dword ptr [ebp-04]
:00425C37 50                      push eax
:00425C38 8B45F0                  mov eax, dword ptr [ebp-10]
:00425C3B 50                      push eax
:00425C3C 8B45F8                  mov eax, dword ptr [ebp-08]
:00425C3F 50                      push eax

* Reference To: USER32.EnableMenuItem, Ord:00A9h
                                  |
:00425C40 FF15E0734700            Call dword ptr [004773E0]
:00425C46 E9BFFFFFFF              jmp 00425C0A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425C11(C)
|
:00425C4B A198D44500              mov eax, dword ptr [0045D498]
:00425C50 50                      push eax

* Reference To: USER32.DrawMenuBar, Ord:00A0h
                                  |
:00425C51 FF1518744700            Call dword ptr [00477418]
:00425C57 E900000000              jmp 00425C5C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425C57(U)
|
:00425C5C 5F                      pop edi
:00425C5D 5E                      pop esi
:00425C5E 5B                      pop ebx
:00425C5F C9                      leave
:00425C60 C3                      ret



* Referenced by a CALL at Addresses:
|:00425D17   , :00425D72   , :00425DC8   , :00425DFB   , :00425E40   
|:0043FDC2   , :0043FE0B   , :0043FE54   , :0043FE95   , :0043FED9   
|:0043FF24   , :0043FF6D   , :0043FFB6   , :00440015   
|
:00425C61 55                      push ebp
:00425C62 8BEC                    mov ebp, esp
:00425C64 83EC04                  sub esp, 00000004
:00425C67 53                      push ebx
:00425C68 56                      push esi
:00425C69 57                      push edi
:00425C6A C745FC00000000          mov [ebp-04], 00000000
:00425C71 E903000000              jmp 00425C79

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425C98(U)
|
:00425C76 FF45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425C71(U)
|
:00425C79 8B450C                  mov eax, dword ptr [ebp+0C]
:00425C7C 3945FC                  cmp dword ptr [ebp-04], eax
:00425C7F 0F8318000000            jnb 00425C9D
:00425C85 6800040000              push 00000400
:00425C8A 8B45FC                  mov eax, dword ptr [ebp-04]
:00425C8D 50                      push eax
:00425C8E 8B4508                  mov eax, dword ptr [ebp+08]
:00425C91 50                      push eax

* Reference To: USER32.CheckMenuItem, Ord:002Dh
                                  |
:00425C92 FF1510744700            Call dword ptr [00477410]
:00425C98 E9D9FFFFFF              jmp 00425C76

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425C7F(C)
|
:00425C9D E900000000              jmp 00425CA2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425C9D(U)
|
:00425CA2 5F                      pop edi
:00425CA3 5E                      pop esi
:00425CA4 5B                      pop ebx
:00425CA5 C9                      leave
:00425CA6 C3                      ret



* Referenced by a CALL at Addresses:
|:0040F080   , :0040F1A3   , :00415892   , :00440905   , :00442D23   
|
:00425CA7 55                      push ebp
:00425CA8 8BEC                    mov ebp, esp
:00425CAA 83EC2C                  sub esp, 0000002C
:00425CAD 53                      push ebx
:00425CAE 56                      push esi
:00425CAF 57                      push edi
:00425CB0 A198D44500              mov eax, dword ptr [0045D498]
:00425CB5 50                      push eax

* Reference To: USER32.GetMenu, Ord:0101h
                                  |
:00425CB6 FF1580744700            Call dword ptr [00477480]
:00425CBC 8945E4                  mov dword ptr [ebp-1C], eax
:00425CBF 8B45E4                  mov eax, dword ptr [ebp-1C]
:00425CC2 50                      push eax

* Reference To: USER32.GetMenuItemCount, Ord:0105h
                                  |
:00425CC3 FF1578744700            Call dword ptr [00477478]
:00425CC9 8945E0                  mov dword ptr [ebp-20], eax
:00425CCC C745E800200000          mov [ebp-18], 00002000
:00425CD3 C745EC00100000          mov [ebp-14], 00001000
:00425CDA C745F000100000          mov [ebp-10], 00001000
:00425CE1 E838B3FDFF              call 0040101E
:00425CE6 33C9                    xor ecx, ecx
:00425CE8 8AC8                    mov cl, al
:00425CEA 83F903                  cmp ecx, 00000003
:00425CED 0F8486010000            je 00425E79
:00425CF3 6A01                    push 00000001
:00425CF5 8B45E4                  mov eax, dword ptr [ebp-1C]
:00425CF8 50                      push eax

* Reference To: USER32.GetSubMenu, Ord:011Fh
                                  |
:00425CF9 FF15E4734700            Call dword ptr [004773E4]
:00425CFF 8945FC                  mov dword ptr [ebp-04], eax
:00425D02 6A00                    push 00000000
:00425D04 8B45FC                  mov eax, dword ptr [ebp-04]
:00425D07 50                      push eax

* Reference To: USER32.GetSubMenu, Ord:011Fh
                                  |
:00425D08 FF15E4734700            Call dword ptr [004773E4]
:00425D0E 8945F4                  mov dword ptr [ebp-0C], eax
:00425D11 6A04                    push 00000004
:00425D13 8B45F4                  mov eax, dword ptr [ebp-0C]
:00425D16 50                      push eax
:00425D17 E845FFFFFF              call 00425C61
:00425D1C 83C408                  add esp, 00000008
:00425D1F B9D0A64600              mov ecx, 0046A6D0
:00425D24 E8A75CFEFF              call 0040B9D0
:00425D29 8845D4                  mov byte ptr [ebp-2C], al
:00425D2C 6808040000              push 00000408
:00425D31 33C0                    xor eax, eax
:00425D33 8A45D4                  mov al, byte ptr [ebp-2C]
:00425D36 50                      push eax
:00425D37 8B45F4                  mov eax, dword ptr [ebp-0C]
:00425D3A 50                      push eax

* Reference To: USER32.CheckMenuItem, Ord:002Dh
                                  |
:00425D3B FF1510744700            Call dword ptr [00477410]
:00425D41 C745DC00000000          mov [ebp-24], 00000000
:00425D48 E903000000              jmp 00425D50

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425DAE(U)
|
:00425D4D FF45DC                  inc [ebp-24]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425D48(U)
|
:00425D50 837DDC02                cmp dword ptr [ebp-24], 00000002
:00425D54 0F8359000000            jnb 00425DB3
:00425D5A 8B45DC                  mov eax, dword ptr [ebp-24]
:00425D5D 40                      inc eax
:00425D5E 50                      push eax
:00425D5F 8B45FC                  mov eax, dword ptr [ebp-04]
:00425D62 50                      push eax

* Reference To: USER32.GetSubMenu, Ord:011Fh
                                  |
:00425D63 FF15E4734700            Call dword ptr [004773E4]
:00425D69 8945F4                  mov dword ptr [ebp-0C], eax
:00425D6C 6A02                    push 00000002
:00425D6E 8B45F4                  mov eax, dword ptr [ebp-0C]
:00425D71 50                      push eax
:00425D72 E8EAFEFFFF              call 00425C61
:00425D77 83C408                  add esp, 00000008
:00425D7A 8B45DC                  mov eax, dword ptr [ebp-24]
:00425D7D 8B4485E8                mov eax, dword ptr [ebp+4*eax-18]
:00425D81 8945F8                  mov dword ptr [ebp-08], eax
:00425D84 B9D0A64600              mov ecx, 0046A6D0
:00425D89 E8925CFEFF              call 0040BA20
:00425D8E 8945D8                  mov dword ptr [ebp-28], eax
:00425D91 6808040000              push 00000408
:00425D96 8B45D8                  mov eax, dword ptr [ebp-28]
:00425D99 2345F8                  and eax, dword ptr [ebp-08]
:00425D9C 83F801                  cmp eax, 00000001
:00425D9F 1BC0                    sbb eax, eax
:00425DA1 F7D8                    neg eax
:00425DA3 50                      push eax
:00425DA4 8B45F4                  mov eax, dword ptr [ebp-0C]
:00425DA7 50                      push eax

* Reference To: USER32.CheckMenuItem, Ord:002Dh
                                  |
:00425DA8 FF1510744700            Call dword ptr [00477410]
:00425DAE E99AFFFFFF              jmp 00425D4D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425D54(C)
|
:00425DB3 6A03                    push 00000003
:00425DB5 8B45FC                  mov eax, dword ptr [ebp-04]
:00425DB8 50                      push eax

* Reference To: USER32.GetSubMenu, Ord:011Fh
                                  |
:00425DB9 FF15E4734700            Call dword ptr [004773E4]
:00425DBF 8945F4                  mov dword ptr [ebp-0C], eax
:00425DC2 6A08                    push 00000008
:00425DC4 8B45F4                  mov eax, dword ptr [ebp-0C]
:00425DC7 50                      push eax
:00425DC8 E894FEFFFF              call 00425C61
:00425DCD 83C408                  add esp, 00000008
:00425DD0 6808040000              push 00000408
:00425DD5 8B45D8                  mov eax, dword ptr [ebp-28]
:00425DD8 83E00F                  and eax, 0000000F
:00425DDB 50                      push eax
:00425DDC 8B45F4                  mov eax, dword ptr [ebp-0C]
:00425DDF 50                      push eax

* Reference To: USER32.CheckMenuItem, Ord:002Dh
                                  |
:00425DE0 FF1510744700            Call dword ptr [00477410]
:00425DE6 6A04                    push 00000004
:00425DE8 8B45FC                  mov eax, dword ptr [ebp-04]
:00425DEB 50                      push eax

* Reference To: USER32.GetSubMenu, Ord:011Fh
                                  |
:00425DEC FF15E4734700            Call dword ptr [004773E4]
:00425DF2 8945F4                  mov dword ptr [ebp-0C], eax
:00425DF5 6A02                    push 00000002
:00425DF7 8B45F4                  mov eax, dword ptr [ebp-0C]
:00425DFA 50                      push eax
:00425DFB E861FEFFFF              call 00425C61
:00425E00 83C408                  add esp, 00000008
:00425E03 B9D0A64600              mov ecx, 0046A6D0
:00425E08 E8135CFEFF              call 0040BA20
:00425E0D 8945D8                  mov dword ptr [ebp-28], eax
:00425E10 6808040000              push 00000408
:00425E15 8B45D8                  mov eax, dword ptr [ebp-28]
:00425E18 2500080000              and eax, 00000800
:00425E1D C1E80B                  shr eax, 0B
:00425E20 50                      push eax
:00425E21 8B45F4                  mov eax, dword ptr [ebp-0C]
:00425E24 50                      push eax

* Reference To: USER32.CheckMenuItem, Ord:002Dh
                                  |
:00425E25 FF1510744700            Call dword ptr [00477410]
:00425E2B 6A05                    push 00000005
:00425E2D 8B45FC                  mov eax, dword ptr [ebp-04]
:00425E30 50                      push eax

* Reference To: USER32.GetSubMenu, Ord:011Fh
                                  |
:00425E31 FF15E4734700            Call dword ptr [004773E4]
:00425E37 8945F4                  mov dword ptr [ebp-0C], eax
:00425E3A 6A02                    push 00000002
:00425E3C 8B45F4                  mov eax, dword ptr [ebp-0C]
:00425E3F 50                      push eax
:00425E40 E81CFEFFFF              call 00425C61
:00425E45 83C408                  add esp, 00000008
:00425E48 B9D0A64600              mov ecx, 0046A6D0
:00425E4D E8CE5BFEFF              call 0040BA20
:00425E52 8945D8                  mov dword ptr [ebp-28], eax
:00425E55 6808040000              push 00000408
:00425E5A 8B45D8                  mov eax, dword ptr [ebp-28]
:00425E5D 2500400000              and eax, 00004000
:00425E62 83F801                  cmp eax, 00000001
:00425E65 1BC0                    sbb eax, eax
:00425E67 F7D8                    neg eax
:00425E69 50                      push eax
:00425E6A 8B45F4                  mov eax, dword ptr [ebp-0C]
:00425E6D 50                      push eax

* Reference To: USER32.CheckMenuItem, Ord:002Dh
                                  |
:00425E6E FF1510744700            Call dword ptr [00477410]
:00425E74 E905000000              jmp 00425E7E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425CED(C)
|
:00425E79 E8FB9E0100              call 0043FD79

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425E74(U)
|
:00425E7E E900000000              jmp 00425E83

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425E7E(U)
|
:00425E83 5F                      pop edi
:00425E84 5E                      pop esi
:00425E85 5B                      pop ebx
:00425E86 C9                      leave
:00425E87 C3                      ret



* Referenced by a CALL at Addresses:
|:0040A15B   , :0040A195   , :0040AF02   , :0040B096   , :0040B5BA   
|:0040B5F4   , :0040F210   , :0040F252   , :0040F289   , :0040F312   
|:0040F755   , :0040F8EC   , :004102EE   , :00410364   , :00416D2B   
|:00425538   , :004255CF   , :00433D3A   , :00433D49   , :004376DD   
|:00437723   , :00437741   , :00438150   , :00438463   , :0043912C   
|:00439457   , :0043959D   , :0043B44A   , :0043B73E   , :0043BAF0   
|:0043BCD8   , :0043C5ED   , :0043D29E   , :0043E417   , :0043E462   
|:0043E49F   , :0043E722   , :0043E731   , :0043E756   , :0043E77B   
|:0043FB89   , :00441B65   , :00442135   , :004421E0   , :00442ADC   
|:00442D34   , :004434FF   , :00443511   , :00444005   
|
:00425E88 55                      push ebp
:00425E89 8BEC                    mov ebp, esp
:00425E8B 83EC04                  sub esp, 00000004
:00425E8E 53                      push ebx
:00425E8F 56                      push esi
:00425E90 57                      push edi

* Reference To: USER32.GetActiveWindow, Ord:00CDh
                                  |
:00425E91 FF15F0734700            Call dword ptr [004773F0]
:00425E97 A324BD4600              mov dword ptr [0046BD24], eax
:00425E9C A124BD4600              mov eax, dword ptr [0046BD24]
:00425EA1 390598D44500            cmp dword ptr [0045D498], eax
:00425EA7 0F857B000000            jne 00425F28
:00425EAD 837D0870                cmp dword ptr [ebp+08], 00000070
:00425EB1 0F8D16000000            jnl 00425ECD
:00425EB7 8B4508                  mov eax, dword ptr [ebp+08]
:00425EBA 8B0485A0D44500          mov eax, dword ptr [4*eax+0045D4A0]
:00425EC1 50                      push eax

* Reference To: USER32.SetCursor, Ord:01D8h
                                  |
:00425EC2 FF157C744700            Call dword ptr [0047747C]
:00425EC8 E95B000000              jmp 00425F28

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425EB1(C)
|
:00425ECD 8B4508                  mov eax, dword ptr [ebp+08]
:00425ED0 8945FC                  mov dword ptr [ebp-04], eax
:00425ED3 E937000000              jmp 00425F0F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425F13(C)
|
:00425ED8 68007F0000              push 00007F00
:00425EDD 6A00                    push 00000000

* Reference To: USER32.LoadCursorA, Ord:0167h
                                  |
:00425EDF FF15B4744700            Call dword ptr [004774B4]
:00425EE5 50                      push eax

* Reference To: USER32.SetCursor, Ord:01D8h
                                  |
:00425EE6 FF157C744700            Call dword ptr [0047747C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425F1D(C)
|
:00425EEC 68027F0000              push 00007F02
:00425EF1 6A00                    push 00000000

* Reference To: USER32.LoadCursorA, Ord:0167h
                                  |
:00425EF3 FF15B4744700            Call dword ptr [004774B4]
:00425EF9 50                      push eax

* Reference To: USER32.SetCursor, Ord:01D8h
                                  |
:00425EFA FF157C744700            Call dword ptr [0047747C]
:00425F00 E923000000              jmp 00425F28
:00425F05 E923000000              jmp 00425F2D
:00425F0A E919000000              jmp 00425F28

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425ED3(U)
|
:00425F0F 837DFC70                cmp dword ptr [ebp-04], 00000070
:00425F13 0F84BFFFFFFF            je 00425ED8
:00425F19 837DFC72                cmp dword ptr [ebp-04], 00000072
:00425F1D 0F84C9FFFFFF            je 00425EEC
:00425F23 E905000000              jmp 00425F2D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00425EA7(C), :00425EC8(U), :00425F00(U), :00425F0A(U)
|
:00425F28 E900000000              jmp 00425F2D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00425F05(U), :00425F23(U), :00425F28(U)
|
:00425F2D 5F                      pop edi
:00425F2E 5E                      pop esi
:00425F2F 5B                      pop ebx
:00425F30 C9                      leave
:00425F31 C3                      ret



* Referenced by a CALL at Address:
|:0040EB04   
|
:00425F32 55                      push ebp
:00425F33 8BEC                    mov ebp, esp
:00425F35 53                      push ebx
:00425F36 56                      push esi
:00425F37 57                      push edi
:00425F38 E8A8F5FFFF              call 004254E5
:00425F3D E888F9FFFF              call 004258CA
:00425F42 E860F2FFFF              call 004251A7
:00425F47 E900000000              jmp 00425F4C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425F47(U)
|
:00425F4C 5F                      pop edi
:00425F4D 5E                      pop esi
:00425F4E 5B                      pop ebx
:00425F4F C9                      leave
:00425F50 C3                      ret


:00425F51 CC                      int 03
:00425F52 CC                      int 03
:00425F53 CC                      int 03
:00425F54 CC                      int 03
:00425F55 CC                      int 03
:00425F56 CC                      int 03
:00425F57 CC                      int 03
:00425F58 CC                      int 03
:00425F59 CC                      int 03
:00425F5A CC                      int 03
:00425F5B CC                      int 03
:00425F5C CC                      int 03
:00425F5D CC                      int 03
:00425F5E CC                      int 03
:00425F5F CC                      int 03

* Referenced by a CALL at Address:
|:00424F0C   
|
:00425F60 55                      push ebp
:00425F61 8BEC                    mov ebp, esp
:00425F63 83EC08                  sub esp, 00000008
:00425F66 53                      push ebx
:00425F67 56                      push esi
:00425F68 57                      push edi
:00425F69 894DF8                  mov dword ptr [ebp-08], ecx
:00425F6C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00425F6F 83C114                  add ecx, 00000014
:00425F72 E819000000              call 00425F90
:00425F77 8945FC                  mov dword ptr [ebp-04], eax
:00425F7A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00425F7D E8E3840000              call 0042E465
:00425F82 8B45FC                  mov eax, dword ptr [ebp-04]
:00425F85 E900000000              jmp 00425F8A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425F85(U)
|
:00425F8A 5F                      pop edi
:00425F8B 5E                      pop esi
:00425F8C 5B                      pop ebx
:00425F8D C9                      leave
:00425F8E C3                      ret


:00425F8F CC                      int 03

* Referenced by a CALL at Address:
|:00425F72   
|
:00425F90 55                      push ebp
:00425F91 8BEC                    mov ebp, esp
:00425F93 83EC04                  sub esp, 00000004
:00425F96 53                      push ebx
:00425F97 56                      push esi
:00425F98 57                      push edi
:00425F99 894DFC                  mov dword ptr [ebp-04], ecx
:00425F9C 6A01                    push 00000001
:00425F9E 6800800000              push 00008000
:00425FA3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00425FA6 E898160200              call 00447643
:00425FAB E900000000              jmp 00425FB0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425FAB(U)
|
:00425FB0 5F                      pop edi
:00425FB1 5E                      pop esi
:00425FB2 5B                      pop ebx
:00425FB3 C9                      leave
:00425FB4 C3                      ret


:00425FB5 CC                      int 03
:00425FB6 CC                      int 03
:00425FB7 CC                      int 03
:00425FB8 CC                      int 03
:00425FB9 CC                      int 03
:00425FBA CC                      int 03
:00425FBB CC                      int 03
:00425FBC CC                      int 03
:00425FBD CC                      int 03
:00425FBE CC                      int 03
:00425FBF CC                      int 03

* Referenced by a CALL at Address:
|:0042577D   
|
:00425FC0 55                      push ebp
:00425FC1 8BEC                    mov ebp, esp
:00425FC3 83EC04                  sub esp, 00000004
:00425FC6 53                      push ebx
:00425FC7 56                      push esi
:00425FC8 57                      push edi
:00425FC9 894DFC                  mov dword ptr [ebp-04], ecx
:00425FCC 8B45FC                  mov eax, dword ptr [ebp-04]
:00425FCF 668B4010                mov ax, word ptr [eax+10]
:00425FD3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00425FD6 66898145030000          mov word ptr [ecx+00000345], ax
:00425FDD 8B45FC                  mov eax, dword ptr [ebp-04]
:00425FE0 668B4012                mov ax, word ptr [eax+12]
:00425FE4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00425FE7 66898147030000          mov word ptr [ecx+00000347], ax
:00425FEE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00425FF1 E80A000000              call 00426000
:00425FF6 E900000000              jmp 00425FFB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425FF6(U)
|
:00425FFB 5F                      pop edi
:00425FFC 5E                      pop esi
:00425FFD 5B                      pop ebx
:00425FFE C9                      leave
:00425FFF C3                      ret



* Referenced by a CALL at Addresses:
|:00425FF1   , :0042E4C5   , :00430BFF   , :00432330   , :004324C1   
|:004328D4   
|
:00426000 55                      push ebp
:00426001 8BEC                    mov ebp, esp
:00426003 83EC08                  sub esp, 00000008
:00426006 53                      push ebx
:00426007 56                      push esi
:00426008 57                      push edi
:00426009 894DF8                  mov dword ptr [ebp-08], ecx
:0042600C C745FC00000000          mov [ebp-04], 00000000
:00426013 E903000000              jmp 0042601B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426046(U)
|
:00426018 FF45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426013(U)
|
:0042601B 817DFC80000000          cmp dword ptr [ebp-04], 00000080
:00426022 0F8D23000000            jnl 0042604B
:00426028 8B45FC                  mov eax, dword ptr [ebp-04]
:0042602B 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042602E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00426031 66C7444145FFFF          mov [ecx+2*eax+45], FFFF
:00426038 8B45FC                  mov eax, dword ptr [ebp-04]
:0042603B 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042603E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00426041 C644414900              mov [ecx+2*eax+49], 00
:00426046 E9CDFFFFFF              jmp 00426018

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426022(C)
|
:0042604B 8B45F8                  mov eax, dword ptr [ebp-08]
:0042604E C7805F03000000000000    mov dword ptr [ebx+0000035F], 00000000
:00426058 E900000000              jmp 0042605D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426058(U)
|
:0042605D 5F                      pop edi
:0042605E 5E                      pop esi
:0042605F 5B                      pop ebx
:00426060 C9                      leave
:00426061 C3                      ret


:00426062 CC                      int 03
:00426063 CC                      int 03
:00426064 CC                      int 03
:00426065 CC                      int 03
:00426066 CC                      int 03
:00426067 CC                      int 03
:00426068 CC                      int 03
:00426069 CC                      int 03
:0042606A CC                      int 03
:0042606B CC                      int 03
:0042606C CC                      int 03
:0042606D CC                      int 03
:0042606E CC                      int 03
:0042606F CC                      int 03

* Referenced by a CALL at Address:
|:00425581   
|
:00426070 55                      push ebp
:00426071 8BEC                    mov ebp, esp
:00426073 83EC04                  sub esp, 00000004
:00426076 53                      push ebx
:00426077 56                      push esi
:00426078 57                      push edi
:00426079 894DFC                  mov dword ptr [ebp-04], ecx
:0042607C 8B45FC                  mov eax, dword ptr [ebp-04]
:0042607F C6407800                mov [eax+78], 00
:00426083 E900000000              jmp 00426088

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426083(U)
|
:00426088 5F                      pop edi
:00426089 5E                      pop esi
:0042608A 5B                      pop ebx
:0042608B C9                      leave
:0042608C C3                      ret


:0042608D CC                      int 03
:0042608E CC                      int 03
:0042608F CC                      int 03
:00426090 55                      push ebp
:00426091 8BEC                    mov ebp, esp
:00426093 83EC18                  sub esp, 00000018
:00426096 53                      push ebx
:00426097 56                      push esi
:00426098 57                      push edi
:00426099 837D0800                cmp dword ptr [ebp+08], 00000000
:0042609D 0F8C83000000            jl 00426126
:004260A3 8B4510                  mov eax, dword ptr [ebp+10]
:004260A6 8B00                    mov eax, dword ptr [eax]
:004260A8 8945F8                  mov dword ptr [ebp-08], eax
:004260AB 8B4510                  mov eax, dword ptr [ebp+10]
:004260AE 8B4004                  mov eax, dword ptr [eax+04]
:004260B1 8945FC                  mov dword ptr [ebp-04], eax
:004260B4 817DFC01020000          cmp dword ptr [ebp-04], 00000201
:004260BB 0F8565000000            jne 00426126
:004260C1 833D40BD460000          cmp dword ptr [0046BD40], 00000000
:004260C8 0F841D000000            je 004260EB
:004260CE A138BD4600              mov eax, dword ptr [0046BD38]
:004260D3 3945F8                  cmp dword ptr [ebp-08], eax
:004260D6 0F850A000000            jne 004260E6
:004260DC C7053CBD460001000000    mov dword ptr [0046BD3C], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004260D6(C)
|
:004260E6 E93B000000              jmp 00426126

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004260C8(C)
|
:004260EB 33C0                    xor eax, eax
:004260ED 66A198D44500            mov ax, word ptr [0045D498]
:004260F3 8945EC                  mov dword ptr [ebp-14], eax
:004260F6 C745F400000000          mov [ebp-0C], 00000000
:004260FD 8B45F4                  mov eax, dword ptr [ebp-0C]
:00426100 8945F0                  mov dword ptr [ebp-10], eax
:00426103 C745E801000000          mov [ebp-18], 00000001
:0042610A 8D45EC                  lea eax, dword ptr [ebp-14]
:0042610D 50                      push eax
:0042610E 8B45E8                  mov eax, dword ptr [ebp-18]
:00426111 50                      push eax
:00426112 6806080000              push 00000806
:00426117 33C0                    xor eax, eax
:00426119 66A1881A4500            mov ax, word ptr [00451A88]
:0042611F 50                      push eax

* Reference To: WINMM.mciSendCommandA, Ord:002Fh
                                  |
:00426120 FF15BC744700            Call dword ptr [004774BC]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042609D(C), :004260BB(C), :004260E6(U)
|
:00426126 8B4510                  mov eax, dword ptr [ebp+10]
:00426129 50                      push eax
:0042612A 8B450C                  mov eax, dword ptr [ebp+0C]
:0042612D 50                      push eax
:0042612E 8B4508                  mov eax, dword ptr [ebp+08]
:00426131 50                      push eax
:00426132 A168BD4600              mov eax, dword ptr [0046BD68]
:00426137 50                      push eax

* Reference To: USER32.CallNextHookEx, Ord:0010h
                                  |
:00426138 FF1504744700            Call dword ptr [00477404]
:0042613E E900000000              jmp 00426143

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042613E(U)
|
:00426143 5F                      pop edi
:00426144 5E                      pop esi
:00426145 5B                      pop ebx
:00426146 C9                      leave
:00426147 C20C00                  ret 000C



* Referenced by a CALL at Addresses:
|:0040E59E   , :00426496   
|
:0042614A 55                      push ebp
:0042614B 8BEC                    mov ebp, esp
:0042614D 83EC3C                  sub esp, 0000003C
:00426150 53                      push ebx
:00426151 56                      push esi
:00426152 57                      push edi
:00426153 833D8C1A450000          cmp dword ptr [00451A8C], 00000000
:0042615A 0F8505000000            jne 00426165
:00426160 E921010000              jmp 00426286

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042615A(C)
|
:00426165 8D45F0                  lea eax, dword ptr [ebp-10]
:00426168 50                      push eax
:00426169 8B4508                  mov eax, dword ptr [ebp+08]
:0042616C 50                      push eax

* Reference To: USER32.GetClientRect, Ord:00DCh
                                  |
:0042616D FF15F8734700            Call dword ptr [004773F8]
:00426173 8D45C4                  lea eax, dword ptr [ebp-3C]
:00426176 50                      push eax
:00426177 6800000200              push 00020000
:0042617C 6843080000              push 00000843
:00426181 33C0                    xor eax, eax
:00426183 66A1881A4500            mov ax, word ptr [00451A88]
:00426189 50                      push eax

* Reference To: WINMM.mciSendCommandA, Ord:002Fh
                                  |
:0042618A FF15BC744700            Call dword ptr [004774BC]
:00426190 8D45C8                  lea eax, dword ptr [ebp-38]
:00426193 8D4DD8                  lea ecx, dword ptr [ebp-28]
:00426196 8B10                    mov edx, dword ptr [eax]
:00426198 8911                    mov dword ptr [ecx], edx
:0042619A 8B5004                  mov edx, dword ptr [eax+04]
:0042619D 895104                  mov dword ptr [ecx+04], edx
:004261A0 8B5008                  mov edx, dword ptr [eax+08]
:004261A3 895108                  mov dword ptr [ecx+08], edx
:004261A6 8B400C                  mov eax, dword ptr [eax+0C]
:004261A9 89410C                  mov dword ptr [ecx+0C], eax
:004261AC B9D0A64600              mov ecx, 0046A6D0
:004261B1 E86A58FEFF              call 0040BA20
:004261B6 F6C408                  test ah, 08
:004261B9 0F841D000000            je 004261DC
:004261BF C745E080020000          mov [ebp-20], 00000280
:004261C6 8B45FC                  mov eax, dword ptr [ebp-04]
:004261C9 3DE0010000              cmp eax, 000001E0
:004261CE 0F8C05000000            jl 004261D9
:004261D4 B8E0010000              mov eax, 000001E0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004261CE(C)
|
:004261D9 8945E4                  mov dword ptr [ebp-1C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004261B9(C)
|
:004261DC 8B45F8                  mov eax, dword ptr [ebp-08]
:004261DF 99                      cdq
:004261E0 2BC2                    sub eax, edx
:004261E2 C1F801                  sar eax, 01
:004261E5 8BC8                    mov ecx, eax
:004261E7 8B45E0                  mov eax, dword ptr [ebp-20]
:004261EA 99                      cdq
:004261EB 2BC2                    sub eax, edx
:004261ED C1F801                  sar eax, 01
:004261F0 2BC8                    sub ecx, eax
:004261F2 890D28BD4600            mov dword ptr [0046BD28], ecx
:004261F8 8B45FC                  mov eax, dword ptr [ebp-04]
:004261FB 99                      cdq
:004261FC 2BC2                    sub eax, edx
:004261FE C1F801                  sar eax, 01
:00426201 8BC8                    mov ecx, eax
:00426203 8B45E4                  mov eax, dword ptr [ebp-1C]
:00426206 99                      cdq
:00426207 2BC2                    sub eax, edx
:00426209 C1F801                  sar eax, 01
:0042620C 2BC8                    sub ecx, eax
:0042620E 890D2CBD4600            mov dword ptr [0046BD2C], ecx
:00426214 8B45E0                  mov eax, dword ptr [ebp-20]
:00426217 030528BD4600            add eax, dword ptr [0046BD28]
:0042621D A330BD4600              mov dword ptr [0046BD30], eax
:00426222 A12CBD4600              mov eax, dword ptr [0046BD2C]
:00426227 0345E4                  add eax, dword ptr [ebp-1C]
:0042622A A334BD4600              mov dword ptr [0046BD34], eax
:0042622F A128BD4600              mov eax, dword ptr [0046BD28]
:00426234 8945E8                  mov dword ptr [ebp-18], eax
:00426237 A12CBD4600              mov eax, dword ptr [0046BD2C]
:0042623C 8945EC                  mov dword ptr [ebp-14], eax
:0042623F 8D45E8                  lea eax, dword ptr [ebp-18]
:00426242 50                      push eax
:00426243 8B4508                  mov eax, dword ptr [ebp+08]
:00426246 50                      push eax

* Reference To: USER32.ClientToScreen, Ord:0033h
                                  |
:00426247 FF1508744700            Call dword ptr [00477408]
:0042624D 8B45E8                  mov eax, dword ptr [ebp-18]
:00426250 A328BD4600              mov dword ptr [0046BD28], eax
:00426255 8B45EC                  mov eax, dword ptr [ebp-14]
:00426258 A32CBD4600              mov dword ptr [0046BD2C], eax
:0042625D 6A00                    push 00000000
:0042625F 8B45E4                  mov eax, dword ptr [ebp-1C]
:00426262 50                      push eax
:00426263 8B45E0                  mov eax, dword ptr [ebp-20]
:00426266 50                      push eax
:00426267 A12CBD4600              mov eax, dword ptr [0046BD2C]
:0042626C 50                      push eax
:0042626D A128BD4600              mov eax, dword ptr [0046BD28]
:00426272 50                      push eax
:00426273 6A00                    push 00000000
:00426275 A138BD4600              mov eax, dword ptr [0046BD38]
:0042627A 50                      push eax

* Reference To: USER32.SetWindowPos, Ord:0207h
                                  |
:0042627B FF150C744700            Call dword ptr [0047740C]
:00426281 E900000000              jmp 00426286

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00426160(U), :00426281(U)
|
:00426286 5F                      pop edi
:00426287 5E                      pop esi
:00426288 5B                      pop ebx
:00426289 C9                      leave
:0042628A C3                      ret



* Referenced by a CALL at Address:
|:00425559   
|
:0042628B 55                      push ebp
:0042628C 8BEC                    mov ebp, esp
:0042628E 83EC1C                  sub esp, 0000001C
:00426291 53                      push ebx
:00426292 56                      push esi
:00426293 57                      push edi
:00426294 C745E400000000          mov [ebp-1C], 00000000
:0042629B C745E800000000          mov [ebp-18], 00000000

* Possible StringData Ref from Data Obj ->"avivideo"
                                  |
:004262A2 C745ECD41A4500          mov [ebp-14], 00451AD4
:004262A9 C745F000000000          mov [ebp-10], 00000000
:004262B0 C745F400000000          mov [ebp-0C], 00000000
:004262B7 C745F800000000          mov [ebp-08], 00000000
:004262BE C745FC00000000          mov [ebp-04], 00000000
:004262C5 8D45E4                  lea eax, dword ptr [ebp-1C]
:004262C8 50                      push eax
:004262C9 6800200000              push 00002000
:004262CE 6803080000              push 00000803
:004262D3 6A00                    push 00000000

* Reference To: WINMM.mciSendCommandA, Ord:002Fh
                                  |
:004262D5 FF15BC744700            Call dword ptr [004774BC]
:004262DB 85C0                    test eax, eax
:004262DD 0F850A000000            jne 004262ED
:004262E3 B801000000              mov eax, 00000001
:004262E8 E902000000              jmp 004262EF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004262DD(C)
|
:004262ED 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004262E8(U)
|
:004262EF E900000000              jmp 004262F4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004262EF(U)
|
:004262F4 5F                      pop edi
:004262F5 5E                      pop esi
:004262F6 5B                      pop ebx
:004262F7 C9                      leave
:004262F8 C3                      ret



* Referenced by a CALL at Addresses:
|:0040E29F   , :0042638A   , :00426B26   
|
:004262F9 55                      push ebp
:004262FA 8BEC                    mov ebp, esp
:004262FC 83EC04                  sub esp, 00000004
:004262FF 53                      push ebx
:00426300 56                      push esi
:00426301 57                      push edi
:00426302 833D8C1A450000          cmp dword ptr [00451A8C], 00000000
:00426309 0F8452000000            je 00426361
:0042630F A168BD4600              mov eax, dword ptr [0046BD68]
:00426314 50                      push eax

* Reference To: USER32.UnhookWindowsHookEx, Ord:022Eh
                                  |
:00426315 FF15E8734700            Call dword ptr [004773E8]
:0042631B 8D45FC                  lea eax, dword ptr [ebp-04]
:0042631E 50                      push eax
:0042631F 6A00                    push 00000000
:00426321 6804080000              push 00000804
:00426326 33C0                    xor eax, eax
:00426328 66A1881A4500            mov ax, word ptr [00451A88]
:0042632E 50                      push eax

* Reference To: WINMM.mciSendCommandA, Ord:002Fh
                                  |
:0042632F FF15BC744700            Call dword ptr [004774BC]
:00426335 C705901A450000000000    mov dword ptr [00451A90], 00000000
:0042633F C7058C1A450000000000    mov dword ptr [00451A8C], 00000000
:00426349 6A01                    push 00000001
:0042634B 6A00                    push 00000000
:0042634D 8B4508                  mov eax, dword ptr [ebp+08]
:00426350 50                      push eax

* Reference To: USER32.InvalidateRect, Ord:0148h
                                  |
:00426351 FF15FC734700            Call dword ptr [004773FC]
:00426357 8B4508                  mov eax, dword ptr [ebp+08]
:0042635A 50                      push eax

* Reference To: USER32.UpdateWindow, Ord:0237h
                                  |
:0042635B FF1500744700            Call dword ptr [00477400]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426309(C)
|
:00426361 B801000000              mov eax, 00000001
:00426366 E900000000              jmp 0042636B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426366(U)
|
:0042636B 5F                      pop edi
:0042636C 5E                      pop esi
:0042636D 5B                      pop ebx
:0042636E C9                      leave
:0042636F C3                      ret



* Referenced by a CALL at Address:
|:004269E7   
|
:00426370 55                      push ebp
:00426371 8BEC                    mov ebp, esp
:00426373 83EC4C                  sub esp, 0000004C
:00426376 53                      push ebx
:00426377 56                      push esi
:00426378 57                      push edi
:00426379 833D8C1A450000          cmp dword ptr [00451A8C], 00000000
:00426380 0F840C000000            je 00426392
:00426386 8B4508                  mov eax, dword ptr [ebp+08]
:00426389 50                      push eax
:0042638A E86AFFFFFF              call 004262F9
:0042638F 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426380(C)
|
:00426392 C745B400000000          mov [ebp-4C], 00000000
:00426399 C745B800000000          mov [ebp-48], 00000000
:004263A0 C745BC00000000          mov [ebp-44], 00000000
:004263A7 8B450C                  mov eax, dword ptr [ebp+0C]
:004263AA 8945C0                  mov dword ptr [ebp-40], eax
:004263AD C745C400000000          mov [ebp-3C], 00000000
:004263B4 C745C800000080          mov [ebp-38], 80000000
:004263BB 8B4508                  mov eax, dword ptr [ebp+08]
:004263BE 8945CC                  mov dword ptr [ebp-34], eax
:004263C1 C745D000000000          mov [ebp-30], 00000000
:004263C8 C745D400000000          mov [ebp-2C], 00000000
:004263CF E903000000              jmp 004263D7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042640B(U)
|
:004263D4 FF45D4                  inc [ebp-2C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004263CF(U)
|
:004263D7 837DD405                cmp dword ptr [ebp-2C], 00000005
:004263DB 0F832F000000            jnb 00426410
:004263E1 8D45B4                  lea eax, dword ptr [ebp-4C]
:004263E4 50                      push eax
:004263E5 6800020300              push 00030200
:004263EA 6803080000              push 00000803
:004263EF 6A00                    push 00000000

* Reference To: WINMM.mciSendCommandA, Ord:002Fh
                                  |
:004263F1 FF15BC744700            Call dword ptr [004774BC]
:004263F7 85C0                    test eax, eax
:004263F9 0F850C000000            jne 0042640B
:004263FF C745D001000000          mov [ebp-30], 00000001
:00426406 E905000000              jmp 00426410

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004263F9(C)
|
:0042640B E9C4FFFFFF              jmp 004263D4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004263DB(C), :00426406(U)
|
:00426410 837DD000                cmp dword ptr [ebp-30], 00000000
:00426414 0F8489000000            je 004264A3
:0042641A 8B45B8                  mov eax, dword ptr [ebp-48]
:0042641D 66A3881A4500            mov word ptr [00451A88], ax
:00426423 C7058C1A450001000000    mov dword ptr [00451A8C], 00000001
:0042642D C745D800000000          mov [ebp-28], 00000000
:00426434 C745DC00000000          mov [ebp-24], 00000000
:0042643B C745E005000000          mov [ebp-20], 00000005
:00426442 C745E400000000          mov [ebp-1C], 00000000
:00426449 8D45D8                  lea eax, dword ptr [ebp-28]
:0042644C 50                      push eax
:0042644D 6800000400              push 00040000
:00426452 6841080000              push 00000841
:00426457 33C0                    xor eax, eax
:00426459 66A1881A4500            mov ax, word ptr [00451A88]
:0042645F 50                      push eax

* Reference To: WINMM.mciSendCommandA, Ord:002Fh
                                  |
:00426460 FF15BC744700            Call dword ptr [004774BC]
:00426466 C745F001400000          mov [ebp-10], 00004001
:0042646D 8D45E8                  lea eax, dword ptr [ebp-18]
:00426470 50                      push eax
:00426471 6800010000              push 00000100
:00426476 6814080000              push 00000814
:0042647B 33C0                    xor eax, eax
:0042647D 66A1881A4500            mov ax, word ptr [00451A88]
:00426483 50                      push eax

* Reference To: WINMM.mciSendCommandA, Ord:002Fh
                                  |
:00426484 FF15BC744700            Call dword ptr [004774BC]
:0042648A 8B45EC                  mov eax, dword ptr [ebp-14]
:0042648D A338BD4600              mov dword ptr [0046BD38], eax
:00426492 8B4508                  mov eax, dword ptr [ebp+08]
:00426495 50                      push eax
:00426496 E8AFFCFFFF              call 0042614A
:0042649B 83C404                  add esp, 00000004
:0042649E E924000000              jmp 004264C7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426414(C)
|
:004264A3 6A30                    push 00000030
:004264A5 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->"ܴ򿪶ļ"
                                  |
:004264A7 68E01A4500              push 00451AE0
:004264AC 8B4508                  mov eax, dword ptr [ebp+08]
:004264AF 50                      push eax

* Reference To: USER32.MessageBoxA, Ord:0188h
                                  |
:004264B0 FF151C744700            Call dword ptr [0047741C]
:004264B6 C7058C1A450000000000    mov dword ptr [00451A8C], 00000000
:004264C0 33C0                    xor eax, eax
:004264C2 E949000000              jmp 00426510

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042649E(U)
|
:004264C7 6A00                    push 00000000
:004264C9 6A00                    push 00000000
:004264CB 8B4508                  mov eax, dword ptr [ebp+08]
:004264CE 50                      push eax

* Reference To: USER32.InvalidateRect, Ord:0148h
                                  |
:004264CF FF15FC734700            Call dword ptr [004773FC]
:004264D5 8B4508                  mov eax, dword ptr [ebp+08]
:004264D8 50                      push eax

* Reference To: USER32.UpdateWindow, Ord:0237h
                                  |
:004264D9 FF1500744700            Call dword ptr [00477400]
:004264DF 6A00                    push 00000000
:004264E1 A138BD4600              mov eax, dword ptr [0046BD38]
:004264E6 50                      push eax

* Reference To: USER32.GetWindowThreadProcessId, Ord:0139h
                                  |
:004264E7 FF15EC734700            Call dword ptr [004773EC]
:004264ED 50                      push eax
:004264EE A1E8D24500              mov eax, dword ptr [0045D2E8]
:004264F3 50                      push eax
:004264F4 6890604200              push 00426090
:004264F9 6A03                    push 00000003

* Reference To: USER32.SetWindowsHookExA, Ord:020Eh
                                  |
:004264FB FF15F4734700            Call dword ptr [004773F4]
:00426501 A368BD4600              mov dword ptr [0046BD68], eax
:00426506 B801000000              mov eax, 00000001
:0042650B E900000000              jmp 00426510

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004264C2(U), :0042650B(U)
|
:00426510 5F                      pop edi
:00426511 5E                      pop esi
:00426512 5B                      pop ebx
:00426513 C9                      leave
:00426514 C3                      ret



* Referenced by a CALL at Address:
|:00426A5D   
|
:00426515 55                      push ebp
:00426516 8BEC                    mov ebp, esp
:00426518 83EC14                  sub esp, 00000014
:0042651B 53                      push ebx
:0042651C 56                      push esi
:0042651D 57                      push edi
:0042651E C705901A450001000000    mov dword ptr [00451A90], 00000001
:00426528 833D901A450000          cmp dword ptr [00451A90], 00000000
:0042652F 0F845B000000            je 00426590
:00426535 8B4508                  mov eax, dword ptr [ebp+08]
:00426538 25FFFF0000              and eax, 0000FFFF
:0042653D 8945F4                  mov dword ptr [ebp-0C], eax
:00426540 C745FC00000000          mov [ebp-04], 00000000
:00426547 8B45FC                  mov eax, dword ptr [ebp-04]
:0042654A 8945F8                  mov dword ptr [ebp-08], eax
:0042654D C745F001000000          mov [ebp-10], 00000001
:00426554 6A00                    push 00000000
:00426556 6800010000              push 00000100
:0042655B 6807080000              push 00000807
:00426560 33C0                    xor eax, eax
:00426562 66A1881A4500            mov ax, word ptr [00451A88]
:00426568 50                      push eax

* Reference To: WINMM.mciSendCommandA, Ord:002Fh
                                  |
:00426569 FF15BC744700            Call dword ptr [004774BC]
:0042656F 8D45F4                  lea eax, dword ptr [ebp-0C]
:00426572 50                      push eax
:00426573 8B45F0                  mov eax, dword ptr [ebp-10]
:00426576 50                      push eax
:00426577 6806080000              push 00000806
:0042657C 33C0                    xor eax, eax
:0042657E 66A1881A4500            mov ax, word ptr [00451A88]
:00426584 50                      push eax

* Reference To: WINMM.mciSendCommandA, Ord:002Fh
                                  |
:00426585 FF15BC744700            Call dword ptr [004774BC]
:0042658B E91A000000              jmp 004265AA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042652F(C)
|
:00426590 8D45EC                  lea eax, dword ptr [ebp-14]
:00426593 50                      push eax
:00426594 6A00                    push 00000000
:00426596 6809080000              push 00000809
:0042659B 33C0                    xor eax, eax
:0042659D 66A1881A4500            mov ax, word ptr [00451A88]
:004265A3 50                      push eax

* Reference To: WINMM.mciSendCommandA, Ord:002Fh
                                  |
:004265A4 FF15BC744700            Call dword ptr [004774BC]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042658B(U)
|
:004265AA B801000000              mov eax, 00000001
:004265AF E900000000              jmp 004265B4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004265AF(U)
|
:004265B4 5F                      pop edi
:004265B5 5E                      pop esi
:004265B6 5B                      pop ebx
:004265B7 C9                      leave
:004265B8 C3                      ret



* Referenced by a CALL at Address:
|:0040E5EF   
|
:004265B9 55                      push ebp
:004265BA 8BEC                    mov ebp, esp
:004265BC 83EC04                  sub esp, 00000004
:004265BF 53                      push ebx
:004265C0 56                      push esi
:004265C1 57                      push edi
:004265C2 33C0                    xor eax, eax
:004265C4 66A1881A4500            mov ax, word ptr [00451A88]
:004265CA 3B450C                  cmp eax, dword ptr [ebp+0C]
:004265CD 0F8533000000            jne 00426606
:004265D3 8B4508                  mov eax, dword ptr [ebp+08]
:004265D6 8945FC                  mov dword ptr [ebp-04], eax
:004265D9 E919000000              jmp 004265F7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004265FB(C)
|
:004265DE C705901A450000000000    mov dword ptr [00451A90], 00000000
:004265E8 B801000000              mov eax, 00000001
:004265ED E91B000000              jmp 0042660D
:004265F2 E90F000000              jmp 00426606

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004265D9(U)
|
:004265F7 837DFC01                cmp dword ptr [ebp-04], 00000001
:004265FB 0F84DDFFFFFF            je 004265DE
:00426601 E900000000              jmp 00426606

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004265CD(C), :004265F2(U), :00426601(U)
|
:00426606 33C0                    xor eax, eax
:00426608 E900000000              jmp 0042660D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004265ED(U), :00426608(U)
|
:0042660D 5F                      pop edi
:0042660E 5E                      pop esi
:0042660F 5B                      pop ebx
:00426610 C9                      leave
:00426611 C3                      ret



* Referenced by a CALL at Address:
|:0040E614   
|
:00426612 55                      push ebp
:00426613 8BEC                    mov ebp, esp
:00426615 53                      push ebx
:00426616 56                      push esi
:00426617 57                      push edi
:00426618 833D8C1A450000          cmp dword ptr [00451A8C], 00000000
:0042661F 0F8431000000            je 00426656
:00426625 A138BD4600              mov eax, dword ptr [0046BD38]
:0042662A 394508                  cmp dword ptr [ebp+08], eax
:0042662D 0F8523000000            jne 00426656
:00426633 8B450C                  mov eax, dword ptr [ebp+0C]
:00426636 C1E810                  shr eax, 10
:00426639 25FFFF0000              and eax, 0000FFFF
:0042663E 0FB7C0                  movzx eax, ax
:00426641 3D01020000              cmp eax, 00000201
:00426646 0F850A000000            jne 00426656
:0042664C B801000000              mov eax, 00000001
:00426651 E907000000              jmp 0042665D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042661F(C), :0042662D(C), :00426646(C)
|
:00426656 33C0                    xor eax, eax
:00426658 E900000000              jmp 0042665D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00426651(U), :00426658(U)
|
:0042665D 5F                      pop edi
:0042665E 5E                      pop esi
:0042665F 5B                      pop ebx
:00426660 C9                      leave
:00426661 C3                      ret



* Referenced by a CALL at Addresses:
|:00425826   , :00426752   , :004269C3   
|
:00426662 55                      push ebp
:00426663 8BEC                    mov ebp, esp
:00426665 81EC98000000            sub esp, 00000098
:0042666B 53                      push ebx
:0042666C 56                      push esi
:0042666D 57                      push edi
:0042666E A1F41A4500              mov eax, dword ptr [00451AF4]
:00426673 8945F8                  mov dword ptr [ebp-08], eax
:00426676 C745F400000000          mov [ebp-0C], 00000000
:0042667D E903000000              jmp 00426685

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042670E(U)
|
:00426682 FF45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042667D(U)
|
:00426685 837DF41A                cmp dword ptr [ebp-0C], 0000001A
:00426689 0F8D84000000            jnl 00426713
:0042668F 0FBE45F4                movsx eax, byte ptr [ebp-0C]
:00426693 83C041                  add eax, 00000041
:00426696 8845F8                  mov byte ptr [ebp-08], al
:00426699 8D45F8                  lea eax, dword ptr [ebp-08]
:0042669C 50                      push eax

* Reference To: KERNEL32.GetDriveTypeA, Ord:00CEh
                                  |
:0042669D FF1514734700            Call dword ptr [00477314]
:004266A3 83F805                  cmp eax, 00000005
:004266A6 0F8562000000            jne 0042670E
:004266AC 0FBE45F4                movsx eax, byte ptr [ebp-0C]
:004266B0 83C041                  add eax, 00000041
:004266B3 A2981A4500              mov byte ptr [00451A98], al
:004266B8 6A00                    push 00000000
:004266BA 8D8568FFFFFF            lea eax, dword ptr [ebp+FFFFFF68]
:004266C0 50                      push eax

* Possible StringData Ref from Data Obj ->"C:\ekd2w95.exe"
                                  |
:004266C1 68981A4500              push 00451A98

* Reference To: KERNEL32.OpenFile, Ord:0197h
                                  |
:004266C6 FF1510734700            Call dword ptr [00477310]
:004266CC 8945FC                  mov dword ptr [ebp-04], eax
:004266CF 837DFCFF                cmp dword ptr [ebp-04], FFFFFFFF
:004266D3 0F8435000000            je 0042670E
:004266D9 6A01                    push 00000001
:004266DB 8D45F0                  lea eax, dword ptr [ebp-10]
:004266DE 50                      push eax
:004266DF 8B45FC                  mov eax, dword ptr [ebp-04]
:004266E2 50                      push eax

* Reference To: KERNEL32._lread, Ord:0263h
                                  |
:004266E3 FF15AC734700            Call dword ptr [004773AC]
:004266E9 83F801                  cmp eax, 00000001
:004266EC 0F8512000000            jne 00426704
:004266F2 8B45FC                  mov eax, dword ptr [ebp-04]
:004266F5 50                      push eax

* Reference To: KERNEL32._lclose, Ord:025Fh
                                  |
:004266F6 FF151C734700            Call dword ptr [0047731C]
:004266FC 8B45F4                  mov eax, dword ptr [ebp-0C]
:004266FF E919000000              jmp 0042671D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004266EC(C)
|
:00426704 8B45FC                  mov eax, dword ptr [ebp-04]
:00426707 50                      push eax

* Reference To: KERNEL32._lclose, Ord:025Fh
                                  |
:00426708 FF151C734700            Call dword ptr [0047731C]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004266A6(C), :004266D3(C)
|
:0042670E E96FFFFFFF              jmp 00426682

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426689(C)
|
:00426713 B8FFFFFFFF              mov eax, FFFFFFFF
:00426718 E900000000              jmp 0042671D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004266FF(U), :00426718(U)
|
:0042671D 5F                      pop edi
:0042671E 5E                      pop esi
:0042671F 5B                      pop ebx
:00426720 C9                      leave
:00426721 C3                      ret



* Referenced by a CALL at Address:
|:0044073A   
|
:00426722 55                      push ebp
:00426723 8BEC                    mov ebp, esp
:00426725 81ECAC000000            sub esp, 000000AC
:0042672B 53                      push ebx
:0042672C 56                      push esi
:0042672D 57                      push edi

* Possible StringData Ref from Data Obj ->"սͼȡС"
                                  |
:0042672E B8F81A4500              mov eax, 00451AF8
:00426733 8D4DE4                  lea ecx, dword ptr [ebp-1C]
:00426736 8B10                    mov edx, dword ptr [eax]
:00426738 8911                    mov dword ptr [ecx], edx
:0042673A 8B5004                  mov edx, dword ptr [eax+04]
:0042673D 895104                  mov dword ptr [ecx+04], edx
:00426740 8B5008                  mov edx, dword ptr [eax+08]
:00426743 895108                  mov dword ptr [ecx+08], edx
:00426746 8B500C                  mov edx, dword ptr [eax+0C]
:00426749 89510C                  mov dword ptr [ecx+0C], edx
:0042674C 8A4010                  mov al, byte ptr [eax+10]
:0042674F 884110                  mov byte ptr [ecx+10], al
:00426752 E80BFFFFFF              call 00426662
:00426757 0FBEC0                  movsx eax, al
:0042675A 83C041                  add eax, 00000041
:0042675D 8B4D08                  mov ecx, dword ptr [ebp+08]
:00426760 8801                    mov byte ptr [ecx], al
:00426762 6A00                    push 00000000
:00426764 8D8558FFFFFF            lea eax, dword ptr [ebp+FFFFFF58]
:0042676A 50                      push eax
:0042676B 8B4508                  mov eax, dword ptr [ebp+08]
:0042676E 50                      push eax

* Reference To: KERNEL32.OpenFile, Ord:0197h
                                  |
:0042676F FF1510734700            Call dword ptr [00477310]
:00426775 8945FC                  mov dword ptr [ebp-04], eax
:00426778 837DFCFF                cmp dword ptr [ebp-04], FFFFFFFF
:0042677C 0F8478010000            je 004268FA
:00426782 8D45E4                  lea eax, dword ptr [ebp-1C]
:00426785 50                      push eax
:00426786 E81F0C0200              call 004473AA
:0042678B 83C404                  add esp, 00000004
:0042678E 898554FFFFFF            mov dword ptr [ebp+FFFFFF54], eax
:00426794 B828000000              mov eax, 00000028
:00426799 8B8D54FFFFFF            mov ecx, dword ptr [ebp+FFFFFF54]
:0042679F 83C108                  add ecx, 00000008
:004267A2 C1E901                  shr ecx, 01
:004267A5 2BC1                    sub eax, ecx
:004267A7 8845E0                  mov byte ptr [ebp-20], al
:004267AA 682C010000              push 0000012C
:004267AF 0FBE45E0                movsx eax, byte ptr [ebp-20]
:004267B3 50                      push eax
:004267B4 B910BC4600              mov ecx, 0046BC10
:004267B9 E84994FFFF              call 0041FC07
:004267BE 8D45E4                  lea eax, dword ptr [ebp-1C]
:004267C1 50                      push eax
:004267C2 6810BC4600              push 0046BC10
:004267C7 E8BBA2FFFF              call 00420A87
:004267CC 83C408                  add esp, 00000008
:004267CF 0FBE45E0                movsx eax, byte ptr [ebp-20]
:004267D3 038554FFFFFF            add eax, dword ptr [ebp+FFFFFF54]
:004267D9 8845E0                  mov byte ptr [ebp-20], al
:004267DC C645F800                mov [ebp-08], 00
:004267E0 E903000000              jmp 004267E8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426824(U)
|
:004267E5 FE45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004267E0(U)
|
:004267E8 0FBE45F8                movsx eax, byte ptr [ebp-08]
:004267EC 83F803                  cmp eax, 00000003
:004267EF 0F8D34000000            jnl 00426829
:004267F5 682C010000              push 0000012C
:004267FA 0FBE45F8                movsx eax, byte ptr [ebp-08]
:004267FE 8D0440                  lea eax, dword ptr [eax+2*eax]
:00426801 0FBE4DE0                movsx ecx, byte ptr [ebp-20]
:00426805 03C1                    add eax, ecx
:00426807 50                      push eax
:00426808 B910BC4600              mov ecx, 0046BC10
:0042680D E8F593FFFF              call 0041FC07

* Possible StringData Ref from Data Obj ->""
                                  |
:00426812 680C1B4500              push 00451B0C
:00426817 6810BC4600              push 0046BC10
:0042681C E866A2FFFF              call 00420A87
:00426821 83C408                  add esp, 00000008
:00426824 E9BCFFFFFF              jmp 004267E5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004267EF(C)
|
:00426829 C645F800                mov [ebp-08], 00
:0042682D E903000000              jmp 00426835

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426898(U)
|
:00426832 FE45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042682D(U)
|
:00426835 6800400B00              push 000B4000
:0042683A 8B450C                  mov eax, dword ptr [ebp+0C]
:0042683D 50                      push eax
:0042683E 8B45FC                  mov eax, dword ptr [ebp-04]
:00426841 50                      push eax

* Reference To: KERNEL32._lread, Ord:0263h
                                  |
:00426842 FF15AC734700            Call dword ptr [004773AC]
:00426848 898554FFFFFF            mov dword ptr [ebp+FFFFFF54], eax
:0042684E 83BD54FFFFFF01          cmp dword ptr [ebp+FFFFFF54], 00000001
:00426855 0F8305000000            jnb 00426860
:0042685B E93D000000              jmp 0042689D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426855(C)
|
:00426860 682C010000              push 0000012C
:00426865 0FBE45F8                movsx eax, byte ptr [ebp-08]
:00426869 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042686C 0FBE4DE0                movsx ecx, byte ptr [ebp-20]
:00426870 03C1                    add eax, ecx
:00426872 50                      push eax
:00426873 B910BC4600              mov ecx, 0046BC10
:00426878 E88A93FFFF              call 0041FC07

* Possible StringData Ref from Data Obj ->""
                                  |
:0042687D 68101B4500              push 00451B10
:00426882 6810BC4600              push 0046BC10
:00426887 E8FBA1FFFF              call 00420A87
:0042688C 83C408                  add esp, 00000008
:0042688F 8B8554FFFFFF            mov eax, dword ptr [ebp+FFFFFF54]
:00426895 01450C                  add dword ptr [ebp+0C], eax
:00426898 E995FFFFFF              jmp 00426832

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042685B(U)
|
:0042689D E903000000              jmp 004268A5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004268E1(U)
|
:004268A2 FE45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042689D(U)
|
:004268A5 0FBE45F8                movsx eax, byte ptr [ebp-08]
:004268A9 83F803                  cmp eax, 00000003
:004268AC 0F8D34000000            jnl 004268E6
:004268B2 682C010000              push 0000012C
:004268B7 0FBE45F8                movsx eax, byte ptr [ebp-08]
:004268BB 8D0440                  lea eax, dword ptr [eax+2*eax]
:004268BE 0FBE4DE0                movsx ecx, byte ptr [ebp-20]
:004268C2 03C1                    add eax, ecx
:004268C4 50                      push eax
:004268C5 B910BC4600              mov ecx, 0046BC10
:004268CA E83893FFFF              call 0041FC07

* Possible StringData Ref from Data Obj ->""
                                  |
:004268CF 68141B4500              push 00451B14
:004268D4 6810BC4600              push 0046BC10
:004268D9 E8A9A1FFFF              call 00420A87
:004268DE 83C408                  add esp, 00000008
:004268E1 E9BCFFFFFF              jmp 004268A2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004268AC(C)
|
:004268E6 8B45FC                  mov eax, dword ptr [ebp-04]
:004268E9 50                      push eax

* Reference To: KERNEL32._lclose, Ord:025Fh
                                  |
:004268EA FF151C734700            Call dword ptr [0047731C]
:004268F0 B801000000              mov eax, 00000001
:004268F5 E907000000              jmp 00426901

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042677C(C)
|
:004268FA 33C0                    xor eax, eax
:004268FC E900000000              jmp 00426901

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004268F5(U), :004268FC(U)
|
:00426901 5F                      pop edi
:00426902 5E                      pop esi
:00426903 5B                      pop ebx
:00426904 C9                      leave
:00426905 C3                      ret



* Referenced by a CALL at Addresses:
|:0040B6F9   , :0040B767   , :004258AE   , :004396E4   , :00439702   
|:00439720   
|
:00426906 55                      push ebp
:00426907 8BEC                    mov ebp, esp
:00426909 83EC18                  sub esp, 00000018
:0042690C 53                      push ebx
:0042690D 56                      push esi
:0042690E 57                      push edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426A39(U)
|
:0042690F C745F801000000          mov [ebp-08], 00000001
:00426916 8B4508                  mov eax, dword ptr [ebp+08]
:00426919 25FFFF0000              and eax, 0000FFFF
:0042691E 8945F0                  mov dword ptr [ebp-10], eax
:00426921 C745F400000000          mov [ebp-0C], 00000000
:00426928 837DF04A                cmp dword ptr [ebp-10], 0000004A
:0042692C 0F8207000000            jb 00426939
:00426932 33C0                    xor eax, eax
:00426934 E90C020000              jmp 00426B45

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042692C(C)
|
:00426939 E8700A0100              call 004373AE
:0042693E 8B45F0                  mov eax, dword ptr [ebp-10]
:00426941 8945E8                  mov dword ptr [ebp-18], eax
:00426944 E961000000              jmp 004269AA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004269B8(C)
|
:00426949 8B45F0                  mov eax, dword ptr [ebp-10]
:0042694C 8B048588194500          mov eax, dword ptr [4*eax+00451988]
:00426953 50                      push eax
:00426954 6848BD4600              push 0046BD48
:00426959 E86F0A0200              call 004473CD
:0042695E 83C408                  add esp, 00000008
:00426961 E95D000000              jmp 004269C3

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004269AE(C), :004269BE(U)
|
:00426966 B90A000000              mov ecx, 0000000A
:0042696B 8B45F0                  mov eax, dword ptr [ebp-10]
:0042696E 2BD2                    sub edx, edx
:00426970 F7F1                    div ecx
:00426972 83C030                  add eax, 00000030
:00426975 A2B31A4500              mov byte ptr [00451AB3], al
:0042697A B90A000000              mov ecx, 0000000A
:0042697F 8B45F0                  mov eax, dword ptr [ebp-10]
:00426982 2BD2                    sub edx, edx
:00426984 F7F1                    div ecx
:00426986 8D4230                  lea eax, dword ptr [edx+30]
:00426989 A2B41A4500              mov byte ptr [00451AB4], al

* Possible StringData Ref from Data Obj ->"Q:i00.AVI"
                                  |
:0042698E 68B01A4500              push 00451AB0
:00426993 6848BD4600              push 0046BD48
:00426998 E8300A0200              call 004473CD
:0042699D 83C408                  add esp, 00000008
:004269A0 E91E000000              jmp 004269C3
:004269A5 E919000000              jmp 004269C3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426944(U)
|
:004269AA 837DE848                cmp dword ptr [ebp-18], 00000048
:004269AE 0F82B2FFFFFF            jb 00426966
:004269B4 837DE849                cmp dword ptr [ebp-18], 00000049
:004269B8 0F868BFFFFFF            jbe 00426949
:004269BE E9A3FFFFFF              jmp 00426966

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00426961(U), :004269A0(U), :004269A5(U)
|
:004269C3 E89AFCFFFF              call 00426662
:004269C8 83C041                  add eax, 00000041
:004269CB A248BD4600              mov byte ptr [0046BD48], al
:004269D0 6A00                    push 00000000
:004269D2 6A00                    push 00000000
:004269D4 E8CBD80100              call 004442A4
:004269D9 83C408                  add esp, 00000008
:004269DC 6848BD4600              push 0046BD48
:004269E1 A198D44500              mov eax, dword ptr [0045D498]
:004269E6 50                      push eax
:004269E7 E884F9FFFF              call 00426370
:004269EC 83C408                  add esp, 00000008
:004269EF FF45F4                  inc [ebp-0C]
:004269F2 833D8C1A450000          cmp dword ptr [00451A8C], 00000000
:004269F9 0F853F000000            jne 00426A3E
:004269FF 6848BD4600              push 0046BD48

* Possible StringData Ref from Data Obj ->"ܲŶ%s"
                                  |
:00426A04 68181B4500              push 00451B18
:00426A09 E8FC78FEFF              call 0040E30A
:00426A0E 83C408                  add esp, 00000008
:00426A11 85C0                    test eax, eax
:00426A13 0F840A000000            je 00426A23
:00426A19 837DF403                cmp dword ptr [ebp-0C], 00000003
:00426A1D 0F8516000000            jne 00426A39

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426A13(C)
|
:00426A23 6800010000              push 00000100
:00426A28 6A00                    push 00000000
:00426A2A E875D80100              call 004442A4
:00426A2F 83C408                  add esp, 00000008
:00426A32 33C0                    xor eax, eax
:00426A34 E90C010000              jmp 00426B45

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426A1D(C)
|
:00426A39 E9D1FEFFFF              jmp 0042690F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004269F9(C)
|
:00426A3E C745EC00000000          mov [ebp-14], 00000000
:00426A45 C7053CBD460000000000    mov dword ptr [0046BD3C], 00000000
:00426A4F 8B4510                  mov eax, dword ptr [ebp+10]
:00426A52 A340BD4600              mov dword ptr [0046BD40], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426B10(C)
|
:00426A57 A198D44500              mov eax, dword ptr [0045D498]
:00426A5C 50                      push eax
:00426A5D E8B3FAFFFF              call 00426515
:00426A62 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426AE2(U)
|
:00426A65 833D901A450000          cmp dword ptr [00451A90], 00000000
:00426A6C 0F8475000000            je 00426AE7
:00426A72 E855F80100              call 004462CC
:00426A77 B9C0524700              mov ecx, 004752C0
:00426A7C E89E0A0200              call 0044751F
:00426A81 85C0                    test eax, eax
:00426A83 0F851F000000            jne 00426AA8
:00426A89 B9C0524700              mov ecx, 004752C0
:00426A8E E8B10A0200              call 00447544
:00426A93 85C0                    test eax, eax
:00426A95 0F850D000000            jne 00426AA8
:00426A9B 833D3CBD460000          cmp dword ptr [0046BD3C], 00000000
:00426AA2 0F840C000000            je 00426AB4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00426A83(C), :00426A95(C)
|
:00426AA8 C745FC01000000          mov [ebp-04], 00000001
:00426AAF E907000000              jmp 00426ABB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426AA2(C)
|
:00426AB4 C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426AAF(U)
|
:00426ABB 837D1000                cmp dword ptr [ebp+10], 00000000
:00426ABF 0F841D000000            je 00426AE2
:00426AC5 837DFC00                cmp dword ptr [ebp-04], 00000000
:00426AC9 0F8413000000            je 00426AE2
:00426ACF C745F800000000          mov [ebp-08], 00000000
:00426AD6 C7450C00000000          mov [ebp+0C], 00000000
:00426ADD E905000000              jmp 00426AE7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00426ABF(C), :00426AC9(C)
|
:00426AE2 E97EFFFFFF              jmp 00426A65

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00426A6C(C), :00426ADD(U)
|
:00426AE7 837D0C00                cmp dword ptr [ebp+0C], 00000000
:00426AEB 0F841B000000            je 00426B0C
:00426AF1 6A00                    push 00000000
:00426AF3 6800010000              push 00000100
:00426AF8 6807080000              push 00000807
:00426AFD 33C0                    xor eax, eax
:00426AFF 66A1881A4500            mov ax, word ptr [00451A88]
:00426B05 50                      push eax

* Reference To: WINMM.mciSendCommandA, Ord:002Fh
                                  |
:00426B06 FF15BC744700            Call dword ptr [004774BC]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426AEB(C)
|
:00426B0C 837D0C00                cmp dword ptr [ebp+0C], 00000000
:00426B10 0F8541FFFFFF            jne 00426A57
:00426B16 837D1400                cmp dword ptr [ebp+14], 00000000
:00426B1A 0F851D000000            jne 00426B3D
:00426B20 A198D44500              mov eax, dword ptr [0045D498]
:00426B25 50                      push eax
:00426B26 E8CEF7FFFF              call 004262F9
:00426B2B 83C404                  add esp, 00000004
:00426B2E 6800010000              push 00000100
:00426B33 6A00                    push 00000000
:00426B35 E86AD70100              call 004442A4
:00426B3A 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426B1A(C)
|
:00426B3D 8B45F8                  mov eax, dword ptr [ebp-08]
:00426B40 E900000000              jmp 00426B45

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00426934(U), :00426A34(U), :00426B40(U)
|
:00426B45 5F                      pop edi
:00426B46 5E                      pop esi
:00426B47 5B                      pop ebx
:00426B48 C9                      leave
:00426B49 C3                      ret


:00426B4A CC                      int 03
:00426B4B CC                      int 03
:00426B4C CC                      int 03
:00426B4D CC                      int 03
:00426B4E CC                      int 03
:00426B4F CC                      int 03

* Referenced by a CALL at Address:
|:00426C4F   
|
:00426B50 55                      push ebp
:00426B51 8BEC                    mov ebp, esp
:00426B53 83EC08                  sub esp, 00000008
:00426B56 53                      push ebx
:00426B57 56                      push esi
:00426B58 57                      push edi
:00426B59 C745FC00000000          mov [ebp-04], 00000000
:00426B60 E903000000              jmp 00426B68

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426C0D(U)
|
:00426B65 FF45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426B60(U)
|
:00426B68 837DFC0B                cmp dword ptr [ebp-04], 0000000B
:00426B6C 0F83A0000000            jnb 00426C12
:00426B72 837D0800                cmp dword ptr [ebp+08], 00000000
:00426B76 0F8460000000            je 00426BDC
:00426B7C 837D0801                cmp dword ptr [ebp+08], 00000001
:00426B80 0F8516000000            jne 00426B9C
:00426B86 8B45FC                  mov eax, dword ptr [ebp-04]
:00426B89 8D04C0                  lea eax, dword ptr [eax+8*eax]
:00426B8C C1E006                  shl eax, 06
:00426B8F 05806B0000              add eax, 00006B80
:00426B94 8945F8                  mov dword ptr [ebp-08], eax
:00426B97 E90D000000              jmp 00426BA9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426B80(C)
|
:00426B9C 8B45FC                  mov eax, dword ptr [ebp-04]
:00426B9F 8B0485781B4500          mov eax, dword ptr [4*eax+00451B78]
:00426BA6 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426B97(U)
|
:00426BA9 6A04                    push 00000004
:00426BAB 6A00                    push 00000000
:00426BAD 8B45F8                  mov eax, dword ptr [ebp-08]
:00426BB0 50                      push eax
:00426BB1 B940CF4600              mov ecx, 0046CF40
:00426BB6 E8650B0200              call 00447720
:00426BBB 50                      push eax
:00426BBC 6A18                    push 00000018
:00426BBE 6A18                    push 00000018
:00426BC0 6A08                    push 00000008
:00426BC2 8B45FC                  mov eax, dword ptr [ebp-04]
:00426BC5 8D0440                  lea eax, dword ptr [eax+2*eax]
:00426BC8 C1E003                  shl eax, 03
:00426BCB 83C008                  add eax, 00000008
:00426BCE 50                      push eax
:00426BCF E8CBEB0100              call 0044579F
:00426BD4 83C414                  add esp, 00000014
:00426BD7 E931000000              jmp 00426C0D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426B76(C)
|
:00426BDC 6A0C                    push 0000000C
:00426BDE 8B45FC                  mov eax, dword ptr [ebp-04]
:00426BE1 8D0440                  lea eax, dword ptr [eax+2*eax]
:00426BE4 40                      inc eax
:00426BE5 50                      push eax
:00426BE6 B910BC4600              mov ecx, 0046BC10
:00426BEB E81790FFFF              call 0041FC07
:00426BF0 8B45FC                  mov eax, dword ptr [ebp-04]
:00426BF3 8B0485481B4500          mov eax, dword ptr [4*eax+00451B48]
:00426BFA 50                      push eax

* Possible StringData Ref from Data Obj ->"M4C7%s"
                                  |
:00426BFB 68EC1B4500              push 00451BEC
:00426C00 6810BC4600              push 0046BC10
:00426C05 E8199FFFFF              call 00420B23
:00426C0A 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426BD7(U)
|
:00426C0D E953FFFFFF              jmp 00426B65

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426B6C(C)
|
:00426C12 E900000000              jmp 00426C17

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426C12(U)
|
:00426C17 5F                      pop edi
:00426C18 5E                      pop esi
:00426C19 5B                      pop ebx
:00426C1A C9                      leave
:00426C1B C3                      ret



* Referenced by a CALL at Addresses:
|:0040F2F9   , :00417860   , :0042592D   , :00435159   , :0043587A   
|:00436ECE   , :00439746   , :004408E9   
|
:00426C1C 55                      push ebp
:00426C1D 8BEC                    mov ebp, esp
:00426C1F 53                      push ebx
:00426C20 56                      push esi
:00426C21 57                      push edi
:00426C22 E870030000              call 00426F97
:00426C27 6A04                    push 00000004
:00426C29 6A00                    push 00000000
:00426C2B 6A00                    push 00000000
:00426C2D B940CF4600              mov ecx, 0046CF40
:00426C32 E8E90A0200              call 00447720
:00426C37 50                      push eax
:00426C38 6A28                    push 00000028
:00426C3A 6880020000              push 00000280
:00426C3F 6A00                    push 00000000
:00426C41 6A00                    push 00000000
:00426C43 E857EB0100              call 0044579F
:00426C48 83C414                  add esp, 00000014
:00426C4B 8B4508                  mov eax, dword ptr [ebp+08]
:00426C4E 50                      push eax
:00426C4F E8FCFEFFFF              call 00426B50
:00426C54 83C404                  add esp, 00000004
:00426C57 837D0801                cmp dword ptr [ebp+08], 00000001
:00426C5B 0F850D000000            jne 00426C6E
:00426C61 6858CF4600              push 0046CF58
:00426C66 E82CA5FDFF              call 00401197
:00426C6B 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426C5B(C)
|
:00426C6E E844030000              call 00426FB7
:00426C73 E900000000              jmp 00426C78

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426C73(U)
|
:00426C78 5F                      pop edi
:00426C79 5E                      pop esi
:00426C7A 5B                      pop ebx
:00426C7B C9                      leave
:00426C7C C3                      ret



* Referenced by a CALL at Addresses:
|:00425198   , :00425448   , :004254D6   
|
:00426C7D 55                      push ebp
:00426C7E 8BEC                    mov ebp, esp
:00426C80 53                      push ebx
:00426C81 56                      push esi
:00426C82 57                      push edi
:00426C83 6A00                    push 00000000
:00426C85 E80D000000              call 00426C97
:00426C8A 83C404                  add esp, 00000004
:00426C8D E900000000              jmp 00426C92

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426C8D(U)
|
:00426C92 5F                      pop edi
:00426C93 5E                      pop esi
:00426C94 5B                      pop ebx
:00426C95 C9                      leave
:00426C96 C3                      ret



* Referenced by a CALL at Addresses:
|:00426C85   , :00426D06   
|
:00426C97 55                      push ebp
:00426C98 8BEC                    mov ebp, esp
:00426C9A 81EC00030000            sub esp, 00000300
:00426CA0 53                      push ebx
:00426CA1 56                      push esi
:00426CA2 57                      push edi
:00426CA3 6A00                    push 00000000
:00426CA5 6800030000              push 00000300
:00426CAA 8D8500FDFFFF            lea eax, dword ptr [ebp+FFFFFD00]
:00426CB0 50                      push eax
:00426CB1 E8AD070200              call 00447463
:00426CB6 83C40C                  add esp, 0000000C
:00426CB9 837D0800                cmp dword ptr [ebp+08], 00000000
:00426CBD 0F841B000000            je 00426CDE
:00426CC3 8D8500FDFFFF            lea eax, dword ptr [ebp+FFFFFD00]
:00426CC9 50                      push eax
:00426CCA 6800010000              push 00000100
:00426CCF 6A00                    push 00000000
:00426CD1 E8C9F20100              call 00445F9F
:00426CD6 83C40C                  add esp, 0000000C
:00426CD9 E916000000              jmp 00426CF4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426CBD(C)
|
:00426CDE 8D8500FDFFFF            lea eax, dword ptr [ebp+FFFFFD00]
:00426CE4 50                      push eax
:00426CE5 6800010000              push 00000100
:00426CEA 6A00                    push 00000000
:00426CEC E8AEF20100              call 00445F9F
:00426CF1 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426CD9(U)
|
:00426CF4 E900000000              jmp 00426CF9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426CF4(U)
|
:00426CF9 5F                      pop edi
:00426CFA 5E                      pop esi
:00426CFB 5B                      pop ebx
:00426CFC C9                      leave
:00426CFD C3                      ret



* Referenced by a CALL at Addresses:
|:0040B6E0   , :0040B76F   , :0040B975   , :0040F2C9   , :00417859   
|:0042511A   , :004251C6   , :00425404   , :00425492   , :0042589C   
|:00425A0A   , :00432156   , :0043553E   , :00436D89   , :00436EB8   
|:004396C9   , :00439728   
|
:00426CFE 55                      push ebp
:00426CFF 8BEC                    mov ebp, esp
:00426D01 53                      push ebx
:00426D02 56                      push esi
:00426D03 57                      push edi
:00426D04 6A01                    push 00000001
:00426D06 E88CFFFFFF              call 00426C97
:00426D0B 83C404                  add esp, 00000004
:00426D0E E900000000              jmp 00426D13

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426D0E(U)
|
:00426D13 5F                      pop edi
:00426D14 5E                      pop esi
:00426D15 5B                      pop ebx
:00426D16 C9                      leave
:00426D17 C3                      ret



* Referenced by a CALL at Addresses:
|:0040B70B   , :0040B779   , :0040B809   , :00439732   
|
:00426D18 55                      push ebp
:00426D19 8BEC                    mov ebp, esp
:00426D1B 83EC0C                  sub esp, 0000000C
:00426D1E 53                      push ebx
:00426D1F 56                      push esi
:00426D20 57                      push edi
:00426D21 8D4DF4                  lea ecx, dword ptr [ebp-0C]
:00426D24 E8C726FEFF              call 004093F0
:00426D29 6A07                    push 00000007
:00426D2B E8A5DF0100              call 00444CD5
:00426D30 83C404                  add esp, 00000004
:00426D33 A1442F4500              mov eax, dword ptr [00452F44]
:00426D38 50                      push eax
:00426D39 8B4508                  mov eax, dword ptr [ebp+08]
:00426D3C 50                      push eax
:00426D3D 8D4DF4                  lea ecx, dword ptr [ebp-0C]
:00426D40 E872080200              call 004475B7
:00426D45 85C0                    test eax, eax
:00426D47 0F8505000000            jne 00426D52
:00426D4D E968000000              jmp 00426DBA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426D47(C)
|
:00426D52 6800030000              push 00000300
:00426D57 6870BD4600              push 0046BD70
:00426D5C 8D4DF4                  lea ecx, dword ptr [ebp-0C]
:00426D5F E8BC050000              call 00427320
:00426D64 8D4DF4                  lea ecx, dword ptr [ebp-0C]
:00426D67 E8B426FEFF              call 00409420
:00426D6C C745FC70BD4600          mov [ebp-04], 0046BD70
:00426D73 C745F800000000          mov [ebp-08], 00000000
:00426D7A E903000000              jmp 00426D82

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426D98(U)
|
:00426D7F FF45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426D7A(U)
|
:00426D82 817DF800030000          cmp dword ptr [ebp-08], 00000300
:00426D89 0F8D0E000000            jnl 00426D9D
:00426D8F 8B45FC                  mov eax, dword ptr [ebp-04]
:00426D92 C02804                  shr byte ptr [eax], 04
:00426D95 FF45FC                  inc [ebp-04]
:00426D98 E9E2FFFFFF              jmp 00426D7F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426D89(C)
|
:00426D9D 6A12                    push 00000012
:00426D9F B870BD4600              mov eax, 0046BD70
:00426DA4 83C01E                  add eax, 0000001E
:00426DA7 50                      push eax
:00426DA8 68301B4500              push 00451B30
:00426DAD E89B060200              call 0044744D
:00426DB2 83C40C                  add esp, 0000000C
:00426DB5 E900000000              jmp 00426DBA

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00426D4D(U), :00426DB5(U)
|
:00426DBA 5F                      pop edi
:00426DBB 5E                      pop esi
:00426DBC 5B                      pop ebx
:00426DBD C9                      leave
:00426DBE C3                      ret



* Referenced by a CALL at Addresses:
|:004250C3   , :004253C4   , :00425452   
|
:00426DBF 55                      push ebp
:00426DC0 8BEC                    mov ebp, esp
:00426DC2 83EC10                  sub esp, 00000010
:00426DC5 53                      push ebx
:00426DC6 56                      push esi
:00426DC7 57                      push edi
:00426DC8 8D4DF4                  lea ecx, dword ptr [ebp-0C]
:00426DCB E82026FEFF              call 004093F0
:00426DD0 6A07                    push 00000007
:00426DD2 E8FEDE0100              call 00444CD5
:00426DD7 83C404                  add esp, 00000004
:00426DDA A1442F4500              mov eax, dword ptr [00452F44]
:00426DDF 50                      push eax
:00426DE0 8B4508                  mov eax, dword ptr [ebp+08]
:00426DE3 50                      push eax
:00426DE4 8D4DF4                  lea ecx, dword ptr [ebp-0C]
:00426DE7 E8CB070200              call 004475B7
:00426DEC 85C0                    test eax, eax
:00426DEE 0F8505000000            jne 00426DF9
:00426DF4 E902010000              jmp 00426EFB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426DEE(C)
|
:00426DF9 6800030000              push 00000300
:00426DFE 6870BD4600              push 0046BD70
:00426E03 8D4DF4                  lea ecx, dword ptr [ebp-0C]
:00426E06 E815050000              call 00427320
:00426E0B 8D4DF4                  lea ecx, dword ptr [ebp-0C]
:00426E0E E80D26FEFF              call 00409420
:00426E13 C745F800000000          mov [ebp-08], 00000000
:00426E1A E903000000              jmp 00426E22

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426E5D(U)
|
:00426E1F FF45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426E1A(U)
|
:00426E22 817DF800010000          cmp dword ptr [ebp-08], 00000100
:00426E29 0F8D33000000            jnl 00426E62
:00426E2F 8B45F8                  mov eax, dword ptr [ebp-08]
:00426E32 8A844070BD4600          mov al, byte ptr [eax+2*eax+0046BD70]
:00426E39 8845F0                  mov byte ptr [ebp-10], al
:00426E3C 8B45F8                  mov eax, dword ptr [ebp-08]
:00426E3F 8A844072BD4600          mov al, byte ptr [eax+2*eax+0046BD72]
:00426E46 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00426E49 88844970BD4600          mov byte ptr [ecx+2*ecx+0046BD70], al
:00426E50 8A45F0                  mov al, byte ptr [ebp-10]
:00426E53 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00426E56 88844972BD4600          mov byte ptr [ecx+2*ecx+0046BD72], al
:00426E5D E9BDFFFFFF              jmp 00426E1F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426E29(C)
|
:00426E62 C745F800000000          mov [ebp-08], 00000000
:00426E69 E903000000              jmp 00426E71

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426EAC(U)
|
:00426E6E FF45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426E69(U)
|
:00426E71 817DF800010000          cmp dword ptr [ebp-08], 00000100
:00426E78 0F8D33000000            jnl 00426EB1
:00426E7E 8B45F8                  mov eax, dword ptr [ebp-08]
:00426E81 8A844071BD4600          mov al, byte ptr [eax+2*eax+0046BD71]
:00426E88 8845F0                  mov byte ptr [ebp-10], al
:00426E8B 8B45F8                  mov eax, dword ptr [ebp-08]
:00426E8E 8A844072BD4600          mov al, byte ptr [eax+2*eax+0046BD72]
:00426E95 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00426E98 88844971BD4600          mov byte ptr [ecx+2*ecx+0046BD71], al
:00426E9F 8A45F0                  mov al, byte ptr [ebp-10]
:00426EA2 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00426EA5 88844972BD4600          mov byte ptr [ecx+2*ecx+0046BD72], al
:00426EAC E9BDFFFFFF              jmp 00426E6E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426E78(C)
|
:00426EB1 C745FC70BD4600          mov [ebp-04], 0046BD70
:00426EB8 C745F800000000          mov [ebp-08], 00000000
:00426EBF E903000000              jmp 00426EC7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426EDD(U)
|
:00426EC4 FF45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426EBF(U)
|
:00426EC7 817DF800030000          cmp dword ptr [ebp-08], 00000300
:00426ECE 0F8D0E000000            jnl 00426EE2
:00426ED4 8B45FC                  mov eax, dword ptr [ebp-04]
:00426ED7 C02804                  shr byte ptr [eax], 04
:00426EDA FF45FC                  inc [ebp-04]
:00426EDD E9E2FFFFFF              jmp 00426EC4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426ECE(C)
|
:00426EE2 6870BD4600              push 0046BD70
:00426EE7 6800010000              push 00000100
:00426EEC 6A00                    push 00000000
:00426EEE E8ACF00100              call 00445F9F
:00426EF3 83C40C                  add esp, 0000000C
:00426EF6 E900000000              jmp 00426EFB

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00426DF4(U), :00426EF6(U)
|
:00426EFB 5F                      pop edi
:00426EFC 5E                      pop esi
:00426EFD 5B                      pop ebx
:00426EFE C9                      leave
:00426EFF C3                      ret



* Referenced by a CALL at Addresses:
|:0040B6A2   , :0040B82C   , :0040B97F   
|
:00426F00 55                      push ebp
:00426F01 8BEC                    mov ebp, esp
:00426F03 53                      push ebx
:00426F04 56                      push esi
:00426F05 57                      push edi
:00426F06 6A00                    push 00000000
:00426F08 E80D000000              call 00426F1A
:00426F0D 83C404                  add esp, 00000004
:00426F10 E900000000              jmp 00426F15

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426F10(U)
|
:00426F15 5F                      pop edi
:00426F16 5E                      pop esi
:00426F17 5B                      pop ebx
:00426F18 C9                      leave
:00426F19 C3                      ret



* Referenced by a CALL at Addresses:
|:00426F08   , :00426F85   
|
:00426F1A 55                      push ebp
:00426F1B 8BEC                    mov ebp, esp
:00426F1D 83EC04                  sub esp, 00000004
:00426F20 53                      push ebx
:00426F21 56                      push esi
:00426F22 57                      push edi
:00426F23 6A07                    push 00000007
:00426F25 E8ABDD0100              call 00444CD5
:00426F2A 83C404                  add esp, 00000004
:00426F2D C745FC70BD4600          mov [ebp-04], 0046BD70
:00426F34 837D0801                cmp dword ptr [ebp+08], 00000001
:00426F38 0F851F000000            jne 00426F5D
:00426F3E 6A01                    push 00000001
:00426F40 6A10                    push 00000010
:00426F42 8B45FC                  mov eax, dword ptr [ebp-04]
:00426F45 83C01E                  add eax, 0000001E
:00426F48 50                      push eax
:00426F49 68F6000000              push 000000F6
:00426F4E 6A0A                    push 0000000A
:00426F50 E8BDF10100              call 00446112
:00426F55 83C414                  add esp, 00000014
:00426F58 E916000000              jmp 00426F73

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426F38(C)
|
:00426F5D 8B45FC                  mov eax, dword ptr [ebp-04]
:00426F60 83C01E                  add eax, 0000001E
:00426F63 50                      push eax
:00426F64 68F6000000              push 000000F6
:00426F69 6A0A                    push 0000000A
:00426F6B E82FF00100              call 00445F9F
:00426F70 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426F58(U)
|
:00426F73 E900000000              jmp 00426F78

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426F73(U)
|
:00426F78 5F                      pop edi
:00426F79 5E                      pop esi
:00426F7A 5B                      pop ebx
:00426F7B C9                      leave
:00426F7C C3                      ret



* Referenced by a CALL at Addresses:
|:0040B786   , :0040F30B   , :00414C32   , :00416D67   , :00425189   
|:00425439   , :004254C7   , :00435568   , :00436DA2   , :00436EDB   
|:00439774   
|
:00426F7D 55                      push ebp
:00426F7E 8BEC                    mov ebp, esp
:00426F80 53                      push ebx
:00426F81 56                      push esi
:00426F82 57                      push edi
:00426F83 6A01                    push 00000001
:00426F85 E890FFFFFF              call 00426F1A
:00426F8A 83C404                  add esp, 00000004
:00426F8D E900000000              jmp 00426F92

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426F8D(U)
|
:00426F92 5F                      pop edi
:00426F93 5E                      pop esi
:00426F94 5B                      pop ebx
:00426F95 C9                      leave
:00426F96 C3                      ret



* Referenced by a CALL at Addresses:
|:0040329A   , :00404B53   , :00404D82   , :0040A43C   , :0040EEF4   
|:0040F2CE   , :00410845   , :004138F1   , :00413913   , :00414C23   
|:00416683   , :00416C9D   , :00416DDA   , :00420A8D   , :00420AFF   
|:00420B29   , :00420C93   , :00420D8B   , :00421029   , :004214A3   
|:0042156E   , :004215D2   , :0042171C   , :00421C3C   , :00422069   
|:00422639   , :0042270E   , :0042287F   , :0042291C   , :00422CDF   
|:00422E60   , :0042344C   , :0042455E   , :0042477D   , :0042511F   
|:00425409   , :00425497   , :00426C22   , :004272EA   , :0042C076   
|:0042C8D6   , :0042D585   , :0042D7A4   , :0042DA97   , :004349E3   
|:004358B8   , :00435B52   , :00435C1D   , :00435C54   , :00435CEF   
|:00436ABB   , :00437A0F   , :00437B94   , :00438E71   , :00439EA4   
|:0043A22A   , :0043A4EA   , :0043A6A2   , :0043AA0F   , :0043ADCF   
|:0043B07D   , :0043B962   , :0043BAF8   , :0043BF7F   , :0043C4F7   
|:0043C600   , :0043C7DF   , :0043C8C3   , :0043C947   , :0043D6F4   
|:0043E238   , :0043EC84   , :0043EFF7   , :00440306   , :004405A9   
|:004408E2   , :00443C1F   , :00443D5A   
|
:00426F97 55                      push ebp
:00426F98 8BEC                    mov ebp, esp
:00426F9A 53                      push ebx
:00426F9B 56                      push esi
:00426F9C 57                      push edi
:00426F9D FE05A41B4500            inc byte ptr [00451BA4]
:00426FA3 6A00                    push 00000000
:00426FA5 E8D0F40100              call 0044647A
:00426FAA 83C404                  add esp, 00000004
:00426FAD E900000000              jmp 00426FB2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426FAD(U)
|
:00426FB2 5F                      pop edi
:00426FB3 5E                      pop esi
:00426FB4 5B                      pop ebx
:00426FB5 C9                      leave
:00426FB6 C3                      ret



* Referenced by a CALL at Addresses:
|:00403334   , :00404C3C   , :00404E94   , :0040AB26   , :0040EF4B   
|:0040F306   , :004108EE   , :004138FB   , :004139CB   , :00414C2D   
|:0041676E   , :00416796   , :00416D33   , :00416DE4   , :00420AA2   
|:00420B14   , :00420B3A   , :00420D59   , :00420E44   , :0042108A   
|:004214DF   , :004215A6   , :00421677   , :004218AB   , :00421D05   
|:0042212B   , :0042266D   , :00422809   , :004228C5   , :0042295A   
|:00422D43   , :00422EC4   , :004234A3   , :004245A5   , :004247FA   
|:00425184   , :00425434   , :004254C2   , :00426C6E   , :00427311   
|:0042C241   , :0042C9B0   , :0042D6B3   , :0042DA04   , :0042DD3B   
|:00434A3C   , :00435980   , :00435B9B   , :00435C6F   , :00435CCA   
|:00435D0C   , :00436C21   , :00437B80   , :00437CBE   , :00438F12   
|:0043A15F   , :0043A483   , :0043A552   , :0043A6D5   , :0043AA21   
|:0043ADE6   , :0043B09C   , :0043BA03   , :0043BCD1   , :0043C05E   
|:0043C559   , :0043C705   , :0043C899   , :0043C910   , :0043CA59   
|:0043DCBA   , :0043E3CC   , :0043ECEF   , :0043F9C2   , :00440391   
|:00440635   , :00440A42   , :00443C6F   , :00443DE1   
|
:00426FB7 55                      push ebp
:00426FB8 8BEC                    mov ebp, esp
:00426FBA 53                      push ebx
:00426FBB 56                      push esi
:00426FBC 57                      push edi
:00426FBD 33C0                    xor eax, eax
:00426FBF A0A41B4500              mov al, byte ptr [00451BA4]
:00426FC4 85C0                    test eax, eax
:00426FC6 0F8410000000            je 00426FDC
:00426FCC 6A01                    push 00000001
:00426FCE E8A7F40100              call 0044647A
:00426FD3 83C404                  add esp, 00000004
:00426FD6 FE0DA41B4500            dec byte ptr [00451BA4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426FC6(C)
|
:00426FDC E900000000              jmp 00426FE1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426FDC(U)
|
:00426FE1 5F                      pop edi
:00426FE2 5E                      pop esi
:00426FE3 5B                      pop ebx
:00426FE4 C9                      leave
:00426FE5 C3                      ret



* Referenced by a CALL at Address:
|:00420F4E   
|
:00426FE6 55                      push ebp
:00426FE7 8BEC                    mov ebp, esp
:00426FE9 53                      push ebx
:00426FEA 56                      push esi
:00426FEB 57                      push edi
:00426FEC 6A07                    push 00000007
:00426FEE E8E2DC0100              call 00444CD5
:00426FF3 83C404                  add esp, 00000004
:00426FF6 8B4518                  mov eax, dword ptr [ebp+18]
:00426FF9 50                      push eax
:00426FFA 8B4514                  mov eax, dword ptr [ebp+14]
:00426FFD 50                      push eax
:00426FFE 8B4510                  mov eax, dword ptr [ebp+10]
:00427001 50                      push eax
:00427002 8B450C                  mov eax, dword ptr [ebp+0C]
:00427005 50                      push eax
:00427006 8B4508                  mov eax, dword ptr [ebp+08]
:00427009 50                      push eax
:0042700A E84CE90100              call 0044595B
:0042700F 83C414                  add esp, 00000014
:00427012 E900000000              jmp 00427017

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427012(U)
|
:00427017 5F                      pop edi
:00427018 5E                      pop esi
:00427019 5B                      pop ebx
:0042701A C9                      leave
:0042701B C3                      ret



* Referenced by a CALL at Address:
|:00421082   
|
:0042701C 55                      push ebp
:0042701D 8BEC                    mov ebp, esp
:0042701F 53                      push ebx
:00427020 56                      push esi
:00427021 57                      push edi
:00427022 6A07                    push 00000007
:00427024 E8ACDC0100              call 00444CD5
:00427029 83C404                  add esp, 00000004
:0042702C 6A00                    push 00000000
:0042702E 6A00                    push 00000000
:00427030 8B4518                  mov eax, dword ptr [ebp+18]
:00427033 50                      push eax
:00427034 E8C6DC0100              call 00444CFF
:00427039 83C40C                  add esp, 0000000C
:0042703C 8B451C                  mov eax, dword ptr [ebp+1C]
:0042703F 50                      push eax
:00427040 8B4514                  mov eax, dword ptr [ebp+14]
:00427043 50                      push eax
:00427044 8B4510                  mov eax, dword ptr [ebp+10]
:00427047 50                      push eax
:00427048 8B450C                  mov eax, dword ptr [ebp+0C]
:0042704B 50                      push eax
:0042704C 8B4508                  mov eax, dword ptr [ebp+08]
:0042704F 50                      push eax
:00427050 E84AE70100              call 0044579F
:00427055 83C414                  add esp, 00000014
:00427058 E900000000              jmp 0042705D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427058(U)
|
:0042705D 5F                      pop edi
:0042705E 5E                      pop esi
:0042705F 5B                      pop ebx
:00427060 C9                      leave
:00427061 C3                      ret



* Referenced by a CALL at Addresses:
|:0040AB89   , :0040B6E5   , :0040B713   , :0040B75A   , :0040B781   
|:0040B811   , :0040B97A   , :00424CE4   , :00425124   , :004251CB   
|:0042540E   , :0042549C   , :004258A1   , :00425A0F   , :004405AE   
|
:00427062 55                      push ebp
:00427063 8BEC                    mov ebp, esp
:00427065 53                      push ebx
:00427066 56                      push esi
:00427067 57                      push edi
:00427068 E8F0DD0100              call 00444E5D
:0042706D E900000000              jmp 00427072

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042706D(U)
|
:00427072 5F                      pop edi
:00427073 5E                      pop esi
:00427074 5B                      pop ebx
:00427075 C9                      leave
:00427076 C3                      ret



* Referenced by a CALL at Addresses:
|:00410880   , :00438701   , :0043BACB   , :0043BBB8   , :0043BC6B   
|:0043BC8F   , :0043C025   , :0043C042   , :0043C86A   , :0043C887   
|
:00427077 55                      push ebp
:00427078 8BEC                    mov ebp, esp
:0042707A 53                      push ebx
:0042707B 56                      push esi
:0042707C 57                      push edi
:0042707D 6A00                    push 00000000
:0042707F 8B451C                  mov eax, dword ptr [ebp+1C]
:00427082 50                      push eax
:00427083 6A00                    push 00000000
:00427085 E875DC0100              call 00444CFF
:0042708A 83C40C                  add esp, 0000000C
:0042708D 8B4518                  mov eax, dword ptr [ebp+18]
:00427090 50                      push eax
:00427091 8B4514                  mov eax, dword ptr [ebp+14]
:00427094 03450C                  add eax, dword ptr [ebp+0C]
:00427097 48                      dec eax
:00427098 50                      push eax
:00427099 8B4510                  mov eax, dword ptr [ebp+10]
:0042709C 034508                  add eax, dword ptr [ebp+08]
:0042709F 48                      dec eax
:004270A0 50                      push eax
:004270A1 8B450C                  mov eax, dword ptr [ebp+0C]
:004270A4 50                      push eax
:004270A5 8B4508                  mov eax, dword ptr [ebp+08]
:004270A8 50                      push eax
:004270A9 E8E3E10100              call 00445291
:004270AE 83C414                  add esp, 00000014
:004270B1 E900000000              jmp 004270B6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004270B1(U)
|
:004270B6 5F                      pop edi
:004270B7 5E                      pop esi
:004270B8 5B                      pop ebx
:004270B9 C9                      leave
:004270BA C3                      ret



* Referenced by a CALL at Addresses:
|:0042717B   , :004271AA   
|
:004270BB 55                      push ebp
:004270BC 8BEC                    mov ebp, esp
:004270BE 53                      push ebx
:004270BF 56                      push esi
:004270C0 57                      push edi
:004270C1 8B450C                  mov eax, dword ptr [ebp+0C]
:004270C4 50                      push eax
:004270C5 8B4508                  mov eax, dword ptr [ebp+08]
:004270C8 50                      push eax
:004270C9 B938CE4600              mov ecx, 0046CE38
:004270CE E8AE050000              call 00427681
:004270D3 E900000000              jmp 004270D8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004270D3(U)
|
:004270D8 5F                      pop edi
:004270D9 5E                      pop esi
:004270DA 5B                      pop ebx
:004270DB C9                      leave
:004270DC C3                      ret



* Referenced by a CALL at Addresses:
|:004166FD   , :00437B06   , :0043F99B   
|
:004270DD 55                      push ebp
:004270DE 8BEC                    mov ebp, esp
:004270E0 83EC04                  sub esp, 00000004
:004270E3 53                      push ebx
:004270E4 56                      push esi
:004270E5 57                      push edi
:004270E6 837D1004                cmp dword ptr [ebp+10], 00000004
:004270EA 0F8511000000            jne 00427101
:004270F0 B9D0A64600              mov ecx, 0046A6D0
:004270F5 E856020000              call 00427350
:004270FA 33C9                    xor ecx, ecx
:004270FC 8AC8                    mov cl, al
:004270FE 894D10                  mov dword ptr [ebp+10], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004270EA(C)
|
:00427101 817D1020010000          cmp dword ptr [ebp+10], 00000120
:00427108 0F820F000000            jb 0042711D
:0042710E B920010000              mov ecx, 00000120
:00427113 8B4510                  mov eax, dword ptr [ebp+10]
:00427116 2BD2                    sub edx, edx
:00427118 F7F1                    div ecx
:0042711A 895510                  mov dword ptr [ebp+10], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427108(C)
|
:0042711D C745FC78CF4600          mov [ebp-04], 0046CF78
:00427124 A1902B4500              mov eax, dword ptr [00452B90]
:00427129 394510                  cmp dword ptr [ebp+10], eax
:0042712C 0F850F000000            jne 00427141
:00427132 C705A81B450001000000    mov dword ptr [00451BA8], 00000001
:0042713C E983000000              jmp 004271C4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042712C(C)
|
:00427141 A1942B4500              mov eax, dword ptr [00452B94]
:00427146 394510                  cmp dword ptr [ebp+10], eax
:00427149 0F8516000000            jne 00427165
:0042714F C745FC30E54600          mov [ebp-04], 0046E530
:00427156 C705A81B450000000000    mov dword ptr [00451BA8], 00000000
:00427160 E95F000000              jmp 004271C4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427149(C)
|
:00427165 833DA81B450000          cmp dword ptr [00451BA8], 00000000
:0042716C 0F8528000000            jne 0042719A
:00427172 6878CF4600              push 0046CF78
:00427177 8B4510                  mov eax, dword ptr [ebp+10]
:0042717A 50                      push eax
:0042717B E83BFFFFFF              call 004270BB
:00427180 83C408                  add esp, 00000008
:00427183 8B4510                  mov eax, dword ptr [ebp+10]
:00427186 A3902B4500              mov dword ptr [00452B90], eax
:0042718B C705A81B450001000000    mov dword ptr [00451BA8], 00000001
:00427195 E92A000000              jmp 004271C4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042716C(C)
|
:0042719A C745FC30E54600          mov [ebp-04], 0046E530
:004271A1 6830E54600              push 0046E530
:004271A6 8B4510                  mov eax, dword ptr [ebp+10]
:004271A9 50                      push eax
:004271AA E80CFFFFFF              call 004270BB
:004271AF 83C408                  add esp, 00000008
:004271B2 8B4510                  mov eax, dword ptr [ebp+10]
:004271B5 A3942B4500              mov dword ptr [00452B94], eax
:004271BA C705A81B450000000000    mov dword ptr [00451BA8], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042713C(U), :00427160(U), :00427195(U)
|
:004271C4 8B45FC                  mov eax, dword ptr [ebp-04]
:004271C7 50                      push eax
:004271C8 8B450C                  mov eax, dword ptr [ebp+0C]
:004271CB 50                      push eax
:004271CC 8B4508                  mov eax, dword ptr [ebp+08]
:004271CF 50                      push eax
:004271D0 E80D000000              call 004271E2
:004271D5 83C40C                  add esp, 0000000C
:004271D8 E900000000              jmp 004271DD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004271D8(U)
|
:004271DD 5F                      pop edi
:004271DE 5E                      pop esi
:004271DF 5B                      pop ebx
:004271E0 C9                      leave
:004271E1 C3                      ret



* Referenced by a CALL at Address:
|:004271D0   
|
:004271E2 55                      push ebp
:004271E3 8BEC                    mov ebp, esp
:004271E5 53                      push ebx
:004271E6 56                      push esi
:004271E7 57                      push edi
:004271E8 8B4510                  mov eax, dword ptr [ebp+10]
:004271EB 50                      push eax
:004271EC 6A50                    push 00000050
:004271EE 6A40                    push 00000040
:004271F0 8B450C                  mov eax, dword ptr [ebp+0C]
:004271F3 50                      push eax
:004271F4 8B4508                  mov eax, dword ptr [ebp+08]
:004271F7 50                      push eax
:004271F8 E8A2E50100              call 0044579F
:004271FD 83C414                  add esp, 00000014
:00427200 E900000000              jmp 00427205

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427200(U)
|
:00427205 5F                      pop edi
:00427206 5E                      pop esi
:00427207 5B                      pop ebx
:00427208 C9                      leave
:00427209 C3                      ret



* Referenced by a CALL at Addresses:
|:00401718   , :0040173D   , :00401762   , :0040CFEA   , :00420DBB   
|:0043455C   , :0043464F   , :00434903   , :00434A57   , :00434AB3   
|:004352C1   , :00435909   , :00435D87   , :00435F92   , :00436B64   
|:00437C1A   , :00438876   
|
:0042720A 55                      push ebp
:0042720B 8BEC                    mov ebp, esp
:0042720D 81EC04010000            sub esp, 00000104
:00427213 53                      push ebx
:00427214 56                      push esi
:00427215 57                      push edi
:00427216 6A07                    push 00000007
:00427218 E8B8DA0100              call 00444CD5
:0042721D 83C404                  add esp, 00000004
:00427220 817D18FFFF0000          cmp dword ptr [ebp+18], 0000FFFF
:00427227 0F850D000000            jne 0042723A
:0042722D B9D0A64600              mov ecx, 0046A6D0
:00427232 E8C949FEFF              call 0040BC00
:00427237 894518                  mov dword ptr [ebp+18], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427227(C)
|
:0042723A 8B4518                  mov eax, dword ptr [ebp+18]
:0042723D 8985FCFEFFFF            mov dword ptr [ebp+FFFFFEFC], eax
:00427243 E976000000              jmp 004272BE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004272C5(C)
|
:00427248 6A0A                    push 0000000A
:0042724A 6800010000              push 00000100
:0042724F 8D8500FFFFFF            lea eax, dword ptr [ebp+FFFFFF00]
:00427255 50                      push eax
:00427256 E808020200              call 00447463
:0042725B 83C40C                  add esp, 0000000C
:0042725E 8D8500FFFFFF            lea eax, dword ptr [ebp+FFFFFF00]
:00427264 50                      push eax
:00427265 6A10                    push 00000010
:00427267 6A01                    push 00000001
:00427269 E83CDC0100              call 00444EAA
:0042726E 83C40C                  add esp, 0000000C
:00427271 E974000000              jmp 004272EA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004272DF(C)
|
:00427276 6A04                    push 00000004
:00427278 6A00                    push 00000000
:0042727A 8B4518                  mov eax, dword ptr [ebp+18]
:0042727D 48                      dec eax
:0042727E C1E007                  shl eax, 07
:00427281 0540A20000              add eax, 0000A240
:00427286 50                      push eax
:00427287 B940CF4600              mov ecx, 0046CF40
:0042728C E88F040200              call 00447720
:00427291 50                      push eax
:00427292 6A10                    push 00000010
:00427294 6A01                    push 00000001
:00427296 E80FDC0100              call 00444EAA
:0042729B 83C40C                  add esp, 0000000C
:0042729E E947000000              jmp 004272EA

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004272D2(C), :004272E5(U)
|

* Possible StringData Ref from Data Obj ->"QQQQQQQQ"
                                  |
:004272A3 68B01B4500              push 00451BB0
:004272A8 6A02                    push 00000002
:004272AA 6A01                    push 00000001
:004272AC E8F9DB0100              call 00444EAA
:004272B1 83C40C                  add esp, 0000000C
:004272B4 E931000000              jmp 004272EA
:004272B9 E92C000000              jmp 004272EA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427243(U)
|
:004272BE 83BDFCFEFFFF00          cmp dword ptr [ebp+FFFFFEFC], 00000000
:004272C5 0F847DFFFFFF            je 00427248
:004272CB 83BDFCFEFFFF01          cmp dword ptr [ebp+FFFFFEFC], 00000001
:004272D2 0F82CBFFFFFF            jb 004272A3
:004272D8 83BDFCFEFFFF07          cmp dword ptr [ebp+FFFFFEFC], 00000007
:004272DF 0F8691FFFFFF            jbe 00427276
:004272E5 E9B9FFFFFF              jmp 004272A3

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00427271(U), :0042729E(U), :004272B4(U), :004272B9(U)
|
:004272EA E8A8FCFFFF              call 00426F97
:004272EF 6A02                    push 00000002
:004272F1 8B4514                  mov eax, dword ptr [ebp+14]
:004272F4 03450C                  add eax, dword ptr [ebp+0C]
:004272F7 48                      dec eax
:004272F8 50                      push eax
:004272F9 8B4510                  mov eax, dword ptr [ebp+10]
:004272FC 034508                  add eax, dword ptr [ebp+08]
:004272FF 48                      dec eax
:00427300 50                      push eax
:00427301 8B450C                  mov eax, dword ptr [ebp+0C]
:00427304 50                      push eax
:00427305 8B4508                  mov eax, dword ptr [ebp+08]
:00427308 50                      push eax
:00427309 E883DF0100              call 00445291
:0042730E 83C414                  add esp, 00000014
:00427311 E8A1FCFFFF              call 00426FB7
:00427316 E900000000              jmp 0042731B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427316(U)
|
:0042731B 5F                      pop edi
:0042731C 5E                      pop esi
:0042731D 5B                      pop ebx
:0042731E C9                      leave
:0042731F C3                      ret



* Referenced by a CALL at Addresses:
|:00426D5F   , :00426E06   , :00427397   , :004276E4   , :004277EA   
|:0042E519   , :0042E52A   , :0042E53B   , :0042E54C   , :0042E55D   
|:0042E56E   , :0042E581   , :0042E594   , :0042E5C9   , :0042E5E2   
|:0042E5FB   , :0042E614   , :0042E62D   , :0042E645   , :0042E658   
|:0042E66B   , :0042E67E   , :0042E691   , :0042E6A4   , :0042E6B7   
|:0042E6CA   , :0042E6DD   , :0042E6F0   , :0042E729   , :0042E749   
|:0042E769   , :0042E789   , :0042E7A9   , :0042E7C9   , :0042E7E9   
|:0042E809   , :0042E81F   , :0042E832   , :0042E848   , :0042E85B   
|:0042E86E   , :004406EB   
|
:00427320 55                      push ebp
:00427321 8BEC                    mov ebp, esp
:00427323 83EC04                  sub esp, 00000004
:00427326 53                      push ebx
:00427327 56                      push esi
:00427328 57                      push edi
:00427329 894DFC                  mov dword ptr [ebp-04], ecx
:0042732C 8B450C                  mov eax, dword ptr [ebp+0C]
:0042732F 50                      push eax
:00427330 8B4508                  mov eax, dword ptr [ebp+08]
:00427333 50                      push eax
:00427334 8B45FC                  mov eax, dword ptr [ebp-04]
:00427337 8B00                    mov eax, dword ptr [eax]
:00427339 50                      push eax
:0042733A E81A050200              call 00447859
:0042733F 83C40C                  add esp, 0000000C
:00427342 E900000000              jmp 00427347

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427342(U)
|
:00427347 5F                      pop edi
:00427348 5E                      pop esi
:00427349 5B                      pop ebx
:0042734A C9                      leave
:0042734B C20800                  ret 0008


:0042734E CC                      int 03
:0042734F CC                      int 03

* Referenced by a CALL at Address:
|:004270F5   
|
:00427350 55                      push ebp
:00427351 8BEC                    mov ebp, esp
:00427353 83EC04                  sub esp, 00000004
:00427356 53                      push ebx
:00427357 56                      push esi
:00427358 57                      push edi
:00427359 894DFC                  mov dword ptr [ebp-04], ecx
:0042735C 8B45FC                  mov eax, dword ptr [ebp-04]
:0042735F 8A4013                  mov al, byte ptr [eax+13]
:00427362 E900000000              jmp 00427367

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427362(U)
|
:00427367 5F                      pop edi
:00427368 5E                      pop esi
:00427369 5B                      pop ebx
:0042736A C9                      leave
:0042736B C3                      ret


:0042736C CC                      int 03
:0042736D CC                      int 03
:0042736E CC                      int 03
:0042736F CC                      int 03

* Referenced by a CALL at Address:
|:00427421   
|
:00427370 55                      push ebp
:00427371 8BEC                    mov ebp, esp
:00427373 83EC08                  sub esp, 00000008
:00427376 53                      push ebx
:00427377 56                      push esi
:00427378 57                      push edi
:00427379 894DF8                  mov dword ptr [ebp-08], ecx
:0042737C 833D80C0460000          cmp dword ptr [0046C080], 00000000
:00427383 0F8539000000            jne 004273C2
:00427389 6800040000              push 00000400
:0042738E A17CC04600              mov eax, dword ptr [0046C07C]
:00427393 50                      push eax
:00427394 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00427397 E884FFFFFF              call 00427320
:0042739C A380C04600              mov dword ptr [0046C080], eax
:004273A1 833D80C0460000          cmp dword ptr [0046C080], 00000000
:004273A8 0F8F0A000000            jg 004273B8
:004273AE B8FFFFFFFF              mov eax, FFFFFFFF
:004273B3 E92C000000              jmp 004273E4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004273A8(C)
|
:004273B8 A17CC04600              mov eax, dword ptr [0046C07C]
:004273BD A370C04600              mov dword ptr [0046C070], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427383(C)
|
:004273C2 FF0D80C04600            dec dword ptr [0046C080]
:004273C8 A170C04600              mov eax, dword ptr [0046C070]
:004273CD 8945FC                  mov dword ptr [ebp-04], eax
:004273D0 FF0570C04600            inc dword ptr [0046C070]
:004273D6 8B45FC                  mov eax, dword ptr [ebp-04]
:004273D9 33C9                    xor ecx, ecx
:004273DB 8A08                    mov cl, byte ptr [eax]
:004273DD 8BC1                    mov eax, ecx
:004273DF E900000000              jmp 004273E4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004273B3(U), :004273DF(U)
|
:004273E4 5F                      pop edi
:004273E5 5E                      pop esi
:004273E6 5B                      pop ebx
:004273E7 C9                      leave
:004273E8 C3                      ret



* Referenced by a CALL at Addresses:
|:004274A3   , :004274E0   
|
:004273E9 55                      push ebp
:004273EA 8BEC                    mov ebp, esp
:004273EC 83EC10                  sub esp, 00000010
:004273EF 53                      push ebx
:004273F0 56                      push esi
:004273F1 57                      push edi
:004273F2 894DF0                  mov dword ptr [ebp-10], ecx
:004273F5 C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427471(U)
|
:004273FC 8B4508                  mov eax, dword ptr [ebp+08]
:004273FF 8945F4                  mov dword ptr [ebp-0C], eax
:00427402 FF4D08                  dec [ebp+08]
:00427405 837DF400                cmp dword ptr [ebp-0C], 00000000
:00427409 0F8467000000            je 00427476
:0042740F 33C0                    xor eax, eax
:00427411 A078C04600              mov al, byte ptr [0046C078]
:00427416 85C0                    test eax, eax
:00427418 0F852E000000            jne 0042744C
:0042741E 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00427421 E84AFFFFFF              call 00427370
:00427426 8945F8                  mov dword ptr [ebp-08], eax
:00427429 837DF8FF                cmp dword ptr [ebp-08], FFFFFFFF
:0042742D 0F850A000000            jne 0042743D
:00427433 B8FFFFFFFF              mov eax, FFFFFFFF
:00427438 E941000000              jmp 0042747E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042742D(C)
|
:0042743D 8A45F8                  mov al, byte ptr [ebp-08]
:00427440 A274C04600              mov byte ptr [0046C074], al
:00427445 C60578C0460008          mov byte ptr [0046C078], 08

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427418(C)
|
:0042744C FE0D78C04600            dec byte ptr [0046C078]
:00427452 33C0                    xor eax, eax
:00427454 A074C04600              mov al, byte ptr [0046C074]
:00427459 2580000000              and eax, 00000080
:0042745E C1E807                  shr eax, 07
:00427461 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00427464 8D0448                  lea eax, dword ptr [eax+2*ecx]
:00427467 8945FC                  mov dword ptr [ebp-04], eax
:0042746A C02574C0460001          shl byte ptr [0046C074], 01
:00427471 E986FFFFFF              jmp 004273FC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427409(C)
|
:00427476 8B45FC                  mov eax, dword ptr [ebp-04]
:00427479 E900000000              jmp 0042747E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00427438(U), :00427479(U)
|
:0042747E 5F                      pop edi
:0042747F 5E                      pop esi
:00427480 5B                      pop ebx
:00427481 C9                      leave
:00427482 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:004275E4   , :00427607   
|
:00427485 55                      push ebp
:00427486 8BEC                    mov ebp, esp
:00427488 83EC10                  sub esp, 00000010
:0042748B 53                      push ebx
:0042748C 56                      push esi
:0042748D 57                      push edi
:0042748E 894DF0                  mov dword ptr [ebp-10], ecx
:00427491 C745FC00000000          mov [ebp-04], 00000000
:00427498 66C745F40000            mov [ebp-0C], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004274D2(C)
|
:0042749E 6A01                    push 00000001
:004274A0 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004274A3 E841FFFFFF              call 004273E9
:004274A8 8945F8                  mov dword ptr [ebp-08], eax
:004274AB 837DF8FF                cmp dword ptr [ebp-08], FFFFFFFF
:004274AF 0F850A000000            jne 004274BF
:004274B5 B8FFFFFFFF              mov eax, FFFFFFFF
:004274BA E94B000000              jmp 0042750A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004274AF(C)
|
:004274BF 8B45FC                  mov eax, dword ptr [ebp-04]
:004274C2 03C0                    add eax, eax
:004274C4 0345F8                  add eax, dword ptr [ebp-08]
:004274C7 8945FC                  mov dword ptr [ebp-04], eax
:004274CA 66FF45F4                inc [ebp-0C]
:004274CE F645FC01                test [ebp-04], 01
:004274D2 0F85C6FFFFFF            jne 0042749E
:004274D8 0FBF45F4                movsx eax, word ptr [ebp-0C]
:004274DC 50                      push eax
:004274DD 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004274E0 E804FFFFFF              call 004273E9
:004274E5 8945F8                  mov dword ptr [ebp-08], eax
:004274E8 837DF8FF                cmp dword ptr [ebp-08], FFFFFFFF
:004274EC 0F850A000000            jne 004274FC
:004274F2 B8FFFFFFFF              mov eax, FFFFFFFF
:004274F7 E90E000000              jmp 0042750A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004274EC(C)
|
:004274FC 8B45F8                  mov eax, dword ptr [ebp-08]
:004274FF 0145FC                  add dword ptr [ebp-04], eax
:00427502 8B45FC                  mov eax, dword ptr [ebp-04]
:00427505 E900000000              jmp 0042750A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004274BA(U), :004274F7(U), :00427505(U)
|
:0042750A 5F                      pop edi
:0042750B 5E                      pop esi
:0042750C 5B                      pop ebx
:0042750D C9                      leave
:0042750E C3                      ret



* Referenced by a CALL at Addresses:
|:004048F7   , :00411E2E   , :00411ECE   , :00414B1E   , :00415607   
|:0042250D   , :0042351D   , :004236E8   , :00425073   , :00425082   
|:0042826B   , :004283DB   , :0042980D   , :0042B498   , :0042B513   
|:0042B623   , :0042E1BB   , :00434130   , :0043F41D   , :0044032F   
|:004403D9   , :00440415   , :00440542   , :00443B00   
|
:0042750F 55                      push ebp
:00427510 8BEC                    mov ebp, esp
:00427512 83EC04                  sub esp, 00000004
:00427515 53                      push ebx
:00427516 56                      push esi
:00427517 57                      push edi
:00427518 894DFC                  mov dword ptr [ebp-04], ecx
:0042751B 6A04                    push 00000004
:0042751D 8B4508                  mov eax, dword ptr [ebp+08]
:00427520 50                      push eax
:00427521 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00427524 E88E000200              call 004475B7
:00427529 85C0                    test eax, eax
:0042752B 0F851A000000            jne 0042754B
:00427531 8B4508                  mov eax, dword ptr [ebp+08]
:00427534 50                      push eax

* Possible StringData Ref from Data Obj ->"File%sOpenErr"
                                  |
:00427535 68F81B4500              push 00451BF8
:0042753A 6A00                    push 00000000
:0042753C E8F4190100              call 00438F35
:00427541 83C40C                  add esp, 0000000C
:00427544 33C0                    xor eax, eax
:00427546 E920000000              jmp 0042756B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042752B(C)
|
:0042754B 6800010000              push 00000100
:00427550 8B45FC                  mov eax, dword ptr [ebp-04]
:00427553 83C004                  add eax, 00000004
:00427556 50                      push eax
:00427557 6A10                    push 00000010
:00427559 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042755C E8EF1EFEFF              call 00409450
:00427561 B801000000              mov eax, 00000001
:00427566 E900000000              jmp 0042756B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00427546(U), :00427566(U)
|
:0042756B 5F                      pop edi
:0042756C 5E                      pop esi
:0042756D 5B                      pop ebx
:0042756E C9                      leave
:0042756F C20400                  ret 0004


:00427572 55                      push ebp
:00427573 8BEC                    mov ebp, esp
:00427575 83EC04                  sub esp, 00000004
:00427578 53                      push ebx
:00427579 56                      push esi
:0042757A 57                      push edi
:0042757B 894DFC                  mov dword ptr [ebp-04], ecx
:0042757E 6A00                    push 00000000
:00427580 8B4508                  mov eax, dword ptr [ebp+08]
:00427583 50                      push eax
:00427584 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00427587 E82B000200              call 004475B7
:0042758C 85C0                    test eax, eax
:0042758E 0F851A000000            jne 004275AE
:00427594 8B4508                  mov eax, dword ptr [ebp+08]
:00427597 50                      push eax

* Possible StringData Ref from Data Obj ->"File%sOpenErr"
                                  |
:00427598 68081C4500              push 00451C08
:0042759D 6A00                    push 00000000
:0042759F E891190100              call 00438F35
:004275A4 83C40C                  add esp, 0000000C
:004275A7 33C0                    xor eax, eax
:004275A9 E920000000              jmp 004275CE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042758E(C)
|
:004275AE 6800010000              push 00000100
:004275B3 8B45FC                  mov eax, dword ptr [ebp-04]
:004275B6 83C004                  add eax, 00000004
:004275B9 50                      push eax
:004275BA 6A10                    push 00000010
:004275BC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004275BF E88C1EFEFF              call 00409450
:004275C4 B801000000              mov eax, 00000001
:004275C9 E900000000              jmp 004275CE

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004275A9(U), :004275C9(U)
|
:004275CE 5F                      pop edi
:004275CF 5E                      pop esi
:004275D0 5B                      pop ebx
:004275D1 C9                      leave
:004275D2 C20400                  ret 0004



* Referenced by a CALL at Address:
|:00427802   
|
:004275D5 55                      push ebp
:004275D6 8BEC                    mov ebp, esp
:004275D8 83EC18                  sub esp, 00000018
:004275DB 53                      push ebx
:004275DC 56                      push esi
:004275DD 57                      push edi
:004275DE 894DE8                  mov dword ptr [ebp-18], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042766F(C)
|
:004275E1 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004275E4 E89CFEFFFF              call 00427485
:004275E9 8945F4                  mov dword ptr [ebp-0C], eax
:004275EC 817DF400010000          cmp dword ptr [ebp-0C], 00000100
:004275F3 0F8C5D000000            jl 00427656
:004275F9 8B45F4                  mov eax, dword ptr [ebp-0C]
:004275FC 2D00010000              sub eax, 00000100
:00427601 8945F8                  mov dword ptr [ebp-08], eax
:00427604 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00427607 E879FEFFFF              call 00427485
:0042760C 83C003                  add eax, 00000003
:0042760F 8945FC                  mov dword ptr [ebp-04], eax
:00427612 8B4508                  mov eax, dword ptr [ebp+08]
:00427615 2B45F8                  sub eax, dword ptr [ebp-08]
:00427618 8945F0                  mov dword ptr [ebp-10], eax
:0042761B C745EC00000000          mov [ebp-14], 00000000
:00427622 E903000000              jmp 0042762A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427646(U)
|
:00427627 FF45EC                  inc [ebp-14]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427622(U)
|
:0042762A 8B45EC                  mov eax, dword ptr [ebp-14]
:0042762D 3945FC                  cmp dword ptr [ebp-04], eax
:00427630 0F8615000000            jbe 0042764B
:00427636 8B45F0                  mov eax, dword ptr [ebp-10]
:00427639 8A00                    mov al, byte ptr [eax]
:0042763B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042763E 8801                    mov byte ptr [ecx], al
:00427640 FF45F0                  inc [ebp-10]
:00427643 FF4508                  inc [ebp+08]
:00427646 E9DCFFFFFF              jmp 00427627

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427630(C)
|
:0042764B 8B45FC                  mov eax, dword ptr [ebp-04]
:0042764E 29450C                  sub dword ptr [ebp+0C], eax
:00427651 E915000000              jmp 0042766B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004275F3(C)
|
:00427656 8B45F4                  mov eax, dword ptr [ebp-0C]
:00427659 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0042765C 8A440804                mov al, byte ptr [eax+ecx+04]
:00427660 8B4D08                  mov ecx, dword ptr [ebp+08]
:00427663 8801                    mov byte ptr [ecx], al
:00427665 FF4508                  inc [ebp+08]
:00427668 FF4D0C                  dec [ebp+0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427651(U)
|
:0042766B 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0042766F 0F856CFFFFFF            jne 004275E1
:00427675 E900000000              jmp 0042767A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427675(U)
|
:0042767A 5F                      pop edi
:0042767B 5E                      pop esi
:0042767C 5B                      pop ebx
:0042767D C9                      leave
:0042767E C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:00404919   , :00404936   , :0040F238   , :0040F267   , :0040F29E   
|:00411CF6   , :00411D32   , :00411EED   , :00414B3D   , :00415626   
|:00422537   , :0042353F   , :0042370D   , :004270CE   , :00428287   
|:00428488   , :00429825   , :0042B4BA   , :0042B535   , :0042B658   
|:00432C31   , :00434183   , :004341BB   , :004341D1   , :0043F450   
|:00440356   , :004403FA   , :00440436   , :0044055A   , :00440585   
|:00443B18   
|
:00427681 55                      push ebp
:00427682 8BEC                    mov ebp, esp
:00427684 81EC10040000            sub esp, 00000410
:0042768A 53                      push ebx
:0042768B 56                      push esi
:0042768C 57                      push edi
:0042768D 898DF0FBFFFF            mov dword ptr [ebp+FFFFFBF0], ecx
:00427693 8D85F4FBFFFF            lea eax, dword ptr [ebp+FFFFFBF4]
:00427699 A37CC04600              mov dword ptr [0046C07C], eax
:0042769E C70580C0460000000000    mov dword ptr [0046C080], 00000000
:004276A8 C60578C0460000          mov byte ptr [0046C078], 00
:004276AF A078C04600              mov al, byte ptr [0046C078]
:004276B4 A274C04600              mov byte ptr [0046C074], al
:004276B9 6A00                    push 00000000
:004276BB 8B4508                  mov eax, dword ptr [ebp+08]
:004276BE 8D0440                  lea eax, dword ptr [eax+2*eax]
:004276C1 C1E002                  shl eax, 02
:004276C4 0510010000              add eax, 00000110
:004276C9 50                      push eax
:004276CA 8B8DF0FBFFFF            mov ecx, dword ptr [ebp+FFFFFBF0]
:004276D0 E84B010000              call 00427820
:004276D5 6A0C                    push 0000000C
:004276D7 8D85F4FBFFFF            lea eax, dword ptr [ebp+FFFFFBF4]
:004276DD 50                      push eax
:004276DE 8B8DF0FBFFFF            mov ecx, dword ptr [ebp+FFFFFBF0]
:004276E4 E837FCFFFF              call 00427320
:004276E9 33C0                    xor eax, eax
:004276EB 8A85FCFBFFFF            mov al, byte ptr [ebp+FFFFFBFC]
:004276F1 8945F8                  mov dword ptr [ebp-08], eax
:004276F4 33C0                    xor eax, eax
:004276F6 8A85FDFBFFFF            mov al, byte ptr [ebp+FFFFFBFD]
:004276FC 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004276FF C1E108                  shl ecx, 08
:00427702 03C1                    add eax, ecx
:00427704 8945F8                  mov dword ptr [ebp-08], eax
:00427707 33C0                    xor eax, eax
:00427709 8A85FEFBFFFF            mov al, byte ptr [ebp+FFFFFBFE]
:0042770F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00427712 C1E108                  shl ecx, 08
:00427715 03C1                    add eax, ecx
:00427717 8945F8                  mov dword ptr [ebp-08], eax
:0042771A 33C0                    xor eax, eax
:0042771C 8A85FFFBFFFF            mov al, byte ptr [ebp+FFFFFBFF]
:00427722 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00427725 C1E108                  shl ecx, 08
:00427728 03C1                    add eax, ecx
:0042772A 8945F8                  mov dword ptr [ebp-08], eax
:0042772D 33C0                    xor eax, eax
:0042772F 8A85F8FBFFFF            mov al, byte ptr [ebp+FFFFFBF8]
:00427735 8945FC                  mov dword ptr [ebp-04], eax
:00427738 33C0                    xor eax, eax
:0042773A 8A85F9FBFFFF            mov al, byte ptr [ebp+FFFFFBF9]
:00427740 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00427743 C1E108                  shl ecx, 08
:00427746 03C1                    add eax, ecx
:00427748 8945FC                  mov dword ptr [ebp-04], eax
:0042774B 33C0                    xor eax, eax
:0042774D 8A85FAFBFFFF            mov al, byte ptr [ebp+FFFFFBFA]
:00427753 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00427756 C1E108                  shl ecx, 08
:00427759 03C1                    add eax, ecx
:0042775B 8945FC                  mov dword ptr [ebp-04], eax
:0042775E 33C0                    xor eax, eax
:00427760 8A85FBFBFFFF            mov al, byte ptr [ebp+FFFFFBFB]
:00427766 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00427769 C1E108                  shl ecx, 08
:0042776C 03C1                    add eax, ecx
:0042776E 8945FC                  mov dword ptr [ebp-04], eax
:00427771 33C0                    xor eax, eax
:00427773 8A85F4FBFFFF            mov al, byte ptr [ebp+FFFFFBF4]
:00427779 8945F4                  mov dword ptr [ebp-0C], eax
:0042777C 33C0                    xor eax, eax
:0042777E 8A85F5FBFFFF            mov al, byte ptr [ebp+FFFFFBF5]
:00427784 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00427787 C1E108                  shl ecx, 08
:0042778A 03C1                    add eax, ecx
:0042778C 8945F4                  mov dword ptr [ebp-0C], eax
:0042778F 33C0                    xor eax, eax
:00427791 8A85F6FBFFFF            mov al, byte ptr [ebp+FFFFFBF6]
:00427797 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042779A C1E108                  shl ecx, 08
:0042779D 03C1                    add eax, ecx
:0042779F 8945F4                  mov dword ptr [ebp-0C], eax
:004277A2 33C0                    xor eax, eax
:004277A4 8A85F7FBFFFF            mov al, byte ptr [ebp+FFFFFBF7]
:004277AA 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004277AD C1E108                  shl ecx, 08
:004277B0 03C1                    add eax, ecx
:004277B2 8945F4                  mov dword ptr [ebp-0C], eax
:004277B5 837D0C00                cmp dword ptr [ebp+0C], 00000000
:004277B9 0F8448000000            je 00427807
:004277BF 6A00                    push 00000000
:004277C1 8B45F8                  mov eax, dword ptr [ebp-08]
:004277C4 50                      push eax
:004277C5 8B8DF0FBFFFF            mov ecx, dword ptr [ebp+FFFFFBF0]
:004277CB E850000000              call 00427820
:004277D0 8B45FC                  mov eax, dword ptr [ebp-04]
:004277D3 3945F4                  cmp dword ptr [ebp-0C], eax
:004277D6 0F8518000000            jne 004277F4
:004277DC 8B45FC                  mov eax, dword ptr [ebp-04]
:004277DF 50                      push eax
:004277E0 8B450C                  mov eax, dword ptr [ebp+0C]
:004277E3 50                      push eax
:004277E4 8B8DF0FBFFFF            mov ecx, dword ptr [ebp+FFFFFBF0]
:004277EA E831FBFFFF              call 00427320
:004277EF E913000000              jmp 00427807

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004277D6(C)
|
:004277F4 8B45FC                  mov eax, dword ptr [ebp-04]
:004277F7 50                      push eax
:004277F8 8B450C                  mov eax, dword ptr [ebp+0C]
:004277FB 50                      push eax
:004277FC 8B8DF0FBFFFF            mov ecx, dword ptr [ebp+FFFFFBF0]
:00427802 E8CEFDFFFF              call 004275D5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004277B9(C), :004277EF(U)
|
:00427807 8B45FC                  mov eax, dword ptr [ebp-04]
:0042780A E900000000              jmp 0042780F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042780A(U)
|
:0042780F 5F                      pop edi
:00427810 5E                      pop esi
:00427811 5B                      pop ebx
:00427812 C9                      leave
:00427813 C20800                  ret 0008


:00427816 CC                      int 03
:00427817 CC                      int 03
:00427818 CC                      int 03
:00427819 CC                      int 03
:0042781A CC                      int 03
:0042781B CC                      int 03
:0042781C CC                      int 03
:0042781D CC                      int 03
:0042781E CC                      int 03
:0042781F CC                      int 03

* Referenced by a CALL at Addresses:
|:004276D0   , :004277CB   
|
:00427820 55                      push ebp
:00427821 8BEC                    mov ebp, esp
:00427823 83EC04                  sub esp, 00000004
:00427826 53                      push ebx
:00427827 56                      push esi
:00427828 57                      push edi
:00427829 894DFC                  mov dword ptr [ebp-04], ecx
:0042782C 8B450C                  mov eax, dword ptr [ebp+0C]
:0042782F 50                      push eax
:00427830 8B4508                  mov eax, dword ptr [ebp+08]
:00427833 50                      push eax
:00427834 8B45FC                  mov eax, dword ptr [ebp-04]
:00427837 8B00                    mov eax, dword ptr [eax]
:00427839 50                      push eax
:0042783A E85E000200              call 0044789D
:0042783F 83C40C                  add esp, 0000000C
:00427842 E900000000              jmp 00427847

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427842(U)
|
:00427847 5F                      pop edi
:00427848 5E                      pop esi
:00427849 5B                      pop ebx
:0042784A C9                      leave
:0042784B C20800                  ret 0008


:0042784E CC                      int 03
:0042784F CC                      int 03
:00427850 55                      push ebp
:00427851 8BEC                    mov ebp, esp
:00427853 53                      push ebx
:00427854 56                      push esi
:00427855 57                      push edi
:00427856 E80A000000              call 00427865
:0042785B E900000000              jmp 00427860

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042785B(U)
|
:00427860 5F                      pop edi
:00427861 5E                      pop esi
:00427862 5B                      pop ebx
:00427863 C9                      leave
:00427864 C3                      ret



* Referenced by a CALL at Address:
|:00427856   
|
:00427865 55                      push ebp
:00427866 8BEC                    mov ebp, esp
:00427868 53                      push ebx
:00427869 56                      push esi
:0042786A 57                      push edi
:0042786B E900000000              jmp 00427870

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042786B(U)
|
:00427870 5F                      pop edi
:00427871 5E                      pop esi
:00427872 5B                      pop ebx
:00427873 C9                      leave
:00427874 C3                      ret



* Referenced by a CALL at Addresses:
|:00427936   , :00427A78   , :00427BE1   , :00427E51   , :004284CA   
|:0042864E   , :004286AD   , :004286D5   , :004288A6   
|
:00427875 55                      push ebp
:00427876 8BEC                    mov ebp, esp
:00427878 83EC04                  sub esp, 00000004
:0042787B 53                      push ebx
:0042787C 56                      push esi
:0042787D 57                      push edi
:0042787E C645FC00                mov [ebp-04], 00
:00427882 E903000000              jmp 0042788A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004278D5(U)
|
:00427887 FE45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427882(U)
|
:0042788A 33C0                    xor eax, eax
:0042788C 8A45FC                  mov al, byte ptr [ebp-04]
:0042788F 83F82D                  cmp eax, 0000002D
:00427892 0F8D42000000            jnl 004278DA
:00427898 33C0                    xor eax, eax
:0042789A 8A45FC                  mov al, byte ptr [ebp-04]
:0042789D 8BC8                    mov ecx, eax
:0042789F 8D0440                  lea eax, dword ptr [eax+2*eax]
:004278A2 C1E003                  shl eax, 03
:004278A5 2BC1                    sub eax, ecx
:004278A7 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004278AD E87E18FEFF              call 00409130
:004278B2 3B4508                  cmp eax, dword ptr [ebp+08]
:004278B5 0F851A000000            jne 004278D5
:004278BB 33C0                    xor eax, eax
:004278BD 8A45FC                  mov al, byte ptr [ebp-04]
:004278C0 8BC8                    mov ecx, eax
:004278C2 8D0440                  lea eax, dword ptr [eax+2*eax]
:004278C5 C1E003                  shl eax, 03
:004278C8 2BC1                    sub eax, ecx
:004278CA 8D8098C04600            lea eax, dword ptr [eax+0046C098]
:004278D0 E90F000000              jmp 004278E4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004278B5(C)
|
:004278D5 E9ADFFFFFF              jmp 00427887

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427892(C)
|
:004278DA B8FFFFFFFF              mov eax, FFFFFFFF
:004278DF E900000000              jmp 004278E4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004278D0(U), :004278DF(U)
|
:004278E4 5F                      pop edi
:004278E5 5E                      pop esi
:004278E6 5B                      pop ebx
:004278E7 C9                      leave
:004278E8 C3                      ret



* Referenced by a CALL at Address:
|:004407C7   
|
:004278E9 55                      push ebp
:004278EA 8BEC                    mov ebp, esp
:004278EC 83EC04                  sub esp, 00000004
:004278EF 53                      push ebx
:004278F0 56                      push esi
:004278F1 57                      push edi
:004278F2 894DFC                  mov dword ptr [ebp-04], ecx
:004278F5 8B45FC                  mov eax, dword ptr [ebp-04]
:004278F8 C600FF                  mov byte ptr [eax], FF
:004278FB 8B45FC                  mov eax, dword ptr [ebp-04]
:004278FE C7400500000000          mov [eax+05], 00000000
:00427905 B808494500              mov eax, 00454908
:0042790A 05C8000000              add eax, 000000C8
:0042790F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00427912 894101                  mov dword ptr [ecx+01], eax
:00427915 E900000000              jmp 0042791A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427915(U)
|
:0042791A 5F                      pop edi
:0042791B 5E                      pop esi
:0042791C 5B                      pop ebx
:0042791D C9                      leave
:0042791E C3                      ret



* Referenced by a CALL at Address:
|:004323E7   
|
:0042791F 55                      push ebp
:00427920 8BEC                    mov ebp, esp
:00427922 83EC24                  sub esp, 00000024
:00427925 53                      push ebx
:00427926 56                      push esi
:00427927 57                      push edi
:00427928 894DDC                  mov dword ptr [ebp-24], ecx
:0042792B C745ECFFFFFFFF          mov [ebp-14], FFFFFFFF
:00427932 8B4508                  mov eax, dword ptr [ebp+08]
:00427935 50                      push eax
:00427936 E83AFFFFFF              call 00427875
:0042793B 83C404                  add esp, 00000004
:0042793E 8945F0                  mov dword ptr [ebp-10], eax
:00427941 C645F8FF                mov [ebp-08], FF
:00427945 837DF0FF                cmp dword ptr [ebp-10], FFFFFFFF
:00427949 0F840A010000            je 00427A59
:0042794F 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00427952 E8D91EFEFF              call 00409830
:00427957 33C9                    xor ecx, ecx
:00427959 8AC8                    mov cl, al
:0042795B 83F901                  cmp ecx, 00000001
:0042795E 0F85EE000000            jne 00427A52
:00427964 C745E800000000          mov [ebp-18], 00000000
:0042796B E903000000              jmp 00427973

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004279AD(U)
|
:00427970 FF45E8                  inc [ebp-18]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042796B(U)
|
:00427973 837DE82D                cmp dword ptr [ebp-18], 0000002D
:00427977 0F8335000000            jnb 004279B2
:0042797D 8B45E8                  mov eax, dword ptr [ebp-18]
:00427980 50                      push eax
:00427981 B9B0C44600              mov ecx, 0046C4B0
:00427986 E8B541FEFF              call 0040BB40
:0042798B 8945F4                  mov dword ptr [ebp-0C], eax
:0042798E 8B45F4                  mov eax, dword ptr [ebp-0C]
:00427991 8945FC                  mov dword ptr [ebp-04], eax
:00427994 8B45FC                  mov eax, dword ptr [ebp-04]
:00427997 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042799A 3908                    cmp dword ptr [eax], ecx
:0042799C 0F850B000000            jne 004279AD
:004279A2 8A45E8                  mov al, byte ptr [ebp-18]
:004279A5 8845F8                  mov byte ptr [ebp-08], al
:004279A8 E905000000              jmp 004279B2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042799C(C)
|
:004279AD E9BEFFFFFF              jmp 00427970

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00427977(C), :004279A8(U)
|
:004279B2 33C0                    xor eax, eax
:004279B4 8A45F8                  mov al, byte ptr [ebp-08]
:004279B7 3DFF000000              cmp eax, 000000FF
:004279BC 0F8484000000            je 00427A46
:004279C2 6A0D                    push 0000000D
:004279C4 B994A64600              mov ecx, 0046A694
:004279C9 E85616FFFF              call 00419024
:004279CE 8B45FC                  mov eax, dword ptr [ebp-04]
:004279D1 F6400604                test [eax+06], 04
:004279D5 0F840C000000            je 004279E7
:004279DB C745E001000000          mov [ebp-20], 00000001
:004279E2 E907000000              jmp 004279EE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004279D5(C)
|
:004279E7 C745E000000000          mov [ebp-20], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004279E2(U)
|
:004279EE 8B45FC                  mov eax, dword ptr [ebp-04]
:004279F1 83C004                  add eax, 00000004
:004279F4 8945E4                  mov dword ptr [ebp-1C], eax
:004279F7 8B45E4                  mov eax, dword ptr [ebp-1C]
:004279FA 8A4001                  mov al, byte ptr [eax+01]
:004279FD 50                      push eax
:004279FE 8B45E4                  mov eax, dword ptr [ebp-1C]
:00427A01 8A00                    mov al, byte ptr [eax]
:00427A03 50                      push eax
:00427A04 B900FB4600              mov ecx, 0046FB00
:00427A09 E8DA370100              call 0043B1E8
:00427A0E 837DE001                cmp dword ptr [ebp-20], 00000001
:00427A12 1BC0                    sbb eax, eax
:00427A14 83E002                  and eax, 00000002
:00427A17 40                      inc eax
:00427A18 50                      push eax
:00427A19 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00427A1C E8FF67FFFF              call 0041E220
:00427A21 8B45E0                  mov eax, dword ptr [ebp-20]
:00427A24 50                      push eax
:00427A25 8B45E4                  mov eax, dword ptr [ebp-1C]
:00427A28 8A4001                  mov al, byte ptr [eax+01]
:00427A2B 50                      push eax
:00427A2C 8B45E4                  mov eax, dword ptr [ebp-1C]
:00427A2F 8A00                    mov al, byte ptr [eax]
:00427A31 50                      push eax
:00427A32 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00427A35 E8333F0000              call 0042B96D
:00427A3A C745EC01000000          mov [ebp-14], 00000001
:00427A41 E907000000              jmp 00427A4D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004279BC(C)
|
:00427A46 C745ECFFFFFFFF          mov [ebp-14], FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427A41(U)
|
:00427A4D E907000000              jmp 00427A59

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042795E(C)
|
:00427A52 C745ECFFFFFFFF          mov [ebp-14], FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00427949(C), :00427A4D(U)
|
:00427A59 8B45EC                  mov eax, dword ptr [ebp-14]
:00427A5C E900000000              jmp 00427A61

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427A5C(U)
|
:00427A61 5F                      pop edi
:00427A62 5E                      pop esi
:00427A63 5B                      pop ebx
:00427A64 C9                      leave
:00427A65 C20C00                  ret 000C



* Referenced by a CALL at Address:
|:00432581   
|
:00427A68 55                      push ebp
:00427A69 8BEC                    mov ebp, esp
:00427A6B 83EC10                  sub esp, 00000010
:00427A6E 53                      push ebx
:00427A6F 56                      push esi
:00427A70 57                      push edi
:00427A71 894DF0                  mov dword ptr [ebp-10], ecx
:00427A74 8B4508                  mov eax, dword ptr [ebp+08]
:00427A77 50                      push eax
:00427A78 E8F8FDFFFF              call 00427875
:00427A7D 83C404                  add esp, 00000004
:00427A80 8945FC                  mov dword ptr [ebp-04], eax
:00427A83 837DFCFF                cmp dword ptr [ebp-04], FFFFFFFF
:00427A87 0F850A000000            jne 00427A97
:00427A8D B8FFFFFFFF              mov eax, FFFFFFFF
:00427A92 E933010000              jmp 00427BCA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427A87(C)
|
:00427A97 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00427A9A E8911DFEFF              call 00409830
:00427A9F 33C9                    xor ecx, ecx
:00427AA1 8AC8                    mov cl, al
:00427AA3 83F904                  cmp ecx, 00000004
:00427AA6 0F852C000000            jne 00427AD8
:00427AAC 8B4510                  mov eax, dword ptr [ebp+10]
:00427AAF 50                      push eax
:00427AB0 8B450C                  mov eax, dword ptr [ebp+0C]
:00427AB3 50                      push eax
:00427AB4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00427AB7 E8B3620000              call 0042DD6F
:00427ABC 6A00                    push 00000000
:00427ABE 8B4510                  mov eax, dword ptr [ebp+10]
:00427AC1 50                      push eax
:00427AC2 8B450C                  mov eax, dword ptr [ebp+0C]
:00427AC5 50                      push eax
:00427AC6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00427AC9 E89F3E0000              call 0042B96D
:00427ACE B8FFFFFFFF              mov eax, FFFFFFFF
:00427AD3 E9F2000000              jmp 00427BCA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427AA6(C)
|
:00427AD8 33C0                    xor eax, eax
:00427ADA A0C8FC4600              mov al, byte ptr [0046FCC8]
:00427ADF 33C9                    xor ecx, ecx
:00427AE1 8A4D0C                  mov cl, byte ptr [ebp+0C]
:00427AE4 3BC1                    cmp eax, ecx
:00427AE6 0F8ED4000000            jle 00427BC0
:00427AEC 33C0                    xor eax, eax
:00427AEE A0C9FC4600              mov al, byte ptr [0046FCC9]
:00427AF3 33C9                    xor ecx, ecx
:00427AF5 8A4D10                  mov cl, byte ptr [ebp+10]
:00427AF8 3BC1                    cmp eax, ecx
:00427AFA 0F8EC0000000            jle 00427BC0
:00427B00 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00427B03 E8C818FEFF              call 004093D0
:00427B08 8845F4                  mov byte ptr [ebp-0C], al
:00427B0B 6A04                    push 00000004
:00427B0D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00427B10 E8AF620000              call 0042DDC4
:00427B15 6A00                    push 00000000
:00427B17 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00427B1A E8B7480000              call 0042C3D6
:00427B1F 8D4DF8                  lea ecx, dword ptr [ebp-08]
:00427B22 E8499DFDFF              call 00401870
:00427B27 8A450C                  mov al, byte ptr [ebp+0C]
:00427B2A 8845F8                  mov byte ptr [ebp-08], al
:00427B2D 8A4510                  mov al, byte ptr [ebp+10]
:00427B30 8845F9                  mov byte ptr [ebp-07], al
:00427B33 8D45F8                  lea eax, dword ptr [ebp-08]
:00427B36 50                      push eax
:00427B37 E8011AFFFF              call 0041953D
:00427B3C 83C404                  add esp, 00000004
:00427B3F 33C9                    xor ecx, ecx
:00427B41 8AC8                    mov cl, al
:00427B43 81F9FF000000            cmp ecx, 000000FF
:00427B49 0F8425000000            je 00427B74
:00427B4F C605A4C44600FF          mov byte ptr [0046C4A4], FF
:00427B56 6A0A                    push 0000000A
:00427B58 8B45F8                  mov eax, dword ptr [ebp-08]
:00427B5B 50                      push eax
:00427B5C E8C0240000              call 0042A021
:00427B61 83C408                  add esp, 00000008
:00427B64 A0A4C44600              mov al, byte ptr [0046C4A4]
:00427B69 88450C                  mov byte ptr [ebp+0C], al
:00427B6C A0A5C44600              mov al, byte ptr [0046C4A5]
:00427B71 884510                  mov byte ptr [ebp+10], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427B49(C)
|
:00427B74 8B4510                  mov eax, dword ptr [ebp+10]
:00427B77 50                      push eax
:00427B78 8B450C                  mov eax, dword ptr [ebp+0C]
:00427B7B 50                      push eax
:00427B7C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00427B7F E8EB610000              call 0042DD6F
:00427B84 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00427B87 E8613BFFFF              call 0041B6ED
:00427B8C 33C0                    xor eax, eax
:00427B8E 8A45F4                  mov al, byte ptr [ebp-0C]
:00427B91 83F807                  cmp eax, 00000007
:00427B94 0F850A000000            jne 00427BA4
:00427B9A 6A07                    push 00000007
:00427B9C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00427B9F E832480000              call 0042C3D6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427B94(C)
|
:00427BA4 68C4000000              push 000000C4
:00427BA9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00427BAC E87F17FEFF              call 00409330
:00427BB1 B801000000              mov eax, 00000001
:00427BB6 E90F000000              jmp 00427BCA
:00427BBB E90A000000              jmp 00427BCA

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00427AE6(C), :00427AFA(C)
|
:00427BC0 B8FFFFFFFF              mov eax, FFFFFFFF
:00427BC5 E900000000              jmp 00427BCA

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00427A92(U), :00427AD3(U), :00427BB6(U), :00427BBB(U), :00427BC5(U)
|
:00427BCA 5F                      pop edi
:00427BCB 5E                      pop esi
:00427BCC 5B                      pop ebx
:00427BCD C9                      leave
:00427BCE C20C00                  ret 000C



* Referenced by a CALL at Address:
|:0043272F   
|
:00427BD1 55                      push ebp
:00427BD2 8BEC                    mov ebp, esp
:00427BD4 83EC0C                  sub esp, 0000000C
:00427BD7 53                      push ebx
:00427BD8 56                      push esi
:00427BD9 57                      push edi
:00427BDA 894DF4                  mov dword ptr [ebp-0C], ecx
:00427BDD 8B4508                  mov eax, dword ptr [ebp+08]
:00427BE0 50                      push eax
:00427BE1 E88FFCFFFF              call 00427875
:00427BE6 83C404                  add esp, 00000004
:00427BE9 8945FC                  mov dword ptr [ebp-04], eax
:00427BEC C745F800000000          mov [ebp-08], 00000000
:00427BF3 837DFCFF                cmp dword ptr [ebp-04], FFFFFFFF
:00427BF7 0F850C000000            jne 00427C09
:00427BFD C745F8FFFFFFFF          mov [ebp-08], FFFFFFFF
:00427C04 E917000000              jmp 00427C20

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427BF7(C)
|
:00427C09 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00427C0C E8F4470000              call 0042C405
:00427C11 85C0                    test eax, eax
:00427C13 0F8407000000            je 00427C20
:00427C19 C745F801000000          mov [ebp-08], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00427C04(U), :00427C13(C)
|
:00427C20 8B45F8                  mov eax, dword ptr [ebp-08]
:00427C23 E900000000              jmp 00427C28

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427C23(U)
|
:00427C28 5F                      pop edi
:00427C29 5E                      pop esi
:00427C2A 5B                      pop ebx
:00427C2B C9                      leave
:00427C2C C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:004306B8   , :00431662   
|
:00427C2F 55                      push ebp
:00427C30 8BEC                    mov ebp, esp
:00427C32 83EC04                  sub esp, 00000004
:00427C35 53                      push ebx
:00427C36 56                      push esi
:00427C37 57                      push edi
:00427C38 894DFC                  mov dword ptr [ebp-04], ecx
:00427C3B B900AA4600              mov ecx, 0046AA00
:00427C40 E80B9CFDFF              call 00401850
:00427C45 33C9                    xor ecx, ecx
:00427C47 8AC8                    mov cl, al
:00427C49 83F903                  cmp ecx, 00000003
:00427C4C 0F8541000000            jne 00427C93
:00427C52 33C0                    xor eax, eax
:00427C54 8A4508                  mov al, byte ptr [ebp+08]
:00427C57 83F801                  cmp eax, 00000001
:00427C5A 1BC0                    sbb eax, eax
:00427C5C 83C003                  add eax, 00000003
:00427C5F 50                      push eax
:00427C60 B998FC4600              mov ecx, 0046FC98
:00427C65 E876110000              call 00428DE0
:00427C6A 33C0                    xor eax, eax
:00427C6C 8A4508                  mov al, byte ptr [ebp+08]
:00427C6F 83F803                  cmp eax, 00000003
:00427C72 0F850C000000            jne 00427C84
:00427C78 6A0B                    push 0000000B
:00427C7A B990A64600              mov ecx, 0046A690
:00427C7F E84612FFFF              call 00418ECA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427C72(C)
|
:00427C84 B801000000              mov eax, 00000001
:00427C89 E90F000000              jmp 00427C9D
:00427C8E E90A000000              jmp 00427C9D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427C4C(C)
|
:00427C93 B8FFFFFFFF              mov eax, FFFFFFFF
:00427C98 E900000000              jmp 00427C9D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00427C89(U), :00427C8E(U), :00427C98(U)
|
:00427C9D 5F                      pop edi
:00427C9E 5E                      pop esi
:00427C9F 5B                      pop ebx
:00427CA0 C9                      leave
:00427CA1 C20400                  ret 0004


:00427CA4 55                      push ebp
:00427CA5 8BEC                    mov ebp, esp
:00427CA7 83EC04                  sub esp, 00000004
:00427CAA 53                      push ebx
:00427CAB 56                      push esi
:00427CAC 57                      push edi
:00427CAD 894DFC                  mov dword ptr [ebp-04], ecx
:00427CB0 B998FC4600              mov ecx, 0046FC98
:00427CB5 E8AE8A0100              call 00440768
:00427CBA E900000000              jmp 00427CBF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427CBA(U)
|
:00427CBF 5F                      pop edi
:00427CC0 5E                      pop esi
:00427CC1 5B                      pop ebx
:00427CC2 C9                      leave
:00427CC3 C3                      ret



* Referenced by a CALL at Address:
|:004320E7   
|
:00427CC4 55                      push ebp
:00427CC5 8BEC                    mov ebp, esp
:00427CC7 83EC04                  sub esp, 00000004
:00427CCA 53                      push ebx
:00427CCB 56                      push esi
:00427CCC 57                      push edi
:00427CCD 894DFC                  mov dword ptr [ebp-04], ecx
:00427CD0 E900000000              jmp 00427CD5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427CD0(U)
|
:00427CD5 5F                      pop edi
:00427CD6 5E                      pop esi
:00427CD7 5B                      pop ebx
:00427CD8 C9                      leave
:00427CD9 C3                      ret



* Referenced by a CALL at Addresses:
|:0042993C   , :0043266B   
|
:00427CDA 55                      push ebp
:00427CDB 8BEC                    mov ebp, esp
:00427CDD 83EC18                  sub esp, 00000018
:00427CE0 53                      push ebx
:00427CE1 56                      push esi
:00427CE2 57                      push edi
:00427CE3 894DEC                  mov dword ptr [ebp-14], ecx
:00427CE6 C745F800000000          mov [ebp-08], 00000000
:00427CED C645F000                mov [ebp-10], 00
:00427CF1 E903000000              jmp 00427CF9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427D4D(U)
|
:00427CF6 FE45F0                  inc [ebp-10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427CF1(U)
|
:00427CF9 33C0                    xor eax, eax
:00427CFB 8A45F0                  mov al, byte ptr [ebp-10]
:00427CFE 83F82D                  cmp eax, 0000002D
:00427D01 0F8D4B000000            jnl 00427D52
:00427D07 33C0                    xor eax, eax
:00427D09 8A45F0                  mov al, byte ptr [ebp-10]
:00427D0C 8BC8                    mov ecx, eax
:00427D0E 8D0440                  lea eax, dword ptr [eax+2*eax]
:00427D11 C1E003                  shl eax, 03
:00427D14 2BC1                    sub eax, ecx
:00427D16 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00427D1C E80F14FEFF              call 00409130
:00427D21 3B450C                  cmp eax, dword ptr [ebp+0C]
:00427D24 0F8523000000            jne 00427D4D
:00427D2A 33C0                    xor eax, eax
:00427D2C 8A45F0                  mov al, byte ptr [ebp-10]
:00427D2F 8BC8                    mov ecx, eax
:00427D31 8D0440                  lea eax, dword ptr [eax+2*eax]
:00427D34 C1E003                  shl eax, 03
:00427D37 2BC1                    sub eax, ecx
:00427D39 0598C04600              add eax, 0046C098
:00427D3E 8945F4                  mov dword ptr [ebp-0C], eax
:00427D41 C745F801000000          mov [ebp-08], 00000001
:00427D48 E905000000              jmp 00427D52

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427D24(C)
|
:00427D4D E9A4FFFFFF              jmp 00427CF6

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00427D01(C), :00427D48(U)
|
:00427D52 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00427D55 E8169BFDFF              call 00401870
:00427D5A 837DF801                cmp dword ptr [ebp-08], 00000001
:00427D5E 0F854B000000            jne 00427DAF
:00427D64 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00427D67 E8C41AFEFF              call 00409830
:00427D6C 33C9                    xor ecx, ecx
:00427D6E 8AC8                    mov cl, al
:00427D70 83F902                  cmp ecx, 00000002
:00427D73 0F8531000000            jne 00427DAA
:00427D79 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00427D7C E87F14FEFF              call 00409200
:00427D81 50                      push eax
:00427D82 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00427D85 E8069BFDFF              call 00401890
:00427D8A 8B45FD                  mov eax, dword ptr [ebp-03]
:00427D8D 50                      push eax
:00427D8E 8B45FC                  mov eax, dword ptr [ebp-04]
:00427D91 50                      push eax
:00427D92 B900FB4600              mov ecx, 0046FB00
:00427D97 E84C340100              call 0043B1E8
:00427D9C 8D45FC                  lea eax, dword ptr [ebp-04]
:00427D9F 50                      push eax
:00427DA0 B900FB4600              mov ecx, 0046FB00
:00427DA5 E8F9670100              call 0043E5A3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427D73(C)
|
:00427DAA E904000000              jmp 00427DB3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427D5E(C)
|
:00427DAF C645FD00                mov [ebp-03], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427DAA(U)
|
:00427DB3 E8F6F50000              call 004373AE
:00427DB8 6A00                    push 00000000
:00427DBA 8B450C                  mov eax, dword ptr [ebp+0C]
:00427DBD 8D0440                  lea eax, dword ptr [eax+2*eax]
:00427DC0 03C0                    add eax, eax
:00427DC2 8D04C0                  lea eax, dword ptr [eax+8*eax]
:00427DC5 05E8564500              add eax, 004556E8
:00427DCA 50                      push eax
:00427DCB 8B4508                  mov eax, dword ptr [ebp+08]
:00427DCE 50                      push eax
:00427DCF 6A70                    push 00000070
:00427DD1 6880010000              push 00000180
:00427DD6 33DB                    xor ebx, ebx
:00427DD8 895DE8                  mov dword ptr [ebp-18], ebx
:00427DDB 33DB                    xor ebx, ebx
:00427DDD 8A5DFD                  mov bl, byte ptr [ebp-03]
:00427DE0 B900FB4600              mov ecx, 0046FB00
:00427DE5 E866CDFFFF              call 00424B50
:00427DEA B903000000              mov ecx, 00000003
:00427DEF 99                      cdq
:00427DF0 F7F9                    idiv ecx
:00427DF2 2BD8                    sub ebx, eax
:00427DF4 83FB04                  cmp ebx, 00000004
:00427DF7 8B45E8                  mov eax, dword ptr [ebp-18]
:00427DFA 0F9CC0                  setl al
:00427DFD 48                      dec eax
:00427DFE 2550FFFFFF              and eax, FFFFFF50
:00427E03 0500010000              add eax, 00000100
:00427E08 50                      push eax
:00427E09 6A28                    push 00000028
:00427E0B E860FB0000              call 00437970
:00427E10 83C41C                  add esp, 0000001C
:00427E13 B900FB4600              mov ecx, 0046FB00
:00427E18 E832670100              call 0043E54F
:00427E1D E900000000              jmp 00427E22

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427E1D(U)
|
:00427E22 5F                      pop edi
:00427E23 5E                      pop esi
:00427E24 5B                      pop ebx
:00427E25 C9                      leave
:00427E26 C20800                  ret 0008



* Referenced by a CALL at Address:
|:0043281B   
|
:00427E29 55                      push ebp
:00427E2A 8BEC                    mov ebp, esp
:00427E2C 83EC04                  sub esp, 00000004
:00427E2F 53                      push ebx
:00427E30 56                      push esi
:00427E31 57                      push edi
:00427E32 894DFC                  mov dword ptr [ebp-04], ecx
:00427E35 E900000000              jmp 00427E3A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427E35(U)
|
:00427E3A 5F                      pop edi
:00427E3B 5E                      pop esi
:00427E3C 5B                      pop ebx
:00427E3D C9                      leave
:00427E3E C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:00430AB7   , :00441123   
|
:00427E41 55                      push ebp
:00427E42 8BEC                    mov ebp, esp
:00427E44 83EC08                  sub esp, 00000008
:00427E47 53                      push ebx
:00427E48 56                      push esi
:00427E49 57                      push edi
:00427E4A 894DF8                  mov dword ptr [ebp-08], ecx
:00427E4D 8B4508                  mov eax, dword ptr [ebp+08]
:00427E50 50                      push eax
:00427E51 E81FFAFFFF              call 00427875
:00427E56 83C404                  add esp, 00000004
:00427E59 8945FC                  mov dword ptr [ebp-04], eax
:00427E5C 837DFCFF                cmp dword ptr [ebp-04], FFFFFFFF
:00427E60 0F850F000000            jne 00427E75
:00427E66 B8FFFFFFFF              mov eax, FFFFFFFF
:00427E6B E97E000000              jmp 00427EEE
:00427E70 E979000000              jmp 00427EEE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427E60(C)
|
:00427E75 8B4508                  mov eax, dword ptr [ebp+08]
:00427E78 8D0440                  lea eax, dword ptr [eax+2*eax]
:00427E7B 03C0                    add eax, eax
:00427E7D 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:00427E84 E8C78FFEFF              call 00410E50
:00427E89 33C9                    xor ecx, ecx
:00427E8B 8AC8                    mov cl, al
:00427E8D 85C9                    test ecx, ecx
:00427E8F 0F844F000000            je 00427EE4
:00427E95 8B4508                  mov eax, dword ptr [ebp+08]
:00427E98 8D0440                  lea eax, dword ptr [eax+2*eax]
:00427E9B 03C0                    add eax, eax
:00427E9D 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:00427EA4 E8A78FFEFF              call 00410E50
:00427EA9 33C9                    xor ecx, ecx
:00427EAB 8AC8                    mov cl, al
:00427EAD 83F906                  cmp ecx, 00000006
:00427EB0 0F842E000000            je 00427EE4
:00427EB6 6A04                    push 00000004
:00427EB8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00427EBB E87014FEFF              call 00409330
:00427EC0 33C0                    xor eax, eax
:00427EC2 8A450C                  mov al, byte ptr [ebp+0C]
:00427EC5 8B0485181C4500          mov eax, dword ptr [4*eax+00451C18]
:00427ECC 50                      push eax
:00427ECD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00427ED0 E801450000              call 0042C3D6
:00427ED5 B801000000              mov eax, 00000001
:00427EDA E90F000000              jmp 00427EEE
:00427EDF E90A000000              jmp 00427EEE

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00427E8F(C), :00427EB0(C)
|
:00427EE4 B8FFFFFFFF              mov eax, FFFFFFFF
:00427EE9 E900000000              jmp 00427EEE

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00427E6B(U), :00427E70(U), :00427EDA(U), :00427EDF(U), :00427EE9(U)
|
:00427EEE 5F                      pop edi
:00427EEF 5E                      pop esi
:00427EF0 5B                      pop ebx
:00427EF1 C9                      leave
:00427EF2 C20800                  ret 0008



* Referenced by a CALL at Address:
|:00440759   
|
:00427EF5 55                      push ebp
:00427EF6 8BEC                    mov ebp, esp
:00427EF8 83EC10                  sub esp, 00000010
:00427EFB 53                      push ebx
:00427EFC 56                      push esi
:00427EFD 57                      push edi
:00427EFE 894DF0                  mov dword ptr [ebp-10], ecx
:00427F01 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00427F04 E86799FDFF              call 00401870
:00427F09 C745F800000000          mov [ebp-08], 00000000
:00427F10 E904000000              jmp 00427F19

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427FCB(U)
|
:00427F15 8345F804                add dword ptr [ebp-08], 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427F10(U)
|
:00427F19 8B45F0                  mov eax, dword ptr [ebp-10]
:00427F1C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00427F1F 394805                  cmp dword ptr [eax+05], ecx
:00427F22 0F86A8000000            jbe 00427FD0
:00427F28 8B45F0                  mov eax, dword ptr [ebp-10]
:00427F2B 8B4001                  mov eax, dword ptr [eax+01]
:00427F2E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00427F31 8A0408                  mov al, byte ptr [eax+ecx]
:00427F34 8845FC                  mov byte ptr [ebp-04], al
:00427F37 8B45F8                  mov eax, dword ptr [ebp-08]
:00427F3A 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00427F3D 8B4901                  mov ecx, dword ptr [ecx+01]
:00427F40 8A440801                mov al, byte ptr [eax+ecx+01]
:00427F44 8845FD                  mov byte ptr [ebp-03], al
:00427F47 8D45FC                  lea eax, dword ptr [ebp-04]
:00427F4A 50                      push eax
:00427F4B E8ED15FFFF              call 0041953D
:00427F50 83C404                  add esp, 00000004
:00427F53 33C9                    xor ecx, ecx
:00427F55 8AC8                    mov cl, al
:00427F57 81F9FF000000            cmp ecx, 000000FF
:00427F5D 0F8568000000            jne 00427FCB
:00427F63 8B45F8                  mov eax, dword ptr [ebp-08]
:00427F66 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00427F69 8B4901                  mov ecx, dword ptr [ecx+01]
:00427F6C 33D2                    xor edx, edx
:00427F6E 8A540802                mov dl, byte ptr [eax+ecx+02]
:00427F72 83C22D                  add edx, 0000002D
:00427F75 52                      push edx
:00427F76 8D45FC                  lea eax, dword ptr [ebp-04]
:00427F79 50                      push eax
:00427F7A E8A817FFFF              call 00419727
:00427F7F 83C408                  add esp, 00000008
:00427F82 6A04                    push 00000004
:00427F84 6A00                    push 00000000
:00427F86 6A00                    push 00000000
:00427F88 B950F94600              mov ecx, 0046F950
:00427F8D E88EF70100              call 00447720
:00427F92 8945F4                  mov dword ptr [ebp-0C], eax
:00427F95 8B45F8                  mov eax, dword ptr [ebp-08]
:00427F98 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00427F9B 8B4901                  mov ecx, dword ptr [ecx+01]
:00427F9E 33D2                    xor edx, edx
:00427FA0 8A540802                mov dl, byte ptr [eax+ecx+02]
:00427FA4 8A82341C4500            mov al, byte ptr [edx+00451C34]
:00427FAA 33C9                    xor ecx, ecx
:00427FAC 8A0DC8FC4600            mov cl, byte ptr [0046FCC8]
:00427FB2 33D2                    xor edx, edx
:00427FB4 8A55FD                  mov dl, byte ptr [ebp-03]
:00427FB7 0FAFCA                  imul ecx, edx
:00427FBA 33D2                    xor edx, edx
:00427FBC 8A55FC                  mov dl, byte ptr [ebp-04]
:00427FBF 03CA                    add ecx, edx
:00427FC1 8B55F4                  mov edx, dword ptr [ebp-0C]
:00427FC4 888411C0210000          mov byte ptr [ecx+edx+000021C0], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427F5D(C)
|
:00427FCB E945FFFFFF              jmp 00427F15

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427F22(C)
|
:00427FD0 E900000000              jmp 00427FD5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427FD0(U)
|
:00427FD5 5F                      pop edi
:00427FD6 5E                      pop esi
:00427FD7 5B                      pop ebx
:00427FD8 C9                      leave
:00427FD9 C3                      ret



* Referenced by a CALL at Address:
|:0043160C   
|
:00427FDA 55                      push ebp
:00427FDB 8BEC                    mov ebp, esp
:00427FDD 83EC18                  sub esp, 00000018
:00427FE0 53                      push ebx
:00427FE1 56                      push esi
:00427FE2 57                      push edi
:00427FE3 894DE8                  mov dword ptr [ebp-18], ecx
:00427FE6 8B450C                  mov eax, dword ptr [ebp+0C]
:00427FE9 50                      push eax
:00427FEA 8B4508                  mov eax, dword ptr [ebp+08]
:00427FED 50                      push eax
:00427FEE 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00427FF1 E85A62FFFF              call 0041E250
:00427FF6 33C0                    xor eax, eax
:00427FF8 8A4510                  mov al, byte ptr [ebp+10]
:00427FFB 83F802                  cmp eax, 00000002
:00427FFE 0F8412000000            je 00428016
:00428004 8B45FD                  mov eax, dword ptr [ebp-03]
:00428007 50                      push eax
:00428008 8B45FC                  mov eax, dword ptr [ebp-04]
:0042800B 50                      push eax
:0042800C B900FB4600              mov ecx, 0046FB00
:00428011 E8D2310100              call 0043B1E8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427FFE(C)
|
:00428016 8D45FC                  lea eax, dword ptr [ebp-04]
:00428019 50                      push eax
:0042801A E81E15FFFF              call 0041953D
:0042801F 83C404                  add esp, 00000004
:00428022 33C9                    xor ecx, ecx
:00428024 8AC8                    mov cl, al
:00428026 81F9FF000000            cmp ecx, 000000FF
:0042802C 0F85E4010000            jne 00428216
:00428032 33C0                    xor eax, eax
:00428034 8A4510                  mov al, byte ptr [ebp+10]
:00428037 83F802                  cmp eax, 00000002
:0042803A 0F8DD6000000            jnl 00428116
:00428040 33C0                    xor eax, eax
:00428042 8A4510                  mov al, byte ptr [ebp+10]
:00428045 83C02D                  add eax, 0000002D
:00428048 50                      push eax
:00428049 8D45FC                  lea eax, dword ptr [ebp-04]
:0042804C 50                      push eax
:0042804D E8D516FFFF              call 00419727
:00428052 83C408                  add esp, 00000008
:00428055 33DB                    xor ebx, ebx
:00428057 8A1DC8FC4600            mov bl, byte ptr [0046FCC8]
:0042805D 33C0                    xor eax, eax
:0042805F 8A450C                  mov al, byte ptr [ebp+0C]
:00428062 0FAFD8                  imul ebx, eax
:00428065 6A04                    push 00000004
:00428067 6A00                    push 00000000
:00428069 6A00                    push 00000000
:0042806B B950F94600              mov ecx, 0046F950
:00428070 E8ABF60100              call 00447720
:00428075 03D8                    add ebx, eax
:00428077 33C0                    xor eax, eax
:00428079 8A4508                  mov al, byte ptr [ebp+08]
:0042807C 8A8403C0210000          mov al, byte ptr [ebx+eax+000021C0]
:00428083 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00428086 8B4905                  mov ecx, dword ptr [ecx+05]
:00428089 8B55E8                  mov edx, dword ptr [ebp-18]
:0042808C 8B5201                  mov edx, dword ptr [edx+01]
:0042808F 88441103                mov byte ptr [ecx+edx+03], al
:00428093 6A04                    push 00000004
:00428095 6A00                    push 00000000
:00428097 6A00                    push 00000000
:00428099 B950F94600              mov ecx, 0046F950
:0042809E E87DF60100              call 00447720
:004280A3 8945F0                  mov dword ptr [ebp-10], eax
:004280A6 33C0                    xor eax, eax
:004280A8 8A4510                  mov al, byte ptr [ebp+10]
:004280AB 8A80341C4500            mov al, byte ptr [eax+00451C34]
:004280B1 33C9                    xor ecx, ecx
:004280B3 8A0DC8FC4600            mov cl, byte ptr [0046FCC8]
:004280B9 33D2                    xor edx, edx
:004280BB 8A550C                  mov dl, byte ptr [ebp+0C]
:004280BE 0FAFCA                  imul ecx, edx
:004280C1 33D2                    xor edx, edx
:004280C3 8A5508                  mov dl, byte ptr [ebp+08]
:004280C6 03CA                    add ecx, edx
:004280C8 8B55F0                  mov edx, dword ptr [ebp-10]
:004280CB 888411C0210000          mov byte ptr [ecx+edx+000021C0], al
:004280D2 8A4508                  mov al, byte ptr [ebp+08]
:004280D5 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004280D8 8B4905                  mov ecx, dword ptr [ecx+05]
:004280DB 8B55E8                  mov edx, dword ptr [ebp-18]
:004280DE 8B5201                  mov edx, dword ptr [edx+01]
:004280E1 880411                  mov byte ptr [ecx+edx], al
:004280E4 8A450C                  mov al, byte ptr [ebp+0C]
:004280E7 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004280EA 8B4905                  mov ecx, dword ptr [ecx+05]
:004280ED 8B55E8                  mov edx, dword ptr [ebp-18]
:004280F0 8B5201                  mov edx, dword ptr [edx+01]
:004280F3 88441101                mov byte ptr [ecx+edx+01], al
:004280F7 8A4510                  mov al, byte ptr [ebp+10]
:004280FA 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004280FD 8B4905                  mov ecx, dword ptr [ecx+05]
:00428100 8B55E8                  mov edx, dword ptr [ebp-18]
:00428103 8B5201                  mov edx, dword ptr [edx+01]
:00428106 88441102                mov byte ptr [ecx+edx+02], al
:0042810A 8B45E8                  mov eax, dword ptr [ebp-18]
:0042810D 83400504                add dword ptr [eax+05], 00000004
:00428111 E900010000              jmp 00428216

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042803A(C)
|
:00428116 C745F800000000          mov [ebp-08], 00000000
:0042811D E904000000              jmp 00428126

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428211(U)
|
:00428122 8345F804                add dword ptr [ebp-08], 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042811D(U)
|
:00428126 8B45E8                  mov eax, dword ptr [ebp-18]
:00428129 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042812C 394805                  cmp dword ptr [eax+05], ecx
:0042812F 0F86E1000000            jbe 00428216
:00428135 8B45E8                  mov eax, dword ptr [ebp-18]
:00428138 8B4001                  mov eax, dword ptr [eax+01]
:0042813B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042813E 33D2                    xor edx, edx
:00428140 8A1408                  mov dl, byte ptr [eax+ecx]
:00428143 33C0                    xor eax, eax
:00428145 8A45FC                  mov al, byte ptr [ebp-04]
:00428148 3BD0                    cmp edx, eax
:0042814A 0F85C1000000            jne 00428211
:00428150 8B45F8                  mov eax, dword ptr [ebp-08]
:00428153 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00428156 8B4901                  mov ecx, dword ptr [ecx+01]
:00428159 33D2                    xor edx, edx
:0042815B 8A540801                mov dl, byte ptr [eax+ecx+01]
:0042815F 33C0                    xor eax, eax
:00428161 8A45FD                  mov al, byte ptr [ebp-03]
:00428164 3BD0                    cmp edx, eax
:00428166 0F85A5000000            jne 00428211
:0042816C 6A04                    push 00000004
:0042816E 6A00                    push 00000000
:00428170 6A00                    push 00000000
:00428172 B950F94600              mov ecx, 0046F950
:00428177 E8A4F50100              call 00447720
:0042817C 8945EC                  mov dword ptr [ebp-14], eax
:0042817F 8B45F8                  mov eax, dword ptr [ebp-08]
:00428182 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00428185 8B4901                  mov ecx, dword ptr [ecx+01]
:00428188 8A440803                mov al, byte ptr [eax+ecx+03]
:0042818C 33C9                    xor ecx, ecx
:0042818E 8A0DC8FC4600            mov cl, byte ptr [0046FCC8]
:00428194 33D2                    xor edx, edx
:00428196 8A550C                  mov dl, byte ptr [ebp+0C]
:00428199 0FAFCA                  imul ecx, edx
:0042819C 33D2                    xor edx, edx
:0042819E 8A5508                  mov dl, byte ptr [ebp+08]
:004281A1 03CA                    add ecx, edx
:004281A3 8B55EC                  mov edx, dword ptr [ebp-14]
:004281A6 888411C0210000          mov byte ptr [ecx+edx+000021C0], al
:004281AD 68FF000000              push 000000FF
:004281B2 8D45FC                  lea eax, dword ptr [ebp-04]
:004281B5 50                      push eax
:004281B6 E86C15FFFF              call 00419727
:004281BB 83C408                  add esp, 00000008
:004281BE 8B45F8                  mov eax, dword ptr [ebp-08]
:004281C1 8945F4                  mov dword ptr [ebp-0C], eax
:004281C4 E904000000              jmp 004281CD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428200(U)
|
:004281C9 8345F404                add dword ptr [ebp-0C], 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004281C4(U)
|
:004281CD 8B45E8                  mov eax, dword ptr [ebp-18]
:004281D0 8B4005                  mov eax, dword ptr [eax+05]
:004281D3 83E804                  sub eax, 00000004
:004281D6 3B45F4                  cmp eax, dword ptr [ebp-0C]
:004281D9 0F8626000000            jbe 00428205
:004281DF 6A04                    push 00000004
:004281E1 8B45E8                  mov eax, dword ptr [ebp-18]
:004281E4 8B4001                  mov eax, dword ptr [eax+01]
:004281E7 0345F4                  add eax, dword ptr [ebp-0C]
:004281EA 50                      push eax
:004281EB 8B45E8                  mov eax, dword ptr [ebp-18]
:004281EE 8B4001                  mov eax, dword ptr [eax+01]
:004281F1 0345F4                  add eax, dword ptr [ebp-0C]
:004281F4 83C004                  add eax, 00000004
:004281F7 50                      push eax
:004281F8 E850F20100              call 0044744D
:004281FD 83C40C                  add esp, 0000000C
:00428200 E9C4FFFFFF              jmp 004281C9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004281D9(C)
|
:00428205 8B45E8                  mov eax, dword ptr [ebp-18]
:00428208 83680504                sub dword ptr [eax+05], 00000004
:0042820C E905000000              jmp 00428216

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042814A(C), :00428166(C)
|
:00428211 E90CFFFFFF              jmp 00428122

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042802C(C), :00428111(U), :0042812F(C), :0042820C(U)
|
:00428216 E900000000              jmp 0042821B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428216(U)
|
:0042821B 5F                      pop edi
:0042821C 5E                      pop esi
:0042821D 5B                      pop ebx
:0042821E C9                      leave
:0042821F C20C00                  ret 000C



* Referenced by a CALL at Address:
|:004315B5   
|
:00428222 55                      push ebp
:00428223 8BEC                    mov ebp, esp
:00428225 81EC0C010000            sub esp, 0000010C
:0042822B 53                      push ebx
:0042822C 56                      push esi
:0042822D 57                      push edi
:0042822E 898DF4FEFFFF            mov dword ptr [ebp+FFFFFEF4], ecx
:00428234 8D8DF8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF8]
:0042823A E83114FEFF              call 00409670
:0042823F 33C0                    xor eax, eax
:00428241 8A4510                  mov al, byte ptr [ebp+10]
:00428244 83C032                  add eax, 00000032
:00428247 8845FC                  mov byte ptr [ebp-04], al
:0042824A 6A06                    push 00000006
:0042824C B994A64600              mov ecx, 0046A694
:00428251 E8CE0DFFFF              call 00419024
:00428256 6A02                    push 00000002
:00428258 E8FDF10000              call 0043745A
:0042825D 83C404                  add esp, 00000004

* Possible StringData Ref from Data Obj ->"B:HEXZMAP.E2"
                                  |
:00428260 6828354500              push 00453528
:00428265 8D8DF8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF8]
:0042826B E89FF2FFFF              call 0042750F
:00428270 B968F94600              mov ecx, 0046F968
:00428275 E8660EFEFF              call 004090E0
:0042827A 50                      push eax
:0042827B 33C0                    xor eax, eax
:0042827D 8A45FC                  mov al, byte ptr [ebp-04]
:00428280 50                      push eax
:00428281 8D8DF8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF8]
:00428287 E8F5F3FFFF              call 00427681
:0042828C 8D8DF8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF8]
:00428292 E88911FEFF              call 00409420
:00428297 33C0                    xor eax, eax
:00428299 A0C8FC4600              mov al, byte ptr [0046FCC8]
:0042829E 33C9                    xor ecx, ecx
:004282A0 8A0DC9FC4600            mov cl, byte ptr [0046FCC9]
:004282A6 0FAFC1                  imul eax, ecx
:004282A9 8D04C0                  lea eax, dword ptr [eax+8*eax]
:004282AC 50                      push eax
:004282AD B950F94600              mov ecx, 0046F950
:004282B2 E8290EFEFF              call 004090E0
:004282B7 50                      push eax
:004282B8 6A04                    push 00000004
:004282BA 6A00                    push 00000000
:004282BC 6A00                    push 00000000
:004282BE B968F94600              mov ecx, 0046F968
:004282C3 E858F40100              call 00447720
:004282C8 83C003                  add eax, 00000003
:004282CB 50                      push eax
:004282CC E87CF10100              call 0044744D
:004282D1 83C40C                  add esp, 0000000C
:004282D4 33C0                    xor eax, eax
:004282D6 A0C8FC4600              mov al, byte ptr [0046FCC8]
:004282DB 33C9                    xor ecx, ecx
:004282DD 8A0DC9FC4600            mov cl, byte ptr [0046FCC9]
:004282E3 0FAFC1                  imul eax, ecx
:004282E6 50                      push eax
:004282E7 6A04                    push 00000004
:004282E9 6A00                    push 00000000
:004282EB 68C0210000              push 000021C0
:004282F0 B950F94600              mov ecx, 0046F950
:004282F5 E826F40100              call 00447720
:004282FA 50                      push eax
:004282FB 33DB                    xor ebx, ebx
:004282FD 8A1DC8FC4600            mov bl, byte ptr [0046FCC8]
:00428303 33C0                    xor eax, eax
:00428305 A0C9FC4600              mov al, byte ptr [0046FCC9]
:0042830A 0FAFD8                  imul ebx, eax
:0042830D 8D1CDB                  lea ebx, dword ptr [ebx+8*ebx]
:00428310 6A04                    push 00000004
:00428312 6A00                    push 00000000
:00428314 6A00                    push 00000000
:00428316 B968F94600              mov ecx, 0046F968
:0042831B E800F40100              call 00447720
:00428320 03D8                    add ebx, eax
:00428322 83C303                  add ebx, 00000003
:00428325 53                      push ebx
:00428326 E822F10100              call 0044744D
:0042832B 83C40C                  add esp, 0000000C
:0042832E E895F00000              call 004373C8
:00428333 33C0                    xor eax, eax
:00428335 8A4510                  mov al, byte ptr [ebp+10]
:00428338 83F804                  cmp eax, 00000004
:0042833B 0F8519000000            jne 0042835A
:00428341 6A02                    push 00000002
:00428343 E82C000000              call 00428374
:00428348 83C404                  add esp, 00000004
:0042834B 6A03                    push 00000003
:0042834D E822000000              call 00428374
:00428352 83C404                  add esp, 00000004
:00428355 E90E000000              jmp 00428368

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042833B(C)
|
:0042835A 33C0                    xor eax, eax
:0042835C 8A4510                  mov al, byte ptr [ebp+10]
:0042835F 50                      push eax
:00428360 E80F000000              call 00428374
:00428365 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428355(U)
|
:00428368 E900000000              jmp 0042836D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428368(U)
|
:0042836D 5F                      pop edi
:0042836E 5E                      pop esi
:0042836F 5B                      pop ebx
:00428370 C9                      leave
:00428371 C20C00                  ret 000C



* Referenced by a CALL at Addresses:
|:00428343   , :0042834D   , :00428360   
|
:00428374 55                      push ebp
:00428375 8BEC                    mov ebp, esp
:00428377 81EC18020000            sub esp, 00000218
:0042837D 53                      push ebx
:0042837E 56                      push esi
:0042837F 57                      push edi
:00428380 8D8DF0FDFFFF            lea ecx, dword ptr [ebp+FFFFFDF0]
:00428386 E8E512FEFF              call 00409670

* Possible StringData Ref from Data Obj ->"C:HMAPCHIP.E2"
                                  |
:0042838B B8AC1C4500              mov eax, 00451CAC
:00428390 8D8DF4FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF4]
:00428396 8B10                    mov edx, dword ptr [eax]
:00428398 8911                    mov dword ptr [ecx], edx
:0042839A 8B5004                  mov edx, dword ptr [eax+04]
:0042839D 895104                  mov dword ptr [ecx+04], edx
:004283A0 8B5008                  mov edx, dword ptr [eax+08]
:004283A3 895108                  mov dword ptr [ecx+08], edx
:004283A6 668B400C                mov ax, word ptr [eax+0C]
:004283AA 6689410C                mov word ptr [ecx+0C], ax
:004283AE 8DBD02FFFFFF            lea edi, dword ptr [ebp+FFFFFF02]
:004283B4 33C0                    xor eax, eax
:004283B6 B93D000000              mov ecx, 0000003D
:004283BB F3                      repz
:004283BC AB                      stosd
:004283BD 66AB                    stosw
:004283BF 837D0804                cmp dword ptr [ebp+08], 00000004
:004283C3 0F8205000000            jb 004283CE
:004283C9 E9E7000000              jmp 004284B5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004283C3(C)
|
:004283CE 8D85F4FEFFFF            lea eax, dword ptr [ebp+FFFFFEF4]
:004283D4 50                      push eax
:004283D5 8D8DF0FDFFFF            lea ecx, dword ptr [ebp+FFFFFDF0]
:004283DB E82FF1FFFF              call 0042750F
:004283E0 8945F8                  mov dword ptr [ebp-08], eax
:004283E3 837DF800                cmp dword ptr [ebp-08], 00000000
:004283E7 0F84C3000000            je 004284B0
:004283ED 8B4508                  mov eax, dword ptr [ebp+08]
:004283F0 8B0485501C4500          mov eax, dword ptr [4*eax+00451C50]
:004283F7 8985ECFDFFFF            mov dword ptr [ebp+FFFFFDEC], eax
:004283FD 33C0                    xor eax, eax
:004283FF A0C8FC4600              mov al, byte ptr [0046FCC8]
:00428404 C1E004                  shl eax, 04
:00428407 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042840A 0FAF85ECFDFFFF          imul eax, dword ptr [ebp+FFFFFDEC]
:00428411 8985ECFDFFFF            mov dword ptr [ebp+FFFFFDEC], eax
:00428417 8B4508                  mov eax, dword ptr [ebp+08]
:0042841A 8B0485381C4500          mov eax, dword ptr [4*eax+00451C38]
:00428421 0185ECFDFFFF            add dword ptr [ebp+FFFFFDEC], eax
:00428427 C685E8FDFFFF00          mov byte ptr [ebp+FFFFFDE8], 00
:0042842E E906000000              jmp 00428439

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004284A0(U)
|
:00428433 FE85E8FDFFFF            inc byte ptr [ebp+FFFFFDE8]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042842E(U)
|
:00428439 8B4508                  mov eax, dword ptr [ebp+08]
:0042843C 33C9                    xor ecx, ecx
:0042843E 8A8DE8FDFFFF            mov cl, byte ptr [ebp+FFFFFDE8]
:00428444 390C85801C4500          cmp dword ptr [4*eax+00451C80], ecx
:0042844B 0F8654000000            jbe 004284A5
:00428451 6A04                    push 00000004
:00428453 6A00                    push 00000000
:00428455 8B85ECFDFFFF            mov eax, dword ptr [ebp+FFFFFDEC]
:0042845B 50                      push eax
:0042845C B980F94600              mov ecx, 0046F980
:00428461 E8BAF20100              call 00447720
:00428466 8945FC                  mov dword ptr [ebp-04], eax
:00428469 8B45FC                  mov eax, dword ptr [ebp-04]
:0042846C 50                      push eax
:0042846D 8B4508                  mov eax, dword ptr [ebp+08]
:00428470 8B0485981C4500          mov eax, dword ptr [4*eax+00451C98]
:00428477 33C9                    xor ecx, ecx
:00428479 8A8DE8FDFFFF            mov cl, byte ptr [ebp+FFFFFDE8]
:0042847F 03C1                    add eax, ecx
:00428481 50                      push eax
:00428482 8D8DF0FDFFFF            lea ecx, dword ptr [ebp+FFFFFDF0]
:00428488 E8F4F1FFFF              call 00427681
:0042848D 33C0                    xor eax, eax
:0042848F A0C8FC4600              mov al, byte ptr [0046FCC8]
:00428494 C1E008                  shl eax, 08
:00428497 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042849A 0185ECFDFFFF            add dword ptr [ebp+FFFFFDEC], eax
:004284A0 E98EFFFFFF              jmp 00428433

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042844B(C)
|
:004284A5 8D8DF0FDFFFF            lea ecx, dword ptr [ebp+FFFFFDF0]
:004284AB E8700FFEFF              call 00409420

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004283E7(C)
|
:004284B0 E900000000              jmp 004284B5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004283C9(U), :004284B0(U)
|
:004284B5 5F                      pop edi
:004284B6 5E                      pop esi
:004284B7 5B                      pop ebx
:004284B8 C9                      leave
:004284B9 C3                      ret



* Referenced by a CALL at Address:
|:00431651   
|
:004284BA 55                      push ebp
:004284BB 8BEC                    mov ebp, esp
:004284BD 83EC14                  sub esp, 00000014
:004284C0 53                      push ebx
:004284C1 56                      push esi
:004284C2 57                      push edi
:004284C3 894DEC                  mov dword ptr [ebp-14], ecx
:004284C6 8B4508                  mov eax, dword ptr [ebp+08]
:004284C9 50                      push eax
:004284CA E8A6F3FFFF              call 00427875
:004284CF 83C404                  add esp, 00000004
:004284D2 8945FC                  mov dword ptr [ebp-04], eax
:004284D5 C745F800000000          mov [ebp-08], 00000000
:004284DC 837DFCFF                cmp dword ptr [ebp-04], FFFFFFFF
:004284E0 0F850F000000            jne 004284F5
:004284E6 B8FFFFFFFF              mov eax, FFFFFFFF
:004284EB E947010000              jmp 00428637
:004284F0 E942010000              jmp 00428637

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004284E0(C)
|
:004284F5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004284F8 E8230DFEFF              call 00409220
:004284FD 8945F4                  mov dword ptr [ebp-0C], eax
:00428500 837DF400                cmp dword ptr [ebp-0C], 00000000
:00428504 0F8409000000            je 00428513
:0042850A C645F00F                mov [ebp-10], 0F
:0042850E E904000000              jmp 00428517

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428504(C)
|
:00428513 C645F000                mov [ebp-10], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042850E(U)
|
:00428517 E903000000              jmp 0042851F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042857A(U)
|
:0042851C FE45F0                  inc [ebp-10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428517(U)
|
:0042851F 837DF401                cmp dword ptr [ebp-0C], 00000001
:00428523 1BC0                    sbb eax, eax
:00428525 83E0E2                  and eax, FFFFFFE2
:00428528 83C02D                  add eax, 0000002D
:0042852B 33C9                    xor ecx, ecx
:0042852D 8A4DF0                  mov cl, byte ptr [ebp-10]
:00428530 3BC1                    cmp eax, ecx
:00428532 0F8E47000000            jle 0042857F
:00428538 33C0                    xor eax, eax
:0042853A 8A45F0                  mov al, byte ptr [ebp-10]
:0042853D 8BC8                    mov ecx, eax
:0042853F 8D0440                  lea eax, dword ptr [eax+2*eax]
:00428542 C1E003                  shl eax, 03
:00428545 2BC1                    sub eax, ecx
:00428547 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0042854D E8DE12FEFF              call 00409830
:00428552 33C9                    xor ecx, ecx
:00428554 8AC8                    mov cl, al
:00428556 85C9                    test ecx, ecx
:00428558 0F851C000000            jne 0042857A
:0042855E 33C0                    xor eax, eax
:00428560 8A45F0                  mov al, byte ptr [ebp-10]
:00428563 8BC8                    mov ecx, eax
:00428565 8D0440                  lea eax, dword ptr [eax+2*eax]
:00428568 C1E003                  shl eax, 03
:0042856B 2BC1                    sub eax, ecx
:0042856D 0598C04600              add eax, 0046C098
:00428572 8945F8                  mov dword ptr [ebp-08], eax
:00428575 E905000000              jmp 0042857F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428558(C)
|
:0042857A E99DFFFFFF              jmp 0042851C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00428532(C), :00428575(U)
|
:0042857F 837DF800                cmp dword ptr [ebp-08], 00000000
:00428583 0F84A4000000            je 0042862D
:00428589 8B450C                  mov eax, dword ptr [ebp+0C]
:0042858C 50                      push eax
:0042858D 8B4508                  mov eax, dword ptr [ebp+08]
:00428590 8D0440                  lea eax, dword ptr [eax+2*eax]
:00428593 03C0                    add eax, eax
:00428595 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:0042859C E85F6EFFFF              call 0041F400
:004285A1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004285A4 E88712FEFF              call 00409830
:004285A9 33C9                    xor ecx, ecx
:004285AB 8AC8                    mov cl, al
:004285AD 83F902                  cmp ecx, 00000002
:004285B0 0F8508000000            jne 004285BE
:004285B6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004285B9 E885330000              call 0042B943

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004285B0(C)
|
:004285BE 8B45FC                  mov eax, dword ptr [ebp-04]
:004285C1 50                      push eax
:004285C2 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004285C5 E846080000              call 00428E10
:004285CA 6A00                    push 00000000
:004285CC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004285CF E84C090000              call 00428F20
:004285D4 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004285D7 E8472E0000              call 0042B423
:004285DC 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004285DF E84C12FEFF              call 00409830
:004285E4 33C9                    xor ecx, ecx
:004285E6 8AC8                    mov cl, al
:004285E8 83F902                  cmp ecx, 00000002
:004285EB 0F852D000000            jne 0042861E
:004285F1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004285F4 E816330000              call 0042B90F
:004285F9 33C0                    xor eax, eax
:004285FB 8A450C                  mov al, byte ptr [ebp+0C]
:004285FE 85C0                    test eax, eax
:00428600 0F840E000000            je 00428614
:00428606 33C0                    xor eax, eax
:00428608 8A450C                  mov al, byte ptr [ebp+0C]
:0042860B 83F806                  cmp eax, 00000006
:0042860E 0F850A000000            jne 0042861E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428600(C)
|
:00428614 6A07                    push 00000007
:00428616 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00428619 E8B83D0000              call 0042C3D6

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004285EB(C), :0042860E(C)
|
:0042861E B801000000              mov eax, 00000001
:00428623 E90F000000              jmp 00428637
:00428628 E90A000000              jmp 00428637

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428583(C)
|
:0042862D B8FFFFFFFF              mov eax, FFFFFFFF
:00428632 E900000000              jmp 00428637

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004284EB(U), :004284F0(U), :00428623(U), :00428628(U), :00428632(U)
|
:00428637 5F                      pop edi
:00428638 5E                      pop esi
:00428639 5B                      pop ebx
:0042863A C9                      leave
:0042863B C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:00430B57   , :0044116C   
|
:0042863E 55                      push ebp
:0042863F 8BEC                    mov ebp, esp
:00428641 83EC08                  sub esp, 00000008
:00428644 53                      push ebx
:00428645 56                      push esi
:00428646 57                      push edi
:00428647 894DF8                  mov dword ptr [ebp-08], ecx
:0042864A 8B4508                  mov eax, dword ptr [ebp+08]
:0042864D 50                      push eax
:0042864E E822F2FFFF              call 00427875
:00428653 83C404                  add esp, 00000004
:00428656 8945FC                  mov dword ptr [ebp-04], eax
:00428659 837DFCFF                cmp dword ptr [ebp-04], FFFFFFFF
:0042865D 0F850F000000            jne 00428672
:00428663 B8FFFFFFFF              mov eax, FFFFFFFF
:00428668 E929000000              jmp 00428696
:0042866D E924000000              jmp 00428696

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042865D(C)
|
:00428672 6A04                    push 00000004
:00428674 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00428677 E8B40CFEFF              call 00409330
:0042867C 8B4510                  mov eax, dword ptr [ebp+10]
:0042867F 50                      push eax
:00428680 8B450C                  mov eax, dword ptr [ebp+0C]
:00428683 50                      push eax
:00428684 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00428687 E8E3560000              call 0042DD6F
:0042868C B801000000              mov eax, 00000001
:00428691 E900000000              jmp 00428696

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00428668(U), :0042866D(U), :00428691(U)
|
:00428696 5F                      pop edi
:00428697 5E                      pop esi
:00428698 5B                      pop ebx
:00428699 C9                      leave
:0042869A C20C00                  ret 000C



* Referenced by a CALL at Addresses:
|:00430B0C   , :0044114B   
|
:0042869D 55                      push ebp
:0042869E 8BEC                    mov ebp, esp
:004286A0 83EC0C                  sub esp, 0000000C
:004286A3 53                      push ebx
:004286A4 56                      push esi
:004286A5 57                      push edi
:004286A6 894DF4                  mov dword ptr [ebp-0C], ecx
:004286A9 8B4508                  mov eax, dword ptr [ebp+08]
:004286AC 50                      push eax
:004286AD E8C3F1FFFF              call 00427875
:004286B2 83C404                  add esp, 00000004
:004286B5 8945FC                  mov dword ptr [ebp-04], eax
:004286B8 837DFCFF                cmp dword ptr [ebp-04], FFFFFFFF
:004286BC 0F850F000000            jne 004286D1
:004286C2 B8FFFFFFFF              mov eax, FFFFFFFF
:004286C7 E94D000000              jmp 00428719
:004286CC E948000000              jmp 00428719

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004286BC(C)
|
:004286D1 8B450C                  mov eax, dword ptr [ebp+0C]
:004286D4 50                      push eax
:004286D5 E89BF1FFFF              call 00427875
:004286DA 83C404                  add esp, 00000004
:004286DD 8945F8                  mov dword ptr [ebp-08], eax
:004286E0 837DF8FF                cmp dword ptr [ebp-08], FFFFFFFF
:004286E4 0F850A000000            jne 004286F4
:004286EA B8FFFFFFFF              mov eax, FFFFFFFF
:004286EF E925000000              jmp 00428719

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004286E4(C)
|
:004286F4 6A04                    push 00000004
:004286F6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004286F9 E8320CFEFF              call 00409330
:004286FE 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00428701 E8CA5BFFFF              call 0041E2D0
:00428706 50                      push eax
:00428707 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042870A E841080000              call 00428F50
:0042870F B801000000              mov eax, 00000001
:00428714 E900000000              jmp 00428719

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004286C7(U), :004286CC(U), :004286EF(U), :00428714(U)
|
:00428719 5F                      pop edi
:0042871A 5E                      pop esi
:0042871B 5B                      pop ebx
:0042871C C9                      leave
:0042871D C20800                  ret 0008



* Referenced by a CALL at Address:
|:00431847   
|
:00428720 55                      push ebp
:00428721 8BEC                    mov ebp, esp
:00428723 83EC1C                  sub esp, 0000001C
:00428726 53                      push ebx
:00428727 56                      push esi
:00428728 57                      push edi
:00428729 894DE4                  mov dword ptr [ebp-1C], ecx
:0042872C 33C0                    xor eax, eax
:0042872E 8A4508                  mov al, byte ptr [ebp+08]
:00428731 85C0                    test eax, eax
:00428733 0F8513000000            jne 0042874C
:00428739 C745F800000000          mov [ebp-08], 00000000
:00428740 C745FC0F000000          mov [ebp-04], 0000000F
:00428747 E90E000000              jmp 0042875A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428733(C)
|
:0042874C C745F80F000000          mov [ebp-08], 0000000F
:00428753 C745FC2D000000          mov [ebp-04], 0000002D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428747(U)
|
:0042875A 8B45F8                  mov eax, dword ptr [ebp-08]
:0042875D 8945F4                  mov dword ptr [ebp-0C], eax
:00428760 E903000000              jmp 00428768

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428885(U)
|
:00428765 FF45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428760(U)
|
:00428768 8B45FC                  mov eax, dword ptr [ebp-04]
:0042876B 3945F4                  cmp dword ptr [ebp-0C], eax
:0042876E 0F8316010000            jnb 0042888A
:00428774 8B45F4                  mov eax, dword ptr [ebp-0C]
:00428777 8BC8                    mov ecx, eax
:00428779 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042877C C1E003                  shl eax, 03
:0042877F 2BC1                    sub eax, ecx
:00428781 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00428787 E8A410FEFF              call 00409830
:0042878C 33C9                    xor ecx, ecx
:0042878E 8AC8                    mov cl, al
:00428790 83F902                  cmp ecx, 00000002
:00428793 0F85EC000000            jne 00428885
:00428799 33C0                    xor eax, eax
:0042879B 8A450C                  mov al, byte ptr [ebp+0C]
:0042879E 85C0                    test eax, eax
:004287A0 0F8453000000            je 004287F9
:004287A6 8B45F4                  mov eax, dword ptr [ebp-0C]
:004287A9 8BC8                    mov ecx, eax
:004287AB 8D0440                  lea eax, dword ptr [eax+2*eax]
:004287AE C1E003                  shl eax, 03
:004287B1 2BC1                    sub eax, ecx
:004287B3 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004287B9 E8F20FFEFF              call 004097B0
:004287BE 8945F0                  mov dword ptr [ebp-10], eax
:004287C1 8B45F0                  mov eax, dword ptr [ebp-10]
:004287C4 C1E801                  shr eax, 01
:004287C7 83F801                  cmp eax, 00000001
:004287CA 0F8F05000000            jg 004287D5
:004287D0 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004287CA(C)
|
:004287D5 8945F0                  mov dword ptr [ebp-10], eax
:004287D8 8B45F0                  mov eax, dword ptr [ebp-10]
:004287DB 50                      push eax
:004287DC 8B45F4                  mov eax, dword ptr [ebp-0C]
:004287DF 8BC8                    mov ecx, eax
:004287E1 8D0440                  lea eax, dword ptr [eax+2*eax]
:004287E4 C1E003                  shl eax, 03
:004287E7 2BC1                    sub eax, ecx
:004287E9 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004287EF E8ED1B0000              call 0042A3E1
:004287F4 E98C000000              jmp 00428885

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004287A0(C)
|
:004287F9 8B45F4                  mov eax, dword ptr [ebp-0C]
:004287FC 8BC8                    mov ecx, eax
:004287FE 8D0440                  lea eax, dword ptr [eax+2*eax]
:00428801 C1E003                  shl eax, 03
:00428804 2BC1                    sub eax, ecx
:00428806 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0042880C E81F09FEFF              call 00409130
:00428811 8D0440                  lea eax, dword ptr [eax+2*eax]
:00428814 03C0                    add eax, eax
:00428816 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:0042881D E85E0AFEFF              call 00409280
:00428822 8845EC                  mov byte ptr [ebp-14], al
:00428825 33C0                    xor eax, eax
:00428827 8A45EC                  mov al, byte ptr [ebp-14]
:0042882A C1F801                  sar eax, 01
:0042882D 8845E8                  mov byte ptr [ebp-18], al
:00428830 33C0                    xor eax, eax
:00428832 8A45E8                  mov al, byte ptr [ebp-18]
:00428835 83F801                  cmp eax, 00000001
:00428838 0F8F05000000            jg 00428843
:0042883E B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428838(C)
|
:00428843 8845E8                  mov byte ptr [ebp-18], al
:00428846 33C0                    xor eax, eax
:00428848 8A45EC                  mov al, byte ptr [ebp-14]
:0042884B C1F801                  sar eax, 01
:0042884E 33C9                    xor ecx, ecx
:00428850 8A4DEC                  mov cl, byte ptr [ebp-14]
:00428853 03C1                    add eax, ecx
:00428855 50                      push eax
:00428856 E8CDEA0100              call 00447328
:0042885B 83C404                  add esp, 00000004
:0042885E 33C9                    xor ecx, ecx
:00428860 8A4DE8                  mov cl, byte ptr [ebp-18]
:00428863 3BC1                    cmp eax, ecx
:00428865 0F871A000000            ja 00428885
:0042886B 6A10                    push 00000010
:0042886D 8B45F4                  mov eax, dword ptr [ebp-0C]
:00428870 8BC8                    mov ecx, eax
:00428872 8D0440                  lea eax, dword ptr [eax+2*eax]
:00428875 C1E003                  shl eax, 03
:00428878 2BC1                    sub eax, ecx
:0042887A 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00428880 E8DB0EFEFF              call 00409760

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00428793(C), :004287F4(U), :00428865(C)
|
:00428885 E9DBFEFFFF              jmp 00428765

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042876E(C)
|
:0042888A E900000000              jmp 0042888F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042888A(U)
|
:0042888F 5F                      pop edi
:00428890 5E                      pop esi
:00428891 5B                      pop ebx
:00428892 C9                      leave
:00428893 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:004289F0   , :00432944   
|
:00428896 55                      push ebp
:00428897 8BEC                    mov ebp, esp
:00428899 83EC08                  sub esp, 00000008
:0042889C 53                      push ebx
:0042889D 56                      push esi
:0042889E 57                      push edi
:0042889F 894DF8                  mov dword ptr [ebp-08], ecx
:004288A2 8B4508                  mov eax, dword ptr [ebp+08]
:004288A5 50                      push eax
:004288A6 E8CAEFFFFF              call 00427875
:004288AB 83C404                  add esp, 00000004
:004288AE 8945FC                  mov dword ptr [ebp-04], eax
:004288B1 837DFCFF                cmp dword ptr [ebp-04], FFFFFFFF
:004288B5 0F850F000000            jne 004288CA
:004288BB B8FFFFFFFF              mov eax, FFFFFFFF
:004288C0 E92B000000              jmp 004288F0
:004288C5 E926000000              jmp 004288F0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004288B5(C)
|
:004288CA 6A04                    push 00000004
:004288CC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004288CF E8F0540000              call 0042DDC4
:004288D4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004288D7 E881310000              call 0042BA5D
:004288DC 6A04                    push 00000004
:004288DE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004288E1 E84A0AFEFF              call 00409330
:004288E6 B801000000              mov eax, 00000001
:004288EB E900000000              jmp 004288F0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004288C0(U), :004288C5(U), :004288EB(U)
|
:004288F0 5F                      pop edi
:004288F1 5E                      pop esi
:004288F2 5B                      pop ebx
:004288F3 C9                      leave
:004288F4 C20400                  ret 0004



* Referenced by a CALL at Address:
|:004309B9   
|
:004288F7 55                      push ebp
:004288F8 8BEC                    mov ebp, esp
:004288FA 83EC14                  sub esp, 00000014
:004288FD 53                      push ebx
:004288FE 56                      push esi
:004288FF 57                      push edi
:00428900 894DEC                  mov dword ptr [ebp-14], ecx
:00428903 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00428906 E8658FFDFF              call 00401870
:0042890B 8A450C                  mov al, byte ptr [ebp+0C]
:0042890E 8845F4                  mov byte ptr [ebp-0C], al
:00428911 E903000000              jmp 00428919

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004289FA(U)
|
:00428916 FE45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428911(U)
|
:00428919 33C0                    xor eax, eax
:0042891B 8A4514                  mov al, byte ptr [ebp+14]
:0042891E 33C9                    xor ecx, ecx
:00428920 8A4DF4                  mov cl, byte ptr [ebp-0C]
:00428923 3BC1                    cmp eax, ecx
:00428925 0F8CD4000000            jl 004289FF
:0042892B 8A4508                  mov al, byte ptr [ebp+08]
:0042892E 8845F8                  mov byte ptr [ebp-08], al
:00428931 E903000000              jmp 00428939

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004289F5(U)
|
:00428936 FE45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428931(U)
|
:00428939 33C0                    xor eax, eax
:0042893B 8A4510                  mov al, byte ptr [ebp+10]
:0042893E 33C9                    xor ecx, ecx
:00428940 8A4DF8                  mov cl, byte ptr [ebp-08]
:00428943 3BC1                    cmp eax, ecx
:00428945 0F8CAF000000            jl 004289FA
:0042894B 8A45F8                  mov al, byte ptr [ebp-08]
:0042894E 8845FC                  mov byte ptr [ebp-04], al
:00428951 8A45F4                  mov al, byte ptr [ebp-0C]
:00428954 8845FD                  mov byte ptr [ebp-03], al
:00428957 8D45FC                  lea eax, dword ptr [ebp-04]
:0042895A 50                      push eax
:0042895B E8DD0BFFFF              call 0041953D
:00428960 83C404                  add esp, 00000004
:00428963 8845F0                  mov byte ptr [ebp-10], al
:00428966 33C0                    xor eax, eax
:00428968 8A45F0                  mov al, byte ptr [ebp-10]
:0042896B 3DFF000000              cmp eax, 000000FF
:00428970 0F847F000000            je 004289F5
:00428976 33C0                    xor eax, eax
:00428978 8A45F0                  mov al, byte ptr [ebp-10]
:0042897B 8BC8                    mov ecx, eax
:0042897D 8D0440                  lea eax, dword ptr [eax+2*eax]
:00428980 C1E003                  shl eax, 03
:00428983 2BC1                    sub eax, ecx
:00428985 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0042898B E8A00EFEFF              call 00409830
:00428990 33C9                    xor ecx, ecx
:00428992 8AC8                    mov cl, al
:00428994 83F902                  cmp ecx, 00000002
:00428997 0F8558000000            jne 004289F5
:0042899D 33C0                    xor eax, eax
:0042899F 8A45F0                  mov al, byte ptr [ebp-10]
:004289A2 8BC8                    mov ecx, eax
:004289A4 8D0440                  lea eax, dword ptr [eax+2*eax]
:004289A7 C1E003                  shl eax, 03
:004289AA 2BC1                    sub eax, ecx
:004289AC 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004289B2 E86908FEFF              call 00409220
:004289B7 33C9                    xor ecx, ecx
:004289B9 8A4D18                  mov cl, byte ptr [ebp+18]
:004289BC 3BC1                    cmp eax, ecx
:004289BE 0F850E000000            jne 004289D2
:004289C4 33C0                    xor eax, eax
:004289C6 8A4518                  mov al, byte ptr [ebp+18]
:004289C9 83F802                  cmp eax, 00000002
:004289CC 0F8523000000            jne 004289F5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004289BE(C)
|
:004289D2 33C0                    xor eax, eax
:004289D4 8A45F0                  mov al, byte ptr [ebp-10]
:004289D7 8BC8                    mov ecx, eax
:004289D9 8D0440                  lea eax, dword ptr [eax+2*eax]
:004289DC C1E003                  shl eax, 03
:004289DF 2BC1                    sub eax, ecx
:004289E1 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004289E7 E84407FEFF              call 00409130
:004289EC 50                      push eax
:004289ED 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004289F0 E8A1FEFFFF              call 00428896

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00428970(C), :00428997(C), :004289CC(C)
|
:004289F5 E93CFFFFFF              jmp 00428936

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428945(C)
|
:004289FA E917FFFFFF              jmp 00428916

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428925(C)
|
:004289FF E900000000              jmp 00428A04

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004289FF(U)
|
:00428A04 5F                      pop edi
:00428A05 5E                      pop esi
:00428A06 5B                      pop ebx
:00428A07 C9                      leave
:00428A08 C21400                  ret 0014



* Referenced by a CALL at Addresses:
|:00423813   , :004238A0   , :00428D9B   , :0042AE9E   , :0042AF1F   
|:00431BC8   
|
:00428A0B 55                      push ebp
:00428A0C 8BEC                    mov ebp, esp
:00428A0E 83EC14                  sub esp, 00000014
:00428A11 53                      push ebx
:00428A12 56                      push esi
:00428A13 57                      push edi
:00428A14 894DF0                  mov dword ptr [ebp-10], ecx
:00428A17 817D0800020000          cmp dword ptr [ebp+08], 00000200
:00428A1E 0F8605000000            jbe 00428A29
:00428A24 E927020000              jmp 00428C50

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428A1E(C)
|
:00428A29 8B4508                  mov eax, dword ptr [ebp+08]
:00428A2C 50                      push eax
:00428A2D E82F060000              call 00429061
:00428A32 83C404                  add esp, 00000004
:00428A35 8845F4                  mov byte ptr [ebp-0C], al
:00428A38 C745FC00000000          mov [ebp-04], 00000000
:00428A3F C745F801000000          mov [ebp-08], 00000001
:00428A46 33C0                    xor eax, eax
:00428A48 8A45F4                  mov al, byte ptr [ebp-0C]
:00428A4B 3DFF000000              cmp eax, 000000FF
:00428A50 0F8427000000            je 00428A7D
:00428A56 33C0                    xor eax, eax
:00428A58 8A45F4                  mov al, byte ptr [ebp-0C]
:00428A5B 8BC8                    mov ecx, eax
:00428A5D 8D0440                  lea eax, dword ptr [eax+2*eax]
:00428A60 C1E003                  shl eax, 03
:00428A63 2BC1                    sub eax, ecx
:00428A65 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00428A6B E8C00DFEFF              call 00409830
:00428A70 33C9                    xor ecx, ecx
:00428A72 8AC8                    mov cl, al
:00428A74 83F902                  cmp ecx, 00000002
:00428A77 0F8405000000            je 00428A82

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428A50(C)
|
:00428A7D E9CE010000              jmp 00428C50

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428A77(C)
|
:00428A82 837D1400                cmp dword ptr [ebp+14], 00000000
:00428A86 0F8416000000            je 00428AA2
:00428A8C 6A00                    push 00000000
:00428A8E 8B4510                  mov eax, dword ptr [ebp+10]
:00428A91 50                      push eax
:00428A92 8B450C                  mov eax, dword ptr [ebp+0C]
:00428A95 50                      push eax
:00428A96 8B45F4                  mov eax, dword ptr [ebp-0C]
:00428A99 50                      push eax
:00428A9A E8AC0E0000              call 0042994B
:00428A9F 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428A86(C)
|
:00428AA2 33C0                    xor eax, eax
:00428AA4 8A450C                  mov al, byte ptr [ebp+0C]
:00428AA7 8945EC                  mov dword ptr [ebp-14], eax
:00428AAA E978010000              jmp 00428C27
:00428AAF 33C0                    xor eax, eax
:00428AB1 8A4510                  mov al, byte ptr [ebp+10]
:00428AB4 83C840                  or eax, 00000040
:00428AB7 50                      push eax
:00428AB8 33C0                    xor eax, eax
:00428ABA 8A45F4                  mov al, byte ptr [ebp-0C]
:00428ABD 8BC8                    mov ecx, eax
:00428ABF 8D0440                  lea eax, dword ptr [eax+2*eax]
:00428AC2 C1E003                  shl eax, 03
:00428AC5 2BC1                    sub eax, ecx
:00428AC7 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00428ACD E8CE0BFEFF              call 004096A0
:00428AD2 E974010000              jmp 00428C4B
:00428AD7 33C0                    xor eax, eax
:00428AD9 8A4510                  mov al, byte ptr [ebp+10]
:00428ADC 83C840                  or eax, 00000040
:00428ADF 50                      push eax
:00428AE0 33C0                    xor eax, eax
:00428AE2 8A45F4                  mov al, byte ptr [ebp-0C]
:00428AE5 8BC8                    mov ecx, eax
:00428AE7 8D0440                  lea eax, dword ptr [eax+2*eax]
:00428AEA C1E003                  shl eax, 03
:00428AED 2BC1                    sub eax, ecx
:00428AEF 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00428AF5 E8060CFEFF              call 00409700
:00428AFA E94C010000              jmp 00428C4B
:00428AFF 33C0                    xor eax, eax
:00428B01 8A45F4                  mov al, byte ptr [ebp-0C]
:00428B04 8BC8                    mov ecx, eax
:00428B06 8D0440                  lea eax, dword ptr [eax+2*eax]
:00428B09 C1E003                  shl eax, 03
:00428B0C 2BC1                    sub eax, ecx
:00428B0E 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00428B14 E8970CFEFF              call 004097B0
:00428B19 33C9                    xor ecx, ecx
:00428B1B 8A4D10                  mov cl, byte ptr [ebp+10]
:00428B1E 3BC1                    cmp eax, ecx
:00428B20 0F8C0D000000            jl 00428B33
:00428B26 33C0                    xor eax, eax
:00428B28 8A4510                  mov al, byte ptr [ebp+10]
:00428B2B 8945FC                  mov dword ptr [ebp-04], eax
:00428B2E E91D000000              jmp 00428B50

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428B20(C)
|
:00428B33 33C0                    xor eax, eax
:00428B35 8A45F4                  mov al, byte ptr [ebp-0C]
:00428B38 8BC8                    mov ecx, eax
:00428B3A 8D0440                  lea eax, dword ptr [eax+2*eax]
:00428B3D C1E003                  shl eax, 03
:00428B40 2BC1                    sub eax, ecx
:00428B42 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00428B48 E8630CFEFF              call 004097B0
:00428B4D 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428B2E(U)
|
:00428B50 33C0                    xor eax, eax
:00428B52 8A45F4                  mov al, byte ptr [ebp-0C]
:00428B55 8BC8                    mov ecx, eax
:00428B57 8D0440                  lea eax, dword ptr [eax+2*eax]
:00428B5A C1E003                  shl eax, 03
:00428B5D 2BC1                    sub eax, ecx
:00428B5F 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00428B65 E8460CFEFF              call 004097B0
:00428B6A 2B45FC                  sub eax, dword ptr [ebp-04]
:00428B6D 83F801                  cmp eax, 00000001
:00428B70 0F8625000000            jbe 00428B9B
:00428B76 33C0                    xor eax, eax
:00428B78 8A45F4                  mov al, byte ptr [ebp-0C]
:00428B7B 8BC8                    mov ecx, eax
:00428B7D 8D0440                  lea eax, dword ptr [eax+2*eax]
:00428B80 C1E003                  shl eax, 03
:00428B83 2BC1                    sub eax, ecx
:00428B85 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00428B8B E8200CFEFF              call 004097B0
:00428B90 2B45FC                  sub eax, dword ptr [ebp-04]
:00428B93 8945F8                  mov dword ptr [ebp-08], eax
:00428B96 E907000000              jmp 00428BA2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428B70(C)
|
:00428B9B C745F801000000          mov [ebp-08], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428B96(U)
|
:00428BA2 8B45F8                  mov eax, dword ptr [ebp-08]
:00428BA5 50                      push eax
:00428BA6 33C0                    xor eax, eax
:00428BA8 8A45F4                  mov al, byte ptr [ebp-0C]
:00428BAB 8BC8                    mov ecx, eax
:00428BAD 8D0440                  lea eax, dword ptr [eax+2*eax]
:00428BB0 C1E003                  shl eax, 03
:00428BB3 2BC1                    sub eax, ecx
:00428BB5 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00428BBB E821180000              call 0042A3E1
:00428BC0 E986000000              jmp 00428C4B
:00428BC5 33C0                    xor eax, eax
:00428BC7 8A4510                  mov al, byte ptr [ebp+10]
:00428BCA A880                    test al, 80
:00428BCC 0F8423000000            je 00428BF5
:00428BD2 8B4510                  mov eax, dword ptr [ebp+10]
:00428BD5 50                      push eax
:00428BD6 33C0                    xor eax, eax
:00428BD8 8A45F4                  mov al, byte ptr [ebp-0C]
:00428BDB 8BC8                    mov ecx, eax
:00428BDD 8D0440                  lea eax, dword ptr [eax+2*eax]
:00428BE0 C1E003                  shl eax, 03
:00428BE3 2BC1                    sub eax, ecx
:00428BE5 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00428BEB E8E00BFEFF              call 004097D0
:00428BF0 E923000000              jmp 00428C18

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428BCC(C)
|
:00428BF5 33C0                    xor eax, eax
:00428BF7 8A4510                  mov al, byte ptr [ebp+10]
:00428BFA 83C840                  or eax, 00000040
:00428BFD 50                      push eax
:00428BFE 33C0                    xor eax, eax
:00428C00 8A45F4                  mov al, byte ptr [ebp-0C]
:00428C03 8BC8                    mov ecx, eax
:00428C05 8D0440                  lea eax, dword ptr [eax+2*eax]
:00428C08 C1E003                  shl eax, 03
:00428C0B 2BC1                    sub eax, ecx
:00428C0D 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00428C13 E8480BFEFF              call 00409760

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428BF0(U)
|
:00428C18 E92E000000              jmp 00428C4B
:00428C1D E929000000              jmp 00428C4B
:00428C22 E924000000              jmp 00428C4B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428AAA(U)
|
:00428C27 837DEC03                cmp dword ptr [ebp-14], 00000003
:00428C2B 0F871A000000            ja 00428C4B
:00428C31 8B45EC                  mov eax, dword ptr [ebp-14]
:00428C34 FF24853B8C4200          jmp dword ptr [4*eax+00428C3B]

:00428C3B AF8A4200                DWORD 00428AAF
:00428C3F D78A4200                DWORD 00428AD7
:00428C43 FF8A4200                DWORD 00428AFF
:00428C47 C58B4200                DWORD 00428BC5



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00428AD2(U), :00428AFA(U), :00428BC0(U), :00428C18(U), :00428C1D(U)
|:00428C22(U), :00428C2B(C)
|
:00428C4B E900000000              jmp 00428C50

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00428A24(U), :00428A7D(U)
|
:00428C50 5F                      pop edi
:00428C51 5E                      pop esi
:00428C52 5B                      pop ebx
:00428C53 C9                      leave
:00428C54 C21000                  ret 0010



* Referenced by a CALL at Address:
|:00431C18   
|
:00428C57 55                      push ebp
:00428C58 8BEC                    mov ebp, esp
:00428C5A 83EC18                  sub esp, 00000018
:00428C5D 53                      push ebx
:00428C5E 56                      push esi
:00428C5F 57                      push edi
:00428C60 894DE8                  mov dword ptr [ebp-18], ecx
:00428C63 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00428C66 E8058CFDFF              call 00401870
:00428C6B 8B4518                  mov eax, dword ptr [ebp+18]
:00428C6E 50                      push eax
:00428C6F 8B4520                  mov eax, dword ptr [ebp+20]
:00428C72 50                      push eax
:00428C73 8B451C                  mov eax, dword ptr [ebp+1C]
:00428C76 50                      push eax
:00428C77 68FF000000              push 000000FF
:00428C7C E8CA0C0000              call 0042994B
:00428C81 83C410                  add esp, 00000010
:00428C84 8A450C                  mov al, byte ptr [ebp+0C]
:00428C87 8845F4                  mov byte ptr [ebp-0C], al
:00428C8A E903000000              jmp 00428C92

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428DA5(U)
|
:00428C8F FE45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428C8A(U)
|
:00428C92 33C0                    xor eax, eax
:00428C94 8A45F4                  mov al, byte ptr [ebp-0C]
:00428C97 33C9                    xor ecx, ecx
:00428C99 8A4D14                  mov cl, byte ptr [ebp+14]
:00428C9C 3BC1                    cmp eax, ecx
:00428C9E 0F8F06010000            jg 00428DAA
:00428CA4 8A4508                  mov al, byte ptr [ebp+08]
:00428CA7 8845F8                  mov byte ptr [ebp-08], al
:00428CAA E903000000              jmp 00428CB2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428DA0(U)
|
:00428CAF FE45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428CAA(U)
|
:00428CB2 33C0                    xor eax, eax
:00428CB4 8A45F8                  mov al, byte ptr [ebp-08]
:00428CB7 33C9                    xor ecx, ecx
:00428CB9 8A4D10                  mov cl, byte ptr [ebp+10]
:00428CBC 3BC1                    cmp eax, ecx
:00428CBE 0F8FE1000000            jg 00428DA5
:00428CC4 8A45F8                  mov al, byte ptr [ebp-08]
:00428CC7 8845FC                  mov byte ptr [ebp-04], al
:00428CCA 8A45F4                  mov al, byte ptr [ebp-0C]
:00428CCD 8845FD                  mov byte ptr [ebp-03], al
:00428CD0 8D45FC                  lea eax, dword ptr [ebp-04]
:00428CD3 50                      push eax
:00428CD4 E86408FFFF              call 0041953D
:00428CD9 83C404                  add esp, 00000004
:00428CDC 8845F0                  mov byte ptr [ebp-10], al
:00428CDF 33C0                    xor eax, eax
:00428CE1 8A45F0                  mov al, byte ptr [ebp-10]
:00428CE4 3DFF000000              cmp eax, 000000FF
:00428CE9 0F84B1000000            je 00428DA0
:00428CEF 33C0                    xor eax, eax
:00428CF1 8A45F0                  mov al, byte ptr [ebp-10]
:00428CF4 8BC8                    mov ecx, eax
:00428CF6 8D0440                  lea eax, dword ptr [eax+2*eax]
:00428CF9 C1E003                  shl eax, 03
:00428CFC 2BC1                    sub eax, ecx
:00428CFE 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00428D04 E8270BFEFF              call 00409830
:00428D09 33C9                    xor ecx, ecx
:00428D0B 8AC8                    mov cl, al
:00428D0D 83F902                  cmp ecx, 00000002
:00428D10 0F858A000000            jne 00428DA0
:00428D16 33C0                    xor eax, eax
:00428D18 8A45F0                  mov al, byte ptr [ebp-10]
:00428D1B 8BC8                    mov ecx, eax
:00428D1D 8D0440                  lea eax, dword ptr [eax+2*eax]
:00428D20 C1E003                  shl eax, 03
:00428D23 2BC1                    sub eax, ecx
:00428D25 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00428D2B E856510000              call 0042DE86
:00428D30 85C0                    test eax, eax
:00428D32 0F8468000000            je 00428DA0
:00428D38 33C0                    xor eax, eax
:00428D3A 8A45F0                  mov al, byte ptr [ebp-10]
:00428D3D 8BC8                    mov ecx, eax
:00428D3F 8D0440                  lea eax, dword ptr [eax+2*eax]
:00428D42 C1E003                  shl eax, 03
:00428D45 2BC1                    sub eax, ecx
:00428D47 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00428D4D E8CE04FEFF              call 00409220
:00428D52 33C9                    xor ecx, ecx
:00428D54 8A4D18                  mov cl, byte ptr [ebp+18]
:00428D57 3BC1                    cmp eax, ecx
:00428D59 0F850E000000            jne 00428D6D
:00428D5F 33C0                    xor eax, eax
:00428D61 8A4518                  mov al, byte ptr [ebp+18]
:00428D64 83F802                  cmp eax, 00000002
:00428D67 0F8533000000            jne 00428DA0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428D59(C)
|
:00428D6D 33C0                    xor eax, eax
:00428D6F 8A45F0                  mov al, byte ptr [ebp-10]
:00428D72 8BC8                    mov ecx, eax
:00428D74 8D0440                  lea eax, dword ptr [eax+2*eax]
:00428D77 C1E003                  shl eax, 03
:00428D7A 2BC1                    sub eax, ecx
:00428D7C 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00428D82 E8A903FEFF              call 00409130
:00428D87 8945EC                  mov dword ptr [ebp-14], eax
:00428D8A 6A00                    push 00000000
:00428D8C 8B4520                  mov eax, dword ptr [ebp+20]
:00428D8F 50                      push eax
:00428D90 8B451C                  mov eax, dword ptr [ebp+1C]
:00428D93 50                      push eax
:00428D94 8B45EC                  mov eax, dword ptr [ebp-14]
:00428D97 50                      push eax
:00428D98 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00428D9B E86BFCFFFF              call 00428A0B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00428CE9(C), :00428D10(C), :00428D32(C), :00428D67(C)
|
:00428DA0 E90AFFFFFF              jmp 00428CAF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428CBE(C)
|
:00428DA5 E9E5FEFFFF              jmp 00428C8F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428C9E(C)
|
:00428DAA E900000000              jmp 00428DAF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428DAA(U)
|
:00428DAF 5F                      pop edi
:00428DB0 5E                      pop esi
:00428DB1 5B                      pop ebx
:00428DB2 C9                      leave
:00428DB3 C21C00                  ret 001C



* Referenced by a CALL at Address:
|:0043173F   
|
:00428DB6 55                      push ebp
:00428DB7 8BEC                    mov ebp, esp
:00428DB9 83EC04                  sub esp, 00000004
:00428DBC 53                      push ebx
:00428DBD 56                      push esi
:00428DBE 57                      push edi
:00428DBF 894DFC                  mov dword ptr [ebp-04], ecx
:00428DC2 8B4508                  mov eax, dword ptr [ebp+08]
:00428DC5 50                      push eax
:00428DC6 B998FC4600              mov ecx, 0046FC98
:00428DCB E8B0010000              call 00428F80
:00428DD0 E900000000              jmp 00428DD5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428DD0(U)
|
:00428DD5 5F                      pop edi
:00428DD6 5E                      pop esi
:00428DD7 5B                      pop ebx
:00428DD8 C9                      leave
:00428DD9 C20400                  ret 0004


:00428DDC CC                      int 03
:00428DDD CC                      int 03
:00428DDE CC                      int 03
:00428DDF CC                      int 03

* Referenced by a CALL at Addresses:
|:00427C65   , :0042BDF0   
|
:00428DE0 55                      push ebp
:00428DE1 8BEC                    mov ebp, esp
:00428DE3 83EC04                  sub esp, 00000004
:00428DE6 53                      push ebx
:00428DE7 56                      push esi
:00428DE8 57                      push edi
:00428DE9 894DFC                  mov dword ptr [ebp-04], ecx
:00428DEC 8A4508                  mov al, byte ptr [ebp+08]
:00428DEF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00428DF2 884101                  mov byte ptr [ecx+01], al
:00428DF5 E900000000              jmp 00428DFA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428DF5(U)
|
:00428DFA 5F                      pop edi
:00428DFB 5E                      pop esi
:00428DFC 5B                      pop ebx
:00428DFD C9                      leave
:00428DFE C20400                  ret 0004


:00428E01 CC                      int 03
:00428E02 CC                      int 03
:00428E03 CC                      int 03
:00428E04 CC                      int 03
:00428E05 CC                      int 03
:00428E06 CC                      int 03
:00428E07 CC                      int 03
:00428E08 CC                      int 03
:00428E09 CC                      int 03
:00428E0A CC                      int 03
:00428E0B CC                      int 03
:00428E0C CC                      int 03
:00428E0D CC                      int 03
:00428E0E CC                      int 03
:00428E0F CC                      int 03

* Referenced by a CALL at Address:
|:004285C5   
|
:00428E10 55                      push ebp
:00428E11 8BEC                    mov ebp, esp
:00428E13 83EC04                  sub esp, 00000004
:00428E16 53                      push ebx
:00428E17 56                      push esi
:00428E18 57                      push edi
:00428E19 894DFC                  mov dword ptr [ebp-04], ecx
:00428E1C 8B4508                  mov eax, dword ptr [ebp+08]
:00428E1F 8B00                    mov eax, dword ptr [eax]
:00428E21 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00428E24 8901                    mov dword ptr [ecx], eax
:00428E26 8B4508                  mov eax, dword ptr [ebp+08]
:00428E29 83C005                  add eax, 00000005
:00428E2C 50                      push eax
:00428E2D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00428E30 83C105                  add ecx, 00000005
:00428E33 E8588AFDFF              call 00401890
:00428E38 8B45FC                  mov eax, dword ptr [ebp-04]
:00428E3B C64007FF                mov [eax+07], FF
:00428E3F 8B45FC                  mov eax, dword ptr [ebp-04]
:00428E42 83C005                  add eax, 00000005
:00428E45 50                      push eax
:00428E46 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00428E49 83C108                  add ecx, 00000008
:00428E4C E83F8AFDFF              call 00401890
:00428E51 8B4508                  mov eax, dword ptr [ebp+08]
:00428E54 8A400B                  mov al, byte ptr [eax+0B]
:00428E57 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00428E5A 88410B                  mov byte ptr [ecx+0B], al
:00428E5D 8B4508                  mov eax, dword ptr [ebp+08]
:00428E60 8A400C                  mov al, byte ptr [eax+0C]
:00428E63 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00428E66 88410C                  mov byte ptr [ecx+0C], al
:00428E69 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00428E6C E8AF03FEFF              call 00409220
:00428E71 85C0                    test eax, eax
:00428E73 0F842E000000            je 00428EA7
:00428E79 8B45FC                  mov eax, dword ptr [ebp-04]
:00428E7C 8B00                    mov eax, dword ptr [eax]
:00428E7E 8D0440                  lea eax, dword ptr [eax+2*eax]
:00428E81 03C0                    add eax, eax
:00428E83 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:00428E8A E8C17FFEFF              call 00410E50
:00428E8F 33C9                    xor ecx, ecx
:00428E91 8AC8                    mov cl, al
:00428E93 85C9                    test ecx, ecx
:00428E95 0F850C000000            jne 00428EA7
:00428E9B 8B45FC                  mov eax, dword ptr [ebp-04]
:00428E9E C6400D07                mov [eax+0D], 07
:00428EA2 E907000000              jmp 00428EAE

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00428E73(C), :00428E95(C)
|
:00428EA7 8B45FC                  mov eax, dword ptr [ebp-04]
:00428EAA C6400D03                mov [eax+0D], 03

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428EA2(U)
|
:00428EAE 8B4508                  mov eax, dword ptr [ebp+08]
:00428EB1 8A400A                  mov al, byte ptr [eax+0A]
:00428EB4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00428EB7 88410A                  mov byte ptr [ecx+0A], al
:00428EBA 8B4508                  mov eax, dword ptr [ebp+08]
:00428EBD 8A400E                  mov al, byte ptr [eax+0E]
:00428EC0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00428EC3 88410E                  mov byte ptr [ecx+0E], al
:00428EC6 8B4508                  mov eax, dword ptr [ebp+08]
:00428EC9 8B400F                  mov eax, dword ptr [eax+0F]
:00428ECC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00428ECF 89410F                  mov dword ptr [ecx+0F], eax
:00428ED2 8B4508                  mov eax, dword ptr [ebp+08]
:00428ED5 8A4013                  mov al, byte ptr [eax+13]
:00428ED8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00428EDB 884113                  mov byte ptr [ecx+13], al
:00428EDE 8B4508                  mov eax, dword ptr [ebp+08]
:00428EE1 8A4014                  mov al, byte ptr [eax+14]
:00428EE4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00428EE7 884114                  mov byte ptr [ecx+14], al
:00428EEA 8B4508                  mov eax, dword ptr [ebp+08]
:00428EED 8A4015                  mov al, byte ptr [eax+15]
:00428EF0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00428EF3 884115                  mov byte ptr [ecx+15], al
:00428EF6 8B4508                  mov eax, dword ptr [ebp+08]
:00428EF9 8A4016                  mov al, byte ptr [eax+16]
:00428EFC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00428EFF 884116                  mov byte ptr [ecx+16], al
:00428F02 8B45FC                  mov eax, dword ptr [ebp-04]
:00428F05 E900000000              jmp 00428F0A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428F05(U)
|
:00428F0A 5F                      pop edi
:00428F0B 5E                      pop esi
:00428F0C 5B                      pop ebx
:00428F0D C9                      leave
:00428F0E C20400                  ret 0004


:00428F11 CC                      int 03
:00428F12 CC                      int 03
:00428F13 CC                      int 03
:00428F14 CC                      int 03
:00428F15 CC                      int 03
:00428F16 CC                      int 03
:00428F17 CC                      int 03
:00428F18 CC                      int 03
:00428F19 CC                      int 03
:00428F1A CC                      int 03
:00428F1B CC                      int 03
:00428F1C CC                      int 03
:00428F1D CC                      int 03
:00428F1E CC                      int 03
:00428F1F CC                      int 03

* Referenced by a CALL at Addresses:
|:004285CF   , :0042B1FD   , :0042B401   , :0042B993   , :0042BAA3   
|:0042BEB0   , :0044384F   , :004438CE   
|
:00428F20 55                      push ebp
:00428F21 8BEC                    mov ebp, esp
:00428F23 83EC04                  sub esp, 00000004
:00428F26 53                      push ebx
:00428F27 56                      push esi
:00428F28 57                      push edi
:00428F29 894DFC                  mov dword ptr [ebp-04], ecx
:00428F2C 8A4508                  mov al, byte ptr [ebp+08]
:00428F2F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00428F32 88410B                  mov byte ptr [ecx+0B], al
:00428F35 E900000000              jmp 00428F3A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428F35(U)
|
:00428F3A 5F                      pop edi
:00428F3B 5E                      pop esi
:00428F3C 5B                      pop ebx
:00428F3D C9                      leave
:00428F3E C20400                  ret 0004


:00428F41 CC                      int 03
:00428F42 CC                      int 03
:00428F43 CC                      int 03
:00428F44 CC                      int 03
:00428F45 CC                      int 03
:00428F46 CC                      int 03
:00428F47 CC                      int 03
:00428F48 CC                      int 03
:00428F49 CC                      int 03
:00428F4A CC                      int 03
:00428F4B CC                      int 03
:00428F4C CC                      int 03
:00428F4D CC                      int 03
:00428F4E CC                      int 03
:00428F4F CC                      int 03

* Referenced by a CALL at Addresses:
|:0042870A   , :0042BB4B   
|
:00428F50 55                      push ebp
:00428F51 8BEC                    mov ebp, esp
:00428F53 83EC04                  sub esp, 00000004
:00428F56 53                      push ebx
:00428F57 56                      push esi
:00428F58 57                      push edi
:00428F59 894DFC                  mov dword ptr [ebp-04], ecx
:00428F5C 8A4508                  mov al, byte ptr [ebp+08]
:00428F5F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00428F62 884107                  mov byte ptr [ecx+07], al
:00428F65 E900000000              jmp 00428F6A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428F65(U)
|
:00428F6A 5F                      pop edi
:00428F6B 5E                      pop esi
:00428F6C 5B                      pop ebx
:00428F6D C9                      leave
:00428F6E C20400                  ret 0004


:00428F71 CC                      int 03
:00428F72 CC                      int 03
:00428F73 CC                      int 03
:00428F74 CC                      int 03
:00428F75 CC                      int 03
:00428F76 CC                      int 03
:00428F77 CC                      int 03
:00428F78 CC                      int 03
:00428F79 CC                      int 03
:00428F7A CC                      int 03
:00428F7B CC                      int 03
:00428F7C CC                      int 03
:00428F7D CC                      int 03
:00428F7E CC                      int 03
:00428F7F CC                      int 03

* Referenced by a CALL at Address:
|:00428DCB   
|
:00428F80 55                      push ebp
:00428F81 8BEC                    mov ebp, esp
:00428F83 83EC04                  sub esp, 00000004
:00428F86 53                      push ebx
:00428F87 56                      push esi
:00428F88 57                      push edi
:00428F89 894DFC                  mov dword ptr [ebp-04], ecx
:00428F8C 8A4508                  mov al, byte ptr [ebp+08]
:00428F8F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00428F92 884124                  mov byte ptr [ecx+24], al
:00428F95 E900000000              jmp 00428F9A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428F95(U)
|
:00428F9A 5F                      pop edi
:00428F9B 5E                      pop esi
:00428F9C 5B                      pop ebx
:00428F9D C9                      leave
:00428F9E C20400                  ret 0004


:00428FA1 CC                      int 03
:00428FA2 CC                      int 03
:00428FA3 CC                      int 03
:00428FA4 CC                      int 03
:00428FA5 CC                      int 03
:00428FA6 CC                      int 03
:00428FA7 CC                      int 03
:00428FA8 CC                      int 03
:00428FA9 CC                      int 03
:00428FAA CC                      int 03
:00428FAB CC                      int 03
:00428FAC CC                      int 03
:00428FAD CC                      int 03
:00428FAE CC                      int 03
:00428FAF CC                      int 03
:00428FB0 55                      push ebp
:00428FB1 8BEC                    mov ebp, esp
:00428FB3 53                      push ebx
:00428FB4 56                      push esi
:00428FB5 57                      push edi
:00428FB6 E80F000000              call 00428FCA
:00428FBB E832000000              call 00428FF2
:00428FC0 E900000000              jmp 00428FC5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428FC0(U)
|
:00428FC5 5F                      pop edi
:00428FC6 5E                      pop esi
:00428FC7 5B                      pop ebx
:00428FC8 C9                      leave
:00428FC9 C3                      ret



* Referenced by a CALL at Address:
|:00428FB6   
|
:00428FCA 55                      push ebp
:00428FCB 8BEC                    mov ebp, esp
:00428FCD 53                      push ebx
:00428FCE 56                      push esi
:00428FCF 57                      push edi
:00428FD0 6840DF4200              push 0042DF40
:00428FD5 6800DF4200              push 0042DF00
:00428FDA 6A2D                    push 0000002D
:00428FDC 6A17                    push 00000017
:00428FDE 6898C04600              push 0046C098
:00428FE3 E858ED0100              call 00447D40
:00428FE8 E900000000              jmp 00428FED

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428FE8(U)
|
:00428FED 5F                      pop edi
:00428FEE 5E                      pop esi
:00428FEF 5B                      pop ebx
:00428FF0 C9                      leave
:00428FF1 C3                      ret



* Referenced by a CALL at Address:
|:00428FBB   
|
:00428FF2 55                      push ebp
:00428FF3 8BEC                    mov ebp, esp
:00428FF5 53                      push ebx
:00428FF6 56                      push esi
:00428FF7 57                      push edi
:00428FF8 680F904200              push 0042900F
:00428FFD E8DEEC0100              call 00447CE0
:00429002 83C404                  add esp, 00000004
:00429005 E900000000              jmp 0042900A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429005(U)
|
:0042900A 5F                      pop edi
:0042900B 5E                      pop esi
:0042900C 5B                      pop ebx
:0042900D C9                      leave
:0042900E C3                      ret


:0042900F 55                      push ebp
:00429010 8BEC                    mov ebp, esp
:00429012 53                      push ebx
:00429013 56                      push esi
:00429014 57                      push edi
:00429015 6840DF4200              push 0042DF40
:0042901A 6A2D                    push 0000002D
:0042901C 6A17                    push 00000017
:0042901E 6898C04600              push 0046C098
:00429023 E8A8ED0100              call 00447DD0
:00429028 E900000000              jmp 0042902D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429028(U)
|
:0042902D 5F                      pop edi
:0042902E 5E                      pop esi
:0042902F 5B                      pop ebx
:00429030 C9                      leave
:00429031 C3                      ret


:00429032 55                      push ebp
:00429033 8BEC                    mov ebp, esp
:00429035 53                      push ebx
:00429036 56                      push esi
:00429037 57                      push edi
:00429038 E80A000000              call 00429047
:0042903D E900000000              jmp 00429042

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042903D(U)
|
:00429042 5F                      pop edi
:00429043 5E                      pop esi
:00429044 5B                      pop ebx
:00429045 C9                      leave
:00429046 C3                      ret



* Referenced by a CALL at Address:
|:00429038   
|
:00429047 55                      push ebp
:00429048 8BEC                    mov ebp, esp
:0042904A 53                      push ebx
:0042904B 56                      push esi
:0042904C 57                      push edi
:0042904D B9A4C44600              mov ecx, 0046C4A4
:00429052 E81988FDFF              call 00401870
:00429057 E900000000              jmp 0042905C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429057(U)
|
:0042905C 5F                      pop edi
:0042905D 5E                      pop esi
:0042905E 5B                      pop ebx
:0042905F C9                      leave
:00429060 C3                      ret



* Referenced by a CALL at Addresses:
|:0040866B   , :00428A2D   , :0042A4C6   , :0043EF99   
|
:00429061 55                      push ebp
:00429062 8BEC                    mov ebp, esp
:00429064 83EC04                  sub esp, 00000004
:00429067 53                      push ebx
:00429068 56                      push esi
:00429069 57                      push edi
:0042906A C745FC00000000          mov [ebp-04], 00000000
:00429071 E903000000              jmp 00429079

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004290AC(U)
|
:00429076 FF45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429071(U)
|
:00429079 837DFC2D                cmp dword ptr [ebp-04], 0000002D
:0042907D 0F832E000000            jnb 004290B1
:00429083 8B45FC                  mov eax, dword ptr [ebp-04]
:00429086 8BC8                    mov ecx, eax
:00429088 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042908B C1E003                  shl eax, 03
:0042908E 2BC1                    sub eax, ecx
:00429090 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00429096 E89500FEFF              call 00409130
:0042909B 3B4508                  cmp eax, dword ptr [ebp+08]
:0042909E 0F8508000000            jne 004290AC
:004290A4 8A45FC                  mov al, byte ptr [ebp-04]
:004290A7 E90C000000              jmp 004290B8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042909E(C)
|
:004290AC E9C5FFFFFF              jmp 00429076

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042907D(C)
|
:004290B1 B0FF                    mov al, FF
:004290B3 E900000000              jmp 004290B8

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004290A7(U), :004290B3(U)
|
:004290B8 5F                      pop edi
:004290B9 5E                      pop esi
:004290BA 5B                      pop ebx
:004290BB C9                      leave
:004290BC C3                      ret



* Referenced by a CALL at Addresses:
|:0042924A   , :0043F3C4   
|
:004290BD 55                      push ebp
:004290BE 8BEC                    mov ebp, esp
:004290C0 83EC08                  sub esp, 00000008
:004290C3 53                      push ebx
:004290C4 56                      push esi
:004290C5 57                      push edi
:004290C6 8B4508                  mov eax, dword ptr [ebp+08]
:004290C9 8945F8                  mov dword ptr [ebp-08], eax
:004290CC E94D000000              jmp 0042911E
:004290D1 C645FC48                mov [ebp-04], 48
:004290D5 E93A010000              jmp 00429214
:004290DA C645FC49                mov [ebp-04], 49
:004290DE E931010000              jmp 00429214
:004290E3 C645FC4A                mov [ebp-04], 4A
:004290E7 E928010000              jmp 00429214
:004290EC C645FC4B                mov [ebp-04], 4B
:004290F0 E91F010000              jmp 00429214
:004290F5 C645FC4C                mov [ebp-04], 4C
:004290F9 E916010000              jmp 00429214
:004290FE C645FC4D                mov [ebp-04], 4D
:00429102 E90D010000              jmp 00429214
:00429107 C645FC4E                mov [ebp-04], 4E
:0042910B E904010000              jmp 00429214

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429125(C)
|
:00429110 C645FCFF                mov [ebp-04], FF
:00429114 E9FB000000              jmp 00429214
:00429119 E9F6000000              jmp 00429214

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004290CC(U)
|
:0042911E 817DF8B6000000          cmp dword ptr [ebp-08], 000000B6
:00429125 0F87E5FFFFFF            ja 00429110
:0042912B 8B45F8                  mov eax, dword ptr [ebp-08]
:0042912E 33C9                    xor ecx, ecx
:00429130 8A885D914200            mov cl, byte ptr [eax+0042915D]
:00429136 FF248D3D914200          jmp dword ptr [4*ecx+0042913D]

:0042913D D1904200                DWORD 004290D1
:00429141 DA904200                DWORD 004290DA
:00429145 E3904200                DWORD 004290E3
:00429149 EC904200                DWORD 004290EC
:0042914D F5904200                DWORD 004290F5
:00429151 FE904200                DWORD 004290FE
:00429155 07914200                DWORD 00429107
:00429159 10914200                DWORD 00429110


:0042915D 0007                    add byte ptr [edi], al
:0042915F 07                      pop es
:00429160 07                      pop es
:00429161 0107                    add dword ptr [edi], eax
:00429163 0207                    add al, byte ptr [edi]
:00429165 07                      pop es
:00429166 07                      pop es
:00429167 07                      pop es
:00429168 07                      pop es
:00429169 07                      pop es
:0042916A 07                      pop es
:0042916B 07                      pop es
:0042916C 07                      pop es
:0042916D 07                      pop es
:0042916E 07                      pop es
:0042916F 07                      pop es
:00429170 07                      pop es
:00429171 07                      pop es
:00429172 07                      pop es
:00429173 07                      pop es
:00429174 07                      pop es
:00429175 07                      pop es
:00429176 07                      pop es
:00429177 07                      pop es
:00429178 07                      pop es
:00429179 07                      pop es
:0042917A 07                      pop es
:0042917B 07                      pop es
:0042917C 07                      pop es
:0042917D 07                      pop es
:0042917E 07                      pop es
:0042917F 07                      pop es
:00429180 07                      pop es
:00429181 07                      pop es
:00429182 07                      pop es
:00429183 07                      pop es
:00429184 07                      pop es
:00429185 07                      pop es
:00429186 07                      pop es
:00429187 07                      pop es
:00429188 07                      pop es
:00429189 07                      pop es
:0042918A 07                      pop es
:0042918B 07                      pop es
:0042918C 07                      pop es
:0042918D 07                      pop es
:0042918E 07                      pop es
:0042918F 07                      pop es
:00429190 07                      pop es
:00429191 07                      pop es
:00429192 07                      pop es
:00429193 07                      pop es
:00429194 07                      pop es
:00429195 07                      pop es
:00429196 07                      pop es
:00429197 07                      pop es
:00429198 07                      pop es
:00429199 07                      pop es
:0042919A 07                      pop es
:0042919B 07                      pop es
:0042919C 07                      pop es
:0042919D 07                      pop es
:0042919E 0307                    add eax, dword ptr [edi]
:004291A0 07                      pop es
:004291A1 07                      pop es
:004291A2 07                      pop es
:004291A3 07                      pop es
:004291A4 07                      pop es
:004291A5 07                      pop es
:004291A6 07                      pop es
:004291A7 07                      pop es
:004291A8 07                      pop es
:004291A9 07                      pop es
:004291AA 07                      pop es
:004291AB 07                      pop es
:004291AC 07                      pop es
:004291AD 07                      pop es
:004291AE 07                      pop es
:004291AF 07                      pop es
:004291B0 07                      pop es
:004291B1 07                      pop es
:004291B2 07                      pop es
:004291B3 07                      pop es
:004291B4 07                      pop es
:004291B5 07                      pop es
:004291B6 07                      pop es
:004291B7 07                      pop es
:004291B8 07                      pop es
:004291B9 07                      pop es
:004291BA 07                      pop es
:004291BB 07                      pop es
:004291BC 07                      pop es
:004291BD 0407                    add al, 07
:004291BF 07                      pop es
:004291C0 07                      pop es
:004291C1 07                      pop es
:004291C2 07                      pop es
:004291C3 07                      pop es
:004291C4 07                      pop es
:004291C5 07                      pop es
:004291C6 07                      pop es
:004291C7 07                      pop es
:004291C8 07                      pop es
:004291C9 07                      pop es
:004291CA 07                      pop es
:004291CB 07                      pop es
:004291CC 07                      pop es
:004291CD 07                      pop es
:004291CE 07                      pop es
:004291CF 07                      pop es
:004291D0 07                      pop es
:004291D1 07                      pop es
:004291D2 07                      pop es
:004291D3 07                      pop es
:004291D4 07                      pop es
:004291D5 07                      pop es
:004291D6 07                      pop es
:004291D7 07                      pop es
:004291D8 07                      pop es
:004291D9 07                      pop es
:004291DA 07                      pop es
:004291DB 07                      pop es
:004291DC 07                      pop es
:004291DD 07                      pop es
:004291DE 07                      pop es
:004291DF 07                      pop es
:004291E0 07                      pop es
:004291E1 07                      pop es
:004291E2 07                      pop es
:004291E3 07                      pop es
:004291E4 07                      pop es
:004291E5 07                      pop es
:004291E6 07                      pop es
:004291E7 07                      pop es
:004291E8 07                      pop es
:004291E9 07                      pop es
:004291EA 07                      pop es
:004291EB 07                      pop es
:004291EC 07                      pop es
:004291ED 07                      pop es
:004291EE 07                      pop es
:004291EF 07                      pop es
:004291F0 07                      pop es
:004291F1 07                      pop es
:004291F2 07                      pop es
:004291F3 07                      pop es
:004291F4 07                      pop es
:004291F5 07                      pop es
:004291F6 07                      pop es
:004291F7 07                      pop es
:004291F8 0507070707              add eax, 07070707
:004291FD 07                      pop es
:004291FE 07                      pop es
:004291FF 07                      pop es
:00429200 07                      pop es
:00429201 07                      pop es
:00429202 07                      pop es
:00429203 07                      pop es
:00429204 07                      pop es
:00429205 07                      pop es
:00429206 07                      pop es
:00429207 07                      pop es
:00429208 07                      pop es
:00429209 07                      pop es
:0042920A 07                      pop es
:0042920B 07                      pop es
:0042920C 07                      pop es
:0042920D 07                      pop es
:0042920E 07                      pop es
:0042920F 07                      pop es
:00429210 07                      pop es
:00429211 07                      pop es
:00429212 07                      pop es
:00429213 06                      push es

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004290D5(U), :004290DE(U), :004290E7(U), :004290F0(U), :004290F9(U)
|:00429102(U), :0042910B(U), :00429114(U), :00429119(U)
|
:00429214 8A45FC                  mov al, byte ptr [ebp-04]
:00429217 E900000000              jmp 0042921C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429217(U)
|
:0042921C 5F                      pop edi
:0042921D 5E                      pop esi
:0042921E 5B                      pop ebx
:0042921F C9                      leave
:00429220 C3                      ret



* Referenced by a CALL at Addresses:
|:00422397   , :004234FC   , :004236CB   , :0042B46F   , :0042B60D   
|:0043F3FC   
|
:00429221 55                      push ebp
:00429222 8BEC                    mov ebp, esp
:00429224 83EC08                  sub esp, 00000008
:00429227 53                      push ebx
:00429228 56                      push esi
:00429229 57                      push edi
:0042922A 33C0                    xor eax, eax
:0042922C 8A4508                  mov al, byte ptr [ebp+08]
:0042922F 8BC8                    mov ecx, eax
:00429231 8D0440                  lea eax, dword ptr [eax+2*eax]
:00429234 C1E003                  shl eax, 03
:00429237 2BC1                    sub eax, ecx
:00429239 0598C04600              add eax, 0046C098
:0042923E 8945FC                  mov dword ptr [ebp-04], eax
:00429241 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00429244 E8E7FEFDFF              call 00409130
:00429249 50                      push eax
:0042924A E86EFEFFFF              call 004290BD
:0042924F 83C404                  add esp, 00000004
:00429252 8845F8                  mov byte ptr [ebp-08], al
:00429255 33C0                    xor eax, eax
:00429257 8A45F8                  mov al, byte ptr [ebp-08]
:0042925A 3DFF000000              cmp eax, 000000FF
:0042925F 0F854D000000            jne 004292B2
:00429265 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00429268 E83300FEFF              call 004092A0
:0042926D 33C9                    xor ecx, ecx
:0042926F 8AC8                    mov cl, al
:00429271 83F920                  cmp ecx, 00000020
:00429274 0F8D26000000            jnl 004292A0
:0042927A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042927D E81E00FEFF              call 004092A0
:00429282 33DB                    xor ebx, ebx
:00429284 8AD8                    mov bl, al
:00429286 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00429289 E892FFFDFF              call 00409220
:0042928E 83F801                  cmp eax, 00000001
:00429291 1BC0                    sbb eax, eax
:00429293 F7D8                    neg eax
:00429295 8D1C58                  lea ebx, dword ptr [eax+2*ebx]
:00429298 885DF8                  mov byte ptr [ebp-08], bl
:0042929B E912000000              jmp 004292B2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429274(C)
|
:004292A0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004292A3 E8F8FFFDFF              call 004092A0
:004292A8 33C9                    xor ecx, ecx
:004292AA 8AC8                    mov cl, al
:004292AC 83C120                  add ecx, 00000020
:004292AF 884DF8                  mov byte ptr [ebp-08], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042925F(C), :0042929B(U)
|
:004292B2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004292B5 E8CC4B0000              call 0042DE86
:004292BA 85C0                    test eax, eax
:004292BC 0F8512000000            jne 004292D4
:004292C2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004292C5 E8D6FFFDFF              call 004092A0
:004292CA 33C9                    xor ecx, ecx
:004292CC 8AC8                    mov cl, al
:004292CE 83C127                  add ecx, 00000027
:004292D1 884DF8                  mov byte ptr [ebp-08], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004292BC(C)
|
:004292D4 8A45F8                  mov al, byte ptr [ebp-08]
:004292D7 E900000000              jmp 004292DC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004292D7(U)
|
:004292DC 5F                      pop edi
:004292DD 5E                      pop esi
:004292DE 5B                      pop ebx
:004292DF C9                      leave
:004292E0 C3                      ret



* Referenced by a CALL at Addresses:
|:004241E7   , :0042420E   
|
:004292E1 55                      push ebp
:004292E2 8BEC                    mov ebp, esp
:004292E4 83EC0C                  sub esp, 0000000C
:004292E7 53                      push ebx
:004292E8 56                      push esi
:004292E9 57                      push edi
:004292EA 8B4D08                  mov ecx, dword ptr [ebp+08]
:004292ED E83EFEFDFF              call 00409130
:004292F2 8945F8                  mov dword ptr [ebp-08], eax
:004292F5 8B45F8                  mov eax, dword ptr [ebp-08]
:004292F8 8945F4                  mov dword ptr [ebp-0C], eax
:004292FB E94F000000              jmp 0042934F
:00429300 C645FC28                mov [ebp-04], 28
:00429304 E93C010000              jmp 00429445
:00429309 C645FC29                mov [ebp-04], 29
:0042930D E933010000              jmp 00429445
:00429312 C645FC2A                mov [ebp-04], 2A
:00429316 E92A010000              jmp 00429445
:0042931B C645FC2B                mov [ebp-04], 2B
:0042931F E921010000              jmp 00429445
:00429324 C645FC2C                mov [ebp-04], 2C
:00429328 E918010000              jmp 00429445
:0042932D C645FC2D                mov [ebp-04], 2D
:00429331 E90F010000              jmp 00429445
:00429336 C645FC2E                mov [ebp-04], 2E
:0042933A E906010000              jmp 00429445

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429356(C)
|
:0042933F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00429342 E859FFFDFF              call 004092A0
:00429347 8845FC                  mov byte ptr [ebp-04], al
:0042934A E9F6000000              jmp 00429445

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004292FB(U)
|
:0042934F 817DF4B6000000          cmp dword ptr [ebp-0C], 000000B6
:00429356 0F87E3FFFFFF            ja 0042933F
:0042935C 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042935F 33C9                    xor ecx, ecx
:00429361 8A888E934200            mov cl, byte ptr [eax+0042938E]
:00429367 FF248D6E934200          jmp dword ptr [4*ecx+0042936E]

:0042936E 00934200                DWORD 00429300
:00429372 09934200                DWORD 00429309
:00429376 12934200                DWORD 00429312
:0042937A 1B934200                DWORD 0042931B
:0042937E 24934200                DWORD 00429324
:00429382 2D934200                DWORD 0042932D
:00429386 36934200                DWORD 00429336
:0042938A 3F934200                DWORD 0042933F


:0042938E 0007                    add byte ptr [edi], al
:00429390 07                      pop es
:00429391 07                      pop es
:00429392 0107                    add dword ptr [edi], eax
:00429394 0207                    add al, byte ptr [edi]
:00429396 07                      pop es
:00429397 07                      pop es
:00429398 07                      pop es
:00429399 07                      pop es
:0042939A 07                      pop es
:0042939B 07                      pop es
:0042939C 07                      pop es
:0042939D 07                      pop es
:0042939E 07                      pop es
:0042939F 07                      pop es
:004293A0 07                      pop es
:004293A1 07                      pop es
:004293A2 07                      pop es
:004293A3 07                      pop es
:004293A4 07                      pop es
:004293A5 07                      pop es
:004293A6 07                      pop es
:004293A7 07                      pop es
:004293A8 07                      pop es
:004293A9 07                      pop es
:004293AA 07                      pop es
:004293AB 07                      pop es
:004293AC 07                      pop es
:004293AD 07                      pop es
:004293AE 07                      pop es
:004293AF 07                      pop es
:004293B0 07                      pop es
:004293B1 07                      pop es
:004293B2 07                      pop es
:004293B3 07                      pop es
:004293B4 07                      pop es
:004293B5 07                      pop es
:004293B6 07                      pop es
:004293B7 07                      pop es
:004293B8 07                      pop es
:004293B9 07                      pop es
:004293BA 07                      pop es
:004293BB 07                      pop es
:004293BC 07                      pop es
:004293BD 07                      pop es
:004293BE 07                      pop es
:004293BF 07                      pop es
:004293C0 07                      pop es
:004293C1 07                      pop es
:004293C2 07                      pop es
:004293C3 07                      pop es
:004293C4 07                      pop es
:004293C5 07                      pop es
:004293C6 07                      pop es
:004293C7 07                      pop es
:004293C8 07                      pop es
:004293C9 07                      pop es
:004293CA 07                      pop es
:004293CB 07                      pop es
:004293CC 07                      pop es
:004293CD 07                      pop es
:004293CE 07                      pop es
:004293CF 0307                    add eax, dword ptr [edi]
:004293D1 07                      pop es
:004293D2 07                      pop es
:004293D3 07                      pop es
:004293D4 07                      pop es
:004293D5 07                      pop es
:004293D6 07                      pop es
:004293D7 07                      pop es
:004293D8 07                      pop es
:004293D9 07                      pop es
:004293DA 07                      pop es
:004293DB 07                      pop es
:004293DC 07                      pop es
:004293DD 07                      pop es
:004293DE 07                      pop es
:004293DF 07                      pop es
:004293E0 07                      pop es
:004293E1 07                      pop es
:004293E2 07                      pop es
:004293E3 07                      pop es
:004293E4 07                      pop es
:004293E5 07                      pop es
:004293E6 07                      pop es
:004293E7 07                      pop es
:004293E8 07                      pop es
:004293E9 07                      pop es
:004293EA 07                      pop es
:004293EB 07                      pop es
:004293EC 07                      pop es
:004293ED 07                      pop es
:004293EE 0407                    add al, 07
:004293F0 07                      pop es
:004293F1 07                      pop es
:004293F2 07                      pop es
:004293F3 07                      pop es
:004293F4 07                      pop es
:004293F5 07                      pop es
:004293F6 07                      pop es
:004293F7 07                      pop es
:004293F8 07                      pop es
:004293F9 07                      pop es
:004293FA 07                      pop es
:004293FB 07                      pop es
:004293FC 07                      pop es
:004293FD 07                      pop es
:004293FE 07                      pop es
:004293FF 07                      pop es
:00429400 07                      pop es
:00429401 07                      pop es
:00429402 07                      pop es
:00429403 07                      pop es
:00429404 07                      pop es
:00429405 07                      pop es
:00429406 07                      pop es
:00429407 07                      pop es
:00429408 07                      pop es
:00429409 07                      pop es
:0042940A 07                      pop es
:0042940B 07                      pop es
:0042940C 07                      pop es
:0042940D 07                      pop es
:0042940E 07                      pop es
:0042940F 07                      pop es
:00429410 07                      pop es
:00429411 07                      pop es
:00429412 07                      pop es
:00429413 07                      pop es
:00429414 07                      pop es
:00429415 07                      pop es
:00429416 07                      pop es
:00429417 07                      pop es
:00429418 07                      pop es
:00429419 07                      pop es
:0042941A 07                      pop es
:0042941B 07                      pop es
:0042941C 07                      pop es
:0042941D 07                      pop es
:0042941E 07                      pop es
:0042941F 07                      pop es
:00429420 07                      pop es
:00429421 07                      pop es
:00429422 07                      pop es
:00429423 07                      pop es
:00429424 07                      pop es
:00429425 07                      pop es
:00429426 07                      pop es
:00429427 07                      pop es
:00429428 07                      pop es
:00429429 0507070707              add eax, 07070707
:0042942E 07                      pop es
:0042942F 07                      pop es
:00429430 07                      pop es
:00429431 07                      pop es
:00429432 07                      pop es
:00429433 07                      pop es
:00429434 07                      pop es
:00429435 07                      pop es
:00429436 07                      pop es
:00429437 07                      pop es
:00429438 07                      pop es
:00429439 07                      pop es
:0042943A 07                      pop es
:0042943B 07                      pop es
:0042943C 07                      pop es
:0042943D 07                      pop es
:0042943E 07                      pop es
:0042943F 07                      pop es
:00429440 07                      pop es
:00429441 07                      pop es
:00429442 07                      pop es
:00429443 07                      pop es
:00429444 06                      push es

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00429304(U), :0042930D(U), :00429316(U), :0042931F(U), :00429328(U)
|:00429331(U), :0042933A(U), :0042934A(U)
|
:00429445 8A45FC                  mov al, byte ptr [ebp-04]
:00429448 E900000000              jmp 0042944D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429448(U)
|
:0042944D 5F                      pop edi
:0042944E 5E                      pop esi
:0042944F 5B                      pop ebx
:00429450 C9                      leave
:00429451 C3                      ret



* Referenced by a CALL at Address:
|:004295FA   
|
:00429452 55                      push ebp
:00429453 8BEC                    mov ebp, esp
:00429455 83EC14                  sub esp, 00000014
:00429458 53                      push ebx
:00429459 56                      push esi
:0042945A 57                      push edi
:0042945B 8B4508                  mov eax, dword ptr [ebp+08]
:0042945E C60000                  mov byte ptr [eax], 00

* Possible StringData Ref from Data Obj ->"("
                                  |
:00429461 68E81F4500              push 00451FE8
:00429466 8B4508                  mov eax, dword ptr [ebp+08]
:00429469 50                      push eax
:0042946A E85EDF0100              call 004473CD
:0042946F 83C408                  add esp, 00000008
:00429472 C645EC00                mov [ebp-14], 00
:00429476 8B450C                  mov eax, dword ptr [ebp+0C]
:00429479 33C9                    xor ecx, ecx
:0042947B 8A08                    mov cl, byte ptr [eax]
:0042947D 51                      push ecx
:0042947E 8D45EC                  lea eax, dword ptr [ebp-14]
:00429481 50                      push eax
:00429482 E863F60000              call 00438AEA
:00429487 83C408                  add esp, 00000008
:0042948A 8D45EC                  lea eax, dword ptr [ebp-14]
:0042948D 50                      push eax
:0042948E 8B4508                  mov eax, dword ptr [ebp+08]
:00429491 50                      push eax
:00429492 E859DF0100              call 004473F0
:00429497 83C408                  add esp, 00000008

* Possible StringData Ref from Data Obj ->","
                                  |
:0042949A 68EC1F4500              push 00451FEC
:0042949F 8B4508                  mov eax, dword ptr [ebp+08]
:004294A2 50                      push eax
:004294A3 E848DF0100              call 004473F0
:004294A8 83C408                  add esp, 00000008
:004294AB C645EC00                mov [ebp-14], 00
:004294AF 8B450C                  mov eax, dword ptr [ebp+0C]
:004294B2 33C9                    xor ecx, ecx
:004294B4 8A4801                  mov cl, byte ptr [eax+01]
:004294B7 51                      push ecx
:004294B8 8D45EC                  lea eax, dword ptr [ebp-14]
:004294BB 50                      push eax
:004294BC E829F60000              call 00438AEA
:004294C1 83C408                  add esp, 00000008
:004294C4 8D45EC                  lea eax, dword ptr [ebp-14]
:004294C7 50                      push eax
:004294C8 8B4508                  mov eax, dword ptr [ebp+08]
:004294CB 50                      push eax
:004294CC E81FDF0100              call 004473F0
:004294D1 83C408                  add esp, 00000008

* Possible StringData Ref from Data Obj ->")"
                                  |
:004294D4 68F01F4500              push 00451FF0
:004294D9 8B4508                  mov eax, dword ptr [ebp+08]
:004294DC 50                      push eax
:004294DD E80EDF0100              call 004473F0
:004294E2 83C408                  add esp, 00000008
:004294E5 E900000000              jmp 004294EA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004294E5(U)
|
:004294EA 5F                      pop edi
:004294EB 5E                      pop esi
:004294EC 5B                      pop ebx
:004294ED C9                      leave
:004294EE C3                      ret



* Referenced by a CALL at Address:
|:0043FB82   
|
:004294EF 55                      push ebp
:004294F0 8BEC                    mov ebp, esp
:004294F2 81EC88000000            sub esp, 00000088
:004294F8 53                      push ebx
:004294F9 56                      push esi
:004294FA 57                      push edi
:004294FB 898D78FFFFFF            mov dword ptr [ebp+FFFFFF78], ecx
:00429501 8B8D78FFFFFF            mov ecx, dword ptr [ebp+FFFFFF78]
:00429507 E8C4FEFDFF              call 004093D0
:0042950C 33C9                    xor ecx, ecx
:0042950E 8AC8                    mov cl, al
:00429510 83F907                  cmp ecx, 00000007
:00429513 0F8401020000            je 0042971A
:00429519 B968F94600              mov ecx, 0046F968
:0042951E E8BDFBFDFF              call 004090E0
:00429523 89857CFFFFFF            mov dword ptr [ebp+FFFFFF7C], eax
:00429529 8B857CFFFFFF            mov eax, dword ptr [ebp+FFFFFF7C]
:0042952F C60000                  mov byte ptr [eax], 00
:00429532 8B8D78FFFFFF            mov ecx, dword ptr [ebp+FFFFFF78]
:00429538 E893FEFDFF              call 004093D0
:0042953D 33C9                    xor ecx, ecx
:0042953F 8AC8                    mov cl, al
:00429541 83F901                  cmp ecx, 00000001
:00429544 0F84FA000000            je 00429644
:0042954A 8B8D78FFFFFF            mov ecx, dword ptr [ebp+FFFFFF78]
:00429550 E80B4A0000              call 0042DF60
:00429555 33C9                    xor ecx, ecx
:00429557 8AC8                    mov cl, al
:00429559 81F9FF000000            cmp ecx, 000000FF
:0042955F 0F8480000000            je 004295E5
:00429565 8B8578FFFFFF            mov eax, dword ptr [ebp+FFFFFF78]
:0042956B 33C9                    xor ecx, ecx
:0042956D 8A4807                  mov cl, byte ptr [eax+07]
:00429570 8BC1                    mov eax, ecx
:00429572 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:00429575 C1E103                  shl ecx, 03
:00429578 2BC8                    sub ecx, eax
:0042957A 8D8998C04600            lea ecx, dword ptr [ecx+0046C098]
:00429580 E8FBFFFDFF              call 00409580
:00429585 50                      push eax
:00429586 6A04                    push 00000004
:00429588 6A00                    push 00000000
:0042958A 6A00                    push 00000000
:0042958C B968F94600              mov ecx, 0046F968
:00429591 E88AE10100              call 00447720
:00429596 50                      push eax
:00429597 E831DE0100              call 004473CD
:0042959C 83C408                  add esp, 00000008

* Possible StringData Ref from Data Obj ->""
                                  |
:0042959F BBF41F4500              mov ebx, 00451FF4

* Possible StringData Ref from Data Obj ->""
                                  |
:004295A4 BEF81F4500              mov esi, 00451FF8
:004295A9 8B8D78FFFFFF            mov ecx, dword ptr [ebp+FFFFFF78]
:004295AF E81CFEFDFF              call 004093D0
:004295B4 33C9                    xor ecx, ecx
:004295B6 8AC8                    mov cl, al
:004295B8 33C0                    xor eax, eax
:004295BA 85C9                    test ecx, ecx
:004295BC 0F94C0                  sete al
:004295BF 48                      dec eax
:004295C0 2BF3                    sub esi, ebx
:004295C2 23C6                    and eax, esi
:004295C4 03C3                    add eax, ebx
:004295C6 50                      push eax
:004295C7 6A04                    push 00000004
:004295C9 6A00                    push 00000000
:004295CB 6A00                    push 00000000
:004295CD B968F94600              mov ecx, 0046F968
:004295D2 E849E10100              call 00447720
:004295D7 50                      push eax
:004295D8 E813DE0100              call 004473F0
:004295DD 83C408                  add esp, 00000008
:004295E0 E95F000000              jmp 00429644

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042955F(C)
|
:004295E5 8B8578FFFFFF            mov eax, dword ptr [ebp+FFFFFF78]
:004295EB 83C008                  add eax, 00000008
:004295EE 50                      push eax
:004295EF B968F94600              mov ecx, 0046F968
:004295F4 E8E7FAFDFF              call 004090E0
:004295F9 50                      push eax
:004295FA E853FEFFFF              call 00429452
:004295FF 83C408                  add esp, 00000008

* Possible StringData Ref from Data Obj ->""
                                  |
:00429602 BBFC1F4500              mov ebx, 00451FFC

* Possible StringData Ref from Data Obj ->""
                                  |
:00429607 BE00204500              mov esi, 00452000
:0042960C 8B8D78FFFFFF            mov ecx, dword ptr [ebp+FFFFFF78]
:00429612 E8B9FDFDFF              call 004093D0
:00429617 33C9                    xor ecx, ecx
:00429619 8AC8                    mov cl, al
:0042961B 33C0                    xor eax, eax
:0042961D 83F902                  cmp ecx, 00000002
:00429620 0F94C0                  sete al
:00429623 48                      dec eax
:00429624 2BF3                    sub esi, ebx
:00429626 23C6                    and eax, esi
:00429628 03C3                    add eax, ebx
:0042962A 50                      push eax
:0042962B 6A04                    push 00000004
:0042962D 6A00                    push 00000000
:0042962F 6A00                    push 00000000
:00429631 B968F94600              mov ecx, 0046F968
:00429636 E8E5E00100              call 00447720
:0042963B 50                      push eax
:0042963C E8AFDD0100              call 004473F0
:00429641 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00429544(C), :004295E0(U)
|
:00429644 8B8D78FFFFFF            mov ecx, dword ptr [ebp+FFFFFF78]
:0042964A E881FDFDFF              call 004093D0
:0042964F 33C9                    xor ecx, ecx
:00429651 8AC8                    mov cl, al
:00429653 83F907                  cmp ecx, 00000007
:00429656 0F8FAC000000            jg 00429708
:0042965C 8B8D78FFFFFF            mov ecx, dword ptr [ebp+FFFFFF78]
:00429662 E869FDFDFF              call 004093D0
:00429667 33C9                    xor ecx, ecx
:00429669 8AC8                    mov cl, al
:0042966B 8B048D781F4500          mov eax, dword ptr [4*ecx+00451F78]
:00429672 50                      push eax
:00429673 6A04                    push 00000004
:00429675 6A00                    push 00000000
:00429677 6A00                    push 00000000
:00429679 B968F94600              mov ecx, 0046F968
:0042967E E89DE00100              call 00447720
:00429683 50                      push eax
:00429684 E867DD0100              call 004473F0
:00429689 83C408                  add esp, 00000008
:0042968C 6A04                    push 00000004
:0042968E 8B8D78FFFFFF            mov ecx, dword ptr [ebp+FFFFFF78]
:00429694 E8C7FCFDFF              call 00409360
:00429699 85C0                    test eax, eax
:0042969B 0F841E000000            je 004296BF

* Possible StringData Ref from Data Obj ->"ţ"
                                  |
:004296A1 6804204500              push 00452004
:004296A6 6A04                    push 00000004
:004296A8 6A00                    push 00000000
:004296AA 6A00                    push 00000000
:004296AC B968F94600              mov ecx, 0046F968
:004296B1 E86AE00100              call 00447720
:004296B6 50                      push eax
:004296B7 E834DD0100              call 004473F0
:004296BC 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042969B(C)
|
:004296BF 6A04                    push 00000004
:004296C1 6A00                    push 00000000
:004296C3 6A00                    push 00000000
:004296C5 B968F94600              mov ecx, 0046F968
:004296CA E851E00100              call 00447720
:004296CF 50                      push eax
:004296D0 8D4580                  lea eax, dword ptr [ebp-80]
:004296D3 50                      push eax
:004296D4 E8F4DC0100              call 004473CD
:004296D9 83C408                  add esp, 00000008
:004296DC 6862010000              push 00000162
:004296E1 6A2C                    push 0000002C
:004296E3 B910BC4600              mov ecx, 0046BC10
:004296E8 E81A65FFFF              call 0041FC07
:004296ED 8D4580                  lea eax, dword ptr [ebp-80]
:004296F0 50                      push eax

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:004296F1 680C204500              push 0045200C
:004296F6 6810BC4600              push 0046BC10
:004296FB E82374FFFF              call 00420B23
:00429700 83C40C                  add esp, 0000000C
:00429703 E912000000              jmp 0042971A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429656(C)
|

* Possible StringData Ref from Data Obj ->"**߂OVERFLOW!!!**"
                                  |
:00429708 6810204500              push 00452010
:0042970D 6810BC4600              push 0046BC10
:00429712 E80C74FFFF              call 00420B23
:00429717 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00429513(C), :00429703(U)
|
:0042971A 6A0F                    push 0000000F
:0042971C B910BC4600              mov ecx, 0046BC10
:00429721 E8AD65FFFF              call 0041FCD3
:00429726 6862010000              push 00000162
:0042972B 6A1E                    push 0000001E
:0042972D B910BC4600              mov ecx, 0046BC10
:00429732 E8D064FFFF              call 0041FC07
:00429737 8B8578FFFFFF            mov eax, dword ptr [ebp+FFFFFF78]
:0042973D 8B00                    mov eax, dword ptr [eax]
:0042973F 50                      push eax

* Possible StringData Ref from Data Obj ->"bno=%3u"
                                  |
:00429740 6828204500              push 00452028
:00429745 6810BC4600              push 0046BC10
:0042974A E8D473FFFF              call 00420B23
:0042974F 83C40C                  add esp, 0000000C
:00429752 8B8578FFFFFF            mov eax, dword ptr [ebp+FFFFFF78]
:00429758 33C9                    xor ecx, ecx
:0042975A 8A4804                  mov cl, byte ptr [eax+04]
:0042975D 51                      push ecx

* Possible StringData Ref from Data Obj ->" ID=%2u"
                                  |
:0042975E 6830204500              push 00452030
:00429763 6810BC4600              push 0046BC10
:00429768 E8B673FFFF              call 00420B23
:0042976D 83C40C                  add esp, 0000000C
:00429770 6A04                    push 00000004
:00429772 B910BC4600              mov ecx, 0046BC10
:00429777 E80567FFFF              call 0041FE81
:0042977C 6A0E                    push 0000000E
:0042977E B910BC4600              mov ecx, 0046BC10
:00429783 E84B65FFFF              call 0041FCD3
:00429788 6890000000              push 00000090
:0042978D 6A2D                    push 0000002D
:0042978F B910BC4600              mov ecx, 0046BC10
:00429794 E86E64FFFF              call 0041FC07
:00429799 8B8D78FFFFFF            mov ecx, dword ptr [ebp+FFFFFF78]
:0042979F E890320000              call 0042CA34
:004297A4 8B0485A02C4500          mov eax, dword ptr [4*eax+00452CA0]
:004297AB 50                      push eax

* Possible StringData Ref from Data Obj ->"%sR"
                                  |
:004297AC 6838204500              push 00452038
:004297B1 6810BC4600              push 0046BC10
:004297B6 E86873FFFF              call 00420B23
:004297BB 83C40C                  add esp, 0000000C
:004297BE E900000000              jmp 004297C3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004297BE(U)
|
:004297C3 5F                      pop edi
:004297C4 5E                      pop esi
:004297C5 5B                      pop ebx
:004297C6 C9                      leave
:004297C7 C3                      ret



* Referenced by a CALL at Addresses:
|:0042BE16   , :0042BE2B   
|
:004297C8 55                      push ebp
:004297C9 8BEC                    mov ebp, esp
:004297CB 81EC10020000            sub esp, 00000210
:004297D1 53                      push ebx
:004297D2 56                      push esi
:004297D3 57                      push edi
:004297D4 C745F800000000          mov [ebp-08], 00000000
:004297DB 837D0801                cmp dword ptr [ebp+08], 00000001
:004297DF 0F8512000000            jne 004297F7
:004297E5 C7450800000000          mov [ebp+08], 00000000
:004297EC C6450C01                mov [ebp+0C], 01
:004297F0 C745F801000000          mov [ebp-08], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004297DF(C)
|
:004297F7 8D8DF4FDFFFF            lea ecx, dword ptr [ebp+FFFFFDF4]
:004297FD E86EFEFDFF              call 00409670

* Possible StringData Ref from Data Obj ->"B:HEXEFF.E2"
                                  |
:00429802 6848354500              push 00453548
:00429807 8D8DF4FDFFFF            lea ecx, dword ptr [ebp+FFFFFDF4]
:0042980D E8FDDCFFFF              call 0042750F
:00429812 B968F94600              mov ecx, 0046F968
:00429817 E8C4F8FDFF              call 004090E0
:0042981C 50                      push eax
:0042981D 6A03                    push 00000003
:0042981F 8D8DF4FDFFFF            lea ecx, dword ptr [ebp+FFFFFDF4]
:00429825 E857DEFFFF              call 00427681
:0042982A 8D8DF4FDFFFF            lea ecx, dword ptr [ebp+FFFFFDF4]
:00429830 E8EBFBFDFF              call 00409420
:00429835 B968F94600              mov ecx, 0046F968
:0042983A E8A1F8FDFF              call 004090E0
:0042983F 8985F0FDFFFF            mov dword ptr [ebp+FFFFFDF0], eax
:00429845 8D85F8FEFFFF            lea eax, dword ptr [ebp+FFFFFEF8]
:0042984B 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429900(U)
|
:0042984E 8B85F0FDFFFF            mov eax, dword ptr [ebp+FFFFFDF0]
:00429854 33C9                    xor ecx, ecx
:00429856 8A08                    mov cl, byte ptr [eax]
:00429858 81F9FF000000            cmp ecx, 000000FF
:0042985E 0F850A000000            jne 0042986E
:00429864 E99C000000              jmp 00429905
:00429869 E992000000              jmp 00429900

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042985E(C)
|
:0042986E 8B85F0FDFFFF            mov eax, dword ptr [ebp+FFFFFDF0]
:00429874 33C9                    xor ecx, ecx
:00429876 8A08                    mov cl, byte ptr [eax]
:00429878 3B4D08                  cmp ecx, dword ptr [ebp+08]
:0042987B 0F8554000000            jne 004298D5
:00429881 FF85F0FDFFFF            inc dword ptr [ebp+FFFFFDF0]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004298C6(U)
|
:00429887 8B85F0FDFFFF            mov eax, dword ptr [ebp+FFFFFDF0]
:0042988D 33C9                    xor ecx, ecx
:0042988F 8A08                    mov cl, byte ptr [eax]
:00429891 83F90A                  cmp ecx, 0000000A
:00429894 0F8431000000            je 004298CB
:0042989A 8B85F0FDFFFF            mov eax, dword ptr [ebp+FFFFFDF0]
:004298A0 8A00                    mov al, byte ptr [eax]
:004298A2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004298A5 8801                    mov byte ptr [ecx], al
:004298A7 FF85F0FDFFFF            inc dword ptr [ebp+FFFFFDF0]
:004298AD FF45FC                  inc [ebp-04]
:004298B0 8B85F0FDFFFF            mov eax, dword ptr [ebp+FFFFFDF0]
:004298B6 8A00                    mov al, byte ptr [eax]
:004298B8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004298BB 8801                    mov byte ptr [ecx], al
:004298BD FF85F0FDFFFF            inc dword ptr [ebp+FFFFFDF0]
:004298C3 FF45FC                  inc [ebp-04]
:004298C6 E9BCFFFFFF              jmp 00429887

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429894(C)
|
:004298CB E935000000              jmp 00429905
:004298D0 E92B000000              jmp 00429900

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042987B(C)
|
:004298D5 FF85F0FDFFFF            inc dword ptr [ebp+FFFFFDF0]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004298F5(U)
|
:004298DB 8B85F0FDFFFF            mov eax, dword ptr [ebp+FFFFFDF0]
:004298E1 33C9                    xor ecx, ecx
:004298E3 8A08                    mov cl, byte ptr [eax]
:004298E5 83F90A                  cmp ecx, 0000000A
:004298E8 0F840C000000            je 004298FA
:004298EE 8385F0FDFFFF02          add dword ptr [ebp+FFFFFDF0], 00000002
:004298F5 E9E1FFFFFF              jmp 004298DB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004298E8(C)
|
:004298FA FF85F0FDFFFF            inc dword ptr [ebp+FFFFFDF0]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00429869(U), :004298D0(U)
|
:00429900 E949FFFFFF              jmp 0042984E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00429864(U), :004298CB(U)
|
:00429905 8B45FC                  mov eax, dword ptr [ebp-04]
:00429908 C60000                  mov byte ptr [eax], 00
:0042990B 33C0                    xor eax, eax
:0042990D 8A85F8FEFFFF            mov al, byte ptr [ebp+FFFFFEF8]
:00429913 85C0                    test eax, eax
:00429915 0F8426000000            je 00429941
:0042991B 837DF800                cmp dword ptr [ebp-08], 00000000
:0042991F 0F8407000000            je 0042992C
:00429925 C7450801000000          mov [ebp+08], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042991F(C)
|
:0042992C 8B4508                  mov eax, dword ptr [ebp+08]
:0042992F 50                      push eax
:00429930 8D85F8FEFFFF            lea eax, dword ptr [ebp+FFFFFEF8]
:00429936 50                      push eax
:00429937 B988C04600              mov ecx, 0046C088
:0042993C E899E3FFFF              call 00427CDA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429915(C)
|
:00429941 E900000000              jmp 00429946

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429941(U)
|
:00429946 5F                      pop edi
:00429947 5E                      pop esi
:00429948 5B                      pop ebx
:00429949 C9                      leave
:0042994A C3                      ret



* Referenced by a CALL at Addresses:
|:00428A9A   , :00428C7C   
|
:0042994B 55                      push ebp
:0042994C 8BEC                    mov ebp, esp
:0042994E 83EC14                  sub esp, 00000014
:00429951 53                      push ebx
:00429952 56                      push esi
:00429953 57                      push edi
:00429954 C645F400                mov [ebp-0C], 00
:00429958 C745F800000000          mov [ebp-08], 00000000
:0042995F 33C0                    xor eax, eax
:00429961 8A4508                  mov al, byte ptr [ebp+08]
:00429964 3DFF000000              cmp eax, 000000FF
:00429969 0F8422000000            je 00429991
:0042996F 33C0                    xor eax, eax
:00429971 8A4508                  mov al, byte ptr [ebp+08]
:00429974 8BC8                    mov ecx, eax
:00429976 8D0440                  lea eax, dword ptr [eax+2*eax]
:00429979 C1E003                  shl eax, 03
:0042997C 2BC1                    sub eax, ecx
:0042997E 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00429984 E8F7FBFDFF              call 00409580
:00429989 8945FC                  mov dword ptr [ebp-04], eax
:0042998C E90F000000              jmp 004299A0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429969(C)
|
:00429991 33C0                    xor eax, eax
:00429993 8A4514                  mov al, byte ptr [ebp+14]
:00429996 8B048550204500          mov eax, dword ptr [4*eax+00452050]
:0042999D 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042998C(U)
|
:004299A0 33C0                    xor eax, eax
:004299A2 8A450C                  mov al, byte ptr [ebp+0C]
:004299A5 8945EC                  mov dword ptr [ebp-14], eax
:004299A8 E99A000000              jmp 00429A47

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429A4B(C)
|
:004299AD 33C0                    xor eax, eax
:004299AF 8A4508                  mov al, byte ptr [ebp+08]
:004299B2 3DFF000000              cmp eax, 000000FF
:004299B7 0F8422000000            je 004299DF
:004299BD 33C0                    xor eax, eax
:004299BF 8A4508                  mov al, byte ptr [ebp+08]
:004299C2 8BC8                    mov ecx, eax
:004299C4 8D0440                  lea eax, dword ptr [eax+2*eax]
:004299C7 C1E003                  shl eax, 03
:004299CA 2BC1                    sub eax, ecx
:004299CC 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004299D2 E8F9FCFDFF              call 004096D0
:004299D7 8845F0                  mov byte ptr [ebp-10], al
:004299DA E904000000              jmp 004299E3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004299B7(C)
|
:004299DF C645F002                mov [ebp-10], 02

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004299DA(U)
|
:004299E3 E982000000              jmp 00429A6A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429A55(C)
|
:004299E8 33C0                    xor eax, eax
:004299EA 8A4508                  mov al, byte ptr [ebp+08]
:004299ED 3DFF000000              cmp eax, 000000FF
:004299F2 0F8422000000            je 00429A1A
:004299F8 33C0                    xor eax, eax
:004299FA 8A4508                  mov al, byte ptr [ebp+08]
:004299FD 8BC8                    mov ecx, eax
:004299FF 8D0440                  lea eax, dword ptr [eax+2*eax]
:00429A02 C1E003                  shl eax, 03
:00429A05 2BC1                    sub eax, ecx
:00429A07 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00429A0D E81EFDFDFF              call 00409730
:00429A12 8845F0                  mov byte ptr [ebp-10], al
:00429A15 E904000000              jmp 00429A1E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004299F2(C)
|
:00429A1A C645F002                mov [ebp-10], 02

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429A15(U)
|
:00429A1E E947000000              jmp 00429A6A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429A5F(C)
|
:00429A23 33C0                    xor eax, eax
:00429A25 8A4510                  mov al, byte ptr [ebp+10]
:00429A28 A880                    test al, 80
:00429A2A 0F8409000000            je 00429A39
:00429A30 C645F401                mov [ebp-0C], 01
:00429A34 E904000000              jmp 00429A3D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429A2A(C)
|
:00429A39 C645F400                mov [ebp-0C], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429A34(U)
|
:00429A3D E928000000              jmp 00429A6A
:00429A42 E923000000              jmp 00429A6A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004299A8(U)
|
:00429A47 837DEC00                cmp dword ptr [ebp-14], 00000000
:00429A4B 0F845CFFFFFF            je 004299AD
:00429A51 837DEC01                cmp dword ptr [ebp-14], 00000001
:00429A55 0F848DFFFFFF            je 004299E8
:00429A5B 837DEC03                cmp dword ptr [ebp-14], 00000003
:00429A5F 0F84BEFFFFFF            je 00429A23
:00429A65 E900000000              jmp 00429A6A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004299E3(U), :00429A1E(U), :00429A3D(U), :00429A42(U), :00429A65(U)
|
:00429A6A 33C0                    xor eax, eax
:00429A6C 8A450C                  mov al, byte ptr [ebp+0C]
:00429A6F 83F802                  cmp eax, 00000002
:00429A72 0F8D09010000            jnl 00429B81
:00429A78 33C0                    xor eax, eax
:00429A7A 8A4510                  mov al, byte ptr [ebp+10]
:00429A7D 33C9                    xor ecx, ecx
:00429A7F 8A4DF0                  mov cl, byte ptr [ebp-10]
:00429A82 3BC1                    cmp eax, ecx
:00429A84 0F8D80000000            jnl 00429B0A
:00429A8A 33C0                    xor eax, eax
:00429A8C 8A45F0                  mov al, byte ptr [ebp-10]
:00429A8F 83F802                  cmp eax, 00000002
:00429A92 0F8E4D000000            jle 00429AE5
:00429A98 33C0                    xor eax, eax
:00429A9A 8A45F0                  mov al, byte ptr [ebp-10]
:00429A9D 83F803                  cmp eax, 00000003
:00429AA0 0F8509000000            jne 00429AAF
:00429AA6 C645F001                mov [ebp-10], 01
:00429AAA E904000000              jmp 00429AB3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429AA0(C)
|
:00429AAF C645F000                mov [ebp-10], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429AAA(U)
|
:00429AB3 33C0                    xor eax, eax
:00429AB5 8A45F0                  mov al, byte ptr [ebp-10]
:00429AB8 8B048548204500          mov eax, dword ptr [4*eax+00452048]
:00429ABF 50                      push eax
:00429AC0 33C0                    xor eax, eax
:00429AC2 8A450C                  mov al, byte ptr [ebp+0C]
:00429AC5 8B048540204500          mov eax, dword ptr [4*eax+00452040]
:00429ACC 50                      push eax
:00429ACD 8B45FC                  mov eax, dword ptr [ebp-04]
:00429AD0 50                      push eax

* Possible StringData Ref from Data Obj ->"%s%s½Ч%s"
                                  |
:00429AD1 6898204500              push 00452098
:00429AD6 6A00                    push 00000000
:00429AD8 E858F40000              call 00438F35
:00429ADD 83C414                  add esp, 00000014
:00429AE0 E920000000              jmp 00429B05

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429A92(C)
|
:00429AE5 33C0                    xor eax, eax
:00429AE7 8A450C                  mov al, byte ptr [ebp+0C]
:00429AEA 8B048540204500          mov eax, dword ptr [4*eax+00452040]
:00429AF1 50                      push eax
:00429AF2 8B45FC                  mov eax, dword ptr [ebp-04]
:00429AF5 50                      push eax

* Possible StringData Ref from Data Obj ->"%s%sˡ"
                                  |
:00429AF6 68AC204500              push 004520AC
:00429AFB 6A00                    push 00000000
:00429AFD E833F40000              call 00438F35
:00429B02 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429AE0(U)
|
:00429B05 E972000000              jmp 00429B7C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429A84(C)
|
:00429B0A 33C0                    xor eax, eax
:00429B0C 8A4510                  mov al, byte ptr [ebp+10]
:00429B0F 33C9                    xor ecx, ecx
:00429B11 8A4DF0                  mov cl, byte ptr [ebp-10]
:00429B14 3BC1                    cmp eax, ecx
:00429B16 0F8E60000000            jle 00429B7C
:00429B1C 33C0                    xor eax, eax
:00429B1E 8A45F0                  mov al, byte ptr [ebp-10]
:00429B21 83F802                  cmp eax, 00000002
:00429B24 0F8D32000000            jnl 00429B5C
:00429B2A 33C0                    xor eax, eax
:00429B2C 8A45F0                  mov al, byte ptr [ebp-10]
:00429B2F 8B048548204500          mov eax, dword ptr [4*eax+00452048]
:00429B36 50                      push eax
:00429B37 33C0                    xor eax, eax
:00429B39 8A450C                  mov al, byte ptr [ebp+0C]
:00429B3C 8B048540204500          mov eax, dword ptr [4*eax+00452040]
:00429B43 50                      push eax
:00429B44 8B45FC                  mov eax, dword ptr [ebp-04]
:00429B47 50                      push eax

* Possible StringData Ref from Data Obj ->"%s%sЧ%s"
                                  |
:00429B48 68BC204500              push 004520BC
:00429B4D 6A00                    push 00000000
:00429B4F E8E1F30000              call 00438F35
:00429B54 83C414                  add esp, 00000014
:00429B57 E920000000              jmp 00429B7C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429B24(C)
|
:00429B5C 33C0                    xor eax, eax
:00429B5E 8A450C                  mov al, byte ptr [ebp+0C]
:00429B61 8B048540204500          mov eax, dword ptr [4*eax+00452040]
:00429B68 50                      push eax
:00429B69 8B45FC                  mov eax, dword ptr [ebp-04]
:00429B6C 50                      push eax

* Possible StringData Ref from Data Obj ->"%s%s½ˡ"
                                  |
:00429B6D 68D0204500              push 004520D0
:00429B72 6A00                    push 00000000
:00429B74 E8BCF30000              call 00438F35
:00429B79 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00429B05(U), :00429B16(C), :00429B57(U)
|
:00429B7C E996040000              jmp 0042A017

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429A72(C)
|
:00429B81 33C0                    xor eax, eax
:00429B83 8A450C                  mov al, byte ptr [ebp+0C]
:00429B86 83F802                  cmp eax, 00000002
:00429B89 0F851E000000            jne 00429BAD
:00429B8F 33C0                    xor eax, eax
:00429B91 8A4510                  mov al, byte ptr [ebp+10]
:00429B94 50                      push eax
:00429B95 8B45FC                  mov eax, dword ptr [ebp-04]
:00429B98 50                      push eax

* Possible StringData Ref from Data Obj ->"%s%w˺"
                                  |
:00429B99 68E0204500              push 004520E0
:00429B9E 6A00                    push 00000000
:00429BA0 E890F30000              call 00438F35
:00429BA5 83C410                  add esp, 00000010
:00429BA8 E96A040000              jmp 0042A017

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429B89(C)
|
:00429BAD 33C0                    xor eax, eax
:00429BAF 8A450C                  mov al, byte ptr [ebp+0C]
:00429BB2 83F803                  cmp eax, 00000003
:00429BB5 0F855C040000            jne 0042A017
:00429BBB 33C0                    xor eax, eax
:00429BBD 8A4510                  mov al, byte ptr [ebp+10]
:00429BC0 A801                    test al, 01
:00429BC2 0F84AD000000            je 00429C75
:00429BC8 33C0                    xor eax, eax
:00429BCA 8A45F4                  mov al, byte ptr [ebp-0C]
:00429BCD 85C0                    test eax, eax
:00429BCF 0F844C000000            je 00429C21
:00429BD5 33C0                    xor eax, eax
:00429BD7 8A4508                  mov al, byte ptr [ebp+08]
:00429BDA 3DFF000000              cmp eax, 000000FF
:00429BDF 0F8424000000            je 00429C09
:00429BE5 6A01                    push 00000001
:00429BE7 33C0                    xor eax, eax
:00429BE9 8A4508                  mov al, byte ptr [ebp+08]
:00429BEC 8BC8                    mov ecx, eax
:00429BEE 8D0440                  lea eax, dword ptr [eax+2*eax]
:00429BF1 C1E003                  shl eax, 03
:00429BF4 2BC1                    sub eax, ecx
:00429BF6 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00429BFC E84FF5FDFF              call 00409150
:00429C01 85C0                    test eax, eax
:00429C03 0F8418000000            je 00429C21

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429BDF(C)
|
:00429C09 8B45FC                  mov eax, dword ptr [ebp-04]
:00429C0C 50                      push eax

* Possible StringData Ref from Data Obj ->"%sƶָˡ"
                                  |
:00429C0D 68F4204500              push 004520F4
:00429C12 6A00                    push 00000000
:00429C14 E81CF30000              call 00438F35
:00429C19 83C40C                  add esp, 0000000C
:00429C1C E954000000              jmp 00429C75

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00429BCF(C), :00429C03(C)
|
:00429C21 33C0                    xor eax, eax
:00429C23 8A45F4                  mov al, byte ptr [ebp-0C]
:00429C26 85C0                    test eax, eax
:00429C28 0F8547000000            jne 00429C75
:00429C2E 33C0                    xor eax, eax
:00429C30 8A4508                  mov al, byte ptr [ebp+08]
:00429C33 3DFF000000              cmp eax, 000000FF
:00429C38 0F8424000000            je 00429C62
:00429C3E 6A01                    push 00000001
:00429C40 33C0                    xor eax, eax
:00429C42 8A4508                  mov al, byte ptr [ebp+08]
:00429C45 8BC8                    mov ecx, eax
:00429C47 8D0440                  lea eax, dword ptr [eax+2*eax]
:00429C4A C1E003                  shl eax, 03
:00429C4D 2BC1                    sub eax, ecx
:00429C4F 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00429C55 E8F6F4FDFF              call 00409150
:00429C5A 85C0                    test eax, eax
:00429C5C 0F8513000000            jne 00429C75

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429C38(C)
|
:00429C62 8B45FC                  mov eax, dword ptr [ebp-04]
:00429C65 50                      push eax

* Possible StringData Ref from Data Obj ->"%sƶˡ"
                                  |
:00429C66 6808214500              push 00452108
:00429C6B 6A00                    push 00000000
:00429C6D E8C3F20000              call 00438F35
:00429C72 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00429BC2(C), :00429C1C(U), :00429C28(C), :00429C5C(C)
|
:00429C75 33C0                    xor eax, eax
:00429C77 8A4510                  mov al, byte ptr [ebp+10]
:00429C7A A802                    test al, 02
:00429C7C 0F84AD000000            je 00429D2F
:00429C82 33C0                    xor eax, eax
:00429C84 8A45F4                  mov al, byte ptr [ebp-0C]
:00429C87 85C0                    test eax, eax
:00429C89 0F844C000000            je 00429CDB
:00429C8F 33C0                    xor eax, eax
:00429C91 8A4508                  mov al, byte ptr [ebp+08]
:00429C94 3DFF000000              cmp eax, 000000FF
:00429C99 0F8424000000            je 00429CC3
:00429C9F 6A02                    push 00000002
:00429CA1 33C0                    xor eax, eax
:00429CA3 8A4508                  mov al, byte ptr [ebp+08]
:00429CA6 8BC8                    mov ecx, eax
:00429CA8 8D0440                  lea eax, dword ptr [eax+2*eax]
:00429CAB C1E003                  shl eax, 03
:00429CAE 2BC1                    sub eax, ecx
:00429CB0 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00429CB6 E895F4FDFF              call 00409150
:00429CBB 85C0                    test eax, eax
:00429CBD 0F8418000000            je 00429CDB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429C99(C)
|
:00429CC3 8B45FC                  mov eax, dword ptr [ebp-04]
:00429CC6 50                      push eax

* Possible StringData Ref from Data Obj ->"%sĹٶȻָˡ"
                                  |
:00429CC7 681C214500              push 0045211C
:00429CCC 6A00                    push 00000000
:00429CCE E862F20000              call 00438F35
:00429CD3 83C40C                  add esp, 0000000C
:00429CD6 E954000000              jmp 00429D2F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00429C89(C), :00429CBD(C)
|
:00429CDB 33C0                    xor eax, eax
:00429CDD 8A45F4                  mov al, byte ptr [ebp-0C]
:00429CE0 85C0                    test eax, eax
:00429CE2 0F8547000000            jne 00429D2F
:00429CE8 33C0                    xor eax, eax
:00429CEA 8A4508                  mov al, byte ptr [ebp+08]
:00429CED 3DFF000000              cmp eax, 000000FF
:00429CF2 0F8424000000            je 00429D1C
:00429CF8 6A02                    push 00000002
:00429CFA 33C0                    xor eax, eax
:00429CFC 8A4508                  mov al, byte ptr [ebp+08]
:00429CFF 8BC8                    mov ecx, eax
:00429D01 8D0440                  lea eax, dword ptr [eax+2*eax]
:00429D04 C1E003                  shl eax, 03
:00429D07 2BC1                    sub eax, ecx
:00429D09 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00429D0F E83CF4FDFF              call 00409150
:00429D14 85C0                    test eax, eax
:00429D16 0F8513000000            jne 00429D2F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429CF2(C)
|
:00429D1C 8B45FC                  mov eax, dword ptr [ebp-04]
:00429D1F 50                      push eax

* Possible StringData Ref from Data Obj ->"%sĹٶȼˡ"
                                  |
:00429D20 6834214500              push 00452134
:00429D25 6A00                    push 00000000
:00429D27 E809F20000              call 00438F35
:00429D2C 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00429C7C(C), :00429CD6(U), :00429CE2(C), :00429D16(C)
|
:00429D2F 33C0                    xor eax, eax
:00429D31 8A4510                  mov al, byte ptr [ebp+10]
:00429D34 A804                    test al, 04
:00429D36 0F84AD000000            je 00429DE9
:00429D3C 33C0                    xor eax, eax
:00429D3E 8A45F4                  mov al, byte ptr [ebp-0C]
:00429D41 85C0                    test eax, eax
:00429D43 0F844C000000            je 00429D95
:00429D49 33C0                    xor eax, eax
:00429D4B 8A4508                  mov al, byte ptr [ebp+08]
:00429D4E 3DFF000000              cmp eax, 000000FF
:00429D53 0F8424000000            je 00429D7D
:00429D59 6A04                    push 00000004
:00429D5B 33C0                    xor eax, eax
:00429D5D 8A4508                  mov al, byte ptr [ebp+08]
:00429D60 8BC8                    mov ecx, eax
:00429D62 8D0440                  lea eax, dword ptr [eax+2*eax]
:00429D65 C1E003                  shl eax, 03
:00429D68 2BC1                    sub eax, ecx
:00429D6A 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00429D70 E8DBF3FDFF              call 00409150
:00429D75 85C0                    test eax, eax
:00429D77 0F8418000000            je 00429D95

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429D53(C)
|
:00429D7D 8B45FC                  mov eax, dword ptr [ebp-04]
:00429D80 50                      push eax

* Possible StringData Ref from Data Obj ->"%sĲԷЧʧˡ"
                                  |
:00429D81 684C214500              push 0045214C
:00429D86 6A00                    push 00000000
:00429D88 E8A8F10000              call 00438F35
:00429D8D 83C40C                  add esp, 0000000C
:00429D90 E954000000              jmp 00429DE9

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00429D43(C), :00429D77(C)
|
:00429D95 33C0                    xor eax, eax
:00429D97 8A45F4                  mov al, byte ptr [ebp-0C]
:00429D9A 85C0                    test eax, eax
:00429D9C 0F8547000000            jne 00429DE9
:00429DA2 33C0                    xor eax, eax
:00429DA4 8A4508                  mov al, byte ptr [ebp+08]
:00429DA7 3DFF000000              cmp eax, 000000FF
:00429DAC 0F8424000000            je 00429DD6
:00429DB2 6A04                    push 00000004
:00429DB4 33C0                    xor eax, eax
:00429DB6 8A4508                  mov al, byte ptr [ebp+08]
:00429DB9 8BC8                    mov ecx, eax
:00429DBB 8D0440                  lea eax, dword ptr [eax+2*eax]
:00429DBE C1E003                  shl eax, 03
:00429DC1 2BC1                    sub eax, ecx
:00429DC3 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00429DC9 E882F3FDFF              call 00409150
:00429DCE 85C0                    test eax, eax
:00429DD0 0F8513000000            jne 00429DE9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429DAC(C)
|
:00429DD6 8B45FC                  mov eax, dword ptr [ebp-04]
:00429DD9 50                      push eax

* Possible StringData Ref from Data Obj ->"%sĲԱסˡ"
                                  |
:00429DDA 6868214500              push 00452168
:00429DDF 6A00                    push 00000000
:00429DE1 E84FF10000              call 00438F35
:00429DE6 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00429D36(C), :00429D90(U), :00429D9C(C), :00429DD0(C)
|
:00429DE9 33C0                    xor eax, eax
:00429DEB 8A4510                  mov al, byte ptr [ebp+10]
:00429DEE A808                    test al, 08
:00429DF0 0F84AD000000            je 00429EA3
:00429DF6 33C0                    xor eax, eax
:00429DF8 8A45F4                  mov al, byte ptr [ebp-0C]
:00429DFB 85C0                    test eax, eax
:00429DFD 0F844C000000            je 00429E4F
:00429E03 33C0                    xor eax, eax
:00429E05 8A4508                  mov al, byte ptr [ebp+08]
:00429E08 3DFF000000              cmp eax, 000000FF
:00429E0D 0F8424000000            je 00429E37
:00429E13 6A08                    push 00000008
:00429E15 33C0                    xor eax, eax
:00429E17 8A4508                  mov al, byte ptr [ebp+08]
:00429E1A 8BC8                    mov ecx, eax
:00429E1C 8D0440                  lea eax, dword ptr [eax+2*eax]
:00429E1F C1E003                  shl eax, 03
:00429E22 2BC1                    sub eax, ecx
:00429E24 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00429E2A E821F3FDFF              call 00409150
:00429E2F 85C0                    test eax, eax
:00429E31 0F8418000000            je 00429E4F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429E0D(C)
|
:00429E37 8B45FC                  mov eax, dword ptr [ebp-04]
:00429E3A 50                      push eax

* Possible StringData Ref from Data Obj ->"%sĲ˺Чʧˡ"
                                  |
:00429E3B 687C214500              push 0045217C
:00429E40 6A00                    push 00000000
:00429E42 E8EEF00000              call 00438F35
:00429E47 83C40C                  add esp, 0000000C
:00429E4A E954000000              jmp 00429EA3

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00429DFD(C), :00429E31(C)
|
:00429E4F 33C0                    xor eax, eax
:00429E51 8A45F4                  mov al, byte ptr [ebp-0C]
:00429E54 85C0                    test eax, eax
:00429E56 0F8547000000            jne 00429EA3
:00429E5C 33C0                    xor eax, eax
:00429E5E 8A4508                  mov al, byte ptr [ebp+08]
:00429E61 3DFF000000              cmp eax, 000000FF
:00429E66 0F8424000000            je 00429E90
:00429E6C 6A08                    push 00000008
:00429E6E 33C0                    xor eax, eax
:00429E70 8A4508                  mov al, byte ptr [ebp+08]
:00429E73 8BC8                    mov ecx, eax
:00429E75 8D0440                  lea eax, dword ptr [eax+2*eax]
:00429E78 C1E003                  shl eax, 03
:00429E7B 2BC1                    sub eax, ecx
:00429E7D 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00429E83 E8C8F2FDFF              call 00409150
:00429E88 85C0                    test eax, eax
:00429E8A 0F8513000000            jne 00429EA3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429E66(C)
|
:00429E90 8B45FC                  mov eax, dword ptr [ebp-04]
:00429E93 50                      push eax

* Possible StringData Ref from Data Obj ->"%sܲԹ˺ˡ"
                                  |
:00429E94 689C214500              push 0045219C
:00429E99 6A00                    push 00000000
:00429E9B E895F00000              call 00438F35
:00429EA0 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00429DF0(C), :00429E4A(U), :00429E56(C), :00429E8A(C)
|
:00429EA3 33C0                    xor eax, eax
:00429EA5 8A4510                  mov al, byte ptr [ebp+10]
:00429EA8 A810                    test al, 10
:00429EAA 0F84AD000000            je 00429F5D
:00429EB0 33C0                    xor eax, eax
:00429EB2 8A45F4                  mov al, byte ptr [ebp-0C]
:00429EB5 85C0                    test eax, eax
:00429EB7 0F844C000000            je 00429F09
:00429EBD 33C0                    xor eax, eax
:00429EBF 8A4508                  mov al, byte ptr [ebp+08]
:00429EC2 3DFF000000              cmp eax, 000000FF
:00429EC7 0F8424000000            je 00429EF1
:00429ECD 6A10                    push 00000010
:00429ECF 33C0                    xor eax, eax
:00429ED1 8A4508                  mov al, byte ptr [ebp+08]
:00429ED4 8BC8                    mov ecx, eax
:00429ED6 8D0440                  lea eax, dword ptr [eax+2*eax]
:00429ED9 C1E003                  shl eax, 03
:00429EDC 2BC1                    sub eax, ecx
:00429EDE 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00429EE4 E867F2FDFF              call 00409150
:00429EE9 85C0                    test eax, eax
:00429EEB 0F8418000000            je 00429F09

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429EC7(C)
|
:00429EF1 8B45FC                  mov eax, dword ptr [ebp-04]
:00429EF4 50                      push eax

* Possible StringData Ref from Data Obj ->"%sĻһָˡ"
                                  |
:00429EF5 68BC214500              push 004521BC
:00429EFA 6A00                    push 00000000
:00429EFC E834F00000              call 00438F35
:00429F01 83C40C                  add esp, 0000000C
:00429F04 E954000000              jmp 00429F5D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00429EB7(C), :00429EEB(C)
|
:00429F09 33C0                    xor eax, eax
:00429F0B 8A45F4                  mov al, byte ptr [ebp-0C]
:00429F0E 85C0                    test eax, eax
:00429F10 0F8547000000            jne 00429F5D
:00429F16 33C0                    xor eax, eax
:00429F18 8A4508                  mov al, byte ptr [ebp+08]
:00429F1B 3DFF000000              cmp eax, 000000FF
:00429F20 0F8424000000            je 00429F4A
:00429F26 6A10                    push 00000010
:00429F28 33C0                    xor eax, eax
:00429F2A 8A4508                  mov al, byte ptr [ebp+08]
:00429F2D 8BC8                    mov ecx, eax
:00429F2F 8D0440                  lea eax, dword ptr [eax+2*eax]
:00429F32 C1E003                  shl eax, 03
:00429F35 2BC1                    sub eax, ecx
:00429F37 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00429F3D E80EF2FDFF              call 00409150
:00429F42 85C0                    test eax, eax
:00429F44 0F8513000000            jne 00429F5D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429F20(C)
|
:00429F4A 8B45FC                  mov eax, dword ptr [ebp-04]
:00429F4D 50                      push eax

* Possible StringData Ref from Data Obj ->"%sˡ"
                                  |
:00429F4E 68D0214500              push 004521D0
:00429F53 6A00                    push 00000000
:00429F55 E8DBEF0000              call 00438F35
:00429F5A 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00429EAA(C), :00429F04(U), :00429F10(C), :00429F44(C)
|
:00429F5D 33C0                    xor eax, eax
:00429F5F 8A4510                  mov al, byte ptr [ebp+10]
:00429F62 A820                    test al, 20
:00429F64 0F84AD000000            je 0042A017
:00429F6A 33C0                    xor eax, eax
:00429F6C 8A45F4                  mov al, byte ptr [ebp-0C]
:00429F6F 85C0                    test eax, eax
:00429F71 0F844C000000            je 00429FC3
:00429F77 33C0                    xor eax, eax
:00429F79 8A4508                  mov al, byte ptr [ebp+08]
:00429F7C 3DFF000000              cmp eax, 000000FF
:00429F81 0F8424000000            je 00429FAB
:00429F87 6A20                    push 00000020
:00429F89 33C0                    xor eax, eax
:00429F8B 8A4508                  mov al, byte ptr [ebp+08]
:00429F8E 8BC8                    mov ecx, eax
:00429F90 8D0440                  lea eax, dword ptr [eax+2*eax]
:00429F93 C1E003                  shl eax, 03
:00429F96 2BC1                    sub eax, ecx
:00429F98 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00429F9E E8ADF1FDFF              call 00409150
:00429FA3 85C0                    test eax, eax
:00429FA5 0F8418000000            je 00429FC3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429F81(C)
|
:00429FAB 8B45FC                  mov eax, dword ptr [ebp-04]
:00429FAE 50                      push eax

* Possible StringData Ref from Data Obj ->"%s;ÿغϼˡ"
                                  |
:00429FAF 68DC214500              push 004521DC
:00429FB4 6A00                    push 00000000
:00429FB6 E87AEF0000              call 00438F35
:00429FBB 83C40C                  add esp, 0000000C
:00429FBE E954000000              jmp 0042A017

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00429F71(C), :00429FA5(C)
|
:00429FC3 33C0                    xor eax, eax
:00429FC5 8A45F4                  mov al, byte ptr [ebp-0C]
:00429FC8 85C0                    test eax, eax
:00429FCA 0F8547000000            jne 0042A017
:00429FD0 33C0                    xor eax, eax
:00429FD2 8A4508                  mov al, byte ptr [ebp+08]
:00429FD5 3DFF000000              cmp eax, 000000FF
:00429FDA 0F8424000000            je 0042A004
:00429FE0 6A20                    push 00000020
:00429FE2 33C0                    xor eax, eax
:00429FE4 8A4508                  mov al, byte ptr [ebp+08]
:00429FE7 8BC8                    mov ecx, eax
:00429FE9 8D0440                  lea eax, dword ptr [eax+2*eax]
:00429FEC C1E003                  shl eax, 03
:00429FEF 2BC1                    sub eax, ecx
:00429FF1 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00429FF7 E854F1FDFF              call 00409150
:00429FFC 85C0                    test eax, eax
:00429FFE 0F8513000000            jne 0042A017

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429FDA(C)
|
:0042A004 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A007 50                      push eax

* Possible StringData Ref from Data Obj ->"%s;ʼÿغϼˡ"
                                  |
:0042A008 68FC214500              push 004521FC
:0042A00D 6A00                    push 00000000
:0042A00F E821EF0000              call 00438F35
:0042A014 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00429B7C(U), :00429BA8(U), :00429BB5(C), :00429F64(C), :00429FBE(U)
|:00429FCA(C), :00429FFE(C)
|
:0042A017 E900000000              jmp 0042A01C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A017(U)
|
:0042A01C 5F                      pop edi
:0042A01D 5E                      pop esi
:0042A01E 5B                      pop ebx
:0042A01F C9                      leave
:0042A020 C3                      ret



* Referenced by a CALL at Addresses:
|:00427B5C   , :0042A109   , :0042B9CE   
|
:0042A021 55                      push ebp
:0042A022 8BEC                    mov ebp, esp
:0042A024 83EC08                  sub esp, 00000008
:0042A027 53                      push ebx
:0042A028 56                      push esi
:0042A029 57                      push edi
:0042A02A 33C0                    xor eax, eax
:0042A02C A0A4C44600              mov al, byte ptr [0046C4A4]
:0042A031 3DFF000000              cmp eax, 000000FF
:0042A036 0F855D000000            jne 0042A099
:0042A03C 8D4508                  lea eax, dword ptr [ebp+08]
:0042A03F 50                      push eax
:0042A040 E8F8F4FEFF              call 0041953D
:0042A045 83C404                  add esp, 00000004
:0042A048 33C9                    xor ecx, ecx
:0042A04A 8AC8                    mov cl, al
:0042A04C 81F9FF000000            cmp ecx, 000000FF
:0042A052 0F8541000000            jne 0042A099
:0042A058 8D4508                  lea eax, dword ptr [ebp+08]
:0042A05B 50                      push eax
:0042A05C E879F5FEFF              call 004195DA
:0042A061 83C404                  add esp, 00000004
:0042A064 33C9                    xor ecx, ecx
:0042A066 8AC8                    mov cl, al
:0042A068 33C0                    xor eax, eax
:0042A06A A0A8C44600              mov al, byte ptr [0046C4A8]
:0042A06F 8BD0                    mov edx, eax
:0042A071 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042A074 2BCA                    sub ecx, edx
:0042A076 33D2                    xor edx, edx
:0042A078 8A94C1F01C4500          mov dl, byte ptr [ecx+8*eax+00451CF0]
:0042A07F 81FAFF000000            cmp edx, 000000FF
:0042A085 0F840E000000            je 0042A099
:0042A08B 8D4508                  lea eax, dword ptr [ebp+08]
:0042A08E 50                      push eax
:0042A08F B9A4C44600              mov ecx, 0046C4A4
:0042A094 E8F777FDFF              call 00401890

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042A036(C), :0042A052(C), :0042A085(C)
|
:0042A099 33C0                    xor eax, eax
:0042A09B 8A450C                  mov al, byte ptr [ebp+0C]
:0042A09E 85C0                    test eax, eax
:0042A0A0 0F8412000000            je 0042A0B8
:0042A0A6 33C0                    xor eax, eax
:0042A0A8 A0A4C44600              mov al, byte ptr [0046C4A4]
:0042A0AD 3DFF000000              cmp eax, 000000FF
:0042A0B2 0F8405000000            je 0042A0BD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A0A0(C)
|
:0042A0B8 E975000000              jmp 0042A132

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A0B2(C)
|
:0042A0BD FE4D0C                  dec [ebp+0C]
:0042A0C0 C645FC00                mov [ebp-04], 00
:0042A0C4 E903000000              jmp 0042A0CC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A128(U)
|
:0042A0C9 FE45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A0C4(U)
|
:0042A0CC 33C0                    xor eax, eax
:0042A0CE 8A45FC                  mov al, byte ptr [ebp-04]
:0042A0D1 83F804                  cmp eax, 00000004
:0042A0D4 0F8D53000000            jnl 0042A12D
:0042A0DA 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A0DD 50                      push eax
:0042A0DE 8D4508                  lea eax, dword ptr [ebp+08]
:0042A0E1 50                      push eax
:0042A0E2 E86EF5FEFF              call 00419655
:0042A0E7 83C408                  add esp, 00000008
:0042A0EA 668B00                  mov ax, word ptr [eax]
:0042A0ED 668945F8                mov word ptr [ebp-08], ax
:0042A0F1 33C0                    xor eax, eax
:0042A0F3 8A45F8                  mov al, byte ptr [ebp-08]
:0042A0F6 3DFF000000              cmp eax, 000000FF
:0042A0FB 0F8427000000            je 0042A128
:0042A101 8B450C                  mov eax, dword ptr [ebp+0C]
:0042A104 50                      push eax
:0042A105 8B45F8                  mov eax, dword ptr [ebp-08]
:0042A108 50                      push eax
:0042A109 E813FFFFFF              call 0042A021
:0042A10E 83C408                  add esp, 00000008
:0042A111 33C0                    xor eax, eax
:0042A113 A0A4C44600              mov al, byte ptr [0046C4A4]
:0042A118 3DFF000000              cmp eax, 000000FF
:0042A11D 0F8405000000            je 0042A128
:0042A123 E905000000              jmp 0042A12D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042A0FB(C), :0042A11D(C)
|
:0042A128 E99CFFFFFF              jmp 0042A0C9

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042A0D4(C), :0042A123(U)
|
:0042A12D E900000000              jmp 0042A132

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042A0B8(U), :0042A12D(U)
|
:0042A132 5F                      pop edi
:0042A133 5E                      pop esi
:0042A134 5B                      pop ebx
:0042A135 C9                      leave
:0042A136 C3                      ret



* Referenced by a CALL at Addresses:
|:0042A534   , :0043F895   
|
:0042A137 55                      push ebp
:0042A138 8BEC                    mov ebp, esp
:0042A13A 83EC04                  sub esp, 00000004
:0042A13D 53                      push ebx
:0042A13E 56                      push esi
:0042A13F 57                      push edi
:0042A140 894DFC                  mov dword ptr [ebp-04], ecx
:0042A143 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A146 8A4014                  mov al, byte ptr [eax+14]
:0042A149 50                      push eax
:0042A14A 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A14D 8B00                    mov eax, dword ptr [eax]
:0042A14F 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042A152 03C0                    add eax, eax
:0042A154 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:0042A15B E80B2AFEFF              call 0040CB6B
:0042A160 50                      push eax
:0042A161 E80D000000              call 0042A173
:0042A166 83C408                  add esp, 00000008
:0042A169 E900000000              jmp 0042A16E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A169(U)
|
:0042A16E 5F                      pop edi
:0042A16F 5E                      pop esi
:0042A170 5B                      pop ebx
:0042A171 C9                      leave
:0042A172 C3                      ret



* Referenced by a CALL at Addresses:
|:0042A161   , :0042A251   
|
:0042A173 55                      push ebp
:0042A174 8BEC                    mov ebp, esp
:0042A176 83EC04                  sub esp, 00000004
:0042A179 53                      push ebx
:0042A17A 56                      push esi
:0042A17B 57                      push edi
:0042A17C 33C0                    xor eax, eax
:0042A17E 8A450C                  mov al, byte ptr [ebp+0C]
:0042A181 83E0BF                  and eax, FFFFFFBF
:0042A184 8945FC                  mov dword ptr [ebp-04], eax
:0042A187 E966000000              jmp 0042A1F2
:0042A18C 8B4508                  mov eax, dword ptr [ebp+08]
:0042A18F 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042A192 8D0480                  lea eax, dword ptr [eax+4*eax]
:0042A195 B90A000000              mov ecx, 0000000A
:0042A19A 2BD2                    sub edx, edx
:0042A19C F7F1                    div ecx
:0042A19E 894508                  mov dword ptr [ebp+08], eax
:0042A1A1 E974000000              jmp 0042A21A
:0042A1A6 8B4508                  mov eax, dword ptr [ebp+08]
:0042A1A9 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042A1AC C1E002                  shl eax, 02
:0042A1AF B90A000000              mov ecx, 0000000A
:0042A1B4 2BD2                    sub edx, edx
:0042A1B6 F7F1                    div ecx
:0042A1B8 894508                  mov dword ptr [ebp+08], eax
:0042A1BB E95A000000              jmp 0042A21A
:0042A1C0 8B4508                  mov eax, dword ptr [ebp+08]
:0042A1C3 C1E002                  shl eax, 02
:0042A1C6 B905000000              mov ecx, 00000005
:0042A1CB 2BD2                    sub edx, edx
:0042A1CD F7F1                    div ecx
:0042A1CF 894508                  mov dword ptr [ebp+08], eax
:0042A1D2 E943000000              jmp 0042A21A
:0042A1D7 8B4508                  mov eax, dword ptr [ebp+08]
:0042A1DA 03C0                    add eax, eax
:0042A1DC B903000000              mov ecx, 00000003
:0042A1E1 2BD2                    sub edx, edx
:0042A1E3 F7F1                    div ecx
:0042A1E5 894508                  mov dword ptr [ebp+08], eax
:0042A1E8 E92D000000              jmp 0042A21A
:0042A1ED E928000000              jmp 0042A21A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A187(U)
|
:0042A1F2 837DFC04                cmp dword ptr [ebp-04], 00000004
:0042A1F6 0F871E000000            ja 0042A21A
:0042A1FC 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A1FF FF248506A24200          jmp dword ptr [4*eax+0042A206]

:0042A206 8CA14200                DWORD 0042A18C
:0042A20A A6A14200                DWORD 0042A1A6
:0042A20E 1AA24200                DWORD 0042A21A
:0042A212 C0A14200                DWORD 0042A1C0
:0042A216 D7A14200                DWORD 0042A1D7



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042A1A1(U), :0042A1BB(U), :0042A1D2(U), :0042A1E8(U), :0042A1ED(U)
|:0042A1F6(C)
|
:0042A21A 8B4508                  mov eax, dword ptr [ebp+08]
:0042A21D E900000000              jmp 0042A222
:0042A222 5F                      pop edi
:0042A223 5E                      pop esi
:0042A224 5B                      pop ebx
:0042A225 C9                      leave
:0042A226 C3                      ret



* Referenced by a CALL at Addresses:
|:0042A550   , :0042AE4C   , :0042AECF   , :0043F900   
|
:0042A227 55                      push ebp
:0042A228 8BEC                    mov ebp, esp
:0042A22A 83EC04                  sub esp, 00000004
:0042A22D 53                      push ebx
:0042A22E 56                      push esi
:0042A22F 57                      push edi
:0042A230 894DFC                  mov dword ptr [ebp-04], ecx
:0042A233 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A236 8A4015                  mov al, byte ptr [eax+15]
:0042A239 50                      push eax
:0042A23A 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A23D 8B00                    mov eax, dword ptr [eax]
:0042A23F 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042A242 03C0                    add eax, eax
:0042A244 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:0042A24B E85C29FEFF              call 0040CBAC
:0042A250 50                      push eax
:0042A251 E81DFFFFFF              call 0042A173
:0042A256 83C408                  add esp, 00000008
:0042A259 E900000000              jmp 0042A25E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A259(U)
|
:0042A25E 5F                      pop edi
:0042A25F 5E                      pop esi
:0042A260 5B                      pop ebx
:0042A261 C9                      leave
:0042A262 C3                      ret



* Referenced by a CALL at Addresses:
|:0041B71B   , :0041DBE9   , :0041DC0B   , :0043F96F   
|
:0042A263 55                      push ebp
:0042A264 8BEC                    mov ebp, esp
:0042A266 83EC08                  sub esp, 00000008
:0042A269 53                      push ebx
:0042A26A 56                      push esi
:0042A26B 57                      push edi
:0042A26C 894DF8                  mov dword ptr [ebp-08], ecx
:0042A26F 8B45F8                  mov eax, dword ptr [ebp-08]
:0042A272 8B00                    mov eax, dword ptr [eax]
:0042A274 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042A277 03C0                    add eax, eax
:0042A279 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:0042A280 E86829FEFF              call 0040CBED
:0042A285 8845FC                  mov byte ptr [ebp-04], al
:0042A288 8B45F8                  mov eax, dword ptr [ebp-08]
:0042A28B 33C9                    xor ecx, ecx
:0042A28D 8A4816                  mov cl, byte ptr [eax+16]
:0042A290 F6C101                  test cl, 01
:0042A293 0F840B000000            je 0042A2A4
:0042A299 33C0                    xor eax, eax
:0042A29B 8A45FC                  mov al, byte ptr [ebp-04]
:0042A29E C1F801                  sar eax, 01
:0042A2A1 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A293(C)
|
:0042A2A4 8A45FC                  mov al, byte ptr [ebp-04]
:0042A2A7 E900000000              jmp 0042A2AC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A2A7(U)
|
:0042A2AC 5F                      pop edi
:0042A2AD 5E                      pop esi
:0042A2AE 5B                      pop ebx
:0042A2AF C9                      leave
:0042A2B0 C3                      ret



* Referenced by a CALL at Address:
|:0042B9B7   
|
:0042A2B1 55                      push ebp
:0042A2B2 8BEC                    mov ebp, esp
:0042A2B4 83EC04                  sub esp, 00000004
:0042A2B7 53                      push ebx
:0042A2B8 56                      push esi
:0042A2B9 57                      push edi
:0042A2BA 894DFC                  mov dword ptr [ebp-04], ecx
:0042A2BD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042A2C0 E8DBEFFDFF              call 004092A0
:0042A2C5 33C9                    xor ecx, ecx
:0042A2C7 8AC8                    mov cl, al
:0042A2C9 8A81C01C4500            mov al, byte ptr [ecx+00451CC0]
:0042A2CF E900000000              jmp 0042A2D4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A2CF(U)
|
:0042A2D4 5F                      pop edi
:0042A2D5 5E                      pop esi
:0042A2D6 5B                      pop ebx
:0042A2D7 C9                      leave
:0042A2D8 C3                      ret



* Referenced by a CALL at Addresses:
|:0041ABFC   , :0041B152   , :0041B373   
|
:0042A2D9 55                      push ebp
:0042A2DA 8BEC                    mov ebp, esp
:0042A2DC 83EC08                  sub esp, 00000008
:0042A2DF 53                      push ebx
:0042A2E0 56                      push esi
:0042A2E1 57                      push edi
:0042A2E2 894DF8                  mov dword ptr [ebp-08], ecx
:0042A2E5 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042A2E8 E8B3EFFDFF              call 004092A0
:0042A2ED 33C9                    xor ecx, ecx
:0042A2EF 8AC8                    mov cl, al
:0042A2F1 8A81C01C4500            mov al, byte ptr [ecx+00451CC0]
:0042A2F7 8845FC                  mov byte ptr [ebp-04], al
:0042A2FA 33C0                    xor eax, eax
:0042A2FC 8A45FC                  mov al, byte ptr [ebp-04]
:0042A2FF 8BC8                    mov ecx, eax
:0042A301 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042A304 C1E003                  shl eax, 03
:0042A307 2BC1                    sub eax, ecx
:0042A309 33C9                    xor ecx, ecx
:0042A30B 8A4D08                  mov cl, byte ptr [ebp+08]
:0042A30E 8A8408F01C4500          mov al, byte ptr [eax+ecx+00451CF0]
:0042A315 E900000000              jmp 0042A31A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A315(U)
|
:0042A31A 5F                      pop edi
:0042A31B 5E                      pop esi
:0042A31C 5B                      pop ebx
:0042A31D C9                      leave
:0042A31E C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:004086B3   , :0041ADEE   , :0041D0D7   , :0041D0EC   , :0042A517   
|:0042A522   
|
:0042A321 55                      push ebp
:0042A322 8BEC                    mov ebp, esp
:0042A324 83EC04                  sub esp, 00000004
:0042A327 53                      push ebx
:0042A328 56                      push esi
:0042A329 57                      push edi
:0042A32A 894DFC                  mov dword ptr [ebp-04], ecx
:0042A32D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042A330 E86BEFFDFF              call 004092A0
:0042A335 33C9                    xor ecx, ecx
:0042A337 8AC8                    mov cl, al
:0042A339 33DB                    xor ebx, ebx
:0042A33B 8A99201E4500            mov bl, byte ptr [ecx+00451E20]
:0042A341 8BC3                    mov eax, ebx
:0042A343 C1E304                  shl ebx, 04
:0042A346 03D8                    add ebx, eax
:0042A348 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042A34B E8B0EEFDFF              call 00409200
:0042A350 50                      push eax
:0042A351 E884F2FEFF              call 004195DA
:0042A356 83C404                  add esp, 00000004
:0042A359 33C9                    xor ecx, ecx
:0042A35B 8AC8                    mov cl, al
:0042A35D 8A840B481E4500          mov al, byte ptr [ebx+ecx+00451E48]
:0042A364 E900000000              jmp 0042A369

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A364(U)
|
:0042A369 5F                      pop edi
:0042A36A 5E                      pop esi
:0042A36B 5B                      pop ebx
:0042A36C C9                      leave
:0042A36D C3                      ret



* Referenced by a CALL at Addresses:
|:00402647   , :00419F54   , :0041A327   , :0041A734   , :0041B5E0   
|:0041DA05   , :004248DB   
|
:0042A36E 55                      push ebp
:0042A36F 8BEC                    mov ebp, esp
:0042A371 83EC04                  sub esp, 00000004
:0042A374 53                      push ebx
:0042A375 56                      push esi
:0042A376 57                      push edi
:0042A377 894DFC                  mov dword ptr [ebp-04], ecx
:0042A37A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042A37D E81EEFFDFF              call 004092A0
:0042A382 33C9                    xor ecx, ecx
:0042A384 8AC8                    mov cl, al
:0042A386 8A81281F4500            mov al, byte ptr [ecx+00451F28]
:0042A38C E900000000              jmp 0042A391

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A38C(U)
|
:0042A391 5F                      pop edi
:0042A392 5E                      pop esi
:0042A393 5B                      pop ebx
:0042A394 C9                      leave
:0042A395 C3                      ret



* Referenced by a CALL at Addresses:
|:0041C5E9   , :00423983   , :00424160   , :00424182   
|
:0042A396 55                      push ebp
:0042A397 8BEC                    mov ebp, esp
:0042A399 83EC08                  sub esp, 00000008
:0042A39C 53                      push ebx
:0042A39D 56                      push esi
:0042A39E 57                      push edi
:0042A39F 894DF8                  mov dword ptr [ebp-08], ecx
:0042A3A2 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042A3A5 E8F6EEFDFF              call 004092A0
:0042A3AA 33C9                    xor ecx, ecx
:0042A3AC 8AC8                    mov cl, al
:0042A3AE 8A81501F4500            mov al, byte ptr [ecx+00451F50]
:0042A3B4 8845FC                  mov byte ptr [ebp-04], al
:0042A3B7 6A02                    push 00000002
:0042A3B9 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042A3BC E88FEDFDFF              call 00409150
:0042A3C1 85C0                    test eax, eax
:0042A3C3 0F840B000000            je 0042A3D4
:0042A3C9 33C0                    xor eax, eax
:0042A3CB 8A45FC                  mov al, byte ptr [ebp-04]
:0042A3CE C1F801                  sar eax, 01
:0042A3D1 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A3C3(C)
|
:0042A3D4 8A45FC                  mov al, byte ptr [ebp-04]
:0042A3D7 E900000000              jmp 0042A3DC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A3D7(U)
|
:0042A3DC 5F                      pop edi
:0042A3DD 5E                      pop esi
:0042A3DE 5B                      pop ebx
:0042A3DF C9                      leave
:0042A3E0 C3                      ret



* Referenced by a CALL at Addresses:
|:00423F94   , :004287EF   , :00428BBB   , :00441003   , :004433E2   
|:00443907   
|
:0042A3E1 55                      push ebp
:0042A3E2 8BEC                    mov ebp, esp
:0042A3E4 83EC0C                  sub esp, 0000000C
:0042A3E7 53                      push ebx
:0042A3E8 56                      push esi
:0042A3E9 57                      push edi
:0042A3EA 894DF4                  mov dword ptr [ebp-0C], ecx
:0042A3ED 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042A3F0 8B00                    mov eax, dword ptr [eax]
:0042A3F2 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042A3F5 03C0                    add eax, eax
:0042A3F7 8D04C0                  lea eax, dword ptr [eax+8*eax]
:0042A3FA 05E8564500              add eax, 004556E8
:0042A3FF 8945F8                  mov dword ptr [ebp-08], eax
:0042A402 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042A405 E886F3FDFF              call 00409790
:0042A40A 8945FC                  mov dword ptr [ebp-04], eax
:0042A40D 8B4508                  mov eax, dword ptr [ebp+08]
:0042A410 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042A413 89410F                  mov dword ptr [ecx+0F], eax
:0042A416 8B4508                  mov eax, dword ptr [ebp+08]
:0042A419 3945FC                  cmp dword ptr [ebp-04], eax
:0042A41C 0F830E000000            jnb 0042A430
:0042A422 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A425 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042A428 89410F                  mov dword ptr [ecx+0F], eax
:0042A42B E909000000              jmp 0042A439

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A41C(C)
|
:0042A430 8B4508                  mov eax, dword ptr [ebp+08]
:0042A433 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042A436 89410F                  mov dword ptr [ecx+0F], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A42B(U)
|
:0042A439 E900000000              jmp 0042A43E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A439(U)
|
:0042A43E 5F                      pop edi
:0042A43F 5E                      pop esi
:0042A440 5B                      pop ebx
:0042A441 C9                      leave
:0042A442 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00402566   , :004051FF   , :00440FD4   , :00443933   
|
:0042A445 55                      push ebp
:0042A446 8BEC                    mov ebp, esp
:0042A448 83EC0C                  sub esp, 0000000C
:0042A44B 53                      push ebx
:0042A44C 56                      push esi
:0042A44D 57                      push edi
:0042A44E 894DF4                  mov dword ptr [ebp-0C], ecx
:0042A451 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042A454 8B00                    mov eax, dword ptr [eax]
:0042A456 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042A459 03C0                    add eax, eax
:0042A45B 8D04C0                  lea eax, dword ptr [eax+8*eax]
:0042A45E 05E8564500              add eax, 004556E8
:0042A463 8945F8                  mov dword ptr [ebp-08], eax
:0042A466 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042A469 E872EDFDFF              call 004091E0
:0042A46E 33C9                    xor ecx, ecx
:0042A470 8AC8                    mov cl, al
:0042A472 894DFC                  mov dword ptr [ebp-04], ecx
:0042A475 8A4508                  mov al, byte ptr [ebp+08]
:0042A478 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042A47B 884113                  mov byte ptr [ecx+13], al
:0042A47E 8B4508                  mov eax, dword ptr [ebp+08]
:0042A481 3945FC                  cmp dword ptr [ebp-04], eax
:0042A484 0F830E000000            jnb 0042A498
:0042A48A 8A45FC                  mov al, byte ptr [ebp-04]
:0042A48D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042A490 884113                  mov byte ptr [ecx+13], al
:0042A493 E909000000              jmp 0042A4A1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A484(C)
|
:0042A498 8A4508                  mov al, byte ptr [ebp+08]
:0042A49B 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042A49E 884113                  mov byte ptr [ecx+13], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A493(U)
|
:0042A4A1 E900000000              jmp 0042A4A6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A4A1(U)
|
:0042A4A6 5F                      pop edi
:0042A4A7 5E                      pop esi
:0042A4A8 5B                      pop ebx
:0042A4A9 C9                      leave
:0042A4AA C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0041A47B   , :00423934   
|
:0042A4AD 55                      push ebp
:0042A4AE 8BEC                    mov ebp, esp
:0042A4B0 83EC28                  sub esp, 00000028
:0042A4B3 53                      push ebx
:0042A4B4 56                      push esi
:0042A4B5 57                      push edi
:0042A4B6 894DDC                  mov dword ptr [ebp-24], ecx
:0042A4B9 8B4508                  mov eax, dword ptr [ebp+08]
:0042A4BC 50                      push eax
:0042A4BD E84A4AFFFF              call 0041EF0C
:0042A4C2 83C404                  add esp, 00000004
:0042A4C5 50                      push eax
:0042A4C6 E896EBFFFF              call 00429061
:0042A4CB 83C404                  add esp, 00000004
:0042A4CE 8845F4                  mov byte ptr [ebp-0C], al
:0042A4D1 33C0                    xor eax, eax
:0042A4D3 8A45F4                  mov al, byte ptr [ebp-0C]
:0042A4D6 3DFF000000              cmp eax, 000000FF
:0042A4DB 0F8507000000            jne 0042A4E8
:0042A4E1 33C0                    xor eax, eax
:0042A4E3 E9AC010000              jmp 0042A694

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A4DB(C)
|
:0042A4E8 33C0                    xor eax, eax
:0042A4EA 8A45F4                  mov al, byte ptr [ebp-0C]
:0042A4ED 8BC8                    mov ecx, eax
:0042A4EF 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042A4F2 C1E003                  shl eax, 03
:0042A4F5 2BC1                    sub eax, ecx
:0042A4F7 0598C04600              add eax, 0046C098
:0042A4FC 8945E4                  mov dword ptr [ebp-1C], eax
:0042A4FF 8B45DC                  mov eax, dword ptr [ebp-24]
:0042A502 8B00                    mov eax, dword ptr [eax]
:0042A504 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042A507 03C0                    add eax, eax
:0042A509 8D04C0                  lea eax, dword ptr [eax+8*eax]
:0042A50C 05E8564500              add eax, 004556E8
:0042A511 8945E8                  mov dword ptr [ebp-18], eax
:0042A514 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0042A517 E805FEFFFF              call 0042A321
:0042A51C 8845F8                  mov byte ptr [ebp-08], al
:0042A51F 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0042A522 E8FAFDFFFF              call 0042A321
:0042A527 8845EC                  mov byte ptr [ebp-14], al
:0042A52A C745F000000000          mov [ebp-10], 00000000
:0042A531 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0042A534 E8FEFBFFFF              call 0042A137
:0042A539 33C9                    xor ecx, ecx
:0042A53B 8A4DF8                  mov cl, byte ptr [ebp-08]
:0042A53E 0FAFC1                  imul eax, ecx
:0042A541 B90A000000              mov ecx, 0000000A
:0042A546 2BD2                    sub edx, edx
:0042A548 F7F1                    div ecx
:0042A54A 8945FC                  mov dword ptr [ebp-04], eax
:0042A54D 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0042A550 E8D2FCFFFF              call 0042A227
:0042A555 33C9                    xor ecx, ecx
:0042A557 8A4DEC                  mov cl, byte ptr [ebp-14]
:0042A55A 0FAFC1                  imul eax, ecx
:0042A55D B90A000000              mov ecx, 0000000A
:0042A562 2BD2                    sub edx, edx
:0042A564 F7F1                    div ecx
:0042A566 8945E0                  mov dword ptr [ebp-20], eax
:0042A569 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A56C 50                      push eax
:0042A56D E8B6CD0100              call 00447328
:0042A572 83C404                  add esp, 00000004
:0042A575 8BC8                    mov ecx, eax
:0042A577 BB0A000000              mov ebx, 0000000A
:0042A57C 8B45E0                  mov eax, dword ptr [ebp-20]
:0042A57F 2BD2                    sub edx, edx
:0042A581 F7F3                    div ebx
:0042A583 3BC8                    cmp ecx, eax
:0042A585 0F8328000000            jnb 0042A5B3
:0042A58B 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0042A58F 0F841E000000            je 0042A5B3
:0042A595 6A10                    push 00000010
:0042A597 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0042A59A E8B1EBFDFF              call 00409150
:0042A59F 85C0                    test eax, eax
:0042A5A1 0F850C000000            jne 0042A5B3
:0042A5A7 33C0                    xor eax, eax
:0042A5A9 E9E6000000              jmp 0042A694
:0042A5AE E9D9000000              jmp 0042A68C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042A585(C), :0042A58F(C), :0042A5A1(C)
|
:0042A5B3 8B45E0                  mov eax, dword ptr [ebp-20]
:0042A5B6 40                      inc eax
:0042A5B7 C1E801                  shr eax, 01
:0042A5BA 3B45FC                  cmp eax, dword ptr [ebp-04]
:0042A5BD 0F820C000000            jb 0042A5CF
:0042A5C3 C745F001000000          mov [ebp-10], 00000001
:0042A5CA E90E000000              jmp 0042A5DD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A5BD(C)
|
:0042A5CF 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A5D2 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0042A5D5 C1E901                  shr ecx, 01
:0042A5D8 2BC1                    sub eax, ecx
:0042A5DA 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A5CA(U)
|
:0042A5DD 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0042A5E0 E8BBECFDFF              call 004092A0
:0042A5E5 33C9                    xor ecx, ecx
:0042A5E7 8AC8                    mov cl, al
:0042A5E9 894DD8                  mov dword ptr [ebp-28], ecx
:0042A5EC E93C000000              jmp 0042A62D
:0042A5F1 8B45F0                  mov eax, dword ptr [ebp-10]
:0042A5F4 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042A5F7 C1E802                  shr eax, 02
:0042A5FA 8945F0                  mov dword ptr [ebp-10], eax
:0042A5FD E98A000000              jmp 0042A68C
:0042A602 8B45F0                  mov eax, dword ptr [ebp-10]
:0042A605 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042A608 C1E801                  shr eax, 01
:0042A60B 8945F0                  mov dword ptr [ebp-10], eax
:0042A60E E979000000              jmp 0042A68C
:0042A613 C16DF001                shr dword ptr [ebp-10], 01
:0042A617 E970000000              jmp 0042A68C
:0042A61C C745F001000000          mov [ebp-10], 00000001
:0042A623 E964000000              jmp 0042A68C
:0042A628 E95F000000              jmp 0042A68C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A5EC(U)
|
:0042A62D 836DD809                sub dword ptr [ebp-28], 00000009
:0042A631 837DD81E                cmp dword ptr [ebp-28], 0000001E
:0042A635 0F8751000000            ja 0042A68C
:0042A63B 8B45D8                  mov eax, dword ptr [ebp-28]
:0042A63E 33C9                    xor ecx, ecx
:0042A640 8A886DA64200            mov cl, byte ptr [eax+0042A66D]
:0042A646 FF248D4DA64200          jmp dword ptr [4*ecx+0042A64D]

:0042A64D F1A54200                DWORD 0042A5F1
:0042A651 02A64200                DWORD 0042A602
:0042A655 13A64200                DWORD 0042A613
:0042A659 1CA64200                DWORD 0042A61C
:0042A65D 13A64200                DWORD 0042A613
:0042A661 F1A54200                DWORD 0042A5F1
:0042A665 13A64200                DWORD 0042A613
:0042A669 8CA64200                DWORD 0042A68C


:0042A66D 000000                  BYTE  3 DUP(0)


:0042A670 07                      pop es
:0042A671 07                      pop es
:0042A672 07                      pop es
:0042A673 07                      pop es
:0042A674 07                      pop es
:0042A675 07                      pop es
:0042A676 07                      pop es
:0042A677 07                      pop es
:0042A678 07                      pop es
:0042A679 07                      pop es
:0042A67A 07                      pop es
:0042A67B 07                      pop es
:0042A67C 07                      pop es
:0042A67D 07                      pop es
:0042A67E 07                      pop es
:0042A67F 0101                    add dword ptr [ecx], eax
:0042A681 0102                    add dword ptr [edx], eax
:0042A683 0207                    add al, byte ptr [edi]
:0042A685 07                      pop es
:0042A686 0304050707068B          add eax, dword ptr [eax+8B060707]
:0042A68D 45                      inc ebp
:0042A68E F0                      lock
:0042A68F E900000000              jmp 0042A694

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042A4E3(U), :0042A5A9(U), :0042A68F(U)
|
:0042A694 5F                      pop edi
:0042A695 5E                      pop esi
:0042A696 5B                      pop ebx
:0042A697 C9                      leave
:0042A698 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:004428AE   , :00443498   
|
:0042A69B 55                      push ebp
:0042A69C 8BEC                    mov ebp, esp
:0042A69E 83EC40                  sub esp, 00000040
:0042A6A1 53                      push ebx
:0042A6A2 56                      push esi
:0042A6A3 57                      push edi
:0042A6A4 894DC4                  mov dword ptr [ebp-3C], ecx
:0042A6A7 8B45C4                  mov eax, dword ptr [ebp-3C]
:0042A6AA 8B00                    mov eax, dword ptr [eax]
:0042A6AC 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042A6AF 03C0                    add eax, eax
:0042A6B1 8D04C0                  lea eax, dword ptr [eax+8*eax]
:0042A6B4 05E8564500              add eax, 004556E8
:0042A6B9 8945EC                  mov dword ptr [ebp-14], eax
:0042A6BC 8B45C4                  mov eax, dword ptr [ebp-3C]
:0042A6BF 8B400F                  mov eax, dword ptr [eax+0F]
:0042A6C2 8945E4                  mov dword ptr [ebp-1C], eax
:0042A6C5 C745FC00000000          mov [ebp-04], 00000000
:0042A6CC C745F800000000          mov [ebp-08], 00000000
:0042A6D3 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:0042A6D6 E855F1FDFF              call 00409830
:0042A6DB 33C9                    xor ecx, ecx
:0042A6DD 8AC8                    mov cl, al
:0042A6DF 83F902                  cmp ecx, 00000002
:0042A6E2 0F8405000000            je 0042A6ED
:0042A6E8 E9A7040000              jmp 0042AB94

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A6E2(C)
|
:0042A6ED 8B45C4                  mov eax, dword ptr [ebp-3C]
:0042A6F0 83C005                  add eax, 00000005
:0042A6F3 50                      push eax
:0042A6F4 E8E1EEFEFF              call 004195DA
:0042A6F9 83C404                  add esp, 00000004
:0042A6FC 8845F4                  mov byte ptr [ebp-0C], al
:0042A6FF C745F000000000          mov [ebp-10], 00000000
:0042A706 8B45C4                  mov eax, dword ptr [ebp-3C]
:0042A709 83C005                  add eax, 00000005
:0042A70C 50                      push eax
:0042A70D E89CEAFEFF              call 004191AE
:0042A712 83C404                  add esp, 00000004
:0042A715 85C0                    test eax, eax
:0042A717 0F842E000000            je 0042A74B
:0042A71D C745F001000000          mov [ebp-10], 00000001
:0042A724 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0042A727 E864F0FDFF              call 00409790
:0042A72C 8BD8                    mov ebx, eax
:0042A72E 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042A731 50                      push eax
:0042A732 E862040000              call 0042AB99
:0042A737 83C404                  add esp, 00000004
:0042A73A 0FAFD8                  imul ebx, eax
:0042A73D B964000000              mov ecx, 00000064
:0042A742 8BC3                    mov eax, ebx
:0042A744 2BD2                    sub edx, edx
:0042A746 F7F1                    div ecx
:0042A748 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A717(C)
|
:0042A74B C745E800000000          mov [ebp-18], 00000000
:0042A752 E903000000              jmp 0042A75A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A7D2(U)
|
:0042A757 FF45E8                  inc [ebp-18]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A752(U)
|
:0042A75A 837DE80F                cmp dword ptr [ebp-18], 0000000F
:0042A75E 0F8373000000            jnb 0042A7D7
:0042A764 8B45E8                  mov eax, dword ptr [ebp-18]
:0042A767 50                      push eax
:0042A768 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0042A76B E890EDFDFF              call 00409500
:0042A770 8845E0                  mov byte ptr [ebp-20], al
:0042A773 33C0                    xor eax, eax
:0042A775 8A45E0                  mov al, byte ptr [ebp-20]
:0042A778 8BC8                    mov ecx, eax
:0042A77A C1E004                  shl eax, 04
:0042A77D 8D8C0818AA4600          lea ecx, dword ptr [eax+ecx+0046AA18]
:0042A784 E897EEFDFF              call 00409620
:0042A789 33C9                    xor ecx, ecx
:0042A78B 8AC8                    mov cl, al
:0042A78D 83F92A                  cmp ecx, 0000002A
:0042A790 0F853C000000            jne 0042A7D2
:0042A796 834DF001                or dword ptr [ebp-10], 00000001
:0042A79A 33C0                    xor eax, eax
:0042A79C 8A45E0                  mov al, byte ptr [ebp-20]
:0042A79F 8BC8                    mov ecx, eax
:0042A7A1 C1E004                  shl eax, 04
:0042A7A4 8D8C0818AA4600          lea ecx, dword ptr [eax+ecx+0046AA18]
:0042A7AB E850EEFDFF              call 00409600
:0042A7B0 33DB                    xor ebx, ebx
:0042A7B2 8AD8                    mov bl, al
:0042A7B4 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0042A7B7 E8D4EFFDFF              call 00409790
:0042A7BC 0FAFD8                  imul ebx, eax
:0042A7BF B964000000              mov ecx, 00000064
:0042A7C4 8BC3                    mov eax, ebx
:0042A7C6 2BD2                    sub edx, edx
:0042A7C8 F7F1                    div ecx
:0042A7CA 8945F8                  mov dword ptr [ebp-08], eax
:0042A7CD E905000000              jmp 0042A7D7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A790(C)
|
:0042A7D2 E980FFFFFF              jmp 0042A757

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042A75E(C), :0042A7CD(U)
|
:0042A7D7 F645F001                test [ebp-10], 01
:0042A7DB 0F8431000000            je 0042A812
:0042A7E1 8B45F8                  mov eax, dword ptr [ebp-08]
:0042A7E4 0345FC                  add eax, dword ptr [ebp-04]
:0042A7E7 0345E4                  add eax, dword ptr [ebp-1C]
:0042A7EA 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:0042A7ED 89410F                  mov dword ptr [ecx+0F], eax
:0042A7F0 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0042A7F3 E898EFFDFF              call 00409790
:0042A7F8 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:0042A7FB 3B410F                  cmp eax, dword ptr [ecx+0F]
:0042A7FE 0F830E000000            jnb 0042A812
:0042A804 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0042A807 E884EFFDFF              call 00409790
:0042A80C 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:0042A80F 89410F                  mov dword ptr [ecx+0F], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042A7DB(C), :0042A7FE(C)
|
:0042A812 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:0042A815 E886EAFDFF              call 004092A0
:0042A81A 33C9                    xor ecx, ecx
:0042A81C 8AC8                    mov cl, al
:0042A81E 83F91D                  cmp ecx, 0000001D
:0042A821 0F85ED000000            jne 0042A914
:0042A827 C745E800000000          mov [ebp-18], 00000000
:0042A82E E903000000              jmp 0042A836

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A90F(U)
|
:0042A833 FF45E8                  inc [ebp-18]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A82E(U)
|
:0042A836 837DE804                cmp dword ptr [ebp-18], 00000004
:0042A83A 0F83D4000000            jnb 0042A914
:0042A840 8B45E8                  mov eax, dword ptr [ebp-18]
:0042A843 50                      push eax
:0042A844 8B45C4                  mov eax, dword ptr [ebp-3C]
:0042A847 83C005                  add eax, 00000005
:0042A84A 50                      push eax
:0042A84B E805EEFEFF              call 00419655
:0042A850 83C408                  add esp, 00000008
:0042A853 668B00                  mov ax, word ptr [eax]
:0042A856 668945DC                mov word ptr [ebp-24], ax
:0042A85A 33C0                    xor eax, eax
:0042A85C 8A45DC                  mov al, byte ptr [ebp-24]
:0042A85F 3DFF000000              cmp eax, 000000FF
:0042A864 0F84A5000000            je 0042A90F
:0042A86A 8D45DC                  lea eax, dword ptr [ebp-24]
:0042A86D 50                      push eax
:0042A86E E8CAECFEFF              call 0041953D
:0042A873 83C404                  add esp, 00000004
:0042A876 8845D8                  mov byte ptr [ebp-28], al
:0042A879 33C0                    xor eax, eax
:0042A87B 8A45D8                  mov al, byte ptr [ebp-28]
:0042A87E 3DFF000000              cmp eax, 000000FF
:0042A883 0F8486000000            je 0042A90F
:0042A889 33C0                    xor eax, eax
:0042A88B 8A45D8                  mov al, byte ptr [ebp-28]
:0042A88E 8BC8                    mov ecx, eax
:0042A890 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042A893 C1E003                  shl eax, 03
:0042A896 2BC1                    sub eax, ecx
:0042A898 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0042A89E E8FDE9FDFF              call 004092A0
:0042A8A3 33C9                    xor ecx, ecx
:0042A8A5 8AC8                    mov cl, al
:0042A8A7 83F91C                  cmp ecx, 0000001C
:0042A8AA 0F845F000000            je 0042A90F
:0042A8B0 33C0                    xor eax, eax
:0042A8B2 8A45D8                  mov al, byte ptr [ebp-28]
:0042A8B5 8BC8                    mov ecx, eax
:0042A8B7 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042A8BA C1E003                  shl eax, 03
:0042A8BD 2BC1                    sub eax, ecx
:0042A8BF 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0042A8C5 E856E9FDFF              call 00409220
:0042A8CA 8BD8                    mov ebx, eax
:0042A8CC 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:0042A8CF E84CE9FDFF              call 00409220
:0042A8D4 3BD8                    cmp ebx, eax
:0042A8D6 0F8533000000            jne 0042A90F
:0042A8DC 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0042A8DF E82CE8FDFF              call 00409110
:0042A8E4 33C9                    xor ecx, ecx
:0042A8E6 8AC8                    mov cl, al
:0042A8E8 BB0A000000              mov ebx, 0000000A
:0042A8ED 8BC1                    mov eax, ecx
:0042A8EF 2BD2                    sub edx, edx
:0042A8F1 F7F3                    div ebx
:0042A8F3 40                      inc eax
:0042A8F4 50                      push eax
:0042A8F5 33C0                    xor eax, eax
:0042A8F7 8A45D8                  mov al, byte ptr [ebp-28]
:0042A8FA 8BC8                    mov ecx, eax
:0042A8FC 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042A8FF C1E003                  shl eax, 03
:0042A902 2BC1                    sub eax, ecx
:0042A904 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0042A90A E80F350000              call 0042DE1E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042A864(C), :0042A883(C), :0042A8AA(C), :0042A8D6(C)
|
:0042A90F E91FFFFFFF              jmp 0042A833

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042A821(C), :0042A83A(C)
|
:0042A914 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:0042A917 E8B4EAFDFF              call 004093D0
:0042A91C 33C9                    xor ecx, ecx
:0042A91E 8AC8                    mov cl, al
:0042A920 83F907                  cmp ecx, 00000007
:0042A923 0F8566020000            jne 0042AB8F
:0042A929 837DF000                cmp dword ptr [ebp-10], 00000000
:0042A92D 0F845C020000            je 0042AB8F
:0042A933 837DF001                cmp dword ptr [ebp-10], 00000001
:0042A937 0F850F000000            jne 0042A94C
:0042A93D 8B45C4                  mov eax, dword ptr [ebp-3C]
:0042A940 8B400F                  mov eax, dword ptr [eax+0F]
:0042A943 2B45E4                  sub eax, dword ptr [ebp-1C]
:0042A946 0F8443020000            je 0042AB8F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A937(C)
|
:0042A94C C745D016000000          mov [ebp-30], 00000016
:0042A953 C745CC00010000          mov [ebp-34], 00000100
:0042A95A F645F001                test [ebp-10], 01
:0042A95E 0F840C000000            je 0042A970
:0042A964 C745D430000000          mov [ebp-2C], 00000030
:0042A96B E907000000              jmp 0042A977

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A95E(C)
|
:0042A970 C745D400000000          mov [ebp-2C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A96B(U)
|
:0042A977 6A04                    push 00000004
:0042A979 B910BC4600              mov ecx, 0046BC10
:0042A97E E8FE54FFFF              call 0041FE81
:0042A983 6A07                    push 00000007
:0042A985 B910BC4600              mov ecx, 0046BC10
:0042A98A E84453FFFF              call 0041FCD3
:0042A98F 6A00                    push 00000000
:0042A991 B910BC4600              mov ecx, 0046BC10
:0042A996 E83554FFFF              call 0041FDD0
:0042A99B 6A01                    push 00000001
:0042A99D 8B45C4                  mov eax, dword ptr [ebp-3C]
:0042A9A0 33C9                    xor ecx, ecx
:0042A9A2 8A4806                  mov cl, byte ptr [eax+06]
:0042A9A5 8D0449                  lea eax, dword ptr [ecx+2*ecx]
:0042A9A8 50                      push eax
:0042A9A9 8B45C4                  mov eax, dword ptr [ebp-3C]
:0042A9AC 33C9                    xor ecx, ecx
:0042A9AE 8A4805                  mov cl, byte ptr [eax+05]
:0042A9B1 8D0449                  lea eax, dword ptr [ecx+2*ecx]
:0042A9B4 50                      push eax
:0042A9B5 B900FB4600              mov ecx, 0046FB00
:0042A9BA E86C050100              call 0043AF2B
:0042A9BF 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:0042A9C2 E879210000              call 0042CB40
:0042A9C7 6A3C                    push 0000003C
:0042A9C9 6800010000              push 00000100
:0042A9CE 8B45CC                  mov eax, dword ptr [ebp-34]
:0042A9D1 50                      push eax
:0042A9D2 8B45D0                  mov eax, dword ptr [ebp-30]
:0042A9D5 8D04C5F8FFFFFF          lea eax, dword ptr [8*eax+FFFFFFF8]
:0042A9DC 50                      push eax
:0042A9DD E8B0FA0000              call 0043A492
:0042A9E2 83C410                  add esp, 00000010
:0042A9E5 B968F94600              mov ecx, 0046F968
:0042A9EA E8F1E6FDFF              call 004090E0
:0042A9EF 50                      push eax
:0042A9F0 6A10                    push 00000010
:0042A9F2 6880000000              push 00000080
:0042A9F7 8B45CC                  mov eax, dword ptr [ebp-34]
:0042A9FA 83C020                  add eax, 00000020
:0042A9FD 50                      push eax
:0042A9FE 8B45D0                  mov eax, dword ptr [ebp-30]
:0042AA01 8D04C538000000          lea eax, dword ptr [8*eax+00000038]
:0042AA08 50                      push eax
:0042AA09 E81D290100              call 0043D32B
:0042AA0E 83C414                  add esp, 00000014
:0042AA11 C745C800000000          mov [ebp-38], 00000000
:0042AA18 8B45C4                  mov eax, dword ptr [ebp-3C]
:0042AA1B 8B400F                  mov eax, dword ptr [eax+0F]
:0042AA1E 2B45E4                  sub eax, dword ptr [ebp-1C]
:0042AA21 0F8404000000            je 0042AA2B
:0042AA27 834DC801                or dword ptr [ebp-38], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042AA21(C)
|
:0042AA2B 8B45C8                  mov eax, dword ptr [ebp-38]
:0042AA2E 8945C0                  mov dword ptr [ebp-40], eax
:0042AA31 E916000000              jmp 0042AA4C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042AA50(C)
|
:0042AA36 6A21                    push 00000021
:0042AA38 B994A64600              mov ecx, 0046A694
:0042AA3D E8E2E5FEFF              call 00419024
:0042AA42 E914000000              jmp 0042AA5B
:0042AA47 E90F000000              jmp 0042AA5B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042AA31(U)
|
:0042AA4C 837DC001                cmp dword ptr [ebp-40], 00000001
:0042AA50 0F84E0FFFFFF            je 0042AA36
:0042AA56 E900000000              jmp 0042AA5B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042AA42(U), :0042AA47(U), :0042AA56(U)
|
:0042AA5B F645F001                test [ebp-10], 01
:0042AA5F 0F848C000000            je 0042AAF1
:0042AA65 8B45CC                  mov eax, dword ptr [ebp-34]
:0042AA68 83C008                  add eax, 00000008
:0042AA6B 50                      push eax
:0042AA6C 8B45D0                  mov eax, dword ptr [ebp-30]
:0042AA6F 83C002                  add eax, 00000002
:0042AA72 50                      push eax
:0042AA73 B910BC4600              mov ecx, 0046BC10
:0042AA78 E88A51FFFF              call 0041FC07
:0042AA7D 8B45C4                  mov eax, dword ptr [ebp-3C]
:0042AA80 8B400F                  mov eax, dword ptr [eax+0F]
:0042AA83 2B45E4                  sub eax, dword ptr [ebp-1C]
:0042AA86 0F8517000000            jne 0042AAA3

* Possible StringData Ref from Data Obj ->"ٻָ;ˡ"
                                  |
:0042AA8C 681C224500              push 0045221C
:0042AA91 6810BC4600              push 0046BC10
:0042AA96 E88860FFFF              call 00420B23
:0042AA9B 83C408                  add esp, 00000008
:0042AA9E E925000000              jmp 0042AAC8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042AA86(C)
|
:0042AAA3 8B45C4                  mov eax, dword ptr [ebp-3C]
:0042AAA6 8B400F                  mov eax, dword ptr [eax+0F]
:0042AAA9 2B45E4                  sub eax, dword ptr [ebp-1C]
:0042AAAC 50                      push eax
:0042AAAD 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:0042AAB0 E8CBEAFDFF              call 00409580
:0042AAB5 50                      push eax

* Possible StringData Ref from Data Obj ->"%s;ָ%u"
                                  |
:0042AAB6 6834224500              push 00452234
:0042AABB 6810BC4600              push 0046BC10
:0042AAC0 E85E60FFFF              call 00420B23
:0042AAC5 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042AA9E(U)
|
:0042AAC8 6880000000              push 00000080
:0042AACD 8B45E4                  mov eax, dword ptr [ebp-1C]
:0042AAD0 50                      push eax
:0042AAD1 8B45EC                  mov eax, dword ptr [ebp-14]
:0042AAD4 50                      push eax
:0042AAD5 8B45CC                  mov eax, dword ptr [ebp-34]
:0042AAD8 83C020                  add eax, 00000020
:0042AADB 50                      push eax
:0042AADC 8B45D0                  mov eax, dword ptr [ebp-30]
:0042AADF 8D04C538000000          lea eax, dword ptr [8*eax+00000038]
:0042AAE6 50                      push eax
:0042AAE7 6A0B                    push 0000000B
:0042AAE9 E83E5DFEFF              call 0041082C
:0042AAEE 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042AA5F(C)
|
:0042AAF1 6A0A                    push 0000000A
:0042AAF3 E862C90000              call 0043745A
:0042AAF8 83C404                  add esp, 00000004
:0042AAFB E8EFC80000              call 004373EF
:0042AB00 E8E2C90000              call 004374E7
:0042AB05 F645F001                test [ebp-10], 01
:0042AB09 0F845A000000            je 0042AB69
:0042AB0F 6A00                    push 00000000
:0042AB11 B968F94600              mov ecx, 0046F968
:0042AB16 E8C5E5FDFF              call 004090E0
:0042AB1B 50                      push eax
:0042AB1C 6A10                    push 00000010
:0042AB1E 6880000000              push 00000080
:0042AB23 8B45CC                  mov eax, dword ptr [ebp-34]
:0042AB26 83C020                  add eax, 00000020
:0042AB29 50                      push eax
:0042AB2A 8B45D0                  mov eax, dword ptr [ebp-30]
:0042AB2D 8D04C538000000          lea eax, dword ptr [8*eax+00000038]
:0042AB34 50                      push eax
:0042AB35 E87B270100              call 0043D2B5
:0042AB3A 83C418                  add esp, 00000018
:0042AB3D 6880000000              push 00000080
:0042AB42 8B45C4                  mov eax, dword ptr [ebp-3C]
:0042AB45 8B400F                  mov eax, dword ptr [eax+0F]
:0042AB48 50                      push eax
:0042AB49 8B45EC                  mov eax, dword ptr [ebp-14]
:0042AB4C 50                      push eax
:0042AB4D 8B45CC                  mov eax, dword ptr [ebp-34]
:0042AB50 83C020                  add eax, 00000020
:0042AB53 50                      push eax
:0042AB54 8B45D0                  mov eax, dword ptr [ebp-30]
:0042AB57 8D04C538000000          lea eax, dword ptr [8*eax+00000038]
:0042AB5E 50                      push eax
:0042AB5F 6A0B                    push 0000000B
:0042AB61 E8C65CFEFF              call 0041082C
:0042AB66 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042AB09(C)
|
:0042AB69 6A0A                    push 0000000A
:0042AB6B E8EAC80000              call 0043745A
:0042AB70 83C404                  add esp, 00000004
:0042AB73 E877C80000              call 004373EF
:0042AB78 E86AC90000              call 004374E7
:0042AB7D 6A09                    push 00000009
:0042AB7F 6A15                    push 00000015
:0042AB81 6A0C                    push 0000000C
:0042AB83 6A09                    push 00000009
:0042AB85 B900FB4600              mov ecx, 0046FB00
:0042AB8A E89EFF0000              call 0043AB2D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042A923(C), :0042A92D(C), :0042A946(C)
|
:0042AB8F E900000000              jmp 0042AB94

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042A6E8(U), :0042AB8F(U)
|
:0042AB94 5F                      pop edi
:0042AB95 5E                      pop esi
:0042AB96 5B                      pop ebx
:0042AB97 C9                      leave
:0042AB98 C3                      ret



* Referenced by a CALL at Address:
|:0042A732   
|
:0042AB99 55                      push ebp
:0042AB9A 8BEC                    mov ebp, esp
:0042AB9C 83EC04                  sub esp, 00000004
:0042AB9F 53                      push ebx
:0042ABA0 56                      push esi
:0042ABA1 57                      push edi
:0042ABA2 33C0                    xor eax, eax
:0042ABA4 8A4508                  mov al, byte ptr [ebp+08]
:0042ABA7 8945FC                  mov dword ptr [ebp-04], eax
:0042ABAA E966000000              jmp 0042AC15
:0042ABAF 6A05                    push 00000005
:0042ABB1 E872C70100              call 00447328
:0042ABB6 83C404                  add esp, 00000004
:0042ABB9 83C00A                  add eax, 0000000A
:0042ABBC E988000000              jmp 0042AC49
:0042ABC1 6A05                    push 00000005
:0042ABC3 E860C70100              call 00447328
:0042ABC8 83C404                  add esp, 00000004
:0042ABCB 83C00F                  add eax, 0000000F
:0042ABCE E976000000              jmp 0042AC49
:0042ABD3 6A05                    push 00000005
:0042ABD5 E84EC70100              call 00447328
:0042ABDA 83C404                  add esp, 00000004
:0042ABDD 83C005                  add eax, 00000005
:0042ABE0 E964000000              jmp 0042AC49
:0042ABE5 6A05                    push 00000005
:0042ABE7 E83CC70100              call 00447328
:0042ABEC 83C404                  add esp, 00000004
:0042ABEF 83C014                  add eax, 00000014
:0042ABF2 E952000000              jmp 0042AC49
:0042ABF7 6A05                    push 00000005
:0042ABF9 E82AC70100              call 00447328
:0042ABFE 83C404                  add esp, 00000004
:0042AC01 83C019                  add eax, 00000019
:0042AC04 E940000000              jmp 0042AC49

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042AC1D(C)
|
:0042AC09 33C0                    xor eax, eax
:0042AC0B E939000000              jmp 0042AC49
:0042AC10 E934000000              jmp 0042AC49

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042ABAA(U)
|
:0042AC15 836DFC07                sub dword ptr [ebp-04], 00000007
:0042AC19 837DFC06                cmp dword ptr [ebp-04], 00000006
:0042AC1D 0F87E6FFFFFF            ja 0042AC09
:0042AC23 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AC26 FF24852DAC4200          jmp dword ptr [4*eax+0042AC2D]

:0042AC2D AFAB4200                DWORD 0042ABAF
:0042AC31 C1AB4200                DWORD 0042ABC1
:0042AC35 D3AB4200                DWORD 0042ABD3
:0042AC39 09AC4200                DWORD 0042AC09
:0042AC3D 09AC4200                DWORD 0042AC09
:0042AC41 F7AB4200                DWORD 0042ABF7
:0042AC45 E5AB4200                DWORD 0042ABE5



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042ABBC(U), :0042ABCE(U), :0042ABE0(U), :0042ABF2(U), :0042AC04(U)
|:0042AC0B(U), :0042AC10(U)
|
:0042AC49 5F                      pop edi
:0042AC4A 5E                      pop esi
:0042AC4B 5B                      pop ebx
:0042AC4C C9                      leave
:0042AC4D C3                      ret



* Referenced by a CALL at Addresses:
|:0042AE75   , :0042AEF6   
|
:0042AC4E 55                      push ebp
:0042AC4F 8BEC                    mov ebp, esp
:0042AC51 83EC10                  sub esp, 00000010
:0042AC54 53                      push ebx
:0042AC55 56                      push esi
:0042AC56 57                      push edi
:0042AC57 33C0                    xor eax, eax
:0042AC59 8A4508                  mov al, byte ptr [ebp+08]
:0042AC5C 8BC8                    mov ecx, eax
:0042AC5E 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042AC61 C1E003                  shl eax, 03
:0042AC64 2BC1                    sub eax, ecx
:0042AC66 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0042AC6C E8BFE4FDFF              call 00409130
:0042AC71 8945F4                  mov dword ptr [ebp-0C], eax
:0042AC74 33C0                    xor eax, eax
:0042AC76 8A4508                  mov al, byte ptr [ebp+08]
:0042AC79 8BC8                    mov ecx, eax
:0042AC7B 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042AC7E C1E003                  shl eax, 03
:0042AC81 2BC1                    sub eax, ecx
:0042AC83 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0042AC89 E812E6FDFF              call 004092A0
:0042AC8E 8845F8                  mov byte ptr [ebp-08], al
:0042AC91 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042AC94 50                      push eax
:0042AC95 E82216FEFF              call 0040C2BC
:0042AC9A 83C404                  add esp, 00000004
:0042AC9D 33C9                    xor ecx, ecx
:0042AC9F 8AC8                    mov cl, al
:0042ACA1 894DF0                  mov dword ptr [ebp-10], ecx
:0042ACA4 E9E9000000              jmp 0042AD92
:0042ACA9 33C0                    xor eax, eax
:0042ACAB 8A450C                  mov al, byte ptr [ebp+0C]
:0042ACAE 85C0                    test eax, eax
:0042ACB0 0F8409000000            je 0042ACBF
:0042ACB6 C645FC03                mov [ebp-04], 03
:0042ACBA E904000000              jmp 0042ACC3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042ACB0(C)
|
:0042ACBF C645FC02                mov [ebp-04], 02

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042ACBA(U)
|
:0042ACC3 E912010000              jmp 0042ADDA
:0042ACC8 33C0                    xor eax, eax
:0042ACCA 8A450C                  mov al, byte ptr [ebp+0C]
:0042ACCD 85C0                    test eax, eax
:0042ACCF 0F8409000000            je 0042ACDE
:0042ACD5 C645FC02                mov [ebp-04], 02
:0042ACD9 E904000000              jmp 0042ACE2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042ACCF(C)
|
:0042ACDE C645FC03                mov [ebp-04], 03

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042ACD9(U)
|
:0042ACE2 E9F3000000              jmp 0042ADDA
:0042ACE7 33C0                    xor eax, eax
:0042ACE9 8A450C                  mov al, byte ptr [ebp+0C]
:0042ACEC 85C0                    test eax, eax
:0042ACEE 0F8409000000            je 0042ACFD
:0042ACF4 C645FC0A                mov [ebp-04], 0A
:0042ACF8 E904000000              jmp 0042AD01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042ACEE(C)
|
:0042ACFD C645FC01                mov [ebp-04], 01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042ACF8(U)
|
:0042AD01 E9D4000000              jmp 0042ADDA
:0042AD06 33C0                    xor eax, eax
:0042AD08 8A450C                  mov al, byte ptr [ebp+0C]
:0042AD0B 85C0                    test eax, eax
:0042AD0D 0F8409000000            je 0042AD1C
:0042AD13 C645FC04                mov [ebp-04], 04
:0042AD17 E904000000              jmp 0042AD20

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042AD0D(C)
|
:0042AD1C C645FC01                mov [ebp-04], 01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042AD17(U)
|
:0042AD20 E9B5000000              jmp 0042ADDA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042AD96(C)
|
:0042AD25 33C0                    xor eax, eax
:0042AD27 8A45F8                  mov al, byte ptr [ebp-08]
:0042AD2A 83F820                  cmp eax, 00000020
:0042AD2D 0F841C000000            je 0042AD4F
:0042AD33 33C0                    xor eax, eax
:0042AD35 8A45F8                  mov al, byte ptr [ebp-08]
:0042AD38 83F821                  cmp eax, 00000021
:0042AD3B 0F840E000000            je 0042AD4F
:0042AD41 33C0                    xor eax, eax
:0042AD43 8A45F8                  mov al, byte ptr [ebp-08]
:0042AD46 83F826                  cmp eax, 00000026
:0042AD49 0F851F000000            jne 0042AD6E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042AD2D(C), :0042AD3B(C)
|
:0042AD4F 33C0                    xor eax, eax
:0042AD51 8A450C                  mov al, byte ptr [ebp+0C]
:0042AD54 85C0                    test eax, eax
:0042AD56 0F8409000000            je 0042AD65
:0042AD5C C645FC04                mov [ebp-04], 04
:0042AD60 E904000000              jmp 0042AD69

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042AD56(C)
|
:0042AD65 C645FC01                mov [ebp-04], 01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042AD60(U)
|
:0042AD69 E91A000000              jmp 0042AD88

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042AD49(C)
|
:0042AD6E 33C0                    xor eax, eax
:0042AD70 8A450C                  mov al, byte ptr [ebp+0C]
:0042AD73 85C0                    test eax, eax
:0042AD75 0F8409000000            je 0042AD84
:0042AD7B C645FC01                mov [ebp-04], 01
:0042AD7F E904000000              jmp 0042AD88

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042AD75(C)
|
:0042AD84 C645FC04                mov [ebp-04], 04

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042AD69(U), :0042AD7F(U)
|
:0042AD88 E94D000000              jmp 0042ADDA
:0042AD8D E948000000              jmp 0042ADDA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042ACA4(U)
|
:0042AD92 837DF00B                cmp dword ptr [ebp-10], 0000000B
:0042AD96 0F8789FFFFFF            ja 0042AD25
:0042AD9C 8B45F0                  mov eax, dword ptr [ebp-10]
:0042AD9F 33C9                    xor ecx, ecx
:0042ADA1 8A88CEAD4200            mov cl, byte ptr [eax+0042ADCE]
:0042ADA7 FF248DAEAD4200          jmp dword ptr [4*ecx+0042ADAE]

:0042ADAE A9AC4200                DWORD 0042ACA9
:0042ADB2 C8AC4200                DWORD 0042ACC8
:0042ADB6 A9AC4200                DWORD 0042ACA9
:0042ADBA C8AC4200                DWORD 0042ACC8
:0042ADBE E7AC4200                DWORD 0042ACE7
:0042ADC2 C8AC4200                DWORD 0042ACC8
:0042ADC6 06AD4200                DWORD 0042AD06
:0042ADCA 25AD4200                DWORD 0042AD25


:0042ADCE 0000                    add byte ptr [eax], al
:0042ADD0 0102                    add dword ptr [edx], eax
:0042ADD2 0203                    add al, byte ptr [ebx]
:0042ADD4 0405                    add al, 05
:0042ADD6 050706068A              add eax, 8A060607
:0042ADDB 45                      inc ebp
:0042ADDC FC                      cld
:0042ADDD E900000000              jmp 0042ADE2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042ADDD(U)
|
:0042ADE2 5F                      pop edi
:0042ADE3 5E                      pop esi
:0042ADE4 5B                      pop ebx
:0042ADE5 C9                      leave
:0042ADE6 C3                      ret



* Referenced by a CALL at Addresses:
|:0042AFAF   , :0042AFE0   , :0042B03E   , :0042B06F   , :0042B0B6   
|:0042B0D9   , :0042B0FC   , :0042B11F   , :0042B142   , :0042B16D   
|
:0042ADE7 55                      push ebp
:0042ADE8 8BEC                    mov ebp, esp
:0042ADEA 83EC10                  sub esp, 00000010
:0042ADED 53                      push ebx
:0042ADEE 56                      push esi
:0042ADEF 57                      push edi
:0042ADF0 894DF4                  mov dword ptr [ebp-0C], ecx
:0042ADF3 C745FC00000000          mov [ebp-04], 00000000
:0042ADFA 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042ADFD 8B00                    mov eax, dword ptr [eax]
:0042ADFF 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042AE02 03C0                    add eax, eax
:0042AE04 8D04C0                  lea eax, dword ptr [eax+8*eax]
:0042AE07 05E8564500              add eax, 004556E8
:0042AE0C 8945F8                  mov dword ptr [ebp-08], eax
:0042AE0F 33C0                    xor eax, eax
:0042AE11 8A4508                  mov al, byte ptr [ebp+08]
:0042AE14 83F803                  cmp eax, 00000003
:0042AE17 0F850A000000            jne 0042AE27
:0042AE1D F6450C08                test [ebp+0C], 08
:0042AE21 0F840E000000            je 0042AE35

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042AE17(C)
|
:0042AE27 33C0                    xor eax, eax
:0042AE29 8A4510                  mov al, byte ptr [ebp+10]
:0042AE2C 83F802                  cmp eax, 00000002
:0042AE2F 0F8E73000000            jle 0042AEA8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042AE21(C)
|
:0042AE35 BB14000000              mov ebx, 00000014
:0042AE3A 895DF0                  mov dword ptr [ebp-10], ebx
:0042AE3D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042AE40 E8CBE2FDFF              call 00409110
:0042AE45 33DB                    xor ebx, ebx
:0042AE47 8AD8                    mov bl, al
:0042AE49 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042AE4C E8D6F3FFFF              call 0042A227
:0042AE51 B964000000              mov ecx, 00000064
:0042AE56 03C3                    add eax, ebx
:0042AE58 2BD2                    sub edx, edx
:0042AE5A F7F1                    div ecx
:0042AE5C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0042AE5F 2BC8                    sub ecx, eax
:0042AE61 51                      push ecx
:0042AE62 E8C1C40100              call 00447328
:0042AE67 83C404                  add esp, 00000004
:0042AE6A 8BD8                    mov ebx, eax
:0042AE6C 6A01                    push 00000001
:0042AE6E 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042AE71 8A4004                  mov al, byte ptr [eax+04]
:0042AE74 50                      push eax
:0042AE75 E8D4FDFFFF              call 0042AC4E
:0042AE7A 83C408                  add esp, 00000008
:0042AE7D 33C9                    xor ecx, ecx
:0042AE7F 8AC8                    mov cl, al
:0042AE81 3BD9                    cmp ebx, ecx
:0042AE83 0F871A000000            ja 0042AEA3
:0042AE89 6A01                    push 00000001
:0042AE8B 8B450C                  mov eax, dword ptr [ebp+0C]
:0042AE8E 50                      push eax
:0042AE8F 8B4508                  mov eax, dword ptr [ebp+08]
:0042AE92 50                      push eax
:0042AE93 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042AE96 8B00                    mov eax, dword ptr [eax]
:0042AE98 50                      push eax
:0042AE99 B988C04600              mov ecx, 0046C088
:0042AE9E E868DBFFFF              call 00428A0B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042AE83(C)
|
:0042AEA3 E97C000000              jmp 0042AF24

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042AE2F(C)
|
:0042AEA8 F6450C08                test [ebp+0C], 08
:0042AEAC 0F850E000000            jne 0042AEC0
:0042AEB2 33C0                    xor eax, eax
:0042AEB4 8A4510                  mov al, byte ptr [ebp+10]
:0042AEB7 83F802                  cmp eax, 00000002
:0042AEBA 0F8D64000000            jnl 0042AF24

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042AEAC(C)
|
:0042AEC0 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042AEC3 E848E2FDFF              call 00409110
:0042AEC8 33DB                    xor ebx, ebx
:0042AECA 8AD8                    mov bl, al
:0042AECC 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042AECF E853F3FFFF              call 0042A227
:0042AED4 B964000000              mov ecx, 00000064
:0042AED9 03C3                    add eax, ebx
:0042AEDB 2BD2                    sub edx, edx
:0042AEDD F7F1                    div ecx
:0042AEDF 83C014                  add eax, 00000014
:0042AEE2 50                      push eax
:0042AEE3 E840C40100              call 00447328
:0042AEE8 83C404                  add esp, 00000004
:0042AEEB 8BD8                    mov ebx, eax
:0042AEED 6A00                    push 00000000
:0042AEEF 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042AEF2 8A4004                  mov al, byte ptr [eax+04]
:0042AEF5 50                      push eax
:0042AEF6 E853FDFFFF              call 0042AC4E
:0042AEFB 83C408                  add esp, 00000008
:0042AEFE 33C9                    xor ecx, ecx
:0042AF00 8AC8                    mov cl, al
:0042AF02 3BD9                    cmp ebx, ecx
:0042AF04 0F871A000000            ja 0042AF24
:0042AF0A 6A01                    push 00000001
:0042AF0C 8B450C                  mov eax, dword ptr [ebp+0C]
:0042AF0F 50                      push eax
:0042AF10 8B4508                  mov eax, dword ptr [ebp+08]
:0042AF13 50                      push eax
:0042AF14 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042AF17 8B00                    mov eax, dword ptr [eax]
:0042AF19 50                      push eax
:0042AF1A B988C04600              mov ecx, 0046C088
:0042AF1F E8E7DAFFFF              call 00428A0B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042AEA3(U), :0042AEBA(C), :0042AF04(C)
|
:0042AF24 E900000000              jmp 0042AF29

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042AF24(U)
|
:0042AF29 5F                      pop edi
:0042AF2A 5E                      pop esi
:0042AF2B 5B                      pop ebx
:0042AF2C C9                      leave
:0042AF2D C20C00                  ret 000C



* Referenced by a CALL at Addresses:
|:004428C8   , :00442CCA   
|
:0042AF30 55                      push ebp
:0042AF31 8BEC                    mov ebp, esp
:0042AF33 83EC04                  sub esp, 00000004
:0042AF36 53                      push ebx
:0042AF37 56                      push esi
:0042AF38 57                      push edi
:0042AF39 894DFC                  mov dword ptr [ebp-04], ecx
:0042AF3C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042AF3F E8ECE8FDFF              call 00409830
:0042AF44 33C9                    xor ecx, ecx
:0042AF46 8AC8                    mov cl, al
:0042AF48 83F902                  cmp ecx, 00000002
:0042AF4B 0F8405000000            je 0042AF56
:0042AF51 E921020000              jmp 0042B177

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042AF4B(C)
|
:0042AF56 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042AF59 E822300000              call 0042DF80
:0042AF5E 33C9                    xor ecx, ecx
:0042AF60 8AC8                    mov cl, al
:0042AF62 F6C140                  test cl, 40
:0042AF65 0F841D000000            je 0042AF88
:0042AF6B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042AF6E E85DE7FDFF              call 004096D0
:0042AF73 33C9                    xor ecx, ecx
:0042AF75 8AC8                    mov cl, al
:0042AF77 83E1BF                  and ecx, FFFFFFBF
:0042AF7A 51                      push ecx
:0042AF7B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042AF7E E81DE7FDFF              call 004096A0
:0042AF83 E95D000000              jmp 0042AFE5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042AF65(C)
|
:0042AF88 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AF8B 33C9                    xor ecx, ecx
:0042AF8D 8A4814                  mov cl, byte ptr [eax+14]
:0042AF90 83F902                  cmp ecx, 00000002
:0042AF93 0F8E20000000            jle 0042AFB9
:0042AF99 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AF9C 8A4014                  mov al, byte ptr [eax+14]
:0042AF9F 50                      push eax
:0042AFA0 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AFA3 33C9                    xor ecx, ecx
:0042AFA5 8A4814                  mov cl, byte ptr [eax+14]
:0042AFA8 49                      dec ecx
:0042AFA9 51                      push ecx
:0042AFAA 6A00                    push 00000000
:0042AFAC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042AFAF E833FEFFFF              call 0042ADE7
:0042AFB4 E92C000000              jmp 0042AFE5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042AF93(C)
|
:0042AFB9 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AFBC 33C9                    xor ecx, ecx
:0042AFBE 8A4814                  mov cl, byte ptr [eax+14]
:0042AFC1 83F902                  cmp ecx, 00000002
:0042AFC4 0F8D1B000000            jnl 0042AFE5
:0042AFCA 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AFCD 8A4014                  mov al, byte ptr [eax+14]
:0042AFD0 50                      push eax
:0042AFD1 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AFD4 33C9                    xor ecx, ecx
:0042AFD6 8A4814                  mov cl, byte ptr [eax+14]
:0042AFD9 41                      inc ecx
:0042AFDA 51                      push ecx
:0042AFDB 6A00                    push 00000000
:0042AFDD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042AFE0 E802FEFFFF              call 0042ADE7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042AF83(U), :0042AFB4(U), :0042AFC4(C)
|
:0042AFE5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042AFE8 E8B32F0000              call 0042DFA0
:0042AFED 33C9                    xor ecx, ecx
:0042AFEF 8AC8                    mov cl, al
:0042AFF1 F6C140                  test cl, 40
:0042AFF4 0F841D000000            je 0042B017
:0042AFFA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042AFFD E82EE7FDFF              call 00409730
:0042B002 33C9                    xor ecx, ecx
:0042B004 8AC8                    mov cl, al
:0042B006 83E1BF                  and ecx, FFFFFFBF
:0042B009 51                      push ecx
:0042B00A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B00D E8EEE6FDFF              call 00409700
:0042B012 E95D000000              jmp 0042B074

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042AFF4(C)
|
:0042B017 8B45FC                  mov eax, dword ptr [ebp-04]
:0042B01A 33C9                    xor ecx, ecx
:0042B01C 8A4815                  mov cl, byte ptr [eax+15]
:0042B01F 83F902                  cmp ecx, 00000002
:0042B022 0F8E20000000            jle 0042B048
:0042B028 8B45FC                  mov eax, dword ptr [ebp-04]
:0042B02B 8A4015                  mov al, byte ptr [eax+15]
:0042B02E 50                      push eax
:0042B02F 8B45FC                  mov eax, dword ptr [ebp-04]
:0042B032 33C9                    xor ecx, ecx
:0042B034 8A4815                  mov cl, byte ptr [eax+15]
:0042B037 49                      dec ecx
:0042B038 51                      push ecx
:0042B039 6A01                    push 00000001
:0042B03B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B03E E8A4FDFFFF              call 0042ADE7
:0042B043 E92C000000              jmp 0042B074

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B022(C)
|
:0042B048 8B45FC                  mov eax, dword ptr [ebp-04]
:0042B04B 33C9                    xor ecx, ecx
:0042B04D 8A4815                  mov cl, byte ptr [eax+15]
:0042B050 83F902                  cmp ecx, 00000002
:0042B053 0F8D1B000000            jnl 0042B074
:0042B059 8B45FC                  mov eax, dword ptr [ebp-04]
:0042B05C 8A4015                  mov al, byte ptr [eax+15]
:0042B05F 50                      push eax
:0042B060 8B45FC                  mov eax, dword ptr [ebp-04]
:0042B063 33C9                    xor ecx, ecx
:0042B065 8A4815                  mov cl, byte ptr [eax+15]
:0042B068 41                      inc ecx
:0042B069 51                      push ecx
:0042B06A 6A01                    push 00000001
:0042B06C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B06F E873FDFFFF              call 0042ADE7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042B012(U), :0042B043(U), :0042B053(C)
|
:0042B074 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B077 E8442F0000              call 0042DFC0
:0042B07C 33C9                    xor ecx, ecx
:0042B07E 8AC8                    mov cl, al
:0042B080 F6C140                  test cl, 40
:0042B083 0F840F000000            je 0042B098
:0042B089 6A40                    push 00000040
:0042B08B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B08E E83DE7FDFF              call 004097D0
:0042B093 E9DA000000              jmp 0042B172

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B083(C)
|
:0042B098 6A01                    push 00000001
:0042B09A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B09D E8AEE0FDFF              call 00409150
:0042B0A2 85C0                    test eax, eax
:0042B0A4 0F8411000000            je 0042B0BB
:0042B0AA 6A02                    push 00000002
:0042B0AC 6881000000              push 00000081
:0042B0B1 6A03                    push 00000003
:0042B0B3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B0B6 E82CFDFFFF              call 0042ADE7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B0A4(C)
|
:0042B0BB 6A02                    push 00000002
:0042B0BD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B0C0 E88BE0FDFF              call 00409150
:0042B0C5 85C0                    test eax, eax
:0042B0C7 0F8411000000            je 0042B0DE
:0042B0CD 6A02                    push 00000002
:0042B0CF 6882000000              push 00000082
:0042B0D4 6A03                    push 00000003
:0042B0D6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B0D9 E809FDFFFF              call 0042ADE7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B0C7(C)
|
:0042B0DE 6A04                    push 00000004
:0042B0E0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B0E3 E868E0FDFF              call 00409150
:0042B0E8 85C0                    test eax, eax
:0042B0EA 0F8411000000            je 0042B101
:0042B0F0 6A02                    push 00000002
:0042B0F2 6884000000              push 00000084
:0042B0F7 6A03                    push 00000003
:0042B0F9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B0FC E8E6FCFFFF              call 0042ADE7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B0EA(C)
|
:0042B101 6A08                    push 00000008
:0042B103 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B106 E845E0FDFF              call 00409150
:0042B10B 85C0                    test eax, eax
:0042B10D 0F8411000000            je 0042B124
:0042B113 6A02                    push 00000002
:0042B115 6888000000              push 00000088
:0042B11A 6A03                    push 00000003
:0042B11C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B11F E8C3FCFFFF              call 0042ADE7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B10D(C)
|
:0042B124 6A10                    push 00000010
:0042B126 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B129 E822E0FDFF              call 00409150
:0042B12E 85C0                    test eax, eax
:0042B130 0F8419000000            je 0042B14F
:0042B136 6A02                    push 00000002
:0042B138 6890000000              push 00000090
:0042B13D 6A03                    push 00000003
:0042B13F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B142 E8A0FCFFFF              call 0042ADE7
:0042B147 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B14A E8700D0000              call 0042BEBF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B130(C)
|
:0042B14F 6A20                    push 00000020
:0042B151 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B154 E8F7DFFDFF              call 00409150
:0042B159 85C0                    test eax, eax
:0042B15B 0F8411000000            je 0042B172
:0042B161 6A02                    push 00000002
:0042B163 68A0000000              push 000000A0
:0042B168 6A03                    push 00000003
:0042B16A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B16D E875FCFFFF              call 0042ADE7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042B093(U), :0042B15B(C)
|
:0042B172 E900000000              jmp 0042B177

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042AF51(U), :0042B172(U)
|
:0042B177 5F                      pop edi
:0042B178 5E                      pop esi
:0042B179 5B                      pop ebx
:0042B17A C9                      leave
:0042B17B C3                      ret



* Referenced by a CALL at Address:
|:00441060   
|
:0042B17C 55                      push ebp
:0042B17D 8BEC                    mov ebp, esp
:0042B17F 83EC08                  sub esp, 00000008
:0042B182 53                      push ebx
:0042B183 56                      push esi
:0042B184 57                      push edi
:0042B185 894DF8                  mov dword ptr [ebp-08], ecx
:0042B188 8B45F8                  mov eax, dword ptr [ebp-08]
:0042B18B 8B00                    mov eax, dword ptr [eax]
:0042B18D 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042B190 03C0                    add eax, eax
:0042B192 8D04C0                  lea eax, dword ptr [eax+8*eax]
:0042B195 05E8564500              add eax, 004556E8
:0042B19A 8945FC                  mov dword ptr [ebp-04], eax
:0042B19D 8B4508                  mov eax, dword ptr [ebp+08]
:0042B1A0 50                      push eax
:0042B1A1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B1A4 E807E4FDFF              call 004095B0
:0042B1A9 8B450C                  mov eax, dword ptr [ebp+0C]
:0042B1AC 50                      push eax
:0042B1AD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B1B0 E82BD4FEFF              call 004185E0
:0042B1B5 8B45F8                  mov eax, dword ptr [ebp-08]
:0042B1B8 33C9                    xor ecx, ecx
:0042B1BA 8A480C                  mov cl, byte ptr [eax+0C]
:0042B1BD 80E110                  and cl, 10
:0042B1C0 8B45F8                  mov eax, dword ptr [ebp-08]
:0042B1C3 88480C                  mov byte ptr [eax+0C], cl
:0042B1C6 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042B1C9 E855020000              call 0042B423
:0042B1CE 6A20                    push 00000020
:0042B1D0 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042B1D3 E8EC2B0000              call 0042DDC4
:0042B1D8 E900000000              jmp 0042B1DD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B1D8(U)
|
:0042B1DD 5F                      pop edi
:0042B1DE 5E                      pop esi
:0042B1DF 5B                      pop ebx
:0042B1E0 C9                      leave
:0042B1E1 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:00440F30   , :00441038   
|
:0042B1E4 55                      push ebp
:0042B1E5 8BEC                    mov ebp, esp
:0042B1E7 83EC04                  sub esp, 00000004
:0042B1EA 53                      push ebx
:0042B1EB 56                      push esi
:0042B1EC 57                      push edi
:0042B1ED 894DFC                  mov dword ptr [ebp-04], ecx
:0042B1F0 8B4508                  mov eax, dword ptr [ebp+08]
:0042B1F3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B1F6 8901                    mov dword ptr [ecx], eax
:0042B1F8 6A01                    push 00000001
:0042B1FA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B1FD E81EDDFFFF              call 00428F20
:0042B202 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B205 E819020000              call 0042B423
:0042B20A 8B4508                  mov eax, dword ptr [ebp+08]
:0042B20D 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042B210 03C0                    add eax, eax
:0042B212 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:0042B219 E872E5FDFF              call 00409790
:0042B21E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B221 89410F                  mov dword ptr [ecx+0F], eax
:0042B224 8B4508                  mov eax, dword ptr [ebp+08]
:0042B227 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042B22A 03C0                    add eax, eax
:0042B22C 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:0042B233 E8A8DFFDFF              call 004091E0
:0042B238 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B23B 884113                  mov byte ptr [ecx+13], al
:0042B23E 8B45FC                  mov eax, dword ptr [ebp-04]
:0042B241 C6401402                mov [eax+14], 02
:0042B245 8B45FC                  mov eax, dword ptr [ebp-04]
:0042B248 C6401502                mov [eax+15], 02
:0042B24C 8B45FC                  mov eax, dword ptr [ebp-04]
:0042B24F C6401600                mov [eax+16], 00
:0042B253 E900000000              jmp 0042B258

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B253(U)
|
:0042B258 5F                      pop edi
:0042B259 5E                      pop esi
:0042B25A 5B                      pop ebx
:0042B25B C9                      leave
:0042B25C C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0044109D   , :004415BE   
|
:0042B25F 55                      push ebp
:0042B260 8BEC                    mov ebp, esp
:0042B262 83EC08                  sub esp, 00000008
:0042B265 53                      push ebx
:0042B266 56                      push esi
:0042B267 57                      push edi
:0042B268 894DF8                  mov dword ptr [ebp-08], ecx
:0042B26B 8B45F8                  mov eax, dword ptr [ebp-08]
:0042B26E 8B00                    mov eax, dword ptr [eax]
:0042B270 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042B273 03C0                    add eax, eax
:0042B275 8D04C0                  lea eax, dword ptr [eax+8*eax]
:0042B278 05E8564500              add eax, 004556E8
:0042B27D 8945FC                  mov dword ptr [ebp-04], eax
:0042B280 33C0                    xor eax, eax
:0042B282 8A4508                  mov al, byte ptr [ebp+08]
:0042B285 85C0                    test eax, eax
:0042B287 0F8411000000            je 0042B29E
:0042B28D 8B4508                  mov eax, dword ptr [ebp+08]
:0042B290 50                      push eax
:0042B291 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B294 E8972BFEFF              call 0040DE30
:0042B299 E91B000000              jmp 0042B2B9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B287(C)
|
:0042B29E 6A00                    push 00000000
:0042B2A0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B2A3 E8DF21FEFF              call 0040D487
:0042B2A8 50                      push eax
:0042B2A9 6A00                    push 00000000
:0042B2AB 8B45F8                  mov eax, dword ptr [ebp-08]
:0042B2AE 8B00                    mov eax, dword ptr [eax]
:0042B2B0 50                      push eax
:0042B2B1 E8170DFEFF              call 0040BFCD
:0042B2B6 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B299(U)
|
:0042B2B9 33C0                    xor eax, eax
:0042B2BB 8A450C                  mov al, byte ptr [ebp+0C]
:0042B2BE 85C0                    test eax, eax
:0042B2C0 0F8411000000            je 0042B2D7
:0042B2C6 8B450C                  mov eax, dword ptr [ebp+0C]
:0042B2C9 50                      push eax
:0042B2CA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B2CD E88E2BFEFF              call 0040DE60
:0042B2D2 E91B000000              jmp 0042B2F2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B2C0(C)
|
:0042B2D7 6A01                    push 00000001
:0042B2D9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B2DC E8A621FEFF              call 0040D487
:0042B2E1 50                      push eax
:0042B2E2 6A01                    push 00000001
:0042B2E4 8B45F8                  mov eax, dword ptr [ebp-08]
:0042B2E7 8B00                    mov eax, dword ptr [eax]
:0042B2E9 50                      push eax
:0042B2EA E8DE0CFEFF              call 0040BFCD
:0042B2EF 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B2D2(U)
|
:0042B2F2 33C0                    xor eax, eax
:0042B2F4 8A4510                  mov al, byte ptr [ebp+10]
:0042B2F7 85C0                    test eax, eax
:0042B2F9 0F8411000000            je 0042B310
:0042B2FF 8B4510                  mov eax, dword ptr [ebp+10]
:0042B302 50                      push eax
:0042B303 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B306 E8F52AFEFF              call 0040DE00
:0042B30B E91B000000              jmp 0042B32B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B2F9(C)
|
:0042B310 6A02                    push 00000002
:0042B312 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B315 E86D21FEFF              call 0040D487
:0042B31A 50                      push eax
:0042B31B 6A02                    push 00000002
:0042B31D 8B45F8                  mov eax, dword ptr [ebp-08]
:0042B320 8B00                    mov eax, dword ptr [eax]
:0042B322 50                      push eax
:0042B323 E8A50CFEFF              call 0040BFCD
:0042B328 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B30B(U)
|
:0042B32B 837D1400                cmp dword ptr [ebp+14], 00000000
:0042B32F 0F8411000000            je 0042B346
:0042B335 8B4514                  mov eax, dword ptr [ebp+14]
:0042B338 50                      push eax
:0042B339 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B33C E87F2BFEFF              call 0040DEC0
:0042B341 E91B000000              jmp 0042B361

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B32F(C)
|
:0042B346 6A03                    push 00000003
:0042B348 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B34B E83721FEFF              call 0040D487
:0042B350 50                      push eax
:0042B351 6A03                    push 00000003
:0042B353 8B45F8                  mov eax, dword ptr [ebp-08]
:0042B356 8B00                    mov eax, dword ptr [eax]
:0042B358 50                      push eax
:0042B359 E86F0CFEFF              call 0040BFCD
:0042B35E 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B341(U)
|
:0042B361 33C0                    xor eax, eax
:0042B363 8A4518                  mov al, byte ptr [ebp+18]
:0042B366 85C0                    test eax, eax
:0042B368 0F8411000000            je 0042B37F
:0042B36E 8B4518                  mov eax, dword ptr [ebp+18]
:0042B371 50                      push eax
:0042B372 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B375 E8162BFEFF              call 0040DE90
:0042B37A E91B000000              jmp 0042B39A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B368(C)
|
:0042B37F 6A04                    push 00000004
:0042B381 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B384 E8FE20FEFF              call 0040D487
:0042B389 50                      push eax
:0042B38A 6A04                    push 00000004
:0042B38C 8B45F8                  mov eax, dword ptr [ebp-08]
:0042B38F 8B00                    mov eax, dword ptr [eax]
:0042B391 50                      push eax
:0042B392 E8360CFEFF              call 0040BFCD
:0042B397 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B37A(U)
|
:0042B39A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B39D E8EEE3FDFF              call 00409790
:0042B3A2 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042B3A5 89410F                  mov dword ptr [ecx+0F], eax
:0042B3A8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B3AB E830DEFDFF              call 004091E0
:0042B3B0 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042B3B3 884113                  mov byte ptr [ecx+13], al
:0042B3B6 E900000000              jmp 0042B3BB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B3B6(U)
|
:0042B3BB 5F                      pop edi
:0042B3BC 5E                      pop esi
:0042B3BD 5B                      pop ebx
:0042B3BE C9                      leave
:0042B3BF C21400                  ret 0014



* Referenced by a CALL at Addresses:
|:00440874   , :004411DA   
|
:0042B3C2 55                      push ebp
:0042B3C3 8BEC                    mov ebp, esp
:0042B3C5 83EC04                  sub esp, 00000004
:0042B3C8 53                      push ebx
:0042B3C9 56                      push esi
:0042B3CA 57                      push edi
:0042B3CB 894DFC                  mov dword ptr [ebp-04], ecx
:0042B3CE 8B45FC                  mov eax, dword ptr [ebp-04]
:0042B3D1 C70000000000            mov dword ptr [eax], 00000000
:0042B3D7 8A4508                  mov al, byte ptr [ebp+08]
:0042B3DA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B3DD 884104                  mov byte ptr [ecx+04], al
:0042B3E0 8B45FC                  mov eax, dword ptr [ebp-04]
:0042B3E3 C64005FF                mov [eax+05], FF
:0042B3E7 8B45FC                  mov eax, dword ptr [ebp-04]
:0042B3EA C64006FF                mov [eax+06], FF
:0042B3EE 8B45FC                  mov eax, dword ptr [ebp-04]
:0042B3F1 C64007FF                mov [eax+07], FF
:0042B3F5 8B45FC                  mov eax, dword ptr [ebp-04]
:0042B3F8 C6400D00                mov [eax+0D], 00
:0042B3FC 6A00                    push 00000000
:0042B3FE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B401 E81ADBFFFF              call 00428F20
:0042B406 8B45FC                  mov eax, dword ptr [ebp-04]
:0042B409 C6400C00                mov [eax+0C], 00
:0042B40D 6A20                    push 00000020
:0042B40F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B412 E8AD290000              call 0042DDC4
:0042B417 E900000000              jmp 0042B41C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B417(U)
|
:0042B41C 5F                      pop edi
:0042B41D 5E                      pop esi
:0042B41E 5B                      pop ebx
:0042B41F C9                      leave
:0042B420 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00403F59   , :00408517   , :004285D7   , :0042B1C9   , :0042B205   
|:00440BC4   , :00440CAC   , :00441820   , :00441B48   
|
:0042B423 55                      push ebp
:0042B424 8BEC                    mov ebp, esp
:0042B426 81EC1C010000            sub esp, 0000011C
:0042B42C 53                      push ebx
:0042B42D 56                      push esi
:0042B42E 57                      push edi
:0042B42F 898DE4FEFFFF            mov dword ptr [ebp+FFFFFEE4], ecx
:0042B435 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0042B43B E830E2FDFF              call 00409670
:0042B440 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:0042B446 E855DEFDFF              call 004092A0
:0042B44B 8845FC                  mov byte ptr [ebp-04], al
:0042B44E 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:0042B454 33C9                    xor ecx, ecx
:0042B456 8A4804                  mov cl, byte ptr [eax+04]
:0042B459 8D0449                  lea eax, dword ptr [ecx+2*ecx]
:0042B45C 8D04C0                  lea eax, dword ptr [eax+8*eax]
:0042B45F C1E009                  shl eax, 09
:0042B462 8945F8                  mov dword ptr [ebp-08], eax
:0042B465 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:0042B46B 8A4004                  mov al, byte ptr [eax+04]
:0042B46E 50                      push eax
:0042B46F E8ADDDFFFF              call 00429221
:0042B474 83C404                  add esp, 00000004
:0042B477 8845F4                  mov byte ptr [ebp-0C], al
:0042B47A 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:0042B480 E8012A0000              call 0042DE86
:0042B485 85C0                    test eax, eax
:0042B487 0F8470000000            je 0042B4FD

* Possible StringData Ref from Data Obj ->"B:CHR_IDO.E2"
                                  |
:0042B48D 6858354500              push 00453558
:0042B492 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0042B498 E872C0FFFF              call 0042750F
:0042B49D 6A04                    push 00000004
:0042B49F 6A00                    push 00000000
:0042B4A1 6A00                    push 00000000
:0042B4A3 B968F94600              mov ecx, 0046F968
:0042B4A8 E873C20100              call 00447720
:0042B4AD 50                      push eax
:0042B4AE 33C0                    xor eax, eax
:0042B4B0 8A45F4                  mov al, byte ptr [ebp-0C]
:0042B4B3 50                      push eax
:0042B4B4 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0042B4BA E8C2C1FFFF              call 00427681
:0042B4BF 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0042B4C5 E856DFFDFF              call 00409420
:0042B4CA 6800360000              push 00003600
:0042B4CF 6A04                    push 00000004
:0042B4D1 6A00                    push 00000000
:0042B4D3 6A00                    push 00000000
:0042B4D5 B9D0E44600              mov ecx, 0046E4D0
:0042B4DA E841C20100              call 00447720
:0042B4DF 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042B4E2 03C8                    add ecx, eax
:0042B4E4 51                      push ecx
:0042B4E5 B968F94600              mov ecx, 0046F968
:0042B4EA E8F1DBFDFF              call 004090E0
:0042B4EF 50                      push eax
:0042B4F0 E858BF0100              call 0044744D
:0042B4F5 83C40C                  add esp, 0000000C
:0042B4F8 E9A8000000              jmp 0042B5A5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B487(C)
|
:0042B4FD 33C0                    xor eax, eax
:0042B4FF 8A45FC                  mov al, byte ptr [ebp-04]
:0042B502 83C027                  add eax, 00000027
:0042B505 8845F4                  mov byte ptr [ebp-0C], al

* Possible StringData Ref from Data Obj ->"B:CHR_BS.E2"
                                  |
:0042B508 6888354500              push 00453588
:0042B50D 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0042B513 E8F7BFFFFF              call 0042750F
:0042B518 6A04                    push 00000004
:0042B51A 6A00                    push 00000000
:0042B51C 6A00                    push 00000000
:0042B51E B968F94600              mov ecx, 0046F968
:0042B523 E8F8C10100              call 00447720
:0042B528 50                      push eax
:0042B529 33C0                    xor eax, eax
:0042B52B 8A45F4                  mov al, byte ptr [ebp-0C]
:0042B52E 50                      push eax
:0042B52F 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0042B535 E847C1FFFF              call 00427681
:0042B53A 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0042B540 E8DBDEFDFF              call 00409420
:0042B545 C785E8FEFFFF00000000    mov dword ptr [ebp+FFFFFEE8], 00000000
:0042B54F E906000000              jmp 0042B55A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B5A0(U)
|
:0042B554 FF85E8FEFFFF            inc dword ptr [ebp+FFFFFEE8]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B54F(U)
|
:0042B55A 83BDE8FEFFFF06          cmp dword ptr [ebp+FFFFFEE8], 00000006
:0042B561 0F833E000000            jnb 0042B5A5
:0042B567 6800090000              push 00000900
:0042B56C 6A04                    push 00000004
:0042B56E 6A00                    push 00000000
:0042B570 8B45F8                  mov eax, dword ptr [ebp-08]
:0042B573 50                      push eax
:0042B574 B9D0E44600              mov ecx, 0046E4D0
:0042B579 E8A2C10100              call 00447720
:0042B57E 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:0042B584 8D0CC9                  lea ecx, dword ptr [ecx+8*ecx]
:0042B587 C1E108                  shl ecx, 08
:0042B58A 03C1                    add eax, ecx
:0042B58C 50                      push eax
:0042B58D B968F94600              mov ecx, 0046F968
:0042B592 E849DBFDFF              call 004090E0
:0042B597 50                      push eax
:0042B598 E8B0BE0100              call 0044744D
:0042B59D 83C40C                  add esp, 0000000C
:0042B5A0 E9AFFFFFFF              jmp 0042B554

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042B4F8(U), :0042B561(C)
|
:0042B5A5 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:0042B5AB E836000000              call 0042B5E6
:0042B5B0 6A10                    push 00000010
:0042B5B2 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:0042B5B8 E8A3DDFDFF              call 00409360
:0042B5BD 8945F0                  mov dword ptr [ebp-10], eax
:0042B5C0 6A10                    push 00000010
:0042B5C2 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:0042B5C8 E863DDFDFF              call 00409330
:0042B5CD 8B45F0                  mov eax, dword ptr [ebp-10]
:0042B5D0 50                      push eax
:0042B5D1 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:0042B5D7 E896000000              call 0042B672
:0042B5DC E900000000              jmp 0042B5E1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B5DC(U)
|
:0042B5E1 5F                      pop edi
:0042B5E2 5E                      pop esi
:0042B5E3 5B                      pop ebx
:0042B5E4 C9                      leave
:0042B5E5 C3                      ret



* Referenced by a CALL at Address:
|:0042B5AB   
|
:0042B5E6 55                      push ebp
:0042B5E7 8BEC                    mov ebp, esp
:0042B5E9 81EC0C010000            sub esp, 0000010C
:0042B5EF 53                      push ebx
:0042B5F0 56                      push esi
:0042B5F1 57                      push edi
:0042B5F2 898DF4FEFFFF            mov dword ptr [ebp+FFFFFEF4], ecx
:0042B5F8 8D8DF8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF8]
:0042B5FE E86DE0FDFF              call 00409670
:0042B603 8B85F4FEFFFF            mov eax, dword ptr [ebp+FFFFFEF4]
:0042B609 8A4004                  mov al, byte ptr [eax+04]
:0042B60C 50                      push eax
:0042B60D E80FDCFFFF              call 00429221
:0042B612 83C404                  add esp, 00000004
:0042B615 8845FC                  mov byte ptr [ebp-04], al

* Possible StringData Ref from Data Obj ->"B:CHR_BS.E2"
                                  |
:0042B618 6888354500              push 00453588
:0042B61D 8D8DF8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF8]
:0042B623 E8E7BEFFFF              call 0042750F
:0042B628 8B85F4FEFFFF            mov eax, dword ptr [ebp+FFFFFEF4]
:0042B62E 33DB                    xor ebx, ebx
:0042B630 8A5804                  mov bl, byte ptr [eax+04]
:0042B633 8D1CDB                  lea ebx, dword ptr [ebx+8*ebx]
:0042B636 C1E308                  shl ebx, 08
:0042B639 6A04                    push 00000004
:0042B63B 6A00                    push 00000000
:0042B63D 6A00                    push 00000000
:0042B63F B980E34600              mov ecx, 0046E380
:0042B644 E8D7C00100              call 00447720
:0042B649 03D8                    add ebx, eax
:0042B64B 53                      push ebx
:0042B64C 33C0                    xor eax, eax
:0042B64E 8A45FC                  mov al, byte ptr [ebp-04]
:0042B651 50                      push eax
:0042B652 8D8DF8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF8]
:0042B658 E824C0FFFF              call 00427681
:0042B65D 8D8DF8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF8]
:0042B663 E8B8DDFDFF              call 00409420
:0042B668 E900000000              jmp 0042B66D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B668(U)
|
:0042B66D 5F                      pop edi
:0042B66E 5E                      pop esi
:0042B66F 5B                      pop ebx
:0042B670 C9                      leave
:0042B671 C3                      ret



* Referenced by a CALL at Addresses:
|:00419510   , :0041952E   , :0042B5D7   , :0042B99F   , :0042D3AD   
|
:0042B672 55                      push ebp
:0042B673 8BEC                    mov ebp, esp
:0042B675 81EC14090000            sub esp, 00000914
:0042B67B 53                      push ebx
:0042B67C 56                      push esi
:0042B67D 57                      push edi
:0042B67E 898DECF6FFFF            mov dword ptr [ebp+FFFFF6EC], ecx
:0042B684 8B85ECF6FFFF            mov eax, dword ptr [ebp+FFFFF6EC]
:0042B68A 33C9                    xor ecx, ecx
:0042B68C 8A480E                  mov cl, byte ptr [eax+0E]
:0042B68F 85C9                    test ecx, ecx
:0042B691 0F8414000000            je 0042B6AB
:0042B697 8B85ECF6FFFF            mov eax, dword ptr [ebp+FFFFF6EC]
:0042B69D 33C9                    xor ecx, ecx
:0042B69F 8A480E                  mov cl, byte ptr [eax+0E]
:0042B6A2 83F902                  cmp ecx, 00000002
:0042B6A5 0F850F000000            jne 0042B6BA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B691(C)
|
:0042B6AB 837D0800                cmp dword ptr [ebp+08], 00000000
:0042B6AF 0F8505000000            jne 0042B6BA
:0042B6B5 E971010000              jmp 0042B82B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042B6A5(C), :0042B6AF(C)
|
:0042B6BA 6A10                    push 00000010
:0042B6BC 8B8DECF6FFFF            mov ecx, dword ptr [ebp+FFFFF6EC]
:0042B6C2 E899DCFDFF              call 00409360
:0042B6C7 3B4508                  cmp eax, dword ptr [ebp+08]
:0042B6CA 0F8456010000            je 0042B826
:0042B6D0 C785F8F6FFFF00000000    mov dword ptr [ebp+FFFFF6F8], 00000000
:0042B6DA E906000000              jmp 0042B6E5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B7ED(U)
|
:0042B6DF FF85F8F6FFFF            inc dword ptr [ebp+FFFFF6F8]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B6DA(U)
|
:0042B6E5 83BDF8F6FFFF02          cmp dword ptr [ebp+FFFFF6F8], 00000002
:0042B6EC 0F8300010000            jnb 0042B7F2
:0042B6F2 8B85ECF6FFFF            mov eax, dword ptr [ebp+FFFFF6EC]
:0042B6F8 33DB                    xor ebx, ebx
:0042B6FA 8A5804                  mov bl, byte ptr [eax+04]
:0042B6FD 8D1C5B                  lea ebx, dword ptr [ebx+2*ebx]
:0042B700 8D1CDB                  lea ebx, dword ptr [ebx+8*ebx]
:0042B703 C1E309                  shl ebx, 09
:0042B706 6A04                    push 00000004
:0042B708 6A00                    push 00000000
:0042B70A 6A00                    push 00000000
:0042B70C B9D0E44600              mov ecx, 0046E4D0
:0042B711 E80AC00100              call 00447720
:0042B716 03D8                    add ebx, eax
:0042B718 8B85F8F6FFFF            mov eax, dword ptr [ebp+FFFFF6F8]
:0042B71E 8D04C0                  lea eax, dword ptr [eax+8*eax]
:0042B721 C1E008                  shl eax, 08
:0042B724 03D8                    add ebx, eax
:0042B726 81C300120000            add ebx, 00001200
:0042B72C 895DFC                  mov dword ptr [ebp-04], ebx
:0042B72F C785F4F6FFFF00000000    mov dword ptr [ebp+FFFFF6F4], 00000000
:0042B739 E906000000              jmp 0042B744

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B799(U)
|
:0042B73E FF85F4F6FFFF            inc dword ptr [ebp+FFFFF6F4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B739(U)
|
:0042B744 83BDF4F6FFFF30          cmp dword ptr [ebp+FFFFF6F4], 00000030
:0042B74B 0F834D000000            jnb 0042B79E
:0042B751 C785F0F6FFFF2F000000    mov dword ptr [ebp+FFFFF6F0], 0000002F
:0042B75B E906000000              jmp 0042B766

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B794(U)
|
:0042B760 FF8DF0F6FFFF            dec dword ptr [ebp+FFFFF6F0]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B75B(U)
|
:0042B766 83BDF0F6FFFF00          cmp dword ptr [ebp+FFFFF6F0], 00000000
:0042B76D 0F8C26000000            jl 0042B799
:0042B773 8B45FC                  mov eax, dword ptr [ebp-04]
:0042B776 8A00                    mov al, byte ptr [eax]
:0042B778 8B8DF4F6FFFF            mov ecx, dword ptr [ebp+FFFFF6F4]
:0042B77E C1E104                  shl ecx, 04
:0042B781 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:0042B784 038DF0F6FFFF            add ecx, dword ptr [ebp+FFFFF6F0]
:0042B78A 88840DFCF6FFFF          mov byte ptr [ebp+ecx-00000904], al
:0042B791 FF45FC                  inc [ebp-04]
:0042B794 E9C7FFFFFF              jmp 0042B760

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B76D(C)
|
:0042B799 E9A0FFFFFF              jmp 0042B73E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B74B(C)
|
:0042B79E 6800090000              push 00000900
:0042B7A3 8B85ECF6FFFF            mov eax, dword ptr [ebp+FFFFF6EC]
:0042B7A9 33DB                    xor ebx, ebx
:0042B7AB 8A5804                  mov bl, byte ptr [eax+04]
:0042B7AE 8D1C5B                  lea ebx, dword ptr [ebx+2*ebx]
:0042B7B1 8D1CDB                  lea ebx, dword ptr [ebx+8*ebx]
:0042B7B4 C1E309                  shl ebx, 09
:0042B7B7 81C300120000            add ebx, 00001200
:0042B7BD 6A04                    push 00000004
:0042B7BF 6A00                    push 00000000
:0042B7C1 6A00                    push 00000000
:0042B7C3 B9D0E44600              mov ecx, 0046E4D0
:0042B7C8 E853BF0100              call 00447720
:0042B7CD 03D8                    add ebx, eax
:0042B7CF 8B85F8F6FFFF            mov eax, dword ptr [ebp+FFFFF6F8]
:0042B7D5 8D04C0                  lea eax, dword ptr [eax+8*eax]
:0042B7D8 C1E008                  shl eax, 08
:0042B7DB 03D8                    add ebx, eax
:0042B7DD 53                      push ebx
:0042B7DE 8D85FCF6FFFF            lea eax, dword ptr [ebp+FFFFF6FC]
:0042B7E4 50                      push eax
:0042B7E5 E863BC0100              call 0044744D
:0042B7EA 83C40C                  add esp, 0000000C
:0042B7ED E9EDFEFFFF              jmp 0042B6DF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B6EC(C)
|
:0042B7F2 837D0800                cmp dword ptr [ebp+08], 00000000
:0042B7F6 0F8412000000            je 0042B80E
:0042B7FC 6A10                    push 00000010
:0042B7FE 8B8DECF6FFFF            mov ecx, dword ptr [ebp+FFFFF6EC]
:0042B804 E8BB250000              call 0042DDC4
:0042B809 E90D000000              jmp 0042B81B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B7F6(C)
|
:0042B80E 6A10                    push 00000010
:0042B810 8B8DECF6FFFF            mov ecx, dword ptr [ebp+FFFFF6EC]
:0042B816 E815DBFDFF              call 00409330

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B809(U)
|
:0042B81B 8B8DECF6FFFF            mov ecx, dword ptr [ebp+FFFFF6EC]
:0042B821 E80C000000              call 0042B832

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B6CA(C)
|
:0042B826 E900000000              jmp 0042B82B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042B6B5(U), :0042B826(U)
|
:0042B82B 5F                      pop edi
:0042B82C 5E                      pop esi
:0042B82D 5B                      pop ebx
:0042B82E C9                      leave
:0042B82F C20400                  ret 0004



* Referenced by a CALL at Address:
|:0042B821   
|
:0042B832 55                      push ebp
:0042B833 8BEC                    mov ebp, esp
:0042B835 81EC10090000            sub esp, 00000910
:0042B83B 53                      push ebx
:0042B83C 56                      push esi
:0042B83D 57                      push edi
:0042B83E 898DF0F6FFFF            mov dword ptr [ebp+FFFFF6F0], ecx
:0042B844 8B85F0F6FFFF            mov eax, dword ptr [ebp+FFFFF6F0]
:0042B84A 33DB                    xor ebx, ebx
:0042B84C 8A5804                  mov bl, byte ptr [eax+04]
:0042B84F 8D1CDB                  lea ebx, dword ptr [ebx+8*ebx]
:0042B852 C1E308                  shl ebx, 08
:0042B855 6A04                    push 00000004
:0042B857 6A00                    push 00000000
:0042B859 6A00                    push 00000000
:0042B85B B980E34600              mov ecx, 0046E380
:0042B860 E8BBBE0100              call 00447720
:0042B865 03D8                    add ebx, eax
:0042B867 895DFC                  mov dword ptr [ebp-04], ebx
:0042B86A C745F800000000          mov [ebp-08], 00000000
:0042B871 E903000000              jmp 0042B879

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B8C8(U)
|
:0042B876 FF45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B871(U)
|
:0042B879 837DF830                cmp dword ptr [ebp-08], 00000030
:0042B87D 0F834A000000            jnb 0042B8CD
:0042B883 C785F4F6FFFF2F000000    mov dword ptr [ebp+FFFFF6F4], 0000002F
:0042B88D E906000000              jmp 0042B898

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B8C3(U)
|
:0042B892 FF8DF4F6FFFF            dec dword ptr [ebp+FFFFF6F4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B88D(U)
|
:0042B898 83BDF4F6FFFF00          cmp dword ptr [ebp+FFFFF6F4], 00000000
:0042B89F 0F8C23000000            jl 0042B8C8
:0042B8A5 8B45FC                  mov eax, dword ptr [ebp-04]
:0042B8A8 8A00                    mov al, byte ptr [eax]
:0042B8AA 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042B8AD C1E104                  shl ecx, 04
:0042B8B0 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:0042B8B3 038DF4F6FFFF            add ecx, dword ptr [ebp+FFFFF6F4]
:0042B8B9 88840DF8F6FFFF          mov byte ptr [ebp+ecx-00000908], al
:0042B8C0 FF45FC                  inc [ebp-04]
:0042B8C3 E9CAFFFFFF              jmp 0042B892

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B89F(C)
|
:0042B8C8 E9A9FFFFFF              jmp 0042B876

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B87D(C)
|
:0042B8CD 6800090000              push 00000900
:0042B8D2 8B85F0F6FFFF            mov eax, dword ptr [ebp+FFFFF6F0]
:0042B8D8 33DB                    xor ebx, ebx
:0042B8DA 8A5804                  mov bl, byte ptr [eax+04]
:0042B8DD 8D1CDB                  lea ebx, dword ptr [ebx+8*ebx]
:0042B8E0 C1E308                  shl ebx, 08
:0042B8E3 6A04                    push 00000004
:0042B8E5 6A00                    push 00000000
:0042B8E7 6A00                    push 00000000
:0042B8E9 B980E34600              mov ecx, 0046E380
:0042B8EE E82DBE0100              call 00447720
:0042B8F3 03D8                    add ebx, eax
:0042B8F5 53                      push ebx
:0042B8F6 8D85F8F6FFFF            lea eax, dword ptr [ebp+FFFFF6F8]
:0042B8FC 50                      push eax
:0042B8FD E84BBB0100              call 0044744D
:0042B902 83C40C                  add esp, 0000000C
:0042B905 E900000000              jmp 0042B90A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B905(U)
|
:0042B90A 5F                      pop edi
:0042B90B 5E                      pop esi
:0042B90C 5B                      pop ebx
:0042B90D C9                      leave
:0042B90E C3                      ret



* Referenced by a CALL at Addresses:
|:0041A309   , :0041E050   , :004285F4   , :0042CBC5   
|
:0042B90F 55                      push ebp
:0042B910 8BEC                    mov ebp, esp
:0042B912 83EC04                  sub esp, 00000004
:0042B915 53                      push ebx
:0042B916 56                      push esi
:0042B917 57                      push edi
:0042B918 894DFC                  mov dword ptr [ebp-04], ecx
:0042B91B 8B45FC                  mov eax, dword ptr [ebp-04]
:0042B91E 8A4004                  mov al, byte ptr [eax+04]
:0042B921 50                      push eax
:0042B922 8B45FC                  mov eax, dword ptr [ebp-04]
:0042B925 83C005                  add eax, 00000005
:0042B928 50                      push eax
:0042B929 E8F9DDFEFF              call 00419727
:0042B92E 83C408                  add esp, 00000008
:0042B931 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B934 E886050000              call 0042BEBF
:0042B939 E900000000              jmp 0042B93E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B939(U)
|
:0042B93E 5F                      pop edi
:0042B93F 5E                      pop esi
:0042B940 5B                      pop ebx
:0042B941 C9                      leave
:0042B942 C3                      ret



* Referenced by a CALL at Addresses:
|:0041A230   , :0041DFC1   , :004285B9   , :0042CB9D   
|
:0042B943 55                      push ebp
:0042B944 8BEC                    mov ebp, esp
:0042B946 83EC04                  sub esp, 00000004
:0042B949 53                      push ebx
:0042B94A 56                      push esi
:0042B94B 57                      push edi
:0042B94C 894DFC                  mov dword ptr [ebp-04], ecx
:0042B94F 68FF000000              push 000000FF
:0042B954 8B45FC                  mov eax, dword ptr [ebp-04]
:0042B957 83C005                  add eax, 00000005
:0042B95A 50                      push eax
:0042B95B E8C7DDFEFF              call 00419727
:0042B960 83C408                  add esp, 00000008
:0042B963 E900000000              jmp 0042B968

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B963(U)
|
:0042B968 5F                      pop edi
:0042B969 5E                      pop esi
:0042B96A 5B                      pop ebx
:0042B96B C9                      leave
:0042B96C C3                      ret



* Referenced by a CALL at Addresses:
|:00409310   , :00427A35   , :00427AC9   , :00440C27   , :00440D0F   
|:00440FA1   , :0044110E   
|
:0042B96D 55                      push ebp
:0042B96E 8BEC                    mov ebp, esp
:0042B970 83EC08                  sub esp, 00000008
:0042B973 53                      push ebx
:0042B974 56                      push esi
:0042B975 57                      push edi
:0042B976 894DF8                  mov dword ptr [ebp-08], ecx
:0042B979 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042B97C E8AFDEFDFF              call 00409830
:0042B981 33C9                    xor ecx, ecx
:0042B983 8AC8                    mov cl, al
:0042B985 83F901                  cmp ecx, 00000001
:0042B988 0F855D000000            jne 0042B9EB
:0042B98E 6A02                    push 00000002
:0042B990 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042B993 E888D5FFFF              call 00428F20
:0042B998 8B4510                  mov eax, dword ptr [ebp+10]
:0042B99B 50                      push eax
:0042B99C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042B99F E8CEFCFFFF              call 0042B672
:0042B9A4 8B450C                  mov eax, dword ptr [ebp+0C]
:0042B9A7 50                      push eax
:0042B9A8 8B4508                  mov eax, dword ptr [ebp+08]
:0042B9AB 50                      push eax
:0042B9AC 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0042B9AF E89C28FFFF              call 0041E250
:0042B9B4 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042B9B7 E8F5E8FFFF              call 0042A2B1
:0042B9BC A2A8C44600              mov byte ptr [0046C4A8], al
:0042B9C1 C605A4C44600FF          mov byte ptr [0046C4A4], FF
:0042B9C8 6A05                    push 00000005
:0042B9CA 8B45FC                  mov eax, dword ptr [ebp-04]
:0042B9CD 50                      push eax
:0042B9CE E84EE6FFFF              call 0042A021
:0042B9D3 83C408                  add esp, 00000008
:0042B9D6 A0A4C44600              mov al, byte ptr [0046C4A4]
:0042B9DB 884508                  mov byte ptr [ebp+08], al
:0042B9DE A0A5C44600              mov al, byte ptr [0046C4A5]
:0042B9E3 88450C                  mov byte ptr [ebp+0C], al
:0042B9E6 E931000000              jmp 0042BA1C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B988(C)
|
:0042B9EB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042B9EE E83DDEFDFF              call 00409830
:0042B9F3 33C9                    xor ecx, ecx
:0042B9F5 8AC8                    mov cl, al
:0042B9F7 83F902                  cmp ecx, 00000002
:0042B9FA 0F851C000000            jne 0042BA1C
:0042BA00 68FF000000              push 000000FF
:0042BA05 8B45F8                  mov eax, dword ptr [ebp-08]
:0042BA08 83C005                  add eax, 00000005
:0042BA0B 50                      push eax
:0042BA0C E816DDFEFF              call 00419727
:0042BA11 83C408                  add esp, 00000008
:0042BA14 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042BA17 E8A3040000              call 0042BEBF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042B9E6(U), :0042B9FA(C)
|
:0042BA1C 8A4508                  mov al, byte ptr [ebp+08]
:0042BA1F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042BA22 884105                  mov byte ptr [ecx+05], al
:0042BA25 8A450C                  mov al, byte ptr [ebp+0C]
:0042BA28 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042BA2B 884106                  mov byte ptr [ecx+06], al
:0042BA2E 8B45F8                  mov eax, dword ptr [ebp-08]
:0042BA31 8A4004                  mov al, byte ptr [eax+04]
:0042BA34 50                      push eax
:0042BA35 8B45F8                  mov eax, dword ptr [ebp-08]
:0042BA38 83C005                  add eax, 00000005
:0042BA3B 50                      push eax
:0042BA3C E8E6DCFEFF              call 00419727
:0042BA41 83C408                  add esp, 00000008
:0042BA44 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042BA47 E873040000              call 0042BEBF
:0042BA4C B801000000              mov eax, 00000001
:0042BA51 E900000000              jmp 0042BA56

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BA51(U)
|
:0042BA56 5F                      pop edi
:0042BA57 5E                      pop esi
:0042BA58 5B                      pop ebx
:0042BA59 C9                      leave
:0042BA5A C20C00                  ret 000C



* Referenced by a CALL at Addresses:
|:00423FFD   , :004288D7   , :0044341A   , :004435DB   , :00443612   
|
:0042BA5D 55                      push ebp
:0042BA5E 8BEC                    mov ebp, esp
:0042BA60 83EC1C                  sub esp, 0000001C
:0042BA63 53                      push ebx
:0042BA64 56                      push esi
:0042BA65 57                      push edi
:0042BA66 894DE4                  mov dword ptr [ebp-1C], ecx
:0042BA69 C745F000000000          mov [ebp-10], 00000000
:0042BA70 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0042BA73 E8B8DDFDFF              call 00409830
:0042BA78 33C9                    xor ecx, ecx
:0042BA7A 8AC8                    mov cl, al
:0042BA7C 83F902                  cmp ecx, 00000002
:0042BA7F 0F8405000000            je 0042BA8A
:0042BA85 E930040000              jmp 0042BEBA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BA7F(C)
|
:0042BA8A 68FF000000              push 000000FF
:0042BA8F 8B45E4                  mov eax, dword ptr [ebp-1C]
:0042BA92 83C005                  add eax, 00000005
:0042BA95 50                      push eax
:0042BA96 E88CDCFEFF              call 00419727
:0042BA9B 83C408                  add esp, 00000008
:0042BA9E 6A04                    push 00000004
:0042BAA0 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0042BAA3 E878D4FFFF              call 00428F20
:0042BAA8 6A09                    push 00000009
:0042BAAA B994A64600              mov ecx, 0046A694
:0042BAAF E870D5FEFF              call 00419024
:0042BAB4 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0042BAB7 E803040000              call 0042BEBF
:0042BABC 8B45E4                  mov eax, dword ptr [ebp-1C]
:0042BABF C6401600                mov [eax+16], 00
:0042BAC3 C645F400                mov [ebp-0C], 00
:0042BAC7 E903000000              jmp 0042BACF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BB6C(U)
|
:0042BACC FE45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BAC7(U)
|
:0042BACF 33C0                    xor eax, eax
:0042BAD1 8A45F4                  mov al, byte ptr [ebp-0C]
:0042BAD4 83F82D                  cmp eax, 0000002D
:0042BAD7 0F8D94000000            jnl 0042BB71
:0042BADD 33C0                    xor eax, eax
:0042BADF 8A45F4                  mov al, byte ptr [ebp-0C]
:0042BAE2 8BC8                    mov ecx, eax
:0042BAE4 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042BAE7 C1E003                  shl eax, 03
:0042BAEA 2BC1                    sub eax, ecx
:0042BAEC 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0042BAF2 E869240000              call 0042DF60
:0042BAF7 33C9                    xor ecx, ecx
:0042BAF9 8AC8                    mov cl, al
:0042BAFB 8B45E4                  mov eax, dword ptr [ebp-1C]
:0042BAFE 33D2                    xor edx, edx
:0042BB00 8A5004                  mov dl, byte ptr [eax+04]
:0042BB03 3BCA                    cmp ecx, edx
:0042BB05 0F8561000000            jne 0042BB6C
:0042BB0B 33C0                    xor eax, eax
:0042BB0D 8A45F4                  mov al, byte ptr [ebp-0C]
:0042BB10 8BC8                    mov ecx, eax
:0042BB12 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042BB15 C1E003                  shl eax, 03
:0042BB18 2BC1                    sub eax, ecx
:0042BB1A 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0042BB20 E8ABD8FDFF              call 004093D0
:0042BB25 33C9                    xor ecx, ecx
:0042BB27 8AC8                    mov cl, al
:0042BB29 85C9                    test ecx, ecx
:0042BB2B 0F853B000000            jne 0042BB6C
:0042BB31 68FF000000              push 000000FF
:0042BB36 33C0                    xor eax, eax
:0042BB38 8A45F4                  mov al, byte ptr [ebp-0C]
:0042BB3B 8BC8                    mov ecx, eax
:0042BB3D 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042BB40 C1E003                  shl eax, 03
:0042BB43 2BC1                    sub eax, ecx
:0042BB45 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0042BB4B E800D4FFFF              call 00428F50
:0042BB50 6A01                    push 00000001
:0042BB52 33C0                    xor eax, eax
:0042BB54 8A45F4                  mov al, byte ptr [ebp-0C]
:0042BB57 8BC8                    mov ecx, eax
:0042BB59 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042BB5C C1E003                  shl eax, 03
:0042BB5F 2BC1                    sub eax, ecx
:0042BB61 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0042BB67 E86A080000              call 0042C3D6

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042BB05(C), :0042BB2B(C)
|
:0042BB6C E95BFFFFFF              jmp 0042BACC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BAD7(C)
|
:0042BB71 6A04                    push 00000004
:0042BB73 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0042BB76 E8E5D7FDFF              call 00409360
:0042BB7B 85C0                    test eax, eax
:0042BB7D 0F8405000000            je 0042BB88
:0042BB83 E932030000              jmp 0042BEBA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BB7D(C)
|
:0042BB88 C745F805000000          mov [ebp-08], 00000005

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BD1A(U)
|
:0042BB8F 837DF805                cmp dword ptr [ebp-08], 00000005
:0042BB93 0F840A000000            je 0042BBA3
:0042BB99 837DF806                cmp dword ptr [ebp-08], 00000006
:0042BB9D 0F857C010000            jne 0042BD1F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BB93(C)
|
:0042BBA3 B998FC4600              mov ecx, 0046FC98
:0042BBA8 E833240000              call 0042DFE0
:0042BBAD 33C9                    xor ecx, ecx
:0042BBAF 8AC8                    mov cl, al
:0042BBB1 85C9                    test ecx, ecx
:0042BBB3 0F8405000000            je 0042BBBE
:0042BBB9 E961010000              jmp 0042BD1F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BBB3(C)
|
:0042BBBE 8B45E4                  mov eax, dword ptr [ebp-1C]
:0042BBC1 8B00                    mov eax, dword ptr [eax]
:0042BBC3 50                      push eax
:0042BBC4 B9B0C44600              mov ecx, 0046C4B0
:0042BBC9 E8DF3D0000              call 0042F9AD
:0042BBCE 8945EC                  mov dword ptr [ebp-14], eax
:0042BBD1 837DEC00                cmp dword ptr [ebp-14], 00000000
:0042BBD5 0F8571000000            jne 0042BC4C
:0042BBDB B9B0C44600              mov ecx, 0046C4B0
:0042BBE0 E8CC380000              call 0042F4B1
:0042BBE5 8945EC                  mov dword ptr [ebp-14], eax
:0042BBE8 817DECFFFF0000          cmp dword ptr [ebp-14], 0000FFFF
:0042BBEF 0F841D000000            je 0042BC12
:0042BBF5 8B45EC                  mov eax, dword ptr [ebp-14]
:0042BBF8 50                      push eax
:0042BBF9 B9B0C44600              mov ecx, 0046C4B0
:0042BBFE E8853F0000              call 0042FB88
:0042BC03 8945F8                  mov dword ptr [ebp-08], eax
:0042BC06 C745F001000000          mov [ebp-10], 00000001
:0042BC0D E935000000              jmp 0042BC47

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BBEF(C)
|
:0042BC12 B9B0C44600              mov ecx, 0046C4B0
:0042BC17 E85D340000              call 0042F079
:0042BC1C 8945EC                  mov dword ptr [ebp-14], eax
:0042BC1F 817DECFFFF0000          cmp dword ptr [ebp-14], 0000FFFF
:0042BC26 0F8416000000            je 0042BC42
:0042BC2C 8B45EC                  mov eax, dword ptr [ebp-14]
:0042BC2F 50                      push eax
:0042BC30 B9B0C44600              mov ecx, 0046C4B0
:0042BC35 E84E3F0000              call 0042FB88
:0042BC3A 8945F8                  mov dword ptr [ebp-08], eax
:0042BC3D E905000000              jmp 0042BC47

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BC26(C)
|
:0042BC42 E9D8000000              jmp 0042BD1F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042BC0D(U), :0042BC3D(U)
|
:0042BC47 E9CE000000              jmp 0042BD1A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BBD5(C)
|
:0042BC4C 837DEC01                cmp dword ptr [ebp-14], 00000001
:0042BC50 0F8571000000            jne 0042BCC7
:0042BC56 B9B0C44600              mov ecx, 0046C4B0
:0042BC5B E821390000              call 0042F581
:0042BC60 8945EC                  mov dword ptr [ebp-14], eax
:0042BC63 817DECFFFF0000          cmp dword ptr [ebp-14], 0000FFFF
:0042BC6A 0F841D000000            je 0042BC8D
:0042BC70 8B45EC                  mov eax, dword ptr [ebp-14]
:0042BC73 50                      push eax
:0042BC74 B9B0C44600              mov ecx, 0046C4B0
:0042BC79 E80A3F0000              call 0042FB88
:0042BC7E 8945F8                  mov dword ptr [ebp-08], eax
:0042BC81 C745F001000000          mov [ebp-10], 00000001
:0042BC88 E935000000              jmp 0042BCC2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BC6A(C)
|
:0042BC8D B9B0C44600              mov ecx, 0046C4B0
:0042BC92 E8E2330000              call 0042F079
:0042BC97 8945EC                  mov dword ptr [ebp-14], eax
:0042BC9A 817DECFFFF0000          cmp dword ptr [ebp-14], 0000FFFF
:0042BCA1 0F8416000000            je 0042BCBD
:0042BCA7 8B45EC                  mov eax, dword ptr [ebp-14]
:0042BCAA 50                      push eax
:0042BCAB B9B0C44600              mov ecx, 0046C4B0
:0042BCB0 E8D33E0000              call 0042FB88
:0042BCB5 8945F8                  mov dword ptr [ebp-08], eax
:0042BCB8 E905000000              jmp 0042BCC2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BCA1(C)
|
:0042BCBD E95D000000              jmp 0042BD1F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042BC88(U), :0042BCB8(U)
|
:0042BCC2 E953000000              jmp 0042BD1A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042BC50(C), :0042BD10(U)
|
:0042BCC7 837DF805                cmp dword ptr [ebp-08], 00000005
:0042BCCB 0F840A000000            je 0042BCDB
:0042BCD1 837DF806                cmp dword ptr [ebp-08], 00000006
:0042BCD5 0F853A000000            jne 0042BD15

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BCCB(C)
|
:0042BCDB B9B0C44600              mov ecx, 0046C4B0
:0042BCE0 E894330000              call 0042F079
:0042BCE5 8945EC                  mov dword ptr [ebp-14], eax
:0042BCE8 817DECFFFF0000          cmp dword ptr [ebp-14], 0000FFFF
:0042BCEF 0F8416000000            je 0042BD0B
:0042BCF5 8B45EC                  mov eax, dword ptr [ebp-14]
:0042BCF8 50                      push eax
:0042BCF9 B9B0C44600              mov ecx, 0046C4B0
:0042BCFE E8853E0000              call 0042FB88
:0042BD03 8945F8                  mov dword ptr [ebp-08], eax
:0042BD06 E905000000              jmp 0042BD10

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BCEF(C)
|
:0042BD0B E905000000              jmp 0042BD15

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BD06(U)
|
:0042BD10 E9B2FFFFFF              jmp 0042BCC7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042BCD5(C), :0042BD0B(U)
|
:0042BD15 E905000000              jmp 0042BD1F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042BC47(U), :0042BCC2(U)
|
:0042BD1A E970FEFFFF              jmp 0042BB8F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042BB9D(C), :0042BBB9(U), :0042BC42(U), :0042BCBD(U), :0042BD15(U)
|
:0042BD1F C745F805000000          mov [ebp-08], 00000005
:0042BD26 B998FC4600              mov ecx, 0046FC98
:0042BD2B E8B0220000              call 0042DFE0
:0042BD30 33C9                    xor ecx, ecx
:0042BD32 8AC8                    mov cl, al
:0042BD34 85C9                    test ecx, ecx
:0042BD36 0F858F000000            jne 0042BDCB
:0042BD3C 8B45E4                  mov eax, dword ptr [ebp-1C]
:0042BD3F 8B00                    mov eax, dword ptr [eax]
:0042BD41 50                      push eax
:0042BD42 B9B0C44600              mov ecx, 0046C4B0
:0042BD47 E8B93A0000              call 0042F805
:0042BD4C 8945E8                  mov dword ptr [ebp-18], eax
:0042BD4F 817DE8FFFF0000          cmp dword ptr [ebp-18], 0000FFFF
:0042BD56 0F841D000000            je 0042BD79
:0042BD5C C745F001000000          mov [ebp-10], 00000001
:0042BD63 8B45E8                  mov eax, dword ptr [ebp-18]
:0042BD66 50                      push eax
:0042BD67 B9B0C44600              mov ecx, 0046C4B0
:0042BD6C E8173E0000              call 0042FB88
:0042BD71 8945F8                  mov dword ptr [ebp-08], eax
:0042BD74 E952000000              jmp 0042BDCB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BD56(C)
|
:0042BD79 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0042BD7C E89FD4FDFF              call 00409220
:0042BD81 85C0                    test eax, eax
:0042BD83 0F8442000000            je 0042BDCB
:0042BD89 6800040000              push 00000400
:0042BD8E B9B0C44600              mov ecx, 0046C4B0
:0042BD93 E86D3A0000              call 0042F805
:0042BD98 8945E8                  mov dword ptr [ebp-18], eax
:0042BD9B 817DE8FFFF0000          cmp dword ptr [ebp-18], 0000FFFF
:0042BDA2 0F8423000000            je 0042BDCB
:0042BDA8 C745F001000000          mov [ebp-10], 00000001
:0042BDAF 8B45E8                  mov eax, dword ptr [ebp-18]
:0042BDB2 50                      push eax
:0042BDB3 B9B0C44600              mov ecx, 0046C4B0
:0042BDB8 E8CB3D0000              call 0042FB88
:0042BDBD 3B45F8                  cmp eax, dword ptr [ebp-08]
:0042BDC0 0F8505000000            jne 0042BDCB
:0042BDC6 E900000000              jmp 0042BDCB

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042BD36(C), :0042BD74(U), :0042BD83(C), :0042BDA2(C), :0042BDC0(C)
|:0042BDC6(U)
|
:0042BDCB C645FC00                mov [ebp-04], 00
:0042BDCF 837DF000                cmp dword ptr [ebp-10], 00000000
:0042BDD3 0F85DC000000            jne 0042BEB5
:0042BDD9 8B45E4                  mov eax, dword ptr [ebp-1C]
:0042BDDC 833800                  cmp dword ptr [eax], 00000000
:0042BDDF 0F851C000000            jne 0042BE01
:0042BDE5 C645FC01                mov [ebp-04], 01
:0042BDE9 6A01                    push 00000001
:0042BDEB B998FC4600              mov ecx, 0046FC98
:0042BDF0 E8EBCFFFFF              call 00428DE0
:0042BDF5 6A0B                    push 0000000B
:0042BDF7 B990A64600              mov ecx, 0046A690
:0042BDFC E8C9D0FEFF              call 00418ECA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BDDF(C)
|
:0042BE01 33C0                    xor eax, eax
:0042BE03 8A45FC                  mov al, byte ptr [ebp-04]
:0042BE06 85C0                    test eax, eax
:0042BE08 0F8515000000            jne 0042BE23
:0042BE0E 6A00                    push 00000000
:0042BE10 8B45E4                  mov eax, dword ptr [ebp-1C]
:0042BE13 8B00                    mov eax, dword ptr [eax]
:0042BE15 50                      push eax
:0042BE16 E8ADD9FFFF              call 004297C8
:0042BE1B 83C408                  add esp, 00000008
:0042BE1E E92F000000              jmp 0042BE52

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BE08(C)
|
:0042BE23 6A01                    push 00000001
:0042BE25 8B45E4                  mov eax, dword ptr [ebp-1C]
:0042BE28 8B00                    mov eax, dword ptr [eax]
:0042BE2A 50                      push eax
:0042BE2B E898D9FFFF              call 004297C8
:0042BE30 83C408                  add esp, 00000008
:0042BE33 8B45E4                  mov eax, dword ptr [ebp-1C]
:0042BE36 833800                  cmp dword ptr [eax], 00000000
:0042BE39 0F8513000000            jne 0042BE52
:0042BE3F 6A10                    push 00000010
:0042BE41 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->"սʧܡ
˺ҵΪӰ"
                                  |
:0042BE43 684C224500              push 0045224C
:0042BE48 6A02                    push 00000002
:0042BE4A E82752FDFF              call 00401076
:0042BE4F 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042BE1E(U), :0042BE39(C)
|
:0042BE52 B998FC4600              mov ecx, 0046FC98
:0042BE57 E884210000              call 0042DFE0
:0042BE5C 33C9                    xor ecx, ecx
:0042BE5E 8AC8                    mov cl, al
:0042BE60 83F901                  cmp ecx, 00000001
:0042BE63 0F844C000000            je 0042BEB5
:0042BE69 33C0                    xor eax, eax
:0042BE6B 8A45FC                  mov al, byte ptr [ebp-04]
:0042BE6E 85C0                    test eax, eax
:0042BE70 0F851D000000            jne 0042BE93
:0042BE76 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0042BE79 E802D7FDFF              call 00409580
:0042BE7E 50                      push eax

* Possible StringData Ref from Data Obj ->"%sˣ"
                                  |
:0042BE7F 6878224500              push 00452278
:0042BE84 6A00                    push 00000000
:0042BE86 E8AAD00000              call 00438F35
:0042BE8B 83C40C                  add esp, 0000000C
:0042BE8E E922000000              jmp 0042BEB5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BE70(C)
|
:0042BE93 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0042BE96 E8E5D6FDFF              call 00409580
:0042BE9B 50                      push eax

* Possible StringData Ref from Data Obj ->"%sˣ"
                                  |
:0042BE9C 6884224500              push 00452284
:0042BEA1 6A00                    push 00000000
:0042BEA3 E88DD00000              call 00438F35
:0042BEA8 83C40C                  add esp, 0000000C
:0042BEAB 6A05                    push 00000005
:0042BEAD 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0042BEB0 E86BD0FFFF              call 00428F20

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042BDD3(C), :0042BE63(C), :0042BE8E(U)
|
:0042BEB5 E900000000              jmp 0042BEBA

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042BA85(U), :0042BB83(U), :0042BEB5(U)
|
:0042BEBA 5F                      pop edi
:0042BEBB 5E                      pop esi
:0042BEBC 5B                      pop ebx
:0042BEBD C9                      leave
:0042BEBE C3                      ret



* Referenced by a CALL at Addresses:
|:00402D0F   , :00404ECE   , :00404EE8   , :00405EA6   , :00406050   
|:00406D47   , :0041DAE6   , :00424709   , :00424851   , :00424AC6   
|:0042B14A   , :0042B934   , :0042BA17   , :0042BA47   , :0042BAB7   
|:0042C9F9   , :0043C79F   
|
:0042BEBF 55                      push ebp
:0042BEC0 8BEC                    mov ebp, esp
:0042BEC2 83EC04                  sub esp, 00000004
:0042BEC5 53                      push ebx
:0042BEC6 56                      push esi
:0042BEC7 57                      push edi
:0042BEC8 894DFC                  mov dword ptr [ebp-04], ecx
:0042BECB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042BECE E85DD9FDFF              call 00409830
:0042BED3 33C9                    xor ecx, ecx
:0042BED5 8AC8                    mov cl, al
:0042BED7 85C9                    test ecx, ecx
:0042BED9 0F843E000000            je 0042BF1D
:0042BEDF 6A03                    push 00000003
:0042BEE1 6A03                    push 00000003
:0042BEE3 8B45FC                  mov eax, dword ptr [ebp-04]
:0042BEE6 33DB                    xor ebx, ebx
:0042BEE8 8A5806                  mov bl, byte ptr [eax+06]
:0042BEEB 8D1C5B                  lea ebx, dword ptr [ebx+2*ebx]
:0042BEEE B900FB4600              mov ecx, 0046FB00
:0042BEF3 E8588CFFFF              call 00424B50
:0042BEF8 2BD8                    sub ebx, eax
:0042BEFA 53                      push ebx
:0042BEFB 8B45FC                  mov eax, dword ptr [ebp-04]
:0042BEFE 33DB                    xor ebx, ebx
:0042BF00 8A5805                  mov bl, byte ptr [eax+05]
:0042BF03 8D1C5B                  lea ebx, dword ptr [ebx+2*ebx]
:0042BF06 B900FB4600              mov ecx, 0046FB00
:0042BF0B E8208CFFFF              call 00424B30
:0042BF10 2BD8                    sub ebx, eax
:0042BF12 53                      push ebx
:0042BF13 B900FB4600              mov ecx, 0046FB00
:0042BF18 E8F1140100              call 0043D40E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BED9(C)
|
:0042BF1D E900000000              jmp 0042BF22

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BF1D(U)
|
:0042BF22 5F                      pop edi
:0042BF23 5E                      pop esi
:0042BF24 5B                      pop ebx
:0042BF25 C9                      leave
:0042BF26 C3                      ret



* Referenced by a CALL at Addresses:
|:0043E532   , :00442E8F   
|
:0042BF27 55                      push ebp
:0042BF28 8BEC                    mov ebp, esp
:0042BF2A 83EC38                  sub esp, 00000038
:0042BF2D 53                      push ebx
:0042BF2E 56                      push esi
:0042BF2F 57                      push edi
:0042BF30 894DC8                  mov dword ptr [ebp-38], ecx
:0042BF33 8B45C8                  mov eax, dword ptr [ebp-38]
:0042BF36 8B00                    mov eax, dword ptr [eax]
:0042BF38 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042BF3B 03C0                    add eax, eax
:0042BF3D 8D04C0                  lea eax, dword ptr [eax+8*eax]
:0042BF40 05E8564500              add eax, 004556E8
:0042BF45 8945FC                  mov dword ptr [ebp-04], eax
:0042BF48 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0042BF4B E850D3FDFF              call 004092A0
:0042BF50 8845F0                  mov byte ptr [ebp-10], al
:0042BF53 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0042BF56 E82B1F0000              call 0042DE86
:0042BF5B 85C0                    test eax, eax
:0042BF5D 0F8505000000            jne 0042BF68
:0042BF63 E9E3020000              jmp 0042C24B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BF5D(C)
|
:0042BF68 B900FB4600              mov ecx, 0046FB00
:0042BF6D E88E200000              call 0042E000
:0042BF72 8945F8                  mov dword ptr [ebp-08], eax
:0042BF75 B900FB4600              mov ecx, 0046FB00
:0042BF7A E8A1200000              call 0042E020
:0042BF7F 8945F4                  mov dword ptr [ebp-0C], eax
:0042BF82 B900FB4600              mov ecx, 0046FB00
:0042BF87 E8A48BFFFF              call 00424B30
:0042BF8C 8945D0                  mov dword ptr [ebp-30], eax
:0042BF8F B900FB4600              mov ecx, 0046FB00
:0042BF94 E8B78BFFFF              call 00424B50
:0042BF99 8945CC                  mov dword ptr [ebp-34], eax
:0042BF9C 8B45C8                  mov eax, dword ptr [ebp-38]
:0042BF9F 33C9                    xor ecx, ecx
:0042BFA1 8A4805                  mov cl, byte ptr [eax+05]
:0042BFA4 BB03000000              mov ebx, 00000003
:0042BFA9 8B45D0                  mov eax, dword ptr [ebp-30]
:0042BFAC 99                      cdq
:0042BFAD F7FB                    idiv ebx
:0042BFAF 2BC8                    sub ecx, eax
:0042BFB1 894DD8                  mov dword ptr [ebp-28], ecx
:0042BFB4 8B45D8                  mov eax, dword ptr [ebp-28]
:0042BFB7 8945EC                  mov dword ptr [ebp-14], eax
:0042BFBA 8B45C8                  mov eax, dword ptr [ebp-38]
:0042BFBD 33C9                    xor ecx, ecx
:0042BFBF 8A4806                  mov cl, byte ptr [eax+06]
:0042BFC2 BB03000000              mov ebx, 00000003
:0042BFC7 8B45CC                  mov eax, dword ptr [ebp-34]
:0042BFCA 99                      cdq
:0042BFCB F7FB                    idiv ebx
:0042BFCD 2BC8                    sub ecx, eax
:0042BFCF 894DD4                  mov dword ptr [ebp-2C], ecx
:0042BFD2 8B45D4                  mov eax, dword ptr [ebp-2C]
:0042BFD5 8945E4                  mov dword ptr [ebp-1C], eax
:0042BFD8 837DEC07                cmp dword ptr [ebp-14], 00000007
:0042BFDC 0F830C000000            jnb 0042BFEE
:0042BFE2 C745E803000000          mov [ebp-18], 00000003
:0042BFE9 E907000000              jmp 0042BFF5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BFDC(C)
|
:0042BFEE C745E8FAFFFFFF          mov [ebp-18], FFFFFFFA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BFE9(U)
|
:0042BFF5 837DE406                cmp dword ptr [ebp-1C], 00000006
:0042BFF9 0F830C000000            jnb 0042C00B
:0042BFFF C745DC00000000          mov [ebp-24], 00000000
:0042C006 E907000000              jmp 0042C012

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BFF9(C)
|
:0042C00B C745DCFEFFFFFF          mov [ebp-24], FFFFFFFE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C006(U)
|
:0042C012 8B45D8                  mov eax, dword ptr [ebp-28]
:0042C015 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042C018 0345E8                  add eax, dword ptr [ebp-18]
:0042C01B 8945EC                  mov dword ptr [ebp-14], eax
:0042C01E 8B45D4                  mov eax, dword ptr [ebp-2C]
:0042C021 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042C024 0345DC                  add eax, dword ptr [ebp-24]
:0042C027 8945E4                  mov dword ptr [ebp-1C], eax
:0042C02A 6A04                    push 00000004
:0042C02C B910BC4600              mov ecx, 0046BC10
:0042C031 E84B3EFFFF              call 0041FE81
:0042C036 6A07                    push 00000007
:0042C038 B910BC4600              mov ecx, 0046BC10
:0042C03D E8913CFFFF              call 0041FCD3
:0042C042 6A00                    push 00000000
:0042C044 B910BC4600              mov ecx, 0046BC10
:0042C049 E8823DFFFF              call 0041FDD0
:0042C04E 837DD800                cmp dword ptr [ebp-28], 00000000
:0042C052 0F82EE010000            jb 0042C246
:0042C058 837DD400                cmp dword ptr [ebp-2C], 00000000
:0042C05C 0F82E4010000            jb 0042C246
:0042C062 837DD813                cmp dword ptr [ebp-28], 00000013
:0042C066 0F83DA010000            jnb 0042C246
:0042C06C 837DD40C                cmp dword ptr [ebp-2C], 0000000C
:0042C070 0F83D0010000            jnb 0042C246
:0042C076 E81CAFFFFF              call 00426F97
:0042C07B 6A05                    push 00000005
:0042C07D 6A06                    push 00000006
:0042C07F 8B45E4                  mov eax, dword ptr [ebp-1C]
:0042C082 50                      push eax
:0042C083 8B45EC                  mov eax, dword ptr [ebp-14]
:0042C086 50                      push eax
:0042C087 B900FB4600              mov ecx, 0046FB00
:0042C08C E8B9E50000              call 0043A64A
:0042C091 C745E000000000          mov [ebp-20], 00000000
:0042C098 E903000000              jmp 0042C0A0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C0E1(U)
|
:0042C09D FF45E0                  inc [ebp-20]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C098(U)
|
:0042C0A0 817DE0001E0000          cmp dword ptr [ebp-20], 00001E00
:0042C0A7 0F8339000000            jnb 0042C0E6
:0042C0AD 8B45E0                  mov eax, dword ptr [ebp-20]
:0042C0B0 83E001                  and eax, 00000001
:0042C0B3 83F801                  cmp eax, 00000001
:0042C0B6 1BC0                    sbb eax, eax
:0042C0B8 83E05F                  and eax, 0000005F
:0042C0BB 05A0000000              add eax, 000000A0
:0042C0C0 50                      push eax
:0042C0C1 6A01                    push 00000001
:0042C0C3 6A04                    push 00000004
:0042C0C5 6A00                    push 00000000
:0042C0C7 6A00                    push 00000000
:0042C0C9 B968F94600              mov ecx, 0046F968
:0042C0CE E84DB60100              call 00447720
:0042C0D3 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0042C0D6 03C8                    add ecx, eax
:0042C0D8 51                      push ecx
:0042C0D9 E885B30100              call 00447463
:0042C0DE 83C40C                  add esp, 0000000C
:0042C0E1 E9B7FFFFFF              jmp 0042C09D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C0A7(C)
|
:0042C0E6 6A02                    push 00000002
:0042C0E8 B968F94600              mov ecx, 0046F968
:0042C0ED E8EECFFDFF              call 004090E0
:0042C0F2 50                      push eax
:0042C0F3 6A50                    push 00000050
:0042C0F5 6A60                    push 00000060
:0042C0F7 8B45E4                  mov eax, dword ptr [ebp-1C]
:0042C0FA 83C003                  add eax, 00000003
:0042C0FD C1E004                  shl eax, 04
:0042C100 50                      push eax
:0042C101 8B45EC                  mov eax, dword ptr [ebp-14]
:0042C104 C1E004                  shl eax, 04
:0042C107 83C008                  add eax, 00000008
:0042C10A 50                      push eax
:0042C10B E8A5110100              call 0043D2B5
:0042C110 83C418                  add esp, 00000018
:0042C113 6A01                    push 00000001
:0042C115 B900FB4600              mov ecx, 0046FB00
:0042C11A E8211F0000              call 0042E040
:0042C11F 8B45EC                  mov eax, dword ptr [ebp-14]
:0042C122 03C0                    add eax, eax
:0042C124 83C002                  add eax, 00000002
:0042C127 8945EC                  mov dword ptr [ebp-14], eax
:0042C12A 8B45E4                  mov eax, dword ptr [ebp-1C]
:0042C12D 83C003                  add eax, 00000003
:0042C130 C1E004                  shl eax, 04
:0042C133 83C008                  add eax, 00000008
:0042C136 8945E4                  mov dword ptr [ebp-1C], eax
:0042C139 8B45E4                  mov eax, dword ptr [ebp-1C]
:0042C13C 83E804                  sub eax, 00000004
:0042C13F 50                      push eax
:0042C140 8B45EC                  mov eax, dword ptr [ebp-14]
:0042C143 50                      push eax
:0042C144 B910BC4600              mov ecx, 0046BC10
:0042C149 E8B93AFFFF              call 0041FC07
:0042C14E 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0042C151 E8A30A0000              call 0042CBF9
:0042C156 6A07                    push 00000007
:0042C158 B910BC4600              mov ecx, 0046BC10
:0042C15D E8713BFFFF              call 0041FCD3
:0042C162 8B45E4                  mov eax, dword ptr [ebp-1C]
:0042C165 83E804                  sub eax, 00000004
:0042C168 50                      push eax
:0042C169 8B45EC                  mov eax, dword ptr [ebp-14]
:0042C16C 83C006                  add eax, 00000006
:0042C16F 50                      push eax
:0042C170 B910BC4600              mov ecx, 0046BC10
:0042C175 E88D3AFFFF              call 0041FC07
:0042C17A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042C17D E8FED0FDFF              call 00409280
:0042C182 33C9                    xor ecx, ecx
:0042C184 8AC8                    mov cl, al
:0042C186 51                      push ecx

* Possible StringData Ref from Data Obj ->"Lv%u"
                                  |
:0042C187 6890224500              push 00452290
:0042C18C 6810BC4600              push 0046BC10
:0042C191 E88D49FFFF              call 00420B23
:0042C196 83C40C                  add esp, 0000000C
:0042C199 8B45E4                  mov eax, dword ptr [ebp-1C]
:0042C19C 83C010                  add eax, 00000010
:0042C19F 50                      push eax
:0042C1A0 8B45EC                  mov eax, dword ptr [ebp-14]
:0042C1A3 50                      push eax
:0042C1A4 B910BC4600              mov ecx, 0046BC10
:0042C1A9 E8593AFFFF              call 0041FC07
:0042C1AE 33C0                    xor eax, eax
:0042C1B0 8A45F0                  mov al, byte ptr [ebp-10]
:0042C1B3 8B0485F82C4500          mov eax, dword ptr [4*eax+00452CF8]
:0042C1BA 50                      push eax

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:0042C1BB 6898224500              push 00452298
:0042C1C0 6810BC4600              push 0046BC10
:0042C1C5 E85949FFFF              call 00420B23
:0042C1CA 83C40C                  add esp, 0000000C
:0042C1CD 8B45E4                  mov eax, dword ptr [ebp-1C]
:0042C1D0 83C024                  add eax, 00000024
:0042C1D3 50                      push eax
:0042C1D4 8B45EC                  mov eax, dword ptr [ebp-14]
:0042C1D7 50                      push eax
:0042C1D8 B910BC4600              mov ecx, 0046BC10
:0042C1DD E8253AFFFF              call 0041FC07
:0042C1E2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042C1E5 E8A6D5FDFF              call 00409790
:0042C1EA 50                      push eax
:0042C1EB 8B45C8                  mov eax, dword ptr [ebp-38]
:0042C1EE 8B400F                  mov eax, dword ptr [eax+0F]
:0042C1F1 50                      push eax

* Possible StringData Ref from Data Obj ->"%3u/%3u"
                                  |
:0042C1F2 689C224500              push 0045229C
:0042C1F7 6810BC4600              push 0046BC10
:0042C1FC E82249FFFF              call 00420B23
:0042C201 83C410                  add esp, 00000010
:0042C204 8B45E4                  mov eax, dword ptr [ebp-1C]
:0042C207 83C036                  add eax, 00000036
:0042C20A 50                      push eax
:0042C20B 8B45EC                  mov eax, dword ptr [ebp-14]
:0042C20E 50                      push eax
:0042C20F B910BC4600              mov ecx, 0046BC10
:0042C214 E8EE39FFFF              call 0041FC07
:0042C219 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042C21C E8BFCFFDFF              call 004091E0
:0042C221 33C9                    xor ecx, ecx
:0042C223 8AC8                    mov cl, al
:0042C225 51                      push ecx
:0042C226 8B45C8                  mov eax, dword ptr [ebp-38]
:0042C229 33C9                    xor ecx, ecx
:0042C22B 8A4813                  mov cl, byte ptr [eax+13]
:0042C22E 51                      push ecx

* Possible StringData Ref from Data Obj ->"%3u/%3u"
                                  |
:0042C22F 68A4224500              push 004522A4
:0042C234 6810BC4600              push 0046BC10
:0042C239 E8E548FFFF              call 00420B23
:0042C23E 83C410                  add esp, 00000010
:0042C241 E871ADFFFF              call 00426FB7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042C052(C), :0042C05C(C), :0042C066(C), :0042C070(C)
|
:0042C246 E900000000              jmp 0042C24B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042BF63(U), :0042C246(U)
|
:0042C24B 5F                      pop edi
:0042C24C 5E                      pop esi
:0042C24D 5B                      pop ebx
:0042C24E C9                      leave
:0042C24F C3                      ret



* Referenced by a CALL at Addresses:
|:0041DC79   , :0042DD92   
|
:0042C250 55                      push ebp
:0042C251 8BEC                    mov ebp, esp
:0042C253 83EC08                  sub esp, 00000008
:0042C256 53                      push ebx
:0042C257 56                      push esi
:0042C258 57                      push edi
:0042C259 894DF8                  mov dword ptr [ebp-08], ecx
:0042C25C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042C25F E83CD0FDFF              call 004092A0
:0042C264 8845FC                  mov byte ptr [ebp-04], al
:0042C267 6A04                    push 00000004
:0042C269 6A00                    push 00000000
:0042C26B 8B4508                  mov eax, dword ptr [ebp+08]
:0042C26E 33C9                    xor ecx, ecx
:0042C270 8A4801                  mov cl, byte ptr [eax+01]
:0042C273 33C0                    xor eax, eax
:0042C275 A0C8FC4600              mov al, byte ptr [0046FCC8]
:0042C27A 0FAFC8                  imul ecx, eax
:0042C27D 8B4508                  mov eax, dword ptr [ebp+08]
:0042C280 33D2                    xor edx, edx
:0042C282 8A10                    mov dl, byte ptr [eax]
:0042C284 03CA                    add ecx, edx
:0042C286 81C180250000            add ecx, 00002580
:0042C28C 51                      push ecx
:0042C28D B950F94600              mov ecx, 0046F950
:0042C292 E889B40100              call 00447720
:0042C297 33C9                    xor ecx, ecx
:0042C299 8A08                    mov cl, byte ptr [eax]
:0042C29B 81F9FF000000            cmp ecx, 000000FF
:0042C2A1 0F8569000000            jne 0042C310
:0042C2A7 33C0                    xor eax, eax
:0042C2A9 8A45FC                  mov al, byte ptr [ebp-04]
:0042C2AC 33DB                    xor ebx, ebx
:0042C2AE 8A98C01C4500            mov bl, byte ptr [eax+00451CC0]
:0042C2B4 8BC3                    mov eax, ebx
:0042C2B6 8D1C5B                  lea ebx, dword ptr [ebx+2*ebx]
:0042C2B9 C1E303                  shl ebx, 03
:0042C2BC 2BD8                    sub ebx, eax
:0042C2BE 6A04                    push 00000004
:0042C2C0 6A00                    push 00000000
:0042C2C2 8B4508                  mov eax, dword ptr [ebp+08]
:0042C2C5 33C9                    xor ecx, ecx
:0042C2C7 8A4801                  mov cl, byte ptr [eax+01]
:0042C2CA 33C0                    xor eax, eax
:0042C2CC A0C8FC4600              mov al, byte ptr [0046FCC8]
:0042C2D1 0FAFC8                  imul ecx, eax
:0042C2D4 8B4508                  mov eax, dword ptr [ebp+08]
:0042C2D7 33D2                    xor edx, edx
:0042C2D9 8A10                    mov dl, byte ptr [eax]
:0042C2DB 03CA                    add ecx, edx
:0042C2DD 81C1C0210000            add ecx, 000021C0
:0042C2E3 51                      push ecx
:0042C2E4 B950F94600              mov ecx, 0046F950
:0042C2E9 E832B40100              call 00447720
:0042C2EE 33C9                    xor ecx, ecx
:0042C2F0 8A08                    mov cl, byte ptr [eax]
:0042C2F2 33C0                    xor eax, eax
:0042C2F4 8A840BF01C4500          mov al, byte ptr [ebx+ecx+00451CF0]
:0042C2FB 3DFF000000              cmp eax, 000000FF
:0042C300 0F840A000000            je 0042C310
:0042C306 B801000000              mov eax, 00000001
:0042C30B E902000000              jmp 0042C312

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042C2A1(C), :0042C300(C)
|
:0042C310 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C30B(U)
|
:0042C312 E900000000              jmp 0042C317

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C312(U)
|
:0042C317 5F                      pop edi
:0042C318 5E                      pop esi
:0042C319 5B                      pop ebx
:0042C31A C9                      leave
:0042C31B C20400                  ret 0004



* Referenced by a CALL at Address:
|:0042C436   
|
:0042C31E 55                      push ebp
:0042C31F 8BEC                    mov ebp, esp
:0042C321 83EC10                  sub esp, 00000010
:0042C324 53                      push ebx
:0042C325 56                      push esi
:0042C326 57                      push edi
:0042C327 894DF0                  mov dword ptr [ebp-10], ecx
:0042C32A 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0042C32D E83E55FDFF              call 00401870
:0042C332 33C0                    xor eax, eax
:0042C334 8A4508                  mov al, byte ptr [ebp+08]
:0042C337 3DFF000000              cmp eax, 000000FF
:0042C33C 0F8486000000            je 0042C3C8
:0042C342 C645F800                mov [ebp-08], 00
:0042C346 E903000000              jmp 0042C34E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C3C3(U)
|
:0042C34B FE45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C346(U)
|
:0042C34E 33C0                    xor eax, eax
:0042C350 8A45F8                  mov al, byte ptr [ebp-08]
:0042C353 83F804                  cmp eax, 00000004
:0042C356 0F8D6C000000            jnl 0042C3C8
:0042C35C 8B45F8                  mov eax, dword ptr [ebp-08]
:0042C35F 50                      push eax
:0042C360 8B45F0                  mov eax, dword ptr [ebp-10]
:0042C363 83C005                  add eax, 00000005
:0042C366 50                      push eax
:0042C367 E8E9D2FEFF              call 00419655
:0042C36C 83C408                  add esp, 00000008
:0042C36F 50                      push eax
:0042C370 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0042C373 E81855FDFF              call 00401890
:0042C378 33C0                    xor eax, eax
:0042C37A 8A45FC                  mov al, byte ptr [ebp-04]
:0042C37D 3DFF000000              cmp eax, 000000FF
:0042C382 0F843B000000            je 0042C3C3
:0042C388 8D45FC                  lea eax, dword ptr [ebp-04]
:0042C38B 50                      push eax
:0042C38C E8ACD1FEFF              call 0041953D
:0042C391 83C404                  add esp, 00000004
:0042C394 8845F4                  mov byte ptr [ebp-0C], al
:0042C397 33C0                    xor eax, eax
:0042C399 8A45F4                  mov al, byte ptr [ebp-0C]
:0042C39C 3DFF000000              cmp eax, 000000FF
:0042C3A1 0F841C000000            je 0042C3C3
:0042C3A7 33C0                    xor eax, eax
:0042C3A9 8A4508                  mov al, byte ptr [ebp+08]
:0042C3AC 33C9                    xor ecx, ecx
:0042C3AE 8A4DF4                  mov cl, byte ptr [ebp-0C]
:0042C3B1 3BC1                    cmp eax, ecx
:0042C3B3 0F850A000000            jne 0042C3C3
:0042C3B9 B801000000              mov eax, 00000001
:0042C3BE E90C000000              jmp 0042C3CF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042C382(C), :0042C3A1(C), :0042C3B3(C)
|
:0042C3C3 E983FFFFFF              jmp 0042C34B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042C33C(C), :0042C356(C)
|
:0042C3C8 33C0                    xor eax, eax
:0042C3CA E900000000              jmp 0042C3CF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042C3BE(U), :0042C3CA(U)
|
:0042C3CF 5F                      pop edi
:0042C3D0 5E                      pop esi
:0042C3D1 5B                      pop ebx
:0042C3D2 C9                      leave
:0042C3D3 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0041B796   , :00427B1A   , :00427B9F   , :00427ED0   , :00428619   
|:0042BB67   , :0042C4AD   , :0042C85C   , :004409AB   , :004409BA   
|:004413BA   , :00441406   , :00442986   
|
:0042C3D6 55                      push ebp
:0042C3D7 8BEC                    mov ebp, esp
:0042C3D9 83EC04                  sub esp, 00000004
:0042C3DC 53                      push ebx
:0042C3DD 56                      push esi
:0042C3DE 57                      push edi
:0042C3DF 894DFC                  mov dword ptr [ebp-04], ecx
:0042C3E2 33C0                    xor eax, eax
:0042C3E4 8A4508                  mov al, byte ptr [ebp+08]
:0042C3E7 83F807                  cmp eax, 00000007
:0042C3EA 0F8F09000000            jg 0042C3F9
:0042C3F0 8A4508                  mov al, byte ptr [ebp+08]
:0042C3F3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042C3F6 88410D                  mov byte ptr [ecx+0D], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C3EA(C)
|
:0042C3F9 E900000000              jmp 0042C3FE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C3F9(U)
|
:0042C3FE 5F                      pop edi
:0042C3FF 5E                      pop esi
:0042C400 5B                      pop ebx
:0042C401 C9                      leave
:0042C402 C20400                  ret 0004



* Referenced by a CALL at Address:
|:00427C0C   
|
:0042C405 55                      push ebp
:0042C406 8BEC                    mov ebp, esp
:0042C408 83EC08                  sub esp, 00000008
:0042C40B 53                      push ebx
:0042C40C 56                      push esi
:0042C40D 57                      push edi
:0042C40E 894DF8                  mov dword ptr [ebp-08], ecx
:0042C411 C745FC00000000          mov [ebp-04], 00000000
:0042C418 8B45F8                  mov eax, dword ptr [ebp-08]
:0042C41B 33C9                    xor ecx, ecx
:0042C41D 8A4807                  mov cl, byte ptr [eax+07]
:0042C420 81F9FF000000            cmp ecx, 000000FF
:0042C426 0F8423000000            je 0042C44F
:0042C42C 8B45F8                  mov eax, dword ptr [ebp-08]
:0042C42F 8A4007                  mov al, byte ptr [eax+07]
:0042C432 50                      push eax
:0042C433 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042C436 E8E3FEFFFF              call 0042C31E
:0042C43B 85C0                    test eax, eax
:0042C43D 0F8407000000            je 0042C44A
:0042C443 C745FC01000000          mov [ebp-04], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C43D(C)
|
:0042C44A E96A000000              jmp 0042C4B9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C426(C)
|
:0042C44F 8B45F8                  mov eax, dword ptr [ebp-08]
:0042C452 83C005                  add eax, 00000005
:0042C455 50                      push eax
:0042C456 8B45F8                  mov eax, dword ptr [ebp-08]
:0042C459 83C008                  add eax, 00000008
:0042C45C 50                      push eax
:0042C45D E81E1EFFFF              call 0041E280
:0042C462 83C408                  add esp, 00000008
:0042C465 85C0                    test eax, eax
:0042C467 0F844C000000            je 0042C4B9
:0042C46D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042C470 E85BCFFDFF              call 004093D0
:0042C475 33C9                    xor ecx, ecx
:0042C477 8AC8                    mov cl, al
:0042C479 85C9                    test ecx, ecx
:0042C47B 0F8415000000            je 0042C496
:0042C481 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042C484 E847CFFDFF              call 004093D0
:0042C489 33C9                    xor ecx, ecx
:0042C48B 8AC8                    mov cl, al
:0042C48D 83F904                  cmp ecx, 00000004
:0042C490 0F851C000000            jne 0042C4B2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C47B(C)
|
:0042C496 8B45F8                  mov eax, dword ptr [ebp-08]
:0042C499 83C005                  add eax, 00000005
:0042C49C 50                      push eax
:0042C49D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042C4A0 83C108                  add ecx, 00000008
:0042C4A3 E8E853FDFF              call 00401890
:0042C4A8 6A03                    push 00000003
:0042C4AA 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042C4AD E824FFFFFF              call 0042C3D6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C490(C)
|
:0042C4B2 C745FC01000000          mov [ebp-04], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042C44A(U), :0042C467(C)
|
:0042C4B9 8B45FC                  mov eax, dword ptr [ebp-04]
:0042C4BC E900000000              jmp 0042C4C1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C4BC(U)
|
:0042C4C1 5F                      pop edi
:0042C4C2 5E                      pop esi
:0042C4C3 5B                      pop ebx
:0042C4C4 C9                      leave
:0042C4C5 C3                      ret



* Referenced by a CALL at Addresses:
|:00402DBB   , :0041BE08   
|
:0042C4C6 55                      push ebp
:0042C4C7 8BEC                    mov ebp, esp
:0042C4C9 83EC28                  sub esp, 00000028
:0042C4CC 53                      push ebx
:0042C4CD 56                      push esi
:0042C4CE 57                      push edi
:0042C4CF 894DDC                  mov dword ptr [ebp-24], ecx
:0042C4D2 C745EC00000000          mov [ebp-14], 00000000
:0042C4D9 8B45DC                  mov eax, dword ptr [ebp-24]
:0042C4DC 8B00                    mov eax, dword ptr [eax]
:0042C4DE 8945E8                  mov dword ptr [ebp-18], eax
:0042C4E1 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0042C4E4 E88753FDFF              call 00401870
:0042C4E9 C645F0FF                mov [ebp-10], FF
:0042C4ED 6A04                    push 00000004
:0042C4EF 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0042C4F2 E869CEFDFF              call 00409360
:0042C4F7 85C0                    test eax, eax
:0042C4F9 0F8515000000            jne 0042C514
:0042C4FF 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0042C502 E829D3FDFF              call 00409830
:0042C507 33C9                    xor ecx, ecx
:0042C509 8AC8                    mov cl, al
:0042C50B 83F902                  cmp ecx, 00000002
:0042C50E 0F8408000000            je 0042C51C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C4F9(C)
|
:0042C514 8B45EC                  mov eax, dword ptr [ebp-14]
:0042C517 E920030000              jmp 0042C83C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C50E(C)
|
:0042C51C C645F400                mov [ebp-0C], 00
:0042C520 E903000000              jmp 0042C528

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C82F(U)
|
:0042C525 FE45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C520(U)
|
:0042C528 33C0                    xor eax, eax
:0042C52A 8A45F4                  mov al, byte ptr [ebp-0C]
:0042C52D 83F803                  cmp eax, 00000003
:0042C530 0F8DFE020000            jnl 0042C834
:0042C536 B998FC4600              mov ecx, 0046FC98
:0042C53B E8A01A0000              call 0042DFE0
:0042C540 33C9                    xor ecx, ecx
:0042C542 8AC8                    mov cl, al
:0042C544 85C9                    test ecx, ecx
:0042C546 0F85E8020000            jne 0042C834
:0042C54C C645E400                mov [ebp-1C], 00
:0042C550 E903000000              jmp 0042C558

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C82A(U)
|
:0042C555 FE45E4                  inc [ebp-1C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C550(U)
|
:0042C558 33C0                    xor eax, eax
:0042C55A 8A45F4                  mov al, byte ptr [ebp-0C]
:0042C55D 83E802                  sub eax, 00000002
:0042C560 83F801                  cmp eax, 00000001
:0042C563 1BC0                    sbb eax, eax
:0042C565 83E003                  and eax, 00000003
:0042C568 40                      inc eax
:0042C569 33C9                    xor ecx, ecx
:0042C56B 8A4DE4                  mov cl, byte ptr [ebp-1C]
:0042C56E 3BC1                    cmp eax, ecx
:0042C570 0F8EB9020000            jle 0042C82F
:0042C576 B998FC4600              mov ecx, 0046FC98
:0042C57B E8601A0000              call 0042DFE0
:0042C580 33C9                    xor ecx, ecx
:0042C582 8AC8                    mov cl, al
:0042C584 85C9                    test ecx, ecx
:0042C586 0F85A3020000            jne 0042C82F
:0042C58C C645E005                mov [ebp-20], 05
:0042C590 C745F800000100          mov [ebp-08], 00010000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C7C4(U)
|
:0042C597 33C0                    xor eax, eax
:0042C599 8A45E0                  mov al, byte ptr [ebp-20]
:0042C59C 83F805                  cmp eax, 00000005
:0042C59F 0F840E000000            je 0042C5B3
:0042C5A5 33C0                    xor eax, eax
:0042C5A7 8A45E0                  mov al, byte ptr [ebp-20]
:0042C5AA 83F806                  cmp eax, 00000006
:0042C5AD 0F8516020000            jne 0042C7C9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C59F(C)
|
:0042C5B3 817DF8FFFF0000          cmp dword ptr [ebp-08], 0000FFFF
:0042C5BA 0F8409020000            je 0042C7C9
:0042C5C0 B998FC4600              mov ecx, 0046FC98
:0042C5C5 E8161A0000              call 0042DFE0
:0042C5CA 33C9                    xor ecx, ecx
:0042C5CC 8AC8                    mov cl, al
:0042C5CE 85C9                    test ecx, ecx
:0042C5D0 0F8405000000            je 0042C5DB
:0042C5D6 E9EE010000              jmp 0042C7C9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C5D0(C)
|
:0042C5DB C745F8FFFF0000          mov [ebp-08], 0000FFFF
:0042C5E2 33C0                    xor eax, eax
:0042C5E4 8A45F4                  mov al, byte ptr [ebp-0C]
:0042C5E7 8945D8                  mov dword ptr [ebp-28], eax
:0042C5EA E98D010000              jmp 0042C77C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C780(C)
|
:0042C5EF 8B45DC                  mov eax, dword ptr [ebp-24]
:0042C5F2 33C9                    xor ecx, ecx
:0042C5F4 8A4806                  mov cl, byte ptr [eax+06]
:0042C5F7 51                      push ecx
:0042C5F8 8B45DC                  mov eax, dword ptr [ebp-24]
:0042C5FB 33C9                    xor ecx, ecx
:0042C5FD 8A4805                  mov cl, byte ptr [eax+05]
:0042C600 51                      push ecx
:0042C601 8B45E8                  mov eax, dword ptr [ebp-18]
:0042C604 50                      push eax
:0042C605 B9B0C44600              mov ecx, 0046C4B0
:0042C60A E8C42D0000              call 0042F3D3
:0042C60F 8945F8                  mov dword ptr [ebp-08], eax
:0042C612 817DF8FFFF0000          cmp dword ptr [ebp-08], 0000FFFF
:0042C619 0F8534000000            jne 0042C653
:0042C61F 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0042C622 E8F9CBFDFF              call 00409220
:0042C627 85C0                    test eax, eax
:0042C629 0F8424000000            je 0042C653
:0042C62F 8B45DC                  mov eax, dword ptr [ebp-24]
:0042C632 33C9                    xor ecx, ecx
:0042C634 8A4806                  mov cl, byte ptr [eax+06]
:0042C637 51                      push ecx
:0042C638 8B45DC                  mov eax, dword ptr [ebp-24]
:0042C63B 33C9                    xor ecx, ecx
:0042C63D 8A4805                  mov cl, byte ptr [eax+05]
:0042C640 51                      push ecx
:0042C641 6800040000              push 00000400
:0042C646 B9B0C44600              mov ecx, 0046C4B0
:0042C64B E8832D0000              call 0042F3D3
:0042C650 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042C619(C), :0042C629(C)
|
:0042C653 E947010000              jmp 0042C79F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C78A(C)
|
:0042C658 8B45DC                  mov eax, dword ptr [ebp-24]
:0042C65B 33C9                    xor ecx, ecx
:0042C65D 8A4806                  mov cl, byte ptr [eax+06]
:0042C660 51                      push ecx
:0042C661 8B45DC                  mov eax, dword ptr [ebp-24]
:0042C664 33C9                    xor ecx, ecx
:0042C666 8A4805                  mov cl, byte ptr [eax+05]
:0042C669 51                      push ecx
:0042C66A 8B45E8                  mov eax, dword ptr [ebp-18]
:0042C66D 50                      push eax
:0042C66E B9B0C44600              mov ecx, 0046C4B0
:0042C673 E8AF300000              call 0042F727
:0042C678 8945F8                  mov dword ptr [ebp-08], eax
:0042C67B 817DF8FFFF0000          cmp dword ptr [ebp-08], 0000FFFF
:0042C682 0F8534000000            jne 0042C6BC
:0042C688 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0042C68B E890CBFDFF              call 00409220
:0042C690 85C0                    test eax, eax
:0042C692 0F8424000000            je 0042C6BC
:0042C698 8B45DC                  mov eax, dword ptr [ebp-24]
:0042C69B 33C9                    xor ecx, ecx
:0042C69D 8A4806                  mov cl, byte ptr [eax+06]
:0042C6A0 51                      push ecx
:0042C6A1 8B45DC                  mov eax, dword ptr [ebp-24]
:0042C6A4 33C9                    xor ecx, ecx
:0042C6A6 8A4805                  mov cl, byte ptr [eax+05]
:0042C6A9 51                      push ecx
:0042C6AA 6800040000              push 00000400
:0042C6AF B9B0C44600              mov ecx, 0046C4B0
:0042C6B4 E86E300000              call 0042F727
:0042C6B9 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042C682(C), :0042C692(C)
|
:0042C6BC E9DE000000              jmp 0042C79F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C794(C)
|
:0042C6C1 8B45E4                  mov eax, dword ptr [ebp-1C]
:0042C6C4 50                      push eax
:0042C6C5 8B45DC                  mov eax, dword ptr [ebp-24]
:0042C6C8 83C005                  add eax, 00000005
:0042C6CB 50                      push eax
:0042C6CC E884CFFEFF              call 00419655
:0042C6D1 83C408                  add esp, 00000008
:0042C6D4 50                      push eax
:0042C6D5 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0042C6D8 E8B351FDFF              call 00401890
:0042C6DD 8D45FC                  lea eax, dword ptr [ebp-04]
:0042C6E0 50                      push eax
:0042C6E1 E857CEFEFF              call 0041953D
:0042C6E6 83C404                  add esp, 00000004
:0042C6E9 8845F0                  mov byte ptr [ebp-10], al
:0042C6EC 33C0                    xor eax, eax
:0042C6EE 8A45F0                  mov al, byte ptr [ebp-10]
:0042C6F1 3DFF000000              cmp eax, 000000FF
:0042C6F6 0F8476000000            je 0042C772
:0042C6FC 33C0                    xor eax, eax
:0042C6FE 8A45F0                  mov al, byte ptr [ebp-10]
:0042C701 8BC8                    mov ecx, eax
:0042C703 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042C706 C1E003                  shl eax, 03
:0042C709 2BC1                    sub eax, ecx
:0042C70B 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0042C711 E81ACAFDFF              call 00409130
:0042C716 50                      push eax
:0042C717 8B45E8                  mov eax, dword ptr [ebp-18]
:0042C71A 50                      push eax
:0042C71B B9B0C44600              mov ecx, 0046C4B0
:0042C720 E8FA2A0000              call 0042F21F
:0042C725 8945F8                  mov dword ptr [ebp-08], eax
:0042C728 817DF8FFFF0000          cmp dword ptr [ebp-08], 0000FFFF
:0042C72F 0F853D000000            jne 0042C772
:0042C735 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0042C738 E8E3CAFDFF              call 00409220
:0042C73D 85C0                    test eax, eax
:0042C73F 0F842D000000            je 0042C772
:0042C745 33C0                    xor eax, eax
:0042C747 8A45F0                  mov al, byte ptr [ebp-10]
:0042C74A 8BC8                    mov ecx, eax
:0042C74C 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042C74F C1E003                  shl eax, 03
:0042C752 2BC1                    sub eax, ecx
:0042C754 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0042C75A E8D1C9FDFF              call 00409130
:0042C75F 50                      push eax
:0042C760 6800040000              push 00000400
:0042C765 B9B0C44600              mov ecx, 0046C4B0
:0042C76A E8B02A0000              call 0042F21F
:0042C76F 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042C6F6(C), :0042C72F(C), :0042C73F(C)
|
:0042C772 E928000000              jmp 0042C79F
:0042C777 E923000000              jmp 0042C79F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C5EA(U)
|
:0042C77C 837DD800                cmp dword ptr [ebp-28], 00000000
:0042C780 0F8469FEFFFF            je 0042C5EF
:0042C786 837DD801                cmp dword ptr [ebp-28], 00000001
:0042C78A 0F84C8FEFFFF            je 0042C658
:0042C790 837DD802                cmp dword ptr [ebp-28], 00000002
:0042C794 0F8427FFFFFF            je 0042C6C1
:0042C79A E900000000              jmp 0042C79F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042C653(U), :0042C6BC(U), :0042C772(U), :0042C777(U), :0042C79A(U)
|
:0042C79F 817DF8FFFF0000          cmp dword ptr [ebp-08], 0000FFFF
:0042C7A6 0F8418000000            je 0042C7C4
:0042C7AC 8B45F8                  mov eax, dword ptr [ebp-08]
:0042C7AF 50                      push eax
:0042C7B0 B9B0C44600              mov ecx, 0046C4B0
:0042C7B5 E8CE330000              call 0042FB88
:0042C7BA 8845E0                  mov byte ptr [ebp-20], al
:0042C7BD C745EC01000000          mov [ebp-14], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C7A6(C)
|
:0042C7C4 E9CEFDFFFF              jmp 0042C597

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042C5AD(C), :0042C5BA(C), :0042C5D6(U)
|
:0042C7C9 C645E005                mov [ebp-20], 05

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C825(U)
|
:0042C7CD 33C0                    xor eax, eax
:0042C7CF 8A45E0                  mov al, byte ptr [ebp-20]
:0042C7D2 83F805                  cmp eax, 00000005
:0042C7D5 0F840E000000            je 0042C7E9
:0042C7DB 33C0                    xor eax, eax
:0042C7DD 8A45E0                  mov al, byte ptr [ebp-20]
:0042C7E0 83F806                  cmp eax, 00000006
:0042C7E3 0F8541000000            jne 0042C82A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C7D5(C)
|
:0042C7E9 B9B0C44600              mov ecx, 0046C4B0
:0042C7EE E886280000              call 0042F079
:0042C7F3 8945F8                  mov dword ptr [ebp-08], eax
:0042C7F6 817DF8FFFF0000          cmp dword ptr [ebp-08], 0000FFFF
:0042C7FD 0F841D000000            je 0042C820
:0042C803 8B45F8                  mov eax, dword ptr [ebp-08]
:0042C806 50                      push eax
:0042C807 B9B0C44600              mov ecx, 0046C4B0
:0042C80C E877330000              call 0042FB88
:0042C811 8845E0                  mov byte ptr [ebp-20], al
:0042C814 C745EC01000000          mov [ebp-14], 00000001
:0042C81B E905000000              jmp 0042C825

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C7FD(C)
|
:0042C820 E905000000              jmp 0042C82A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C81B(U)
|
:0042C825 E9A3FFFFFF              jmp 0042C7CD

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042C7E3(C), :0042C820(U)
|
:0042C82A E926FDFFFF              jmp 0042C555

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042C570(C), :0042C586(C)
|
:0042C82F E9F1FCFFFF              jmp 0042C525

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042C530(C), :0042C546(C)
|
:0042C834 8B45EC                  mov eax, dword ptr [ebp-14]
:0042C837 E900000000              jmp 0042C83C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042C517(U), :0042C837(U)
|
:0042C83C 5F                      pop edi
:0042C83D 5E                      pop esi
:0042C83E 5B                      pop ebx
:0042C83F C9                      leave
:0042C840 C3                      ret


:0042C841 55                      push ebp
:0042C842 8BEC                    mov ebp, esp
:0042C844 83EC04                  sub esp, 00000004
:0042C847 53                      push ebx
:0042C848 56                      push esi
:0042C849 57                      push edi
:0042C84A 894DFC                  mov dword ptr [ebp-04], ecx
:0042C84D 6A04                    push 00000004
:0042C84F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042C852 E8D9CAFDFF              call 00409330
:0042C857 6A01                    push 00000001
:0042C859 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042C85C E875FBFFFF              call 0042C3D6
:0042C861 E900000000              jmp 0042C866

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C861(U)
|
:0042C866 5F                      pop edi
:0042C867 5E                      pop esi
:0042C868 5B                      pop ebx
:0042C869 C9                      leave
:0042C86A C3                      ret



* Referenced by a CALL at Addresses:
|:0041A228   , :0041B697   , :0041BDB1   
|
:0042C86B 55                      push ebp
:0042C86C 8BEC                    mov ebp, esp
:0042C86E 83EC1C                  sub esp, 0000001C
:0042C871 53                      push ebx
:0042C872 56                      push esi
:0042C873 57                      push edi
:0042C874 894DE4                  mov dword ptr [ebp-1C], ecx

* Possible StringData Ref from Data Obj ->"%sƶ"
                                  |
:0042C877 C745F0AC224500          mov [ebp-10], 004522AC

* Possible StringData Ref from Data Obj ->"%sĹ"
                                  |
:0042C87E C745F4B8224500          mov [ebp-0C], 004522B8

* Possible StringData Ref from Data Obj ->"%sĲ"
                                  |
:0042C885 C745F8C4224500          mov [ebp-08], 004522C4
:0042C88C 6A20                    push 00000020
:0042C88E 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0042C891 E8CACAFDFF              call 00409360
:0042C896 85C0                    test eax, eax
:0042C898 0F848A010000            je 0042CA28
:0042C89E B9D0A64600              mov ecx, 0046A6D0
:0042C8A3 E8D8C8FDFF              call 00409180
:0042C8A8 F6C410                  test ah, 10
:0042C8AB 0F850D000000            jne 0042C8BE
:0042C8B1 33C0                    xor eax, eax
:0042C8B3 8A4508                  mov al, byte ptr [ebp+08]
:0042C8B6 85C0                    test eax, eax
:0042C8B8 0F8418000000            je 0042C8D6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C8AB(C)
|
:0042C8BE 8B45E4                  mov eax, dword ptr [ebp-1C]
:0042C8C1 8A4006                  mov al, byte ptr [eax+06]
:0042C8C4 50                      push eax
:0042C8C5 8B45E4                  mov eax, dword ptr [ebp-1C]
:0042C8C8 8A4005                  mov al, byte ptr [eax+05]
:0042C8CB 50                      push eax
:0042C8CC B900FB4600              mov ecx, 0046FB00
:0042C8D1 E812E90000              call 0043B1E8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C8B8(C)
|
:0042C8D6 E8BCA6FFFF              call 00426F97
:0042C8DB 6A00                    push 00000000
:0042C8DD 6A03                    push 00000003
:0042C8DF 6A30                    push 00000030
:0042C8E1 6890000000              push 00000090
:0042C8E6 6A40                    push 00000040
:0042C8E8 6810010000              push 00000110
:0042C8ED B958BC4600              mov ecx, 0046BC58
:0042C8F2 E87344FFFF              call 00420D6A
:0042C8F7 6A04                    push 00000004
:0042C8F9 B910BC4600              mov ecx, 0046BC10
:0042C8FE E87E35FFFF              call 0041FE81
:0042C903 6A07                    push 00000007
:0042C905 B910BC4600              mov ecx, 0046BC10
:0042C90A E8C433FFFF              call 0041FCD3
:0042C90F 6A00                    push 00000000
:0042C911 B910BC4600              mov ecx, 0046BC10
:0042C916 E8B534FFFF              call 0041FDD0
:0042C91B 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0042C91E E863150000              call 0042DE86
:0042C923 85C0                    test eax, eax
:0042C925 0F8410000000            je 0042C93B
:0042C92B 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0042C92E E84DCCFDFF              call 00409580
:0042C933 8945FC                  mov dword ptr [ebp-04], eax
:0042C936 E916000000              jmp 0042C951

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C925(C)
|
:0042C93B 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0042C93E E85DC9FDFF              call 004092A0
:0042C943 33C9                    xor ecx, ecx
:0042C945 8AC8                    mov cl, al
:0042C947 8B048DF82C4500          mov eax, dword ptr [4*ecx+00452CF8]
:0042C94E 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C936(U)
|
:0042C951 8B45FC                  mov eax, dword ptr [ebp-04]
:0042C954 50                      push eax
:0042C955 33C0                    xor eax, eax
:0042C957 8A4508                  mov al, byte ptr [ebp+08]
:0042C95A 8B4485F0                mov eax, dword ptr [ebp+4*eax-10]
:0042C95E 50                      push eax
:0042C95F E8E8C40000              call 00438E4C
:0042C964 83C408                  add esp, 00000008
:0042C967 68B0F94600              push 0046F9B0
:0042C96C E839AA0100              call 004473AA
:0042C971 83C404                  add esp, 00000004
:0042C974 8845EC                  mov byte ptr [ebp-14], al
:0042C977 6A50                    push 00000050
:0042C979 B80E000000              mov eax, 0000000E
:0042C97E 33C9                    xor ecx, ecx
:0042C980 8A4DEC                  mov cl, byte ptr [ebp-14]
:0042C983 2BC1                    sub eax, ecx
:0042C985 99                      cdq
:0042C986 2BC2                    sub eax, edx
:0042C988 C1F801                  sar eax, 01
:0042C98B 83C024                  add eax, 00000024
:0042C98E 50                      push eax
:0042C98F B910BC4600              mov ecx, 0046BC10
:0042C994 E86E32FFFF              call 0041FC07
:0042C999 68B0F94600              push 0046F9B0

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:0042C99E 68D0224500              push 004522D0
:0042C9A3 6810BC4600              push 0046BC10
:0042C9A8 E87641FFFF              call 00420B23
:0042C9AD 83C40C                  add esp, 0000000C
:0042C9B0 E802A6FFFF              call 00426FB7
:0042C9B5 6A03                    push 00000003
:0042C9B7 6A09                    push 00000009
:0042C9B9 6A01                    push 00000001
:0042C9BB 6A11                    push 00000011
:0042C9BD B900FB4600              mov ecx, 0046FB00
:0042C9C2 E883DC0000              call 0043A64A
:0042C9C7 6A01                    push 00000001
:0042C9C9 B900FB4600              mov ecx, 0046FB00
:0042C9CE E86D160000              call 0042E040
:0042C9D3 C745E800000000          mov [ebp-18], 00000000
:0042C9DA E903000000              jmp 0042C9E2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CA08(U)
|
:0042C9DF FF45E8                  inc [ebp-18]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C9DA(U)
|
:0042C9E2 837DE804                cmp dword ptr [ebp-18], 00000004
:0042C9E6 0F8321000000            jnb 0042CA0D
:0042C9EC B998FC4600              mov ecx, 0046FC98
:0042C9F1 E82A19FFFF              call 0041E320
:0042C9F6 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0042C9F9 E8C1F4FFFF              call 0042BEBF
:0042C9FE 6A01                    push 00000001
:0042CA00 E8B6AB0000              call 004375BB
:0042CA05 83C404                  add esp, 00000004
:0042CA08 E9D2FFFFFF              jmp 0042C9DF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C9E6(C)
|
:0042CA0D B900FB4600              mov ecx, 0046FB00
:0042CA12 E86FDC0000              call 0043A686
:0042CA17 8B45E4                  mov eax, dword ptr [ebp-1C]
:0042CA1A 8A4004                  mov al, byte ptr [eax+04]
:0042CA1D 50                      push eax
:0042CA1E B900FB4600              mov ecx, 0046FB00
:0042CA23 E836E40000              call 0043AE5E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C898(C)
|
:0042CA28 E900000000              jmp 0042CA2D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CA28(U)
|
:0042CA2D 5F                      pop edi
:0042CA2E 5E                      pop esi
:0042CA2F 5B                      pop ebx
:0042CA30 C9                      leave
:0042CA31 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0042979F   , :0043C1C7   , :00442517   , :00442537   
|
:0042CA34 55                      push ebp
:0042CA35 8BEC                    mov ebp, esp
:0042CA37 83EC08                  sub esp, 00000008
:0042CA3A 53                      push ebx
:0042CA3B 56                      push esi
:0042CA3C 57                      push edi
:0042CA3D 894DF8                  mov dword ptr [ebp-08], ecx
:0042CA40 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042CA43 E8D8C7FDFF              call 00409220
:0042CA48 85C0                    test eax, eax
:0042CA4A 0F841E000000            je 0042CA6E
:0042CA50 33C0                    xor eax, eax
:0042CA52 A0A8354500              mov al, byte ptr [004535A8]
:0042CA57 3DFF000000              cmp eax, 000000FF
:0042CA5C 0F850C000000            jne 0042CA6E
:0042CA62 C745FC00000000          mov [ebp-04], 00000000
:0042CA69 E964000000              jmp 0042CAD2

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042CA4A(C), :0042CA5C(C)
|
:0042CA6E 8B45F8                  mov eax, dword ptr [ebp-08]
:0042CA71 8B00                    mov eax, dword ptr [eax]
:0042CA73 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042CA76 03C0                    add eax, eax
:0042CA78 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:0042CA7F E8CC43FEFF              call 00410E50
:0042CA84 33C9                    xor ecx, ecx
:0042CA86 8AC8                    mov cl, al
:0042CA88 894DFC                  mov dword ptr [ebp-04], ecx
:0042CA8B 837DFC09                cmp dword ptr [ebp-04], 00000009
:0042CA8F 0F853D000000            jne 0042CAD2
:0042CA95 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042CA98 E883C7FDFF              call 00409220
:0042CA9D 83F801                  cmp eax, 00000001
:0042CAA0 1BC0                    sbb eax, eax
:0042CAA2 83E00F                  and eax, 0000000F
:0042CAA5 8BC8                    mov ecx, eax
:0042CAA7 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042CAAA C1E003                  shl eax, 03
:0042CAAD 2BC1                    sub eax, ecx
:0042CAAF 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0042CAB5 E876C6FDFF              call 00409130
:0042CABA 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042CABD 03C0                    add eax, eax
:0042CABF 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:0042CAC6 E88543FEFF              call 00410E50
:0042CACB 33C9                    xor ecx, ecx
:0042CACD 8AC8                    mov cl, al
:0042CACF 894DFC                  mov dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042CA69(U), :0042CA8F(C)
|
:0042CAD2 837DFC09                cmp dword ptr [ebp-04], 00000009
:0042CAD6 0F8657000000            jbe 0042CB33
:0042CADC 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042CADF E83CC7FDFF              call 00409220
:0042CAE4 83F801                  cmp eax, 00000001
:0042CAE7 1BC0                    sbb eax, eax
:0042CAE9 83E00F                  and eax, 0000000F
:0042CAEC 8BC8                    mov ecx, eax
:0042CAEE 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042CAF1 C1E003                  shl eax, 03
:0042CAF4 2BC1                    sub eax, ecx
:0042CAF6 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0042CAFC E82FC6FDFF              call 00409130
:0042CB01 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042CB04 03C0                    add eax, eax
:0042CB06 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:0042CB0D E83E43FEFF              call 00410E50
:0042CB12 33C9                    xor ecx, ecx
:0042CB14 8AC8                    mov cl, al
:0042CB16 894DFC                  mov dword ptr [ebp-04], ecx
:0042CB19 8B45FC                  mov eax, dword ptr [ebp-04]
:0042CB1C 50                      push eax
:0042CB1D 8B45F8                  mov eax, dword ptr [ebp-08]
:0042CB20 8B00                    mov eax, dword ptr [eax]
:0042CB22 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042CB25 03C0                    add eax, eax
:0042CB27 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:0042CB2E E8CD28FFFF              call 0041F400

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CAD6(C)
|
:0042CB33 8B45FC                  mov eax, dword ptr [ebp-04]
:0042CB36 E900000000              jmp 0042CB3B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CB36(U)
|
:0042CB3B 5F                      pop edi
:0042CB3C 5E                      pop esi
:0042CB3D 5B                      pop ebx
:0042CB3E C9                      leave
:0042CB3F C3                      ret



* Referenced by a CALL at Address:
|:0042A9C2   
|
:0042CB40 55                      push ebp
:0042CB41 8BEC                    mov ebp, esp
:0042CB43 83EC10                  sub esp, 00000010
:0042CB46 53                      push ebx
:0042CB47 56                      push esi
:0042CB48 57                      push edi
:0042CB49 894DF0                  mov dword ptr [ebp-10], ecx
:0042CB4C 8B45F0                  mov eax, dword ptr [ebp-10]
:0042CB4F 33DB                    xor ebx, ebx
:0042CB51 8A5805                  mov bl, byte ptr [eax+05]
:0042CB54 8D1C5B                  lea ebx, dword ptr [ebx+2*ebx]
:0042CB57 B900FB4600              mov ecx, 0046FB00
:0042CB5C E8CF7FFFFF              call 00424B30
:0042CB61 2BD8                    sub ebx, eax
:0042CB63 895DFC                  mov dword ptr [ebp-04], ebx
:0042CB66 8B45F0                  mov eax, dword ptr [ebp-10]
:0042CB69 33DB                    xor ebx, ebx
:0042CB6B 8A5806                  mov bl, byte ptr [eax+06]
:0042CB6E 8D1C5B                  lea ebx, dword ptr [ebx+2*ebx]
:0042CB71 B900FB4600              mov ecx, 0046FB00
:0042CB76 E8D57FFFFF              call 00424B50
:0042CB7B 2BD8                    sub ebx, eax
:0042CB7D 895DF8                  mov dword ptr [ebp-08], ebx
:0042CB80 C645F400                mov [ebp-0C], 00
:0042CB84 E903000000              jmp 0042CB8C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CBEA(U)
|
:0042CB89 FE45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CB84(U)
|
:0042CB8C 33C0                    xor eax, eax
:0042CB8E 8A45F4                  mov al, byte ptr [ebp-0C]
:0042CB91 83F803                  cmp eax, 00000003
:0042CB94 0F8D55000000            jnl 0042CBEF
:0042CB9A 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0042CB9D E8A1EDFFFF              call 0042B943
:0042CBA2 6A03                    push 00000003
:0042CBA4 6A03                    push 00000003
:0042CBA6 8B45F8                  mov eax, dword ptr [ebp-08]
:0042CBA9 50                      push eax
:0042CBAA 8B45FC                  mov eax, dword ptr [ebp-04]
:0042CBAD 50                      push eax
:0042CBAE B900FB4600              mov ecx, 0046FB00
:0042CBB3 E875DF0000              call 0043AB2D
:0042CBB8 6A01                    push 00000001
:0042CBBA E8FCA90000              call 004375BB
:0042CBBF 83C404                  add esp, 00000004
:0042CBC2 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0042CBC5 E845EDFFFF              call 0042B90F
:0042CBCA 6A03                    push 00000003
:0042CBCC 6A03                    push 00000003
:0042CBCE 8B45F8                  mov eax, dword ptr [ebp-08]
:0042CBD1 50                      push eax
:0042CBD2 8B45FC                  mov eax, dword ptr [ebp-04]
:0042CBD5 50                      push eax
:0042CBD6 B900FB4600              mov ecx, 0046FB00
:0042CBDB E84DDF0000              call 0043AB2D
:0042CBE0 6A01                    push 00000001
:0042CBE2 E8D4A90000              call 004375BB
:0042CBE7 83C404                  add esp, 00000004
:0042CBEA E99AFFFFFF              jmp 0042CB89

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CB94(C)
|
:0042CBEF E900000000              jmp 0042CBF4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CBEF(U)
|
:0042CBF4 5F                      pop edi
:0042CBF5 5E                      pop esi
:0042CBF6 5B                      pop ebx
:0042CBF7 C9                      leave
:0042CBF8 C3                      ret



* Referenced by a CALL at Addresses:
|:0042C151   , :0043C9BA   
|
:0042CBF9 55                      push ebp
:0042CBFA 8BEC                    mov ebp, esp
:0042CBFC 83EC04                  sub esp, 00000004
:0042CBFF 53                      push ebx
:0042CC00 56                      push esi
:0042CC01 57                      push edi
:0042CC02 894DFC                  mov dword ptr [ebp-04], ecx
:0042CC05 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042CC08 E813C6FDFF              call 00409220
:0042CC0D 85C0                    test eax, eax
:0042CC0F 0F845D000000            je 0042CC72
:0042CC15 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042CC18 E8B3C7FDFF              call 004093D0
:0042CC1D 33C9                    xor ecx, ecx
:0042CC1F 8AC8                    mov cl, al
:0042CC21 83F907                  cmp ecx, 00000007
:0042CC24 0F8537000000            jne 0042CC61
:0042CC2A 6880000000              push 00000080
:0042CC2F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042CC32 E829C7FDFF              call 00409360
:0042CC37 85C0                    test eax, eax
:0042CC39 0F8411000000            je 0042CC50
:0042CC3F 6A0E                    push 0000000E
:0042CC41 B910BC4600              mov ecx, 0046BC10
:0042CC46 E88830FFFF              call 0041FCD3
:0042CC4B E90C000000              jmp 0042CC5C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CC39(C)
|
:0042CC50 6A17                    push 00000017
:0042CC52 B910BC4600              mov ecx, 0046BC10
:0042CC57 E87730FFFF              call 0041FCD3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CC4B(U)
|
:0042CC5C E90C000000              jmp 0042CC6D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CC24(C)
|
:0042CC61 6A0D                    push 0000000D
:0042CC63 B910BC4600              mov ecx, 0046BC10
:0042CC68 E86630FFFF              call 0041FCD3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CC5C(U)
|
:0042CC6D E90C000000              jmp 0042CC7E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CC0F(C)
|
:0042CC72 6A0F                    push 0000000F
:0042CC74 B910BC4600              mov ecx, 0046BC10
:0042CC79 E85530FFFF              call 0041FCD3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CC6D(U)
|
:0042CC7E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042CC81 E8AACBFDFF              call 00409830
:0042CC86 33C9                    xor ecx, ecx
:0042CC88 8AC8                    mov cl, al
:0042CC8A 83F902                  cmp ecx, 00000002
:0042CC8D 0F8411000000            je 0042CCA4
:0042CC93 6A0C                    push 0000000C
:0042CC95 B910BC4600              mov ecx, 0046BC10
:0042CC9A E83430FFFF              call 0041FCD3
:0042CC9F E91E000000              jmp 0042CCC2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CC8D(C)
|
:0042CCA4 6A10                    push 00000010
:0042CCA6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042CCA9 E8A2C4FDFF              call 00409150
:0042CCAE 85C0                    test eax, eax
:0042CCB0 0F840C000000            je 0042CCC2
:0042CCB6 6A18                    push 00000018
:0042CCB8 B910BC4600              mov ecx, 0046BC10
:0042CCBD E81130FFFF              call 0041FCD3

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042CC9F(U), :0042CCB0(C)
|
:0042CCC2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042CCC5 E8B6C8FDFF              call 00409580
:0042CCCA 50                      push eax

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:0042CCCB 68D4224500              push 004522D4
:0042CCD0 6810BC4600              push 0046BC10
:0042CCD5 E8493EFFFF              call 00420B23
:0042CCDA 83C40C                  add esp, 0000000C
:0042CCDD E900000000              jmp 0042CCE2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CCDD(U)
|
:0042CCE2 5F                      pop edi
:0042CCE3 5E                      pop esi
:0042CCE4 5B                      pop ebx
:0042CCE5 C9                      leave
:0042CCE6 C3                      ret



* Referenced by a CALL at Addresses:
|:0041A2C0   , :0041E034   
|
:0042CCE7 55                      push ebp
:0042CCE8 8BEC                    mov ebp, esp
:0042CCEA 81ECB4000000            sub esp, 000000B4
:0042CCF0 53                      push ebx
:0042CCF1 56                      push esi
:0042CCF2 57                      push edi
:0042CCF3 898D50FFFFFF            mov dword ptr [ebp+FFFFFF50], ecx
:0042CCF9 C645B801                mov [ebp-48], 01
:0042CCFD C645B902                mov [ebp-47], 02
:0042CD01 C645BA04                mov [ebp-46], 04
:0042CD05 C645BB08                mov [ebp-45], 08
:0042CD09 C645BC10                mov [ebp-44], 10
:0042CD0D B900FB4600              mov ecx, 0046FB00
:0042CD12 E8197EFFFF              call 00424B30
:0042CD17 898578FFFFFF            mov dword ptr [ebp+FFFFFF78], eax
:0042CD1D B900FB4600              mov ecx, 0046FB00
:0042CD22 E8297EFFFF              call 00424B50
:0042CD27 89856CFFFFFF            mov dword ptr [ebp+FFFFFF6C], eax
:0042CD2D C745D000000000          mov [ebp-30], 00000000
:0042CD34 C745C000000000          mov [ebp-40], 00000000
:0042CD3B C745C400000000          mov [ebp-3C], 00000000
:0042CD42 C745AC00000000          mov [ebp-54], 00000000
:0042CD49 B998FC4600              mov ecx, 0046FC98
:0042CD4E E83D7EFFFF              call 00424B90
:0042CD53 33C9                    xor ecx, ecx
:0042CD55 8AC8                    mov cl, al
:0042CD57 85C9                    test ecx, ecx
:0042CD59 0F850C000000            jne 0042CD6B
:0042CD5F C7459800000000          mov [ebp-68], 00000000
:0042CD66 E907000000              jmp 0042CD72

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CD59(C)
|
:0042CD6B C7459800090000          mov [ebp-68], 00000900

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CD66(U)
|
:0042CD72 C7458C00000000          mov [ebp-74], 00000000
:0042CD79 C7458000000000          mov [ebp-80], 00000000
:0042CD80 6A10                    push 00000010
:0042CD82 8B8D50FFFFFF            mov ecx, dword ptr [ebp+FFFFFF50]
:0042CD88 E8D3C5FDFF              call 00409360
:0042CD8D 894590                  mov dword ptr [ebp-70], eax
:0042CD90 8B8550FFFFFF            mov eax, dword ptr [ebp+FFFFFF50]
:0042CD96 33C9                    xor ecx, ecx
:0042CD98 8A4805                  mov cl, byte ptr [eax+05]
:0042CD9B 8D0449                  lea eax, dword ptr [ecx+2*ecx]
:0042CD9E 8945EC                  mov dword ptr [ebp-14], eax
:0042CDA1 8B8550FFFFFF            mov eax, dword ptr [ebp+FFFFFF50]
:0042CDA7 33C9                    xor ecx, ecx
:0042CDA9 8A4806                  mov cl, byte ptr [eax+06]
:0042CDAC 8D0449                  lea eax, dword ptr [ecx+2*ecx]
:0042CDAF 8945D8                  mov dword ptr [ebp-28], eax
:0042CDB2 C745F003000000          mov [ebp-10], 00000003
:0042CDB9 C745DC03000000          mov [ebp-24], 00000003
:0042CDC0 8B45EC                  mov eax, dword ptr [ebp-14]
:0042CDC3 8945C8                  mov dword ptr [ebp-38], eax
:0042CDC6 8B45D8                  mov eax, dword ptr [ebp-28]
:0042CDC9 8945B0                  mov dword ptr [ebp-50], eax
:0042CDCC 33C0                    xor eax, eax
:0042CDCE 8A4508                  mov al, byte ptr [ebp+08]
:0042CDD1 89854CFFFFFF            mov dword ptr [ebp+FFFFFF4C], eax
:0042CDD7 E9A3000000              jmp 0042CE7F
:0042CDDC 8B8550FFFFFF            mov eax, dword ptr [ebp+FFFFFF50]
:0042CDE2 C6400E00                mov [eax+0E], 00
:0042CDE6 C78570FFFFFF00240000    mov dword ptr [ebp+FFFFFF70], 00002400
:0042CDF0 836DB003                sub dword ptr [ebp-50], 00000003
:0042CDF4 8345DC03                add dword ptr [ebp-24], 00000003
:0042CDF8 E9AC000000              jmp 0042CEA9
:0042CDFD 8B8550FFFFFF            mov eax, dword ptr [ebp+FFFFFF50]
:0042CE03 C6400E02                mov [eax+0E], 02
:0042CE07 C78570FFFFFF00000000    mov dword ptr [ebp+FFFFFF70], 00000000
:0042CE11 8345DC03                add dword ptr [ebp-24], 00000003
:0042CE15 E98F000000              jmp 0042CEA9
:0042CE1A 8B8550FFFFFF            mov eax, dword ptr [ebp+FFFFFF50]
:0042CE20 C6400E01                mov [eax+0E], 01
:0042CE24 C78570FFFFFF00120000    mov dword ptr [ebp+FFFFFF70], 00001200
:0042CE2E C7459001000000          mov [ebp-70], 00000001
:0042CE35 8345F003                add dword ptr [ebp-10], 00000003
:0042CE39 E96B000000              jmp 0042CEA9
:0042CE3E 8B8550FFFFFF            mov eax, dword ptr [ebp+FFFFFF50]
:0042CE44 C6400E03                mov [eax+0E], 03
:0042CE48 C78570FFFFFF00120000    mov dword ptr [ebp+FFFFFF70], 00001200
:0042CE52 C7459000000000          mov [ebp-70], 00000000
:0042CE59 836DC803                sub dword ptr [ebp-38], 00000003
:0042CE5D 8345F003                add dword ptr [ebp-10], 00000003
:0042CE61 E943000000              jmp 0042CEA9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CE86(C)
|

* Possible StringData Ref from Data Obj ->"ԪƶERROR!"
                                  |
:0042CE66 68D8224500              push 004522D8
:0042CE6B 6A00                    push 00000000
:0042CE6D E8C3C00000              call 00438F35
:0042CE72 83C408                  add esp, 00000008
:0042CE75 E92F000000              jmp 0042CEA9
:0042CE7A E92A000000              jmp 0042CEA9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CDD7(U)
|
:0042CE7F 83BD4CFFFFFF03          cmp dword ptr [ebp+FFFFFF4C], 00000003
:0042CE86 0F87DAFFFFFF            ja 0042CE66
:0042CE8C 8B854CFFFFFF            mov eax, dword ptr [ebp+FFFFFF4C]
:0042CE92 FF248599CE4200          jmp dword ptr [4*eax+0042CE99]

:0042CE99 DCCD4200                DWORD 0042CDDC
:0042CE9D 1ACE4200                DWORD 0042CE1A
:0042CEA1 FDCD4200                DWORD 0042CDFD
:0042CEA5 3ECE4200                DWORD 0042CE3E



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042CDF8(U), :0042CE15(U), :0042CE39(U), :0042CE61(U), :0042CE75(U)
|:0042CE7A(U)
|
:0042CEA9 8B8578FFFFFF            mov eax, dword ptr [ebp+FFFFFF78]
:0042CEAF 3945C8                  cmp dword ptr [ebp-38], eax
:0042CEB2 0F830C000000            jnb 0042CEC4
:0042CEB8 8B8578FFFFFF            mov eax, dword ptr [ebp+FFFFFF78]
:0042CEBE 2B45C8                  sub eax, dword ptr [ebp-38]
:0042CEC1 8945D0                  mov dword ptr [ebp-30], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CEB2(C)
|
:0042CEC4 8B45C8                  mov eax, dword ptr [ebp-38]
:0042CEC7 0345F0                  add eax, dword ptr [ebp-10]
:0042CECA 8B8D78FFFFFF            mov ecx, dword ptr [ebp+FFFFFF78]
:0042CED0 83C127                  add ecx, 00000027
:0042CED3 3BC1                    cmp eax, ecx
:0042CED5 0F8614000000            jbe 0042CEEF
:0042CEDB 8B45C8                  mov eax, dword ptr [ebp-38]
:0042CEDE 0345F0                  add eax, dword ptr [ebp-10]
:0042CEE1 8B8D78FFFFFF            mov ecx, dword ptr [ebp+FFFFFF78]
:0042CEE7 83C127                  add ecx, 00000027
:0042CEEA 2BC1                    sub eax, ecx
:0042CEEC 8945C4                  mov dword ptr [ebp-3C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CED5(C)
|
:0042CEEF 8B856CFFFFFF            mov eax, dword ptr [ebp+FFFFFF6C]
:0042CEF5 3945B0                  cmp dword ptr [ebp-50], eax
:0042CEF8 0F830C000000            jnb 0042CF0A
:0042CEFE 8B856CFFFFFF            mov eax, dword ptr [ebp+FFFFFF6C]
:0042CF04 2B45B0                  sub eax, dword ptr [ebp-50]
:0042CF07 8945C0                  mov dword ptr [ebp-40], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CEF8(C)
|
:0042CF0A 8B45B0                  mov eax, dword ptr [ebp-50]
:0042CF0D 0345DC                  add eax, dword ptr [ebp-24]
:0042CF10 8B8D6CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF6C]
:0042CF16 83C118                  add ecx, 00000018
:0042CF19 3BC1                    cmp eax, ecx
:0042CF1B 0F8614000000            jbe 0042CF35
:0042CF21 8B45B0                  mov eax, dword ptr [ebp-50]
:0042CF24 0345DC                  add eax, dword ptr [ebp-24]
:0042CF27 8B8D6CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF6C]
:0042CF2D 83C118                  add ecx, 00000018
:0042CF30 2BC1                    sub eax, ecx
:0042CF32 8945AC                  mov dword ptr [ebp-54], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CF1B(C)
|
:0042CF35 33C0                    xor eax, eax
:0042CF37 8A4508                  mov al, byte ptr [ebp+08]
:0042CF3A 83F801                  cmp eax, 00000001
:0042CF3D 0F840E000000            je 0042CF51
:0042CF43 33C0                    xor eax, eax
:0042CF45 8A4508                  mov al, byte ptr [ebp+08]
:0042CF48 83F803                  cmp eax, 00000003
:0042CF4B 0F8532000000            jne 0042CF83

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CF3D(C)
|
:0042CF51 837DD006                cmp dword ptr [ebp-30], 00000006
:0042CF55 0F831E000000            jnb 0042CF79
:0042CF5B 837DC406                cmp dword ptr [ebp-3C], 00000006
:0042CF5F 0F8314000000            jnb 0042CF79
:0042CF65 837DC003                cmp dword ptr [ebp-40], 00000003
:0042CF69 0F830A000000            jnb 0042CF79
:0042CF6F 837DAC03                cmp dword ptr [ebp-54], 00000003
:0042CF73 0F8205000000            jb 0042CF7E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042CF55(C), :0042CF5F(C), :0042CF69(C)
|
:0042CF79 E9EA0D0000              jmp 0042DD68

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CF73(C)
|
:0042CF7E E92D000000              jmp 0042CFB0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CF4B(C)
|
:0042CF83 837DC006                cmp dword ptr [ebp-40], 00000006
:0042CF87 0F831E000000            jnb 0042CFAB
:0042CF8D 837DAC06                cmp dword ptr [ebp-54], 00000006
:0042CF91 0F8314000000            jnb 0042CFAB
:0042CF97 837DD003                cmp dword ptr [ebp-30], 00000003
:0042CF9B 0F830A000000            jnb 0042CFAB
:0042CFA1 837DC403                cmp dword ptr [ebp-3C], 00000003
:0042CFA5 0F8205000000            jb 0042CFB0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042CF87(C), :0042CF91(C), :0042CF9B(C)
|
:0042CFAB E9B80D0000              jmp 0042DD68

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042CF7E(U), :0042CFA5(C)
|
:0042CFB0 C6459C0E                mov [ebp-64], 0E
:0042CFB4 8B8D50FFFFFF            mov ecx, dword ptr [ebp+FFFFFF50]
:0042CFBA E8E1C2FDFF              call 004092A0
:0042CFBF 8845E0                  mov byte ptr [ebp-20], al
:0042CFC2 8B8D50FFFFFF            mov ecx, dword ptr [ebp+FFFFFF50]
:0042CFC8 E8B90E0000              call 0042DE86
:0042CFCD 85C0                    test eax, eax
:0042CFCF 0F847F000000            je 0042D054
:0042CFD5 33C0                    xor eax, eax
:0042CFD7 8A45E0                  mov al, byte ptr [ebp-20]
:0042CFDA 83F806                  cmp eax, 00000006
:0042CFDD 0F8C0E000000            jl 0042CFF1
:0042CFE3 33C0                    xor eax, eax
:0042CFE5 8A45E0                  mov al, byte ptr [ebp-20]
:0042CFE8 83F808                  cmp eax, 00000008
:0042CFEB 0F8E2A000000            jle 0042D01B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CFDD(C)
|
:0042CFF1 33C0                    xor eax, eax
:0042CFF3 8A45E0                  mov al, byte ptr [ebp-20]
:0042CFF6 83F80F                  cmp eax, 0000000F
:0042CFF9 0F8C0E000000            jl 0042D00D
:0042CFFF 33C0                    xor eax, eax
:0042D001 8A45E0                  mov al, byte ptr [ebp-20]
:0042D004 83F811                  cmp eax, 00000011
:0042D007 0F8E0E000000            jle 0042D01B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CFF9(C)
|
:0042D00D 33C0                    xor eax, eax
:0042D00F 8A45E0                  mov al, byte ptr [ebp-20]
:0042D012 83F81F                  cmp eax, 0000001F
:0042D015 0F8509000000            jne 0042D024

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042CFEB(C), :0042D007(C)
|
:0042D01B C6459C10                mov [ebp-64], 10
:0042D01F E920000000              jmp 0042D044

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D015(C)
|
:0042D024 33C0                    xor eax, eax
:0042D026 8A45E0                  mov al, byte ptr [ebp-20]
:0042D029 83F809                  cmp eax, 00000009
:0042D02C 0F8C12000000            jl 0042D044
:0042D032 33C0                    xor eax, eax
:0042D034 8A45E0                  mov al, byte ptr [ebp-20]
:0042D037 83F80E                  cmp eax, 0000000E
:0042D03A 0F8F04000000            jg 0042D044
:0042D040 C6459C0F                mov [ebp-64], 0F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042D01F(U), :0042D02C(C), :0042D03A(C)
|
:0042D044 33C0                    xor eax, eax
:0042D046 8A459C                  mov al, byte ptr [ebp-64]
:0042D049 50                      push eax
:0042D04A B994A64600              mov ecx, 0046A694
:0042D04F E8D0BFFEFF              call 00419024

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CFCF(C)
|
:0042D054 8B8550FFFFFF            mov eax, dword ptr [ebp+FFFFFF50]
:0042D05A 83C005                  add eax, 00000005
:0042D05D 50                      push eax
:0042D05E E8DAC4FEFF              call 0041953D
:0042D063 83C404                  add esp, 00000004
:0042D066 8845A0                  mov byte ptr [ebp-60], al
:0042D069 C745A400000000          mov [ebp-5C], 00000000
:0042D070 33C0                    xor eax, eax
:0042D072 8A45A0                  mov al, byte ptr [ebp-60]
:0042D075 3DFF000000              cmp eax, 000000FF
:0042D07A 0F842A010000            je 0042D1AA
:0042D080 6880000000              push 00000080
:0042D085 33C0                    xor eax, eax
:0042D087 8A45A0                  mov al, byte ptr [ebp-60]
:0042D08A 8BC8                    mov ecx, eax
:0042D08C 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042D08F C1E003                  shl eax, 03
:0042D092 2BC1                    sub eax, ecx
:0042D094 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0042D09A E8C1C2FDFF              call 00409360
:0042D09F 85C0                    test eax, eax
:0042D0A1 0F8524000000            jne 0042D0CB
:0042D0A7 6A40                    push 00000040
:0042D0A9 33C0                    xor eax, eax
:0042D0AB 8A45A0                  mov al, byte ptr [ebp-60]
:0042D0AE 8BC8                    mov ecx, eax
:0042D0B0 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042D0B3 C1E003                  shl eax, 03
:0042D0B6 2BC1                    sub eax, ecx
:0042D0B8 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0042D0BE E89DC2FDFF              call 00409360
:0042D0C3 85C0                    test eax, eax
:0042D0C5 0F840C000000            je 0042D0D7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D0A1(C)
|
:0042D0CB C745A401000000          mov [ebp-5C], 00000001
:0042D0D2 E907000000              jmp 0042D0DE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D0C5(C)
|
:0042D0D7 C745A400000000          mov [ebp-5C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D0D2(U)
|
:0042D0DE 837DA400                cmp dword ptr [ebp-5C], 00000000
:0042D0E2 0F8425000000            je 0042D10D
:0042D0E8 33DB                    xor ebx, ebx
:0042D0EA 8A5DA0                  mov bl, byte ptr [ebp-60]
:0042D0ED 8D1CDB                  lea ebx, dword ptr [ebx+8*ebx]
:0042D0F0 C1E308                  shl ebx, 08
:0042D0F3 6A04                    push 00000004
:0042D0F5 6A00                    push 00000000
:0042D0F7 6A00                    push 00000000
:0042D0F9 B980E34600              mov ecx, 0046E380
:0042D0FE E81DA60100              call 00447720
:0042D103 03D8                    add ebx, eax
:0042D105 895DE4                  mov dword ptr [ebp-1C], ebx
:0042D108 E932000000              jmp 0042D13F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D0E2(C)
|
:0042D10D 33DB                    xor ebx, ebx
:0042D10F 8A5DA0                  mov bl, byte ptr [ebp-60]
:0042D112 8D1C5B                  lea ebx, dword ptr [ebx+2*ebx]
:0042D115 8D1CDB                  lea ebx, dword ptr [ebx+8*ebx]
:0042D118 C1E309                  shl ebx, 09
:0042D11B 8B45A4                  mov eax, dword ptr [ebp-5C]
:0042D11E 8D44C012                lea eax, dword ptr [eax+8*eax+12]
:0042D122 C1E008                  shl eax, 08
:0042D125 03D8                    add ebx, eax
:0042D127 6A04                    push 00000004
:0042D129 6A00                    push 00000000
:0042D12B 6A00                    push 00000000
:0042D12D B9D0E44600              mov ecx, 0046E4D0
:0042D132 E8E9A50100              call 00447720
:0042D137 03D8                    add ebx, eax
:0042D139 035D98                  add ebx, dword ptr [ebp-68]
:0042D13C 895DE4                  mov dword ptr [ebp-1C], ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D108(U)
|
:0042D13F 6A10                    push 00000010
:0042D141 33C0                    xor eax, eax
:0042D143 8A45A0                  mov al, byte ptr [ebp-60]
:0042D146 8BC8                    mov ecx, eax
:0042D148 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042D14B C1E003                  shl eax, 03
:0042D14E 2BC1                    sub eax, ecx
:0042D150 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0042D156 E8F5BFFDFF              call 00409150
:0042D15B 85C0                    test eax, eax
:0042D15D 0F8440000000            je 0042D1A3
:0042D163 33C0                    xor eax, eax
:0042D165 8A45A0                  mov al, byte ptr [ebp-60]
:0042D168 8BC8                    mov ecx, eax
:0042D16A 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042D16D C1E003                  shl eax, 03
:0042D170 2BC1                    sub eax, ecx
:0042D172 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0042D178 E8A3C0FDFF              call 00409220
:0042D17D 83F801                  cmp eax, 00000001
:0042D180 1BDB                    sbb ebx, ebx
:0042D182 81E300120000            and ebx, 00001200
:0042D188 6A04                    push 00000004
:0042D18A 6A00                    push 00000000
:0042D18C 6800040300              push 00030400
:0042D191 B9E8E44600              mov ecx, 0046E4E8
:0042D196 E885A50100              call 00447720
:0042D19B 03D8                    add ebx, eax
:0042D19D 035D98                  add ebx, dword ptr [ebp-68]
:0042D1A0 895DE4                  mov dword ptr [ebp-1C], ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D15D(C)
|
:0042D1A3 C7458C01000000          mov [ebp-74], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D07A(C)
|
:0042D1AA C745A400000000          mov [ebp-5C], 00000000
:0042D1B1 8B4508                  mov eax, dword ptr [ebp+08]
:0042D1B4 50                      push eax
:0042D1B5 8B8550FFFFFF            mov eax, dword ptr [ebp+FFFFFF50]
:0042D1BB 83C005                  add eax, 00000005
:0042D1BE 50                      push eax
:0042D1BF E891C4FEFF              call 00419655
:0042D1C4 83C408                  add esp, 00000008
:0042D1C7 668B00                  mov ax, word ptr [eax]
:0042D1CA 668945E8                mov word ptr [ebp-18], ax
:0042D1CE C645A0FF                mov [ebp-60], FF
:0042D1D2 33C0                    xor eax, eax
:0042D1D4 8A45E8                  mov al, byte ptr [ebp-18]
:0042D1D7 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042D1DA 2B8578FFFFFF            sub eax, dword ptr [ebp+FFFFFF78]
:0042D1E0 894594                  mov dword ptr [ebp-6C], eax
:0042D1E3 33C0                    xor eax, eax
:0042D1E5 8A45E9                  mov al, byte ptr [ebp-17]
:0042D1E8 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042D1EB 2B856CFFFFFF            sub eax, dword ptr [ebp+FFFFFF6C]
:0042D1F1 894584                  mov dword ptr [ebp-7C], eax
:0042D1F4 33C0                    xor eax, eax
:0042D1F6 8A45E8                  mov al, byte ptr [ebp-18]
:0042D1F9 3DFF000000              cmp eax, 000000FF
:0042D1FE 0F840F000000            je 0042D213
:0042D204 8D45E8                  lea eax, dword ptr [ebp-18]
:0042D207 50                      push eax
:0042D208 E830C3FEFF              call 0041953D
:0042D20D 83C404                  add esp, 00000004
:0042D210 8845A0                  mov byte ptr [ebp-60], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D1FE(C)
|
:0042D213 33C0                    xor eax, eax
:0042D215 8A45A0                  mov al, byte ptr [ebp-60]
:0042D218 3DFF000000              cmp eax, 000000FF
:0042D21D 0F8458010000            je 0042D37B
:0042D223 837D9400                cmp dword ptr [ebp-6C], 00000000
:0042D227 0F824E010000            jb 0042D37B
:0042D22D 837D8400                cmp dword ptr [ebp-7C], 00000000
:0042D231 0F8244010000            jb 0042D37B
:0042D237 817D9478020000          cmp dword ptr [ebp-6C], 00000278
:0042D23E 0F8337010000            jnb 0042D37B
:0042D244 817D8480010000          cmp dword ptr [ebp-7C], 00000180
:0042D24B 0F832A010000            jnb 0042D37B
:0042D251 6880000000              push 00000080
:0042D256 33C0                    xor eax, eax
:0042D258 8A45A0                  mov al, byte ptr [ebp-60]
:0042D25B 8BC8                    mov ecx, eax
:0042D25D 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042D260 C1E003                  shl eax, 03
:0042D263 2BC1                    sub eax, ecx
:0042D265 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0042D26B E8F0C0FDFF              call 00409360
:0042D270 85C0                    test eax, eax
:0042D272 0F8524000000            jne 0042D29C
:0042D278 6A40                    push 00000040
:0042D27A 33C0                    xor eax, eax
:0042D27C 8A45A0                  mov al, byte ptr [ebp-60]
:0042D27F 8BC8                    mov ecx, eax
:0042D281 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042D284 C1E003                  shl eax, 03
:0042D287 2BC1                    sub eax, ecx
:0042D289 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0042D28F E8CCC0FDFF              call 00409360
:0042D294 85C0                    test eax, eax
:0042D296 0F840C000000            je 0042D2A8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D272(C)
|
:0042D29C C745A401000000          mov [ebp-5C], 00000001
:0042D2A3 E907000000              jmp 0042D2AF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D296(C)
|
:0042D2A8 C745A400000000          mov [ebp-5C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D2A3(U)
|
:0042D2AF 837DA400                cmp dword ptr [ebp-5C], 00000000
:0042D2B3 0F8425000000            je 0042D2DE
:0042D2B9 33DB                    xor ebx, ebx
:0042D2BB 8A5DA0                  mov bl, byte ptr [ebp-60]
:0042D2BE 8D1CDB                  lea ebx, dword ptr [ebx+8*ebx]
:0042D2C1 C1E308                  shl ebx, 08
:0042D2C4 6A04                    push 00000004
:0042D2C6 6A00                    push 00000000
:0042D2C8 6A00                    push 00000000
:0042D2CA B980E34600              mov ecx, 0046E380
:0042D2CF E84CA40100              call 00447720
:0042D2D4 03D8                    add ebx, eax
:0042D2D6 895DD4                  mov dword ptr [ebp-2C], ebx
:0042D2D9 E932000000              jmp 0042D310

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D2B3(C)
|
:0042D2DE 33DB                    xor ebx, ebx
:0042D2E0 8A5DA0                  mov bl, byte ptr [ebp-60]
:0042D2E3 8D1C5B                  lea ebx, dword ptr [ebx+2*ebx]
:0042D2E6 8D1CDB                  lea ebx, dword ptr [ebx+8*ebx]
:0042D2E9 C1E309                  shl ebx, 09
:0042D2EC 8B45A4                  mov eax, dword ptr [ebp-5C]
:0042D2EF 8D44C012                lea eax, dword ptr [eax+8*eax+12]
:0042D2F3 C1E008                  shl eax, 08
:0042D2F6 03D8                    add ebx, eax
:0042D2F8 6A04                    push 00000004
:0042D2FA 6A00                    push 00000000
:0042D2FC 6A00                    push 00000000
:0042D2FE B9D0E44600              mov ecx, 0046E4D0
:0042D303 E818A40100              call 00447720
:0042D308 03D8                    add ebx, eax
:0042D30A 035D98                  add ebx, dword ptr [ebp-68]
:0042D30D 895DD4                  mov dword ptr [ebp-2C], ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D2D9(U)
|
:0042D310 6A10                    push 00000010
:0042D312 33C0                    xor eax, eax
:0042D314 8A45A0                  mov al, byte ptr [ebp-60]
:0042D317 8BC8                    mov ecx, eax
:0042D319 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042D31C C1E003                  shl eax, 03
:0042D31F 2BC1                    sub eax, ecx
:0042D321 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0042D327 E824BEFDFF              call 00409150
:0042D32C 85C0                    test eax, eax
:0042D32E 0F8440000000            je 0042D374
:0042D334 33C0                    xor eax, eax
:0042D336 8A45A0                  mov al, byte ptr [ebp-60]
:0042D339 8BC8                    mov ecx, eax
:0042D33B 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042D33E C1E003                  shl eax, 03
:0042D341 2BC1                    sub eax, ecx
:0042D343 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0042D349 E8D2BEFDFF              call 00409220
:0042D34E 83F801                  cmp eax, 00000001
:0042D351 1BDB                    sbb ebx, ebx
:0042D353 81E300120000            and ebx, 00001200
:0042D359 6A04                    push 00000004
:0042D35B 6A00                    push 00000000
:0042D35D 6800040300              push 00030400
:0042D362 B9E8E44600              mov ecx, 0046E4E8
:0042D367 E8B4A30100              call 00447720
:0042D36C 03D8                    add ebx, eax
:0042D36E 035D98                  add ebx, dword ptr [ebp-68]
:0042D371 895DD4                  mov dword ptr [ebp-2C], ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D32E(C)
|
:0042D374 C7458001000000          mov [ebp-80], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042D21D(C), :0042D227(C), :0042D231(C), :0042D23E(C), :0042D24B(C)
|
:0042D37B 8B8550FFFFFF            mov eax, dword ptr [ebp+FFFFFF50]
:0042D381 33C9                    xor ecx, ecx
:0042D383 8A480E                  mov cl, byte ptr [eax+0E]
:0042D386 83F901                  cmp ecx, 00000001
:0042D389 0F8414000000            je 0042D3A3
:0042D38F 8B8550FFFFFF            mov eax, dword ptr [ebp+FFFFFF50]
:0042D395 33C9                    xor ecx, ecx
:0042D397 8A480E                  mov cl, byte ptr [eax+0E]
:0042D39A 83F903                  cmp ecx, 00000003
:0042D39D 0F850F000000            jne 0042D3B2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D389(C)
|
:0042D3A3 8B4590                  mov eax, dword ptr [ebp-70]
:0042D3A6 50                      push eax
:0042D3A7 8B8D50FFFFFF            mov ecx, dword ptr [ebp+FFFFFF50]
:0042D3AD E8C0E2FFFF              call 0042B672

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D39D(C)
|
:0042D3B2 B9D0A64600              mov ecx, 0046A6D0
:0042D3B7 E8C4BDFDFF              call 00409180
:0042D3BC 83E00F                  and eax, 0000000F
:0042D3BF 8A4405B8                mov al, byte ptr [ebp+eax-48]
:0042D3C3 8845F4                  mov byte ptr [ebp-0C], al
:0042D3C6 8B8D50FFFFFF            mov ecx, dword ptr [ebp+FFFFFF50]
:0042D3CC E8B50A0000              call 0042DE86
:0042D3D1 85C0                    test eax, eax
:0042D3D3 0F8504000000            jne 0042D3DD
:0042D3D9 C645F402                mov [ebp-0C], 02

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D3D3(C)
|
:0042D3DD 33C0                    xor eax, eax
:0042D3DF 8A4508                  mov al, byte ptr [ebp+08]
:0042D3E2 83F801                  cmp eax, 00000001
:0042D3E5 0F850C000000            jne 0042D3F7
:0042D3EB C745CC03000000          mov [ebp-34], 00000003
:0042D3F2 E921000000              jmp 0042D418

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D3E5(C)
|
:0042D3F7 33C0                    xor eax, eax
:0042D3F9 8A4508                  mov al, byte ptr [ebp+08]
:0042D3FC 83F803                  cmp eax, 00000003
:0042D3FF 0F850C000000            jne 0042D411
:0042D405 C745CCFDFFFFFF          mov [ebp-34], FFFFFFFD
:0042D40C E907000000              jmp 0042D418

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D3FF(C)
|
:0042D411 C745CC00000000          mov [ebp-34], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042D3F2(U), :0042D40C(U)
|
:0042D418 33C0                    xor eax, eax
:0042D41A 8A4508                  mov al, byte ptr [ebp+08]
:0042D41D 85C0                    test eax, eax
:0042D41F 0F850C000000            jne 0042D431
:0042D425 C745B4FDFFFFFF          mov [ebp-4C], FFFFFFFD
:0042D42C E921000000              jmp 0042D452

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D41F(C)
|
:0042D431 33C0                    xor eax, eax
:0042D433 8A4508                  mov al, byte ptr [ebp+08]
:0042D436 83F802                  cmp eax, 00000002
:0042D439 0F850C000000            jne 0042D44B
:0042D43F C745B403000000          mov [ebp-4C], 00000003
:0042D446 E907000000              jmp 0042D452

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D439(C)
|
:0042D44B C745B400000000          mov [ebp-4C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042D42C(U), :0042D446(U)
|
:0042D452 C68574FFFFFF00          mov byte ptr [ebp+FFFFFF74], 00
:0042D459 8B5DEC                  mov ebx, dword ptr [ebp-14]
:0042D45C B900FB4600              mov ecx, 0046FB00
:0042D461 E8CA76FFFF              call 00424B30
:0042D466 2BD8                    sub ebx, eax
:0042D468 C1E304                  shl ebx, 04
:0042D46B 83C308                  add ebx, 00000008
:0042D46E 895DFC                  mov dword ptr [ebp-04], ebx
:0042D471 8B5DD8                  mov ebx, dword ptr [ebp-28]
:0042D474 83C303                  add ebx, 00000003
:0042D477 B900FB4600              mov ecx, 0046FB00
:0042D47C E8CF76FFFF              call 00424B50
:0042D481 2BD8                    sub ebx, eax
:0042D483 C1E304                  shl ebx, 04
:0042D486 895DF8                  mov dword ptr [ebp-08], ebx
:0042D489 837DD003                cmp dword ptr [ebp-30], 00000003
:0042D48D 0F834D020000            jnb 0042D6E0
:0042D493 837DC403                cmp dword ptr [ebp-3C], 00000003
:0042D497 0F8343020000            jnb 0042D6E0
:0042D49D 837DC003                cmp dword ptr [ebp-40], 00000003
:0042D4A1 0F8339020000            jnb 0042D6E0
:0042D4A7 837DAC03                cmp dword ptr [ebp-54], 00000003
:0042D4AB 0F832F020000            jnb 0042D6E0
:0042D4B1 33C0                    xor eax, eax
:0042D4B3 8A45F4                  mov al, byte ptr [ebp-0C]
:0042D4B6 8945A8                  mov dword ptr [ebp-58], eax
:0042D4B9 E90E000000              jmp 0042D4CC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D6D6(U)
|
:0042D4BE 33C0                    xor eax, eax
:0042D4C0 8A45F4                  mov al, byte ptr [ebp-0C]
:0042D4C3 0145A8                  add dword ptr [ebp-58], eax
:0042D4C6 FE8574FFFFFF            inc byte ptr [ebp+FFFFFF74]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D4B9(U)
|
:0042D4CC 837DA830                cmp dword ptr [ebp-58], 00000030
:0042D4D0 0F8705020000            ja 0042D6DB
:0042D4D6 33C0                    xor eax, eax
:0042D4D8 8A4508                  mov al, byte ptr [ebp+08]
:0042D4DB 83F801                  cmp eax, 00000001
:0042D4DE 0F850B000000            jne 0042D4EF
:0042D4E4 8B45A8                  mov eax, dword ptr [ebp-58]
:0042D4E7 894588                  mov dword ptr [ebp-78], eax
:0042D4EA E928000000              jmp 0042D517

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D4DE(C)
|
:0042D4EF 33C0                    xor eax, eax
:0042D4F1 8A4508                  mov al, byte ptr [ebp+08]
:0042D4F4 83F803                  cmp eax, 00000003
:0042D4F7 0F8513000000            jne 0042D510
:0042D4FD 8B45A8                  mov eax, dword ptr [ebp-58]
:0042D500 8BC8                    mov ecx, eax
:0042D502 03C0                    add eax, eax
:0042D504 2BC1                    sub eax, ecx
:0042D506 F7D8                    neg eax
:0042D508 894588                  mov dword ptr [ebp-78], eax
:0042D50B E907000000              jmp 0042D517

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D4F7(C)
|
:0042D510 C7458800000000          mov [ebp-78], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042D4EA(U), :0042D50B(U)
|
:0042D517 33C0                    xor eax, eax
:0042D519 8A4508                  mov al, byte ptr [ebp+08]
:0042D51C 85C0                    test eax, eax
:0042D51E 0F8516000000            jne 0042D53A
:0042D524 8B45A8                  mov eax, dword ptr [ebp-58]
:0042D527 8BC8                    mov ecx, eax
:0042D529 03C0                    add eax, eax
:0042D52B 2BC1                    sub eax, ecx
:0042D52D F7D8                    neg eax
:0042D52F 89857CFFFFFF            mov dword ptr [ebp+FFFFFF7C], eax
:0042D535 E926000000              jmp 0042D560

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D51E(C)
|
:0042D53A 33C0                    xor eax, eax
:0042D53C 8A4508                  mov al, byte ptr [ebp+08]
:0042D53F 83F802                  cmp eax, 00000002
:0042D542 0F850E000000            jne 0042D556
:0042D548 8B45A8                  mov eax, dword ptr [ebp-58]
:0042D54B 89857CFFFFFF            mov dword ptr [ebp+FFFFFF7C], eax
:0042D551 E90A000000              jmp 0042D560

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D542(C)
|
:0042D556 C7857CFFFFFF00000000    mov dword ptr [ebp+FFFFFF7C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042D535(U), :0042D551(U)
|
:0042D560 33C0                    xor eax, eax
:0042D562 8A8574FFFFFF            mov al, byte ptr [ebp+FFFFFF74]
:0042D568 B903000000              mov ecx, 00000003
:0042D56D 99                      cdq
:0042D56E F7F9                    idiv ecx
:0042D570 83FA02                  cmp edx, 00000002
:0042D573 0F850C000000            jne 0042D585
:0042D579 6A01                    push 00000001
:0042D57B B9B0FA4600              mov ecx, 0046FAB0
:0042D580 E82BBCFDFF              call 004091B0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D573(C)
|
:0042D585 E80D9AFFFF              call 00426F97
:0042D58A 8B45D8                  mov eax, dword ptr [ebp-28]
:0042D58D 2B856CFFFFFF            sub eax, dword ptr [ebp+FFFFFF6C]
:0042D593 50                      push eax
:0042D594 8B45EC                  mov eax, dword ptr [ebp-14]
:0042D597 2B8578FFFFFF            sub eax, dword ptr [ebp+FFFFFF78]
:0042D59D 50                      push eax
:0042D59E E8414AFFFF              call 00421FE4
:0042D5A3 83C408                  add esp, 00000008
:0042D5A6 8B45D8                  mov eax, dword ptr [ebp-28]
:0042D5A9 2B856CFFFFFF            sub eax, dword ptr [ebp+FFFFFF6C]
:0042D5AF 0345B4                  add eax, dword ptr [ebp-4C]
:0042D5B2 50                      push eax
:0042D5B3 8B45EC                  mov eax, dword ptr [ebp-14]
:0042D5B6 2B8578FFFFFF            sub eax, dword ptr [ebp+FFFFFF78]
:0042D5BC 0345CC                  add eax, dword ptr [ebp-34]
:0042D5BF 50                      push eax
:0042D5C0 E81F4AFFFF              call 00421FE4
:0042D5C5 83C408                  add esp, 00000008
:0042D5C8 837D8000                cmp dword ptr [ebp-80], 00000000
:0042D5CC 0F8426000000            je 0042D5F8
:0042D5D2 6A04                    push 00000004
:0042D5D4 8B45D4                  mov eax, dword ptr [ebp-2C]
:0042D5D7 50                      push eax
:0042D5D8 6A30                    push 00000030
:0042D5DA 6A30                    push 00000030
:0042D5DC 8B4584                  mov eax, dword ptr [ebp-7C]
:0042D5DF 83C003                  add eax, 00000003
:0042D5E2 C1E004                  shl eax, 04
:0042D5E5 50                      push eax
:0042D5E6 8B4594                  mov eax, dword ptr [ebp-6C]
:0042D5E9 C1E004                  shl eax, 04
:0042D5EC 83C008                  add eax, 00000008
:0042D5EF 50                      push eax
:0042D5F0 E8C0FC0000              call 0043D2B5
:0042D5F5 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D5CC(C)
|
:0042D5F8 837D8C00                cmp dword ptr [ebp-74], 00000000
:0042D5FC 0F8432000000            je 0042D634
:0042D602 6A04                    push 00000004
:0042D604 8B45E4                  mov eax, dword ptr [ebp-1C]
:0042D607 50                      push eax
:0042D608 6A30                    push 00000030
:0042D60A 6A30                    push 00000030
:0042D60C 8B45D8                  mov eax, dword ptr [ebp-28]
:0042D60F 83C003                  add eax, 00000003
:0042D612 2B856CFFFFFF            sub eax, dword ptr [ebp+FFFFFF6C]
:0042D618 C1E004                  shl eax, 04
:0042D61B 50                      push eax
:0042D61C 8B45EC                  mov eax, dword ptr [ebp-14]
:0042D61F 2B8578FFFFFF            sub eax, dword ptr [ebp+FFFFFF78]
:0042D625 C1E004                  shl eax, 04
:0042D628 83C008                  add eax, 00000008
:0042D62B 50                      push eax
:0042D62C E884FC0000              call 0043D2B5
:0042D631 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D5FC(C)
|
:0042D634 6A04                    push 00000004
:0042D636 8B8550FFFFFF            mov eax, dword ptr [ebp+FFFFFF50]
:0042D63C 33DB                    xor ebx, ebx
:0042D63E 8A5804                  mov bl, byte ptr [eax+04]
:0042D641 8D1C5B                  lea ebx, dword ptr [ebx+2*ebx]
:0042D644 8D1CDB                  lea ebx, dword ptr [ebx+8*ebx]
:0042D647 C1E309                  shl ebx, 09
:0042D64A 039D70FFFFFF            add ebx, dword ptr [ebp+FFFFFF70]
:0042D650 8B45A8                  mov eax, dword ptr [ebp-58]
:0042D653 B918000000              mov ecx, 00000018
:0042D658 48                      dec eax
:0042D659 2BD2                    sub edx, edx
:0042D65B F7F1                    div ecx
:0042D65D 83FA0C                  cmp edx, 0000000C
:0042D660 1BC0                    sbb eax, eax
:0042D662 8D44C009                lea eax, dword ptr [eax+8*eax+09]
:0042D666 C1E008                  shl eax, 08
:0042D669 03D8                    add ebx, eax
:0042D66B 6A04                    push 00000004
:0042D66D 6A00                    push 00000000
:0042D66F 6A00                    push 00000000
:0042D671 B9D0E44600              mov ecx, 0046E4D0
:0042D676 E8A5A00100              call 00447720
:0042D67B 03D8                    add ebx, eax
:0042D67D 53                      push ebx
:0042D67E 6A30                    push 00000030
:0042D680 6A30                    push 00000030
:0042D682 8B45D8                  mov eax, dword ptr [ebp-28]
:0042D685 83C003                  add eax, 00000003
:0042D688 2B856CFFFFFF            sub eax, dword ptr [ebp+FFFFFF6C]
:0042D68E C1E004                  shl eax, 04
:0042D691 03857CFFFFFF            add eax, dword ptr [ebp+FFFFFF7C]
:0042D697 50                      push eax
:0042D698 8B45EC                  mov eax, dword ptr [ebp-14]
:0042D69B 2B8578FFFFFF            sub eax, dword ptr [ebp+FFFFFF78]
:0042D6A1 C1E004                  shl eax, 04
:0042D6A4 034588                  add eax, dword ptr [ebp-78]
:0042D6A7 83C008                  add eax, 00000008
:0042D6AA 50                      push eax
:0042D6AB E805FC0000              call 0043D2B5
:0042D6B0 83C418                  add esp, 00000018
:0042D6B3 E8FF98FFFF              call 00426FB7
:0042D6B8 33C0                    xor eax, eax
:0042D6BA 8A8574FFFFFF            mov al, byte ptr [ebp+FFFFFF74]
:0042D6C0 B903000000              mov ecx, 00000003
:0042D6C5 99                      cdq
:0042D6C6 F7F9                    idiv ecx
:0042D6C8 83FA02                  cmp edx, 00000002
:0042D6CB 0F8505000000            jne 0042D6D6
:0042D6D1 E8F29C0000              call 004373C8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D6CB(C)
|
:0042D6D6 E9E3FDFFFF              jmp 0042D4BE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D4D0(C)
|
:0042D6DB E983060000              jmp 0042DD63

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042D48D(C), :0042D497(C), :0042D4A1(C), :0042D4AB(C)
|
:0042D6E0 837DD003                cmp dword ptr [ebp-30], 00000003
:0042D6E4 0F840A000000            je 0042D6F4
:0042D6EA 837DC403                cmp dword ptr [ebp-3C], 00000003
:0042D6EE 0F851C000000            jne 0042D710

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D6E4(C)
|
:0042D6F4 33C0                    xor eax, eax
:0042D6F6 8A4508                  mov al, byte ptr [ebp+08]
:0042D6F9 83F801                  cmp eax, 00000001
:0042D6FC 0F843D000000            je 0042D73F
:0042D702 33C0                    xor eax, eax
:0042D704 8A4508                  mov al, byte ptr [ebp+08]
:0042D707 83F803                  cmp eax, 00000003
:0042D70A 0F842F000000            je 0042D73F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D6EE(C)
|
:0042D710 837DC003                cmp dword ptr [ebp-40], 00000003
:0042D714 0F840A000000            je 0042D724
:0042D71A 837DAC03                cmp dword ptr [ebp-54], 00000003
:0042D71E 0F853F060000            jne 0042DD63

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D714(C)
|
:0042D724 33C0                    xor eax, eax
:0042D726 8A4508                  mov al, byte ptr [ebp+08]
:0042D729 85C0                    test eax, eax
:0042D72B 0F840E000000            je 0042D73F
:0042D731 33C0                    xor eax, eax
:0042D733 8A4508                  mov al, byte ptr [ebp+08]
:0042D736 83F802                  cmp eax, 00000002
:0042D739 0F8524060000            jne 0042DD63

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042D6FC(C), :0042D70A(C), :0042D72B(C)
|
:0042D73F 33C0                    xor eax, eax
:0042D741 8A4508                  mov al, byte ptr [ebp+08]
:0042D744 85C0                    test eax, eax
:0042D746 0F840E000000            je 0042D75A
:0042D74C 33C0                    xor eax, eax
:0042D74E 8A4508                  mov al, byte ptr [ebp+08]
:0042D751 83F802                  cmp eax, 00000002
:0042D754 0F85D7020000            jne 0042DA31

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D746(C)
|
:0042D75A 33C0                    xor eax, eax
:0042D75C 8A45F4                  mov al, byte ptr [ebp-0C]
:0042D75F 8945A8                  mov dword ptr [ebp-58], eax
:0042D762 E90E000000              jmp 0042D775

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DA27(U)
|
:0042D767 33C0                    xor eax, eax
:0042D769 8A45F4                  mov al, byte ptr [ebp-0C]
:0042D76C 0145A8                  add dword ptr [ebp-58], eax
:0042D76F FE8574FFFFFF            inc byte ptr [ebp+FFFFFF74]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D762(U)
|
:0042D775 837DA830                cmp dword ptr [ebp-58], 00000030
:0042D779 0F87AD020000            ja 0042DA2C
:0042D77F 33C0                    xor eax, eax
:0042D781 8A8574FFFFFF            mov al, byte ptr [ebp+FFFFFF74]
:0042D787 B903000000              mov ecx, 00000003
:0042D78C 99                      cdq
:0042D78D F7F9                    idiv ecx
:0042D78F 83FA02                  cmp edx, 00000002
:0042D792 0F850C000000            jne 0042D7A4
:0042D798 6A01                    push 00000001
:0042D79A B9B0FA4600              mov ecx, 0046FAB0
:0042D79F E80CBAFDFF              call 004091B0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D792(C)
|
:0042D7A4 E8EE97FFFF              call 00426F97
:0042D7A9 837DC003                cmp dword ptr [ebp-40], 00000003
:0042D7AD 0F850D000000            jne 0042D7C0
:0042D7B3 33C0                    xor eax, eax
:0042D7B5 8A4508                  mov al, byte ptr [ebp+08]
:0042D7B8 85C0                    test eax, eax
:0042D7BA 0F8418000000            je 0042D7D8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D7AD(C)
|
:0042D7C0 837DAC03                cmp dword ptr [ebp-54], 00000003
:0042D7C4 0F854E000000            jne 0042D818
:0042D7CA 33C0                    xor eax, eax
:0042D7CC 8A4508                  mov al, byte ptr [ebp+08]
:0042D7CF 83F802                  cmp eax, 00000002
:0042D7D2 0F8540000000            jne 0042D818

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D7BA(C)
|
:0042D7D8 8B45D8                  mov eax, dword ptr [ebp-28]
:0042D7DB 2B856CFFFFFF            sub eax, dword ptr [ebp+FFFFFF6C]
:0042D7E1 50                      push eax
:0042D7E2 8B45EC                  mov eax, dword ptr [ebp-14]
:0042D7E5 2B8578FFFFFF            sub eax, dword ptr [ebp+FFFFFF78]
:0042D7EB 50                      push eax
:0042D7EC E8F347FFFF              call 00421FE4
:0042D7F1 83C408                  add esp, 00000008
:0042D7F4 837D8C00                cmp dword ptr [ebp-74], 00000000
:0042D7F8 0F841A000000            je 0042D818
:0042D7FE 6A04                    push 00000004
:0042D800 8B45E4                  mov eax, dword ptr [ebp-1C]
:0042D803 50                      push eax
:0042D804 6A30                    push 00000030
:0042D806 6A30                    push 00000030
:0042D808 8B45F8                  mov eax, dword ptr [ebp-08]
:0042D80B 50                      push eax
:0042D80C 8B45FC                  mov eax, dword ptr [ebp-04]
:0042D80F 50                      push eax
:0042D810 E8A0FA0000              call 0043D2B5
:0042D815 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042D7C4(C), :0042D7D2(C), :0042D7F8(C)
|
:0042D818 837DC003                cmp dword ptr [ebp-40], 00000003
:0042D81C 0F850E000000            jne 0042D830
:0042D822 33C0                    xor eax, eax
:0042D824 8A4508                  mov al, byte ptr [ebp+08]
:0042D827 83F802                  cmp eax, 00000002
:0042D82A 0F8417000000            je 0042D847

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D81C(C)
|
:0042D830 837DAC03                cmp dword ptr [ebp-54], 00000003
:0042D834 0F855F000000            jne 0042D899
:0042D83A 33C0                    xor eax, eax
:0042D83C 8A4508                  mov al, byte ptr [ebp+08]
:0042D83F 85C0                    test eax, eax
:0042D841 0F8552000000            jne 0042D899

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D82A(C)
|
:0042D847 8B45D8                  mov eax, dword ptr [ebp-28]
:0042D84A 2B856CFFFFFF            sub eax, dword ptr [ebp+FFFFFF6C]
:0042D850 0345B4                  add eax, dword ptr [ebp-4C]
:0042D853 50                      push eax
:0042D854 8B45EC                  mov eax, dword ptr [ebp-14]
:0042D857 2B8578FFFFFF            sub eax, dword ptr [ebp+FFFFFF78]
:0042D85D 0345CC                  add eax, dword ptr [ebp-34]
:0042D860 50                      push eax
:0042D861 E87E47FFFF              call 00421FE4
:0042D866 83C408                  add esp, 00000008
:0042D869 837D8000                cmp dword ptr [ebp-80], 00000000
:0042D86D 0F8426000000            je 0042D899
:0042D873 6A04                    push 00000004
:0042D875 8B45D4                  mov eax, dword ptr [ebp-2C]
:0042D878 50                      push eax
:0042D879 6A30                    push 00000030
:0042D87B 6A30                    push 00000030
:0042D87D 8B4584                  mov eax, dword ptr [ebp-7C]
:0042D880 83C003                  add eax, 00000003
:0042D883 C1E004                  shl eax, 04
:0042D886 50                      push eax
:0042D887 8B4594                  mov eax, dword ptr [ebp-6C]
:0042D88A C1E004                  shl eax, 04
:0042D88D 83C008                  add eax, 00000008
:0042D890 50                      push eax
:0042D891 E81FFA0000              call 0043D2B5
:0042D896 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042D834(C), :0042D841(C), :0042D86D(C)
|
:0042D899 837DC003                cmp dword ptr [ebp-40], 00000003
:0042D89D 0F820F000000            jb 0042D8B2
:0042D8A3 C7855CFFFFFF30000000    mov dword ptr [ebp+FFFFFF5C], 00000030
:0042D8AD E935000000              jmp 0042D8E7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D89D(C)
|
:0042D8B2 837DAC03                cmp dword ptr [ebp-54], 00000003
:0042D8B6 0F821F000000            jb 0042D8DB
:0042D8BC 33C0                    xor eax, eax
:0042D8BE 8A4508                  mov al, byte ptr [ebp+08]
:0042D8C1 83F802                  cmp eax, 00000002
:0042D8C4 0F8511000000            jne 0042D8DB
:0042D8CA 8B45F8                  mov eax, dword ptr [ebp-08]
:0042D8CD 0345A8                  add eax, dword ptr [ebp-58]
:0042D8D0 89855CFFFFFF            mov dword ptr [ebp+FFFFFF5C], eax
:0042D8D6 E90C000000              jmp 0042D8E7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042D8B6(C), :0042D8C4(C)
|
:0042D8DB 8B45F8                  mov eax, dword ptr [ebp-08]
:0042D8DE 2B45A8                  sub eax, dword ptr [ebp-58]
:0042D8E1 89855CFFFFFF            mov dword ptr [ebp+FFFFFF5C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042D8AD(U), :0042D8D6(U)
|
:0042D8E7 837DC003                cmp dword ptr [ebp-40], 00000003
:0042D8EB 0F820E000000            jb 0042D8FF
:0042D8F1 33C0                    xor eax, eax
:0042D8F3 8A4508                  mov al, byte ptr [ebp+08]
:0042D8F6 83F802                  cmp eax, 00000002
:0042D8F9 0F8417000000            je 0042D916

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D8EB(C)
|
:0042D8FF 837DAC03                cmp dword ptr [ebp-54], 00000003
:0042D903 0F821B000000            jb 0042D924
:0042D909 33C0                    xor eax, eax
:0042D90B 8A4508                  mov al, byte ptr [ebp+08]
:0042D90E 85C0                    test eax, eax
:0042D910 0F850E000000            jne 0042D924

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D8F9(C)
|
:0042D916 8B45A8                  mov eax, dword ptr [ebp-58]
:0042D919 898560FFFFFF            mov dword ptr [ebp+FFFFFF60], eax
:0042D91F E90E000000              jmp 0042D932

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042D903(C), :0042D910(C)
|
:0042D924 B830000000              mov eax, 00000030
:0042D929 2B45A8                  sub eax, dword ptr [ebp-58]
:0042D92C 898560FFFFFF            mov dword ptr [ebp+FFFFFF60], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D91F(U)
|
:0042D932 837DC003                cmp dword ptr [ebp-40], 00000003
:0042D936 0F8227000000            jb 0042D963
:0042D93C 33C0                    xor eax, eax
:0042D93E 8A4508                  mov al, byte ptr [ebp+08]
:0042D941 83F802                  cmp eax, 00000002
:0042D944 0F8519000000            jne 0042D963
:0042D94A B830000000              mov eax, 00000030
:0042D94F 2B45A8                  sub eax, dword ptr [ebp-58]
:0042D952 C1E004                  shl eax, 04
:0042D955 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042D958 898558FFFFFF            mov dword ptr [ebp+FFFFFF58], eax
:0042D95E E935000000              jmp 0042D998

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042D936(C), :0042D944(C)
|
:0042D963 837DC003                cmp dword ptr [ebp-40], 00000003
:0042D967 0F8221000000            jb 0042D98E
:0042D96D 33C0                    xor eax, eax
:0042D96F 8A4508                  mov al, byte ptr [ebp+08]
:0042D972 85C0                    test eax, eax
:0042D974 0F8514000000            jne 0042D98E
:0042D97A 8B45A8                  mov eax, dword ptr [ebp-58]
:0042D97D C1E004                  shl eax, 04
:0042D980 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042D983 898558FFFFFF            mov dword ptr [ebp+FFFFFF58], eax
:0042D989 E90A000000              jmp 0042D998

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042D967(C), :0042D974(C)
|
:0042D98E C78558FFFFFF00000000    mov dword ptr [ebp+FFFFFF58], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042D95E(U), :0042D989(U)
|
:0042D998 6A04                    push 00000004
:0042D99A 8B8550FFFFFF            mov eax, dword ptr [ebp+FFFFFF50]
:0042D9A0 33DB                    xor ebx, ebx
:0042D9A2 8A5804                  mov bl, byte ptr [eax+04]
:0042D9A5 8D1C5B                  lea ebx, dword ptr [ebx+2*ebx]
:0042D9A8 8D1CDB                  lea ebx, dword ptr [ebx+8*ebx]
:0042D9AB C1E309                  shl ebx, 09
:0042D9AE 039D70FFFFFF            add ebx, dword ptr [ebp+FFFFFF70]
:0042D9B4 039D58FFFFFF            add ebx, dword ptr [ebp+FFFFFF58]
:0042D9BA 8B45A8                  mov eax, dword ptr [ebp-58]
:0042D9BD B918000000              mov ecx, 00000018
:0042D9C2 48                      dec eax
:0042D9C3 2BD2                    sub edx, edx
:0042D9C5 F7F1                    div ecx
:0042D9C7 83FA0C                  cmp edx, 0000000C
:0042D9CA 1BC0                    sbb eax, eax
:0042D9CC 8D44C009                lea eax, dword ptr [eax+8*eax+09]
:0042D9D0 C1E008                  shl eax, 08
:0042D9D3 03D8                    add ebx, eax
:0042D9D5 6A04                    push 00000004
:0042D9D7 6A00                    push 00000000
:0042D9D9 6A00                    push 00000000
:0042D9DB B9D0E44600              mov ecx, 0046E4D0
:0042D9E0 E83B9D0100              call 00447720
:0042D9E5 03D8                    add ebx, eax
:0042D9E7 53                      push ebx
:0042D9E8 8B8560FFFFFF            mov eax, dword ptr [ebp+FFFFFF60]
:0042D9EE 50                      push eax
:0042D9EF 6A30                    push 00000030
:0042D9F1 8B855CFFFFFF            mov eax, dword ptr [ebp+FFFFFF5C]
:0042D9F7 50                      push eax
:0042D9F8 8B45FC                  mov eax, dword ptr [ebp-04]
:0042D9FB 50                      push eax
:0042D9FC E8B4F80000              call 0043D2B5
:0042DA01 83C418                  add esp, 00000018
:0042DA04 E8AE95FFFF              call 00426FB7
:0042DA09 33C0                    xor eax, eax
:0042DA0B 8A8574FFFFFF            mov al, byte ptr [ebp+FFFFFF74]
:0042DA11 B903000000              mov ecx, 00000003
:0042DA16 99                      cdq
:0042DA17 F7F9                    idiv ecx
:0042DA19 83FA02                  cmp edx, 00000002
:0042DA1C 0F8505000000            jne 0042DA27
:0042DA22 E8A1990000              call 004373C8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DA1C(C)
|
:0042DA27 E93BFDFFFF              jmp 0042D767

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D779(C)
|
:0042DA2C E932030000              jmp 0042DD63

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D754(C)
|
:0042DA31 33C0                    xor eax, eax
:0042DA33 8A4508                  mov al, byte ptr [ebp+08]
:0042DA36 83F803                  cmp eax, 00000003
:0042DA39 0F840E000000            je 0042DA4D
:0042DA3F 33C0                    xor eax, eax
:0042DA41 8A4508                  mov al, byte ptr [ebp+08]
:0042DA44 83F801                  cmp eax, 00000001
:0042DA47 0F8516030000            jne 0042DD63

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DA39(C)
|
:0042DA4D 33C0                    xor eax, eax
:0042DA4F 8A45F4                  mov al, byte ptr [ebp-0C]
:0042DA52 8945A8                  mov dword ptr [ebp-58], eax
:0042DA55 E90E000000              jmp 0042DA68

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DD5E(U)
|
:0042DA5A 33C0                    xor eax, eax
:0042DA5C 8A45F4                  mov al, byte ptr [ebp-0C]
:0042DA5F 0145A8                  add dword ptr [ebp-58], eax
:0042DA62 FE8574FFFFFF            inc byte ptr [ebp+FFFFFF74]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DA55(U)
|
:0042DA68 837DA830                cmp dword ptr [ebp-58], 00000030
:0042DA6C 0F87F1020000            ja 0042DD63
:0042DA72 33C0                    xor eax, eax
:0042DA74 8A8574FFFFFF            mov al, byte ptr [ebp+FFFFFF74]
:0042DA7A B903000000              mov ecx, 00000003
:0042DA7F 99                      cdq
:0042DA80 F7F9                    idiv ecx
:0042DA82 83FA02                  cmp edx, 00000002
:0042DA85 0F850C000000            jne 0042DA97
:0042DA8B 6A01                    push 00000001
:0042DA8D B9B0FA4600              mov ecx, 0046FAB0
:0042DA92 E819B7FDFF              call 004091B0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DA85(C)
|
:0042DA97 E8FB94FFFF              call 00426F97
:0042DA9C 837DD003                cmp dword ptr [ebp-30], 00000003
:0042DAA0 0F850E000000            jne 0042DAB4
:0042DAA6 33C0                    xor eax, eax
:0042DAA8 8A4508                  mov al, byte ptr [ebp+08]
:0042DAAB 83F803                  cmp eax, 00000003
:0042DAAE 0F8418000000            je 0042DACC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DAA0(C)
|
:0042DAB4 837DC403                cmp dword ptr [ebp-3C], 00000003
:0042DAB8 0F855A000000            jne 0042DB18
:0042DABE 33C0                    xor eax, eax
:0042DAC0 8A4508                  mov al, byte ptr [ebp+08]
:0042DAC3 83F801                  cmp eax, 00000001
:0042DAC6 0F854C000000            jne 0042DB18

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DAAE(C)
|
:0042DACC 8B5DD8                  mov ebx, dword ptr [ebp-28]
:0042DACF B900FB4600              mov ecx, 0046FB00
:0042DAD4 E87770FFFF              call 00424B50
:0042DAD9 2BD8                    sub ebx, eax
:0042DADB 53                      push ebx
:0042DADC 8B5DEC                  mov ebx, dword ptr [ebp-14]
:0042DADF B900FB4600              mov ecx, 0046FB00
:0042DAE4 E84770FFFF              call 00424B30
:0042DAE9 2BD8                    sub ebx, eax
:0042DAEB 53                      push ebx
:0042DAEC E8F344FFFF              call 00421FE4
:0042DAF1 83C408                  add esp, 00000008
:0042DAF4 837D8C00                cmp dword ptr [ebp-74], 00000000
:0042DAF8 0F841A000000            je 0042DB18
:0042DAFE 6A04                    push 00000004
:0042DB00 8B45E4                  mov eax, dword ptr [ebp-1C]
:0042DB03 50                      push eax
:0042DB04 6A30                    push 00000030
:0042DB06 6A30                    push 00000030
:0042DB08 8B45F8                  mov eax, dword ptr [ebp-08]
:0042DB0B 50                      push eax
:0042DB0C 8B45FC                  mov eax, dword ptr [ebp-04]
:0042DB0F 50                      push eax
:0042DB10 E8A0F70000              call 0043D2B5
:0042DB15 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042DAB8(C), :0042DAC6(C), :0042DAF8(C)
|
:0042DB18 837DD003                cmp dword ptr [ebp-30], 00000003
:0042DB1C 0F850E000000            jne 0042DB30
:0042DB22 33C0                    xor eax, eax
:0042DB24 8A4508                  mov al, byte ptr [ebp+08]
:0042DB27 83F801                  cmp eax, 00000001
:0042DB2A 0F8418000000            je 0042DB48

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DB1C(C)
|
:0042DB30 837DC403                cmp dword ptr [ebp-3C], 00000003
:0042DB34 0F8560000000            jne 0042DB9A
:0042DB3A 33C0                    xor eax, eax
:0042DB3C 8A4508                  mov al, byte ptr [ebp+08]
:0042DB3F 83F803                  cmp eax, 00000003
:0042DB42 0F8552000000            jne 0042DB9A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DB2A(C)
|
:0042DB48 8B45D8                  mov eax, dword ptr [ebp-28]
:0042DB4B 2B856CFFFFFF            sub eax, dword ptr [ebp+FFFFFF6C]
:0042DB51 0345B4                  add eax, dword ptr [ebp-4C]
:0042DB54 50                      push eax
:0042DB55 8B45EC                  mov eax, dword ptr [ebp-14]
:0042DB58 2B8578FFFFFF            sub eax, dword ptr [ebp+FFFFFF78]
:0042DB5E 0345CC                  add eax, dword ptr [ebp-34]
:0042DB61 50                      push eax
:0042DB62 E87D44FFFF              call 00421FE4
:0042DB67 83C408                  add esp, 00000008
:0042DB6A 837D8000                cmp dword ptr [ebp-80], 00000000
:0042DB6E 0F8426000000            je 0042DB9A
:0042DB74 6A04                    push 00000004
:0042DB76 8B45D4                  mov eax, dword ptr [ebp-2C]
:0042DB79 50                      push eax
:0042DB7A 6A30                    push 00000030
:0042DB7C 6A30                    push 00000030
:0042DB7E 8B4584                  mov eax, dword ptr [ebp-7C]
:0042DB81 83C003                  add eax, 00000003
:0042DB84 C1E004                  shl eax, 04
:0042DB87 50                      push eax
:0042DB88 8B4594                  mov eax, dword ptr [ebp-6C]
:0042DB8B C1E004                  shl eax, 04
:0042DB8E 83C008                  add eax, 00000008
:0042DB91 50                      push eax
:0042DB92 E81EF70000              call 0043D2B5
:0042DB97 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042DB34(C), :0042DB42(C), :0042DB6E(C)
|
:0042DB9A 837DD003                cmp dword ptr [ebp-30], 00000003
:0042DB9E 0F820F000000            jb 0042DBB3
:0042DBA4 C78564FFFFFF08000000    mov dword ptr [ebp+FFFFFF64], 00000008
:0042DBAE E935000000              jmp 0042DBE8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DB9E(C)
|
:0042DBB3 837DC403                cmp dword ptr [ebp-3C], 00000003
:0042DBB7 0F821F000000            jb 0042DBDC
:0042DBBD 33C0                    xor eax, eax
:0042DBBF 8A4508                  mov al, byte ptr [ebp+08]
:0042DBC2 83F801                  cmp eax, 00000001
:0042DBC5 0F8511000000            jne 0042DBDC
:0042DBCB 8B45FC                  mov eax, dword ptr [ebp-04]
:0042DBCE 0345A8                  add eax, dword ptr [ebp-58]
:0042DBD1 898564FFFFFF            mov dword ptr [ebp+FFFFFF64], eax
:0042DBD7 E90C000000              jmp 0042DBE8

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042DBB7(C), :0042DBC5(C)
|
:0042DBDC 8B45FC                  mov eax, dword ptr [ebp-04]
:0042DBDF 2B45A8                  sub eax, dword ptr [ebp-58]
:0042DBE2 898564FFFFFF            mov dword ptr [ebp+FFFFFF64], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042DBAE(U), :0042DBD7(U)
|
:0042DBE8 837DD003                cmp dword ptr [ebp-30], 00000003
:0042DBEC 0F820E000000            jb 0042DC00
:0042DBF2 33C0                    xor eax, eax
:0042DBF4 8A4508                  mov al, byte ptr [ebp+08]
:0042DBF7 83F801                  cmp eax, 00000001
:0042DBFA 0F8418000000            je 0042DC18

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DBEC(C)
|
:0042DC00 837DC403                cmp dword ptr [ebp-3C], 00000003
:0042DC04 0F821C000000            jb 0042DC26
:0042DC0A 33C0                    xor eax, eax
:0042DC0C 8A4508                  mov al, byte ptr [ebp+08]
:0042DC0F 83F803                  cmp eax, 00000003
:0042DC12 0F850E000000            jne 0042DC26

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DBFA(C)
|
:0042DC18 8B45A8                  mov eax, dword ptr [ebp-58]
:0042DC1B 898568FFFFFF            mov dword ptr [ebp+FFFFFF68], eax
:0042DC21 E90E000000              jmp 0042DC34

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042DC04(C), :0042DC12(C)
|
:0042DC26 B830000000              mov eax, 00000030
:0042DC2B 2B45A8                  sub eax, dword ptr [ebp-58]
:0042DC2E 898568FFFFFF            mov dword ptr [ebp+FFFFFF68], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DC21(U)
|
:0042DC34 837DD003                cmp dword ptr [ebp-30], 00000003
:0042DC38 0F8221000000            jb 0042DC5F
:0042DC3E 33C0                    xor eax, eax
:0042DC40 8A4508                  mov al, byte ptr [ebp+08]
:0042DC43 83F801                  cmp eax, 00000001
:0042DC46 0F8513000000            jne 0042DC5F
:0042DC4C B830000000              mov eax, 00000030
:0042DC51 2B45A8                  sub eax, dword ptr [ebp-58]
:0042DC54 898558FFFFFF            mov dword ptr [ebp+FFFFFF58], eax
:0042DC5A E930000000              jmp 0042DC8F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042DC38(C), :0042DC46(C)
|
:0042DC5F 837DD003                cmp dword ptr [ebp-30], 00000003
:0042DC63 0F830E000000            jnb 0042DC77
:0042DC69 33C0                    xor eax, eax
:0042DC6B 8A4508                  mov al, byte ptr [ebp+08]
:0042DC6E 83F803                  cmp eax, 00000003
:0042DC71 0F850E000000            jne 0042DC85

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DC63(C)
|
:0042DC77 8B45A8                  mov eax, dword ptr [ebp-58]
:0042DC7A 898558FFFFFF            mov dword ptr [ebp+FFFFFF58], eax
:0042DC80 E90A000000              jmp 0042DC8F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DC71(C)
|
:0042DC85 C78558FFFFFF00000000    mov dword ptr [ebp+FFFFFF58], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042DC5A(U), :0042DC80(U)
|
:0042DC8F C68554FFFFFF00          mov byte ptr [ebp+FFFFFF54], 00
:0042DC96 E906000000              jmp 0042DCA1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DD36(U)
|
:0042DC9B FE8554FFFFFF            inc byte ptr [ebp+FFFFFF54]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DC96(U)
|
:0042DCA1 33C0                    xor eax, eax
:0042DCA3 8A8554FFFFFF            mov al, byte ptr [ebp+FFFFFF54]
:0042DCA9 83F830                  cmp eax, 00000030
:0042DCAC 0F8D89000000            jnl 0042DD3B
:0042DCB2 6A04                    push 00000004
:0042DCB4 8B8550FFFFFF            mov eax, dword ptr [ebp+FFFFFF50]
:0042DCBA 33DB                    xor ebx, ebx
:0042DCBC 8A5804                  mov bl, byte ptr [eax+04]
:0042DCBF 8D1C5B                  lea ebx, dword ptr [ebx+2*ebx]
:0042DCC2 8D1CDB                  lea ebx, dword ptr [ebx+8*ebx]
:0042DCC5 C1E309                  shl ebx, 09
:0042DCC8 039D70FFFFFF            add ebx, dword ptr [ebp+FFFFFF70]
:0042DCCE 039D58FFFFFF            add ebx, dword ptr [ebp+FFFFFF58]
:0042DCD4 8B45A8                  mov eax, dword ptr [ebp-58]
:0042DCD7 B918000000              mov ecx, 00000018
:0042DCDC 48                      dec eax
:0042DCDD 2BD2                    sub edx, edx
:0042DCDF F7F1                    div ecx
:0042DCE1 83FA0C                  cmp edx, 0000000C
:0042DCE4 1BC0                    sbb eax, eax
:0042DCE6 8D44C009                lea eax, dword ptr [eax+8*eax+09]
:0042DCEA C1E008                  shl eax, 08
:0042DCED 03D8                    add ebx, eax
:0042DCEF 6A04                    push 00000004
:0042DCF1 6A00                    push 00000000
:0042DCF3 6A00                    push 00000000
:0042DCF5 B9D0E44600              mov ecx, 0046E4D0
:0042DCFA E8219A0100              call 00447720
:0042DCFF 03D8                    add ebx, eax
:0042DD01 33C0                    xor eax, eax
:0042DD03 8A8554FFFFFF            mov al, byte ptr [ebp+FFFFFF54]
:0042DD09 C1E004                  shl eax, 04
:0042DD0C 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042DD0F 03D8                    add ebx, eax
:0042DD11 53                      push ebx
:0042DD12 6A01                    push 00000001
:0042DD14 8B8568FFFFFF            mov eax, dword ptr [ebp+FFFFFF68]
:0042DD1A 50                      push eax
:0042DD1B 33C0                    xor eax, eax
:0042DD1D 8A8554FFFFFF            mov al, byte ptr [ebp+FFFFFF54]
:0042DD23 0345F8                  add eax, dword ptr [ebp-08]
:0042DD26 50                      push eax
:0042DD27 8B8564FFFFFF            mov eax, dword ptr [ebp+FFFFFF64]
:0042DD2D 50                      push eax
:0042DD2E E882F50000              call 0043D2B5
:0042DD33 83C418                  add esp, 00000018
:0042DD36 E960FFFFFF              jmp 0042DC9B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DCAC(C)
|
:0042DD3B E87792FFFF              call 00426FB7
:0042DD40 33C0                    xor eax, eax
:0042DD42 8A8574FFFFFF            mov al, byte ptr [ebp+FFFFFF74]
:0042DD48 B903000000              mov ecx, 00000003
:0042DD4D 99                      cdq
:0042DD4E F7F9                    idiv ecx
:0042DD50 83FA02                  cmp edx, 00000002
:0042DD53 0F8505000000            jne 0042DD5E
:0042DD59 E86A960000              call 004373C8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DD53(C)
|
:0042DD5E E9F7FCFFFF              jmp 0042DA5A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042D6DB(U), :0042D71E(C), :0042D739(C), :0042DA2C(U), :0042DA47(C)
|:0042DA6C(C)
|
:0042DD63 E900000000              jmp 0042DD68

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042CF79(U), :0042CFAB(U), :0042DD63(U)
|
:0042DD68 5F                      pop edi
:0042DD69 5E                      pop esi
:0042DD6A 5B                      pop ebx
:0042DD6B C9                      leave
:0042DD6C C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00427AB7   , :00427B7F   , :00428687   
|
:0042DD6F 55                      push ebp
:0042DD70 8BEC                    mov ebp, esp
:0042DD72 83EC08                  sub esp, 00000008
:0042DD75 53                      push ebx
:0042DD76 56                      push esi
:0042DD77 57                      push edi
:0042DD78 894DF8                  mov dword ptr [ebp-08], ecx
:0042DD7B 8B450C                  mov eax, dword ptr [ebp+0C]
:0042DD7E 50                      push eax
:0042DD7F 8B4508                  mov eax, dword ptr [ebp+08]
:0042DD82 50                      push eax
:0042DD83 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0042DD86 E8C504FFFF              call 0041E250
:0042DD8B 8D45FC                  lea eax, dword ptr [ebp-04]
:0042DD8E 50                      push eax
:0042DD8F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042DD92 E8B9E4FFFF              call 0042C250
:0042DD97 85C0                    test eax, eax
:0042DD99 0F8419000000            je 0042DDB8
:0042DD9F 8A4508                  mov al, byte ptr [ebp+08]
:0042DDA2 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042DDA5 884108                  mov byte ptr [ecx+08], al
:0042DDA8 8A450C                  mov al, byte ptr [ebp+0C]
:0042DDAB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042DDAE 884109                  mov byte ptr [ecx+09], al
:0042DDB1 8B45F8                  mov eax, dword ptr [ebp-08]
:0042DDB4 C64007FF                mov [eax+07], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DD99(C)
|
:0042DDB8 E900000000              jmp 0042DDBD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DDB8(U)
|
:0042DDBD 5F                      pop edi
:0042DDBE 5E                      pop esi
:0042DDBF 5B                      pop ebx
:0042DDC0 C9                      leave
:0042DDC1 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:00402CAF   , :00402CD0   , :00402D04   , :004036F5   , :004037D7   
|:00404345   , :00408212   , :0041A301   , :0041B6D4   , :0041DA7A   
|:0041E05A   , :00427B10   , :004288CF   , :0042B1D3   , :0042B412   
|:0042B804   , :00442A25   
|
:0042DDC4 55                      push ebp
:0042DDC5 8BEC                    mov ebp, esp
:0042DDC7 83EC04                  sub esp, 00000004
:0042DDCA 53                      push ebx
:0042DDCB 56                      push esi
:0042DDCC 57                      push edi
:0042DDCD 894DFC                  mov dword ptr [ebp-04], ecx
:0042DDD0 33C0                    xor eax, eax
:0042DDD2 8A4508                  mov al, byte ptr [ebp+08]
:0042DDD5 83F840                  cmp eax, 00000040
:0042DDD8 0F850C000000            jne 0042DDEA
:0042DDDE 6A2A                    push 0000002A
:0042DDE0 B994A64600              mov ecx, 0046A694
:0042DDE5 E83AB2FEFF              call 00419024

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DDD8(C)
|
:0042DDEA 8B45FC                  mov eax, dword ptr [ebp-04]
:0042DDED 33C9                    xor ecx, ecx
:0042DDEF 8A480C                  mov cl, byte ptr [eax+0C]
:0042DDF2 33C0                    xor eax, eax
:0042DDF4 8A4508                  mov al, byte ptr [ebp+08]
:0042DDF7 F7D0                    not eax
:0042DDF9 23C8                    and ecx, eax
:0042DDFB 8B45FC                  mov eax, dword ptr [ebp-04]
:0042DDFE 88480C                  mov byte ptr [eax+0C], cl
:0042DE01 8B45FC                  mov eax, dword ptr [ebp-04]
:0042DE04 33C9                    xor ecx, ecx
:0042DE06 8A480C                  mov cl, byte ptr [eax+0C]
:0042DE09 0A4D08                  or cl, byte ptr [ebp+08]
:0042DE0C 8B45FC                  mov eax, dword ptr [ebp-04]
:0042DE0F 88480C                  mov byte ptr [eax+0C], cl
:0042DE12 E900000000              jmp 0042DE17

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DE12(U)
|
:0042DE17 5F                      pop edi
:0042DE18 5E                      pop esi
:0042DE19 5B                      pop ebx
:0042DE1A C9                      leave
:0042DE1B C20400                  ret 0004



* Referenced by a CALL at Address:
|:0042A90A   
|
:0042DE1E 55                      push ebp
:0042DE1F 8BEC                    mov ebp, esp
:0042DE21 83EC08                  sub esp, 00000008
:0042DE24 53                      push ebx
:0042DE25 56                      push esi
:0042DE26 57                      push edi
:0042DE27 894DF8                  mov dword ptr [ebp-08], ecx
:0042DE2A 8B45F8                  mov eax, dword ptr [ebp-08]
:0042DE2D 8B00                    mov eax, dword ptr [eax]
:0042DE2F 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042DE32 03C0                    add eax, eax
:0042DE34 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:0042DE3B E8A0B3FDFF              call 004091E0
:0042DE40 33C9                    xor ecx, ecx
:0042DE42 8AC8                    mov cl, al
:0042DE44 894DFC                  mov dword ptr [ebp-04], ecx
:0042DE47 8B45F8                  mov eax, dword ptr [ebp-08]
:0042DE4A 33C9                    xor ecx, ecx
:0042DE4C 8A4813                  mov cl, byte ptr [eax+13]
:0042DE4F 034D08                  add ecx, dword ptr [ebp+08]
:0042DE52 3B4DFC                  cmp ecx, dword ptr [ebp-04]
:0042DE55 0F8E0E000000            jle 0042DE69
:0042DE5B 8A45FC                  mov al, byte ptr [ebp-04]
:0042DE5E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042DE61 884113                  mov byte ptr [ecx+13], al
:0042DE64 E911000000              jmp 0042DE7A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DE55(C)
|
:0042DE69 8B45F8                  mov eax, dword ptr [ebp-08]
:0042DE6C 33C9                    xor ecx, ecx
:0042DE6E 8A4813                  mov cl, byte ptr [eax+13]
:0042DE71 034D08                  add ecx, dword ptr [ebp+08]
:0042DE74 8B45F8                  mov eax, dword ptr [ebp-08]
:0042DE77 884813                  mov byte ptr [eax+13], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DE64(U)
|
:0042DE7A E900000000              jmp 0042DE7F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DE7A(U)
|
:0042DE7F 5F                      pop edi
:0042DE80 5E                      pop esi
:0042DE81 5B                      pop ebx
:0042DE82 C9                      leave
:0042DE83 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00419E41   , :00419E85   , :0041A238   , :0041DDA7   , :0041DDFF   
|:0041DE68   , :0041DEC0   , :00428D2B   , :004292B5   , :0042B480   
|:0042BF56   , :0042C91E   , :0042CFC8   , :0042D3CC   , :0043AE9D   
|:0043C337   , :0043CB30   , :0043CBF5   , :0043D122   , :0043D1D6   
|:0043DB25   , :004429FE   , :00442F54   , :004432FD   
|
:0042DE86 55                      push ebp
:0042DE87 8BEC                    mov ebp, esp
:0042DE89 83EC08                  sub esp, 00000008
:0042DE8C 53                      push ebx
:0042DE8D 56                      push esi
:0042DE8E 57                      push edi
:0042DE8F 894DF8                  mov dword ptr [ebp-08], ecx
:0042DE92 C745FC00000000          mov [ebp-04], 00000000
:0042DE99 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042DE9C E8FFB3FDFF              call 004092A0
:0042DEA1 33C9                    xor ecx, ecx
:0042DEA3 8AC8                    mov cl, al
:0042DEA5 83F928                  cmp ecx, 00000028
:0042DEA8 0F8307000000            jnb 0042DEB5
:0042DEAE C745FC01000000          mov [ebp-04], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DEA8(C)
|
:0042DEB5 8B45FC                  mov eax, dword ptr [ebp-04]
:0042DEB8 E900000000              jmp 0042DEBD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DEB8(U)
|
:0042DEBD 5F                      pop edi
:0042DEBE 5E                      pop esi
:0042DEBF 5B                      pop ebx
:0042DEC0 C9                      leave
:0042DEC1 C3                      ret



* Referenced by a CALL at Addresses:
|:00423FE2   , :004433FA   
|
:0042DEC2 55                      push ebp
:0042DEC3 8BEC                    mov ebp, esp
:0042DEC5 83EC08                  sub esp, 00000008
:0042DEC8 53                      push ebx
:0042DEC9 56                      push esi
:0042DECA 57                      push edi
:0042DECB 894DF8                  mov dword ptr [ebp-08], ecx
:0042DECE C745FC00000000          mov [ebp-04], 00000000
:0042DED5 8B45F8                  mov eax, dword ptr [ebp-08]
:0042DED8 83780F00                cmp dword ptr [eax+0F], 00000000
:0042DEDC 0F8507000000            jne 0042DEE9
:0042DEE2 C745FC01000000          mov [ebp-04], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DEDC(C)
|
:0042DEE9 8B45FC                  mov eax, dword ptr [ebp-04]
:0042DEEC E900000000              jmp 0042DEF1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DEEC(U)
|
:0042DEF1 5F                      pop edi
:0042DEF2 5E                      pop esi
:0042DEF3 5B                      pop ebx
:0042DEF4 C9                      leave
:0042DEF5 C3                      ret


:0042DEF6 CC                      int 03
:0042DEF7 CC                      int 03
:0042DEF8 CC                      int 03
:0042DEF9 CC                      int 03
:0042DEFA CC                      int 03
:0042DEFB CC                      int 03
:0042DEFC CC                      int 03
:0042DEFD CC                      int 03
:0042DEFE CC                      int 03
:0042DEFF CC                      int 03
:0042DF00 55                      push ebp
:0042DF01 8BEC                    mov ebp, esp
:0042DF03 83EC04                  sub esp, 00000004
:0042DF06 53                      push ebx
:0042DF07 56                      push esi
:0042DF08 57                      push edi
:0042DF09 894DFC                  mov dword ptr [ebp-04], ecx
:0042DF0C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042DF0F 83C105                  add ecx, 00000005
:0042DF12 E85939FDFF              call 00401870
:0042DF17 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042DF1A 83C108                  add ecx, 00000008
:0042DF1D E84E39FDFF              call 00401870
:0042DF22 8B45FC                  mov eax, dword ptr [ebp-04]
:0042DF25 C700FF000000            mov dword ptr [eax], 000000FF
:0042DF2B E900000000              jmp 0042DF30

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DF2B(U)
|
:0042DF30 8B45FC                  mov eax, dword ptr [ebp-04]
:0042DF33 5F                      pop edi
:0042DF34 5E                      pop esi
:0042DF35 5B                      pop ebx
:0042DF36 C9                      leave
:0042DF37 C3                      ret


:0042DF38 CC                      int 03
:0042DF39 CC                      int 03
:0042DF3A CC                      int 03
:0042DF3B CC                      int 03
:0042DF3C CC                      int 03
:0042DF3D CC                      int 03
:0042DF3E CC                      int 03
:0042DF3F CC                      int 03
:0042DF40 55                      push ebp
:0042DF41 8BEC                    mov ebp, esp
:0042DF43 83EC04                  sub esp, 00000004
:0042DF46 53                      push ebx
:0042DF47 56                      push esi
:0042DF48 57                      push edi
:0042DF49 894DFC                  mov dword ptr [ebp-04], ecx
:0042DF4C E900000000              jmp 0042DF51

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DF4C(U)
|
:0042DF51 5F                      pop edi
:0042DF52 5E                      pop esi
:0042DF53 5B                      pop ebx
:0042DF54 C9                      leave
:0042DF55 C3                      ret


:0042DF56 CC                      int 03
:0042DF57 CC                      int 03
:0042DF58 CC                      int 03
:0042DF59 CC                      int 03
:0042DF5A CC                      int 03
:0042DF5B CC                      int 03
:0042DF5C CC                      int 03
:0042DF5D CC                      int 03
:0042DF5E CC                      int 03
:0042DF5F CC                      int 03

* Referenced by a CALL at Addresses:
|:00429550   , :0042BAF2   
|
:0042DF60 55                      push ebp
:0042DF61 8BEC                    mov ebp, esp
:0042DF63 83EC04                  sub esp, 00000004
:0042DF66 53                      push ebx
:0042DF67 56                      push esi
:0042DF68 57                      push edi
:0042DF69 894DFC                  mov dword ptr [ebp-04], ecx
:0042DF6C 8B45FC                  mov eax, dword ptr [ebp-04]
:0042DF6F 8A4007                  mov al, byte ptr [eax+07]
:0042DF72 E900000000              jmp 0042DF77

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DF72(U)
|
:0042DF77 5F                      pop edi
:0042DF78 5E                      pop esi
:0042DF79 5B                      pop ebx
:0042DF7A C9                      leave
:0042DF7B C3                      ret


:0042DF7C CC                      int 03
:0042DF7D CC                      int 03
:0042DF7E CC                      int 03
:0042DF7F CC                      int 03

* Referenced by a CALL at Address:
|:0042AF59   
|
:0042DF80 55                      push ebp
:0042DF81 8BEC                    mov ebp, esp
:0042DF83 83EC04                  sub esp, 00000004
:0042DF86 53                      push ebx
:0042DF87 56                      push esi
:0042DF88 57                      push edi
:0042DF89 894DFC                  mov dword ptr [ebp-04], ecx
:0042DF8C 8B45FC                  mov eax, dword ptr [ebp-04]
:0042DF8F 8A4014                  mov al, byte ptr [eax+14]
:0042DF92 E900000000              jmp 0042DF97

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DF92(U)
|
:0042DF97 5F                      pop edi
:0042DF98 5E                      pop esi
:0042DF99 5B                      pop ebx
:0042DF9A C9                      leave
:0042DF9B C3                      ret


:0042DF9C CC                      int 03
:0042DF9D CC                      int 03
:0042DF9E CC                      int 03
:0042DF9F CC                      int 03

* Referenced by a CALL at Address:
|:0042AFE8   
|
:0042DFA0 55                      push ebp
:0042DFA1 8BEC                    mov ebp, esp
:0042DFA3 83EC04                  sub esp, 00000004
:0042DFA6 53                      push ebx
:0042DFA7 56                      push esi
:0042DFA8 57                      push edi
:0042DFA9 894DFC                  mov dword ptr [ebp-04], ecx
:0042DFAC 8B45FC                  mov eax, dword ptr [ebp-04]
:0042DFAF 8A4015                  mov al, byte ptr [eax+15]
:0042DFB2 E900000000              jmp 0042DFB7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DFB2(U)
|
:0042DFB7 5F                      pop edi
:0042DFB8 5E                      pop esi
:0042DFB9 5B                      pop ebx
:0042DFBA C9                      leave
:0042DFBB C3                      ret


:0042DFBC CC                      int 03
:0042DFBD CC                      int 03
:0042DFBE CC                      int 03
:0042DFBF CC                      int 03

* Referenced by a CALL at Address:
|:0042B077   
|
:0042DFC0 55                      push ebp
:0042DFC1 8BEC                    mov ebp, esp
:0042DFC3 83EC04                  sub esp, 00000004
:0042DFC6 53                      push ebx
:0042DFC7 56                      push esi
:0042DFC8 57                      push edi
:0042DFC9 894DFC                  mov dword ptr [ebp-04], ecx
:0042DFCC 8B45FC                  mov eax, dword ptr [ebp-04]
:0042DFCF 8A4016                  mov al, byte ptr [eax+16]
:0042DFD2 E900000000              jmp 0042DFD7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DFD2(U)
|
:0042DFD7 5F                      pop edi
:0042DFD8 5E                      pop esi
:0042DFD9 5B                      pop ebx
:0042DFDA C9                      leave
:0042DFDB C3                      ret


:0042DFDC CC                      int 03
:0042DFDD CC                      int 03
:0042DFDE CC                      int 03
:0042DFDF CC                      int 03

* Referenced by a CALL at Addresses:
|:0042BBA8   , :0042BD2B   , :0042BE57   , :0042C53B   , :0042C57B   
|:0042C5C5   , :0044029C   , :004412CD   , :00443676   , :004439E5   
|
:0042DFE0 55                      push ebp
:0042DFE1 8BEC                    mov ebp, esp
:0042DFE3 83EC04                  sub esp, 00000004
:0042DFE6 53                      push ebx
:0042DFE7 56                      push esi
:0042DFE8 57                      push edi
:0042DFE9 894DFC                  mov dword ptr [ebp-04], ecx
:0042DFEC 8B45FC                  mov eax, dword ptr [ebp-04]
:0042DFEF 8A4001                  mov al, byte ptr [eax+01]
:0042DFF2 E900000000              jmp 0042DFF7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DFF2(U)
|
:0042DFF7 5F                      pop edi
:0042DFF8 5E                      pop esi
:0042DFF9 5B                      pop ebx
:0042DFFA C9                      leave
:0042DFFB C3                      ret


:0042DFFC CC                      int 03
:0042DFFD CC                      int 03
:0042DFFE CC                      int 03
:0042DFFF CC                      int 03

* Referenced by a CALL at Addresses:
|:0042BF6D   , :0043DF06   , :0043DF30   , :0043E89D   
|
:0042E000 55                      push ebp
:0042E001 8BEC                    mov ebp, esp
:0042E003 83EC04                  sub esp, 00000004
:0042E006 53                      push ebx
:0042E007 56                      push esi
:0042E008 57                      push edi
:0042E009 894DFC                  mov dword ptr [ebp-04], ecx
:0042E00C 8B45FC                  mov eax, dword ptr [ebp-04]
:0042E00F 8B00                    mov eax, dword ptr [eax]
:0042E011 E900000000              jmp 0042E016

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E011(U)
|
:0042E016 5F                      pop edi
:0042E017 5E                      pop esi
:0042E018 5B                      pop ebx
:0042E019 C9                      leave
:0042E01A C3                      ret


:0042E01B CC                      int 03
:0042E01C CC                      int 03
:0042E01D CC                      int 03
:0042E01E CC                      int 03
:0042E01F CC                      int 03

* Referenced by a CALL at Addresses:
|:0042BF7A   , :0043DF1B   , :0043DF45   , :0043E8CA   
|
:0042E020 55                      push ebp
:0042E021 8BEC                    mov ebp, esp
:0042E023 83EC04                  sub esp, 00000004
:0042E026 53                      push ebx
:0042E027 56                      push esi
:0042E028 57                      push edi
:0042E029 894DFC                  mov dword ptr [ebp-04], ecx
:0042E02C 8B45FC                  mov eax, dword ptr [ebp-04]
:0042E02F 8B4004                  mov eax, dword ptr [eax+04]
:0042E032 E900000000              jmp 0042E037

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E032(U)
|
:0042E037 5F                      pop edi
:0042E038 5E                      pop esi
:0042E039 5B                      pop ebx
:0042E03A C9                      leave
:0042E03B C3                      ret


:0042E03C CC                      int 03
:0042E03D CC                      int 03
:0042E03E CC                      int 03
:0042E03F CC                      int 03

* Referenced by a CALL at Addresses:
|:0042C11A   , :0042C9CE   , :0043A6AC   , :0043E3E8   , :0043E424   
|:0043E498   
|
:0042E040 55                      push ebp
:0042E041 8BEC                    mov ebp, esp
:0042E043 83EC04                  sub esp, 00000004
:0042E046 53                      push ebx
:0042E047 56                      push esi
:0042E048 57                      push edi
:0042E049 894DFC                  mov dword ptr [ebp-04], ecx
:0042E04C 8B4508                  mov eax, dword ptr [ebp+08]
:0042E04F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042E052 894124                  mov dword ptr [ecx+24], eax
:0042E055 E900000000              jmp 0042E05A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E055(U)
|
:0042E05A 5F                      pop edi
:0042E05B 5E                      pop esi
:0042E05C 5B                      pop ebx
:0042E05D C9                      leave
:0042E05E C20400                  ret 0004


:0042E061 CC                      int 03
:0042E062 CC                      int 03
:0042E063 CC                      int 03
:0042E064 CC                      int 03
:0042E065 CC                      int 03
:0042E066 CC                      int 03
:0042E067 CC                      int 03
:0042E068 CC                      int 03
:0042E069 CC                      int 03
:0042E06A CC                      int 03
:0042E06B CC                      int 03
:0042E06C CC                      int 03
:0042E06D CC                      int 03
:0042E06E CC                      int 03
:0042E06F CC                      int 03
:0042E070 55                      push ebp
:0042E071 8BEC                    mov ebp, esp
:0042E073 53                      push ebx
:0042E074 56                      push esi
:0042E075 57                      push edi
:0042E076 E80F000000              call 0042E08A
:0042E07B E824000000              call 0042E0A4
:0042E080 E900000000              jmp 0042E085

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E080(U)
|
:0042E085 5F                      pop edi
:0042E086 5E                      pop esi
:0042E087 5B                      pop ebx
:0042E088 C9                      leave
:0042E089 C3                      ret



* Referenced by a CALL at Address:
|:0042E076   
|
:0042E08A 55                      push ebp
:0042E08B 8BEC                    mov ebp, esp
:0042E08D 53                      push ebx
:0042E08E 56                      push esi
:0042E08F 57                      push edi
:0042E090 B9B0C44600              mov ecx, 0046C4B0
:0042E095 E8A6490000              call 00432A40
:0042E09A E900000000              jmp 0042E09F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E09A(U)
|
:0042E09F 5F                      pop edi
:0042E0A0 5E                      pop esi
:0042E0A1 5B                      pop ebx
:0042E0A2 C9                      leave
:0042E0A3 C3                      ret



* Referenced by a CALL at Address:
|:0042E07B   
|
:0042E0A4 55                      push ebp
:0042E0A5 8BEC                    mov ebp, esp
:0042E0A7 53                      push ebx
:0042E0A8 56                      push esi
:0042E0A9 57                      push edi
:0042E0AA 68C1E04200              push 0042E0C1
:0042E0AF E82C9C0100              call 00447CE0
:0042E0B4 83C404                  add esp, 00000004
:0042E0B7 E900000000              jmp 0042E0BC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E0B7(U)
|
:0042E0BC 5F                      pop edi
:0042E0BD 5E                      pop esi
:0042E0BE 5B                      pop ebx
:0042E0BF C9                      leave
:0042E0C0 C3                      ret


:0042E0C1 55                      push ebp
:0042E0C2 8BEC                    mov ebp, esp
:0042E0C4 53                      push ebx
:0042E0C5 56                      push esi
:0042E0C6 57                      push edi
:0042E0C7 B9B0C44600              mov ecx, 0046C4B0
:0042E0CC E81F490000              call 004329F0
:0042E0D1 E900000000              jmp 0042E0D6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E0D1(U)
|
:0042E0D6 5F                      pop edi
:0042E0D7 5E                      pop esi
:0042E0D8 5B                      pop ebx
:0042E0D9 C9                      leave
:0042E0DA C3                      ret



* Referenced by a CALL at Addresses:
|:00401A9D   , :0042EFB6   , :00431F1B   , :00432D42   , :00433410   
|
:0042E0DB 55                      push ebp
:0042E0DC 8BEC                    mov ebp, esp
:0042E0DE 83EC14                  sub esp, 00000014
:0042E0E1 53                      push ebx
:0042E0E2 56                      push esi
:0042E0E3 57                      push edi
:0042E0E4 894DEC                  mov dword ptr [ebp-14], ecx
:0042E0E7 8B450C                  mov eax, dword ptr [ebp+0C]
:0042E0EA 25FFFF0000              and eax, 0000FFFF
:0042E0EF 50                      push eax
:0042E0F0 8B4508                  mov eax, dword ptr [ebp+08]
:0042E0F3 25FFFF0000              and eax, 0000FFFF
:0042E0F8 50                      push eax
:0042E0F9 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0042E0FC E8AF4A0000              call 00432BB0
:0042E101 8945F4                  mov dword ptr [ebp-0C], eax
:0042E104 C745FC00000000          mov [ebp-04], 00000000
:0042E10B 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042E10E 33C9                    xor ecx, ecx
:0042E110 8A4801                  mov cl, byte ptr [eax+01]
:0042E113 81E180000000            and ecx, 00000080
:0042E119 894DF8                  mov dword ptr [ebp-08], ecx
:0042E11C 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042E11F 33C9                    xor ecx, ecx
:0042E121 8A4801                  mov cl, byte ptr [eax+01]
:0042E124 83E17F                  and ecx, 0000007F
:0042E127 894DF0                  mov dword ptr [ebp-10], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E150(C)
|
:0042E12A FF45FC                  inc [ebp-04]
:0042E12D 8345F40A                add dword ptr [ebp-0C], 0000000A
:0042E131 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042E134 50                      push eax
:0042E135 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0042E138 E8A34A0000              call 00432BE0
:0042E13D 85C0                    test eax, eax
:0042E13F 0F8511000000            jne 0042E156
:0042E145 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042E148 33C9                    xor ecx, ecx
:0042E14A 8A4801                  mov cl, byte ptr [eax+01]
:0042E14D 3B4DF0                  cmp ecx, dword ptr [ebp-10]
:0042E150 0F84D4FFFFFF            je 0042E12A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E13F(C)
|
:0042E156 8B45F8                  mov eax, dword ptr [ebp-08]
:0042E159 0B45FC                  or eax, dword ptr [ebp-04]
:0042E15C E900000000              jmp 0042E161

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E15C(U)
|
:0042E161 5F                      pop edi
:0042E162 5E                      pop esi
:0042E163 5B                      pop ebx
:0042E164 C9                      leave
:0042E165 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:00425926   , :004259A1   , :0042EF82   , :00430622   , :00430705   
|:004334A7   
|
:0042E168 55                      push ebp
:0042E169 8BEC                    mov ebp, esp
:0042E16B 81EC10010000            sub esp, 00000110
:0042E171 53                      push ebx
:0042E172 56                      push esi
:0042E173 57                      push edi
:0042E174 898DF0FEFFFF            mov dword ptr [ebp+FFFFFEF0], ecx
:0042E17A 8B85F0FEFFFF            mov eax, dword ptr [ebp+FFFFFEF0]
:0042E180 8B00                    mov eax, dword ptr [eax]
:0042E182 83C030                  add eax, 00000030
:0042E185 A2F5224500              mov byte ptr [004522F5], al
:0042E18A 8B85F0FEFFFF            mov eax, dword ptr [ebp+FFFFFEF0]
:0042E190 8B00                    mov eax, dword ptr [eax]
:0042E192 83C030                  add eax, 00000030
:0042E195 A205234500              mov byte ptr [00452305], al
:0042E19A 8D8DF8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF8]
:0042E1A0 E84BB2FDFF              call 004093F0
:0042E1A5 8D8DFCFEFFFF            lea ecx, dword ptr [ebp+FFFFFEFC]
:0042E1AB E8C0B4FDFF              call 00409670

* Possible StringData Ref from Data Obj ->"C:SNRxD.e2"
                                  |
:0042E1B0 68F0224500              push 004522F0
:0042E1B5 8D8DFCFEFFFF            lea ecx, dword ptr [ebp+FFFFFEFC]
:0042E1BB E84F93FFFF              call 0042750F
:0042E1C0 85C0                    test eax, eax
:0042E1C2 0F8505000000            jne 0042E1CD
:0042E1C8 E9AC000000              jmp 0042E279

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E1C2(C)
|
:0042E1CD 8B85F0FEFFFF            mov eax, dword ptr [ebp+FFFFFEF0]
:0042E1D3 8B4004                  mov eax, dword ptr [eax+04]
:0042E1D6 50                      push eax
:0042E1D7 8D85FCFEFFFF            lea eax, dword ptr [ebp+FFFFFEFC]
:0042E1DD 50                      push eax
:0042E1DE 8B8DF0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEF0]
:0042E1E4 83C114                  add ecx, 00000014
:0042E1E7 E8244A0000              call 00432C10
:0042E1EC 85C0                    test eax, eax
:0042E1EE 0F8D05000000            jnl 0042E1F9
:0042E1F4 E90B000000              jmp 0042E204

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E1EE(C)
|
:0042E1F9 8D8DFCFEFFFF            lea ecx, dword ptr [ebp+FFFFFEFC]
:0042E1FF E81CB2FDFF              call 00409420

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E1F4(U)
|
:0042E204 A1442F4500              mov eax, dword ptr [00452F44]
:0042E209 50                      push eax

* Possible StringData Ref from Data Obj ->"C:SNRxM.e2"
                                  |
:0042E20A 6800234500              push 00452300
:0042E20F 8D8DF8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF8]
:0042E215 E89D930100              call 004475B7
:0042E21A 85C0                    test eax, eax
:0042E21C 0F8505000000            jne 0042E227
:0042E222 E94D000000              jmp 0042E274

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E21C(C)
|
:0042E227 6A02                    push 00000002
:0042E229 8D85F4FEFFFF            lea eax, dword ptr [ebp+FFFFFEF4]
:0042E22F 50                      push eax
:0042E230 8B85F0FEFFFF            mov eax, dword ptr [ebp+FFFFFEF0]
:0042E236 8B4004                  mov eax, dword ptr [eax+04]
:0042E239 03C0                    add eax, eax
:0042E23B 50                      push eax
:0042E23C 8D8DF8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF8]
:0042E242 E809B2FDFF              call 00409450
:0042E247 33C0                    xor eax, eax
:0042E249 8A85F5FEFFFF            mov al, byte ptr [ebp+FFFFFEF5]
:0042E24F C1E008                  shl eax, 08
:0042E252 33C9                    xor ecx, ecx
:0042E254 8A8DF4FEFFFF            mov cl, byte ptr [ebp+FFFFFEF4]
:0042E25A 03C1                    add eax, ecx
:0042E25C 8B8DF0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEF0]
:0042E262 66898194070000          mov word ptr [ecx+00000794], ax
:0042E269 8D8DF8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF8]
:0042E26F E8ACB1FDFF              call 00409420

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E222(U)
|
:0042E274 E900000000              jmp 0042E279

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042E1C8(U), :0042E274(U)
|
:0042E279 5F                      pop edi
:0042E27A 5E                      pop esi
:0042E27B 5B                      pop ebx
:0042E27C C9                      leave
:0042E27D C3                      ret



* Referenced by a CALL at Addresses:
|:0043033D   , :004304C5   , :00430537   , :00430573   , :004305BE   
|:0043138C   , :0043192F   , :004321C2   
|
:0042E27E 55                      push ebp
:0042E27F 8BEC                    mov ebp, esp
:0042E281 83EC08                  sub esp, 00000008
:0042E284 53                      push ebx
:0042E285 56                      push esi
:0042E286 57                      push edi
:0042E287 894DF8                  mov dword ptr [ebp-08], ecx
:0042E28A 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0042E28D E85EB1FDFF              call 004093F0
:0042E292 A1442F4500              mov eax, dword ptr [00452F44]
:0042E297 50                      push eax

* Possible StringData Ref from Data Obj ->"C:SNRxM.e2"
                                  |
:0042E298 6800234500              push 00452300
:0042E29D 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0042E2A0 E812930100              call 004475B7
:0042E2A5 85C0                    test eax, eax
:0042E2A7 0F8507000000            jne 0042E2B4
:0042E2AD 33C0                    xor eax, eax
:0042E2AF E938000000              jmp 0042E2EC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E2A7(C)
|
:0042E2B4 6800040000              push 00000400
:0042E2B9 8B450C                  mov eax, dword ptr [ebp+0C]
:0042E2BC 50                      push eax
:0042E2BD 8B45F8                  mov eax, dword ptr [ebp-08]
:0042E2C0 33C9                    xor ecx, ecx
:0042E2C2 668B8894070000          mov cx, word ptr [eax+00000794]
:0042E2C9 8B4508                  mov eax, dword ptr [ebp+08]
:0042E2CC 25FFFF0000              and eax, 0000FFFF
:0042E2D1 03C8                    add ecx, eax
:0042E2D3 51                      push ecx
:0042E2D4 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0042E2D7 E874B1FDFF              call 00409450
:0042E2DC 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0042E2DF E83CB1FDFF              call 00409420
:0042E2E4 8B450C                  mov eax, dword ptr [ebp+0C]
:0042E2E7 E900000000              jmp 0042E2EC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042E2AF(U), :0042E2E7(U)
|
:0042E2EC 5F                      pop edi
:0042E2ED 5E                      pop esi
:0042E2EE 5B                      pop ebx
:0042E2EF C9                      leave
:0042E2F0 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:00430356   , :004304DE   , :00430550   , :0043058C   , :004305D7   
|:004313A5   , :0043194D   , :00432210   
|
:0042E2F3 55                      push ebp
:0042E2F4 8BEC                    mov ebp, esp
:0042E2F6 83EC10                  sub esp, 00000010
:0042E2F9 53                      push ebx
:0042E2FA 56                      push esi
:0042E2FB 57                      push edi
:0042E2FC 894DF4                  mov dword ptr [ebp-0C], ecx
:0042E2FF 8B4508                  mov eax, dword ptr [ebp+08]
:0042E302 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E44B(U)
|
:0042E305 8B450C                  mov eax, dword ptr [ebp+0C]
:0042E308 33C9                    xor ecx, ecx
:0042E30A 8A08                    mov cl, byte ptr [eax]
:0042E30C 85C9                    test ecx, ecx
:0042E30E 0F843C010000            je 0042E450
:0042E314 8B450C                  mov eax, dword ptr [ebp+0C]
:0042E317 33C9                    xor ecx, ecx
:0042E319 8A08                    mov cl, byte ptr [eax]
:0042E31B 83F920                  cmp ecx, 00000020
:0042E31E 0F8D15000000            jnl 0042E339
:0042E324 8B450C                  mov eax, dword ptr [ebp+0C]
:0042E327 8A00                    mov al, byte ptr [eax]
:0042E329 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E32C 8801                    mov byte ptr [ecx], al
:0042E32E FF450C                  inc [ebp+0C]
:0042E331 FF4508                  inc [ebp+08]
:0042E334 E912010000              jmp 0042E44B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E31E(C)
|
:0042E339 8B450C                  mov eax, dword ptr [ebp+0C]
:0042E33C 33C9                    xor ecx, ecx
:0042E33E 8A08                    mov cl, byte ptr [eax]
:0042E340 83F973                  cmp ecx, 00000073
:0042E343 0F8D2F000000            jnl 0042E378
:0042E349 8B450C                  mov eax, dword ptr [ebp+0C]
:0042E34C 33C9                    xor ecx, ecx
:0042E34E 8A08                    mov cl, byte ptr [eax]
:0042E350 81C17F820000            add ecx, 0000827F
:0042E356 66894DF8                mov word ptr [ebp-08], cx
:0042E35A FF450C                  inc [ebp+0C]
:0042E35D 8B45F8                  mov eax, dword ptr [ebp-08]
:0042E360 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E363 8821                    mov byte ptr [ecx], ah
:0042E365 FF4508                  inc [ebp+08]
:0042E368 8A45F8                  mov al, byte ptr [ebp-08]
:0042E36B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E36E 8801                    mov byte ptr [ecx], al
:0042E370 FF4508                  inc [ebp+08]
:0042E373 E9D3000000              jmp 0042E44B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E343(C)
|
:0042E378 8B450C                  mov eax, dword ptr [ebp+0C]
:0042E37B 33C9                    xor ecx, ecx
:0042E37D 8A08                    mov cl, byte ptr [eax]
:0042E37F 81F980000000            cmp ecx, 00000080
:0042E385 0F8DA0000000            jnl 0042E42B
:0042E38B 8B450C                  mov eax, dword ptr [ebp+0C]
:0042E38E 33C9                    xor ecx, ecx
:0042E390 8A08                    mov cl, byte ptr [eax]
:0042E392 894DF0                  mov dword ptr [ebp-10], ecx
:0042E395 E961000000              jmp 0042E3FB
:0042E39A 8B4508                  mov eax, dword ptr [ebp+08]
:0042E39D C60081                  mov byte ptr [eax], 81
:0042E3A0 FF4508                  inc [ebp+08]
:0042E3A3 8B4508                  mov eax, dword ptr [ebp+08]
:0042E3A6 C60041                  mov byte ptr [eax], 41
:0042E3A9 FF4508                  inc [ebp+08]
:0042E3AC E972000000              jmp 0042E423
:0042E3B1 8B4508                  mov eax, dword ptr [ebp+08]
:0042E3B4 C60081                  mov byte ptr [eax], 81
:0042E3B7 FF4508                  inc [ebp+08]
:0042E3BA 8B4508                  mov eax, dword ptr [ebp+08]
:0042E3BD C60042                  mov byte ptr [eax], 42
:0042E3C0 FF4508                  inc [ebp+08]
:0042E3C3 E95B000000              jmp 0042E423
:0042E3C8 8B4508                  mov eax, dword ptr [ebp+08]
:0042E3CB C60081                  mov byte ptr [eax], 81
:0042E3CE FF4508                  inc [ebp+08]
:0042E3D1 8B4508                  mov eax, dword ptr [ebp+08]
:0042E3D4 C60048                  mov byte ptr [eax], 48
:0042E3D7 FF4508                  inc [ebp+08]
:0042E3DA E944000000              jmp 0042E423
:0042E3DF 8B4508                  mov eax, dword ptr [ebp+08]
:0042E3E2 C60081                  mov byte ptr [eax], 81
:0042E3E5 FF4508                  inc [ebp+08]
:0042E3E8 8B4508                  mov eax, dword ptr [ebp+08]
:0042E3EB C60049                  mov byte ptr [eax], 49
:0042E3EE FF4508                  inc [ebp+08]
:0042E3F1 E92D000000              jmp 0042E423
:0042E3F6 E928000000              jmp 0042E423

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E395(U)
|
:0042E3FB 836DF073                sub dword ptr [ebp-10], 00000073
:0042E3FF 837DF003                cmp dword ptr [ebp-10], 00000003
:0042E403 0F871A000000            ja 0042E423
:0042E409 8B45F0                  mov eax, dword ptr [ebp-10]
:0042E40C FF248513E44200          jmp dword ptr [4*eax+0042E413]

:0042E413 9AE34200                DWORD 0042E39A
:0042E417 B1E34200                DWORD 0042E3B1
:0042E41B C8E34200                DWORD 0042E3C8
:0042E41F DFE34200                DWORD 0042E3DF



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042E3AC(U), :0042E3C3(U), :0042E3DA(U), :0042E3F1(U), :0042E3F6(U)
|:0042E403(C)
|
:0042E423 FF450C                  inc [ebp+0C]
:0042E426 E920000000              jmp 0042E44B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E385(C)
|
:0042E42B 8B450C                  mov eax, dword ptr [ebp+0C]
:0042E42E 8A00                    mov al, byte ptr [eax]
:0042E430 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E433 8801                    mov byte ptr [ecx], al
:0042E435 FF450C                  inc [ebp+0C]
:0042E438 FF4508                  inc [ebp+08]
:0042E43B 8B450C                  mov eax, dword ptr [ebp+0C]
:0042E43E 8A00                    mov al, byte ptr [eax]
:0042E440 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E443 8801                    mov byte ptr [ecx], al
:0042E445 FF450C                  inc [ebp+0C]
:0042E448 FF4508                  inc [ebp+08]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042E334(U), :0042E373(U)
|
:0042E44B E9B5FEFFFF              jmp 0042E305

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E30E(C)
|
:0042E450 8B4508                  mov eax, dword ptr [ebp+08]
:0042E453 C60000                  mov byte ptr [eax], 00
:0042E456 8B45FC                  mov eax, dword ptr [ebp-04]
:0042E459 E900000000              jmp 0042E45E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E459(U)
|
:0042E45E 5F                      pop edi
:0042E45F 5E                      pop esi
:0042E460 5B                      pop ebx
:0042E461 C9                      leave
:0042E462 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:004258E9   , :00425F7D   
|
:0042E465 55                      push ebp
:0042E466 8BEC                    mov ebp, esp
:0042E468 83EC04                  sub esp, 00000004
:0042E46B 53                      push ebx
:0042E46C 56                      push esi
:0042E46D 57                      push edi
:0042E46E 894DFC                  mov dword ptr [ebp-04], ecx
:0042E471 8B45FC                  mov eax, dword ptr [ebp-04]
:0042E474 C70000000000            mov dword ptr [eax], 00000000
:0042E47A 8B45FC                  mov eax, dword ptr [ebp-04]
:0042E47D C7400400000000          mov [eax+04], 00000000
:0042E484 8B45FC                  mov eax, dword ptr [ebp-04]
:0042E487 C7400800000000          mov [eax+08], 00000000
:0042E48E 8B45FC                  mov eax, dword ptr [ebp-04]
:0042E491 C7400C00000000          mov [eax+0C], 00000000
:0042E498 8B45FC                  mov eax, dword ptr [ebp-04]
:0042E49B 66C740100000            mov [eax+10], 0000
:0042E4A1 8B45FC                  mov eax, dword ptr [ebp-04]
:0042E4A4 66C740120000            mov [eax+12], 0000
:0042E4AA 8B45FC                  mov eax, dword ptr [ebp-04]
:0042E4AD 66C78045030000FFFF      mov word ptr [ebx+00000345], FFFF
:0042E4B6 8B45FC                  mov eax, dword ptr [ebp-04]
:0042E4B9 66C78047030000FFFF      mov word ptr [ebx+00000347], FFFF
:0042E4C2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042E4C5 E8367BFFFF              call 00426000
:0042E4CA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042E4CD E87E470000              call 00432C50
:0042E4D2 6A00                    push 00000000
:0042E4D4 6A20                    push 00000020
:0042E4D6 8B45FC                  mov eax, dword ptr [ebp-04]
:0042E4D9 83C025                  add eax, 00000025
:0042E4DC 50                      push eax
:0042E4DD E8818F0100              call 00447463
:0042E4E2 83C40C                  add esp, 0000000C
:0042E4E5 6A00                    push 00000000
:0042E4E7 6A21                    push 00000021
:0042E4E9 8B45FC                  mov eax, dword ptr [ebp-04]
:0042E4EC 0519090000              add eax, 00000919
:0042E4F1 50                      push eax
:0042E4F2 E86C8F0100              call 00447463
:0042E4F7 83C40C                  add esp, 0000000C
:0042E4FA E900000000              jmp 0042E4FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E4FA(U)
|
:0042E4FF 5F                      pop edi
:0042E500 5E                      pop esi
:0042E501 5B                      pop ebx
:0042E502 C9                      leave
:0042E503 C3                      ret



* Referenced by a CALL at Addresses:
|:0040A2F3   , :0040AFC2   
|
:0042E504 55                      push ebp
:0042E505 8BEC                    mov ebp, esp
:0042E507 83EC08                  sub esp, 00000008
:0042E50A 53                      push ebx
:0042E50B 56                      push esi
:0042E50C 57                      push edi
:0042E50D 894DF8                  mov dword ptr [ebp-08], ecx
:0042E510 6A04                    push 00000004
:0042E512 8B45F8                  mov eax, dword ptr [ebp-08]
:0042E515 50                      push eax
:0042E516 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E519 E8028EFFFF              call 00427320
:0042E51E 6A04                    push 00000004
:0042E520 8B45F8                  mov eax, dword ptr [ebp-08]
:0042E523 83C004                  add eax, 00000004
:0042E526 50                      push eax
:0042E527 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E52A E8F18DFFFF              call 00427320
:0042E52F 6A04                    push 00000004
:0042E531 8B45F8                  mov eax, dword ptr [ebp-08]
:0042E534 83C008                  add eax, 00000008
:0042E537 50                      push eax
:0042E538 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E53B E8E08DFFFF              call 00427320
:0042E540 6A04                    push 00000004
:0042E542 8B45F8                  mov eax, dword ptr [ebp-08]
:0042E545 83C00C                  add eax, 0000000C
:0042E548 50                      push eax
:0042E549 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E54C E8CF8DFFFF              call 00427320
:0042E551 6A02                    push 00000002
:0042E553 8B45F8                  mov eax, dword ptr [ebp-08]
:0042E556 83C010                  add eax, 00000010
:0042E559 50                      push eax
:0042E55A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E55D E8BE8DFFFF              call 00427320
:0042E562 6A02                    push 00000002
:0042E564 8B45F8                  mov eax, dword ptr [ebp-08]
:0042E567 83C012                  add eax, 00000012
:0042E56A 50                      push eax
:0042E56B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E56E E8AD8DFFFF              call 00427320
:0042E573 6A02                    push 00000002
:0042E575 8B45F8                  mov eax, dword ptr [ebp-08]
:0042E578 0545030000              add eax, 00000345
:0042E57D 50                      push eax
:0042E57E 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E581 E89A8DFFFF              call 00427320
:0042E586 6A02                    push 00000002
:0042E588 8B45F8                  mov eax, dword ptr [ebp-08]
:0042E58B 0547030000              add eax, 00000347
:0042E590 50                      push eax
:0042E591 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E594 E8878DFFFF              call 00427320
:0042E599 C745FC00000000          mov [ebp-04], 00000000
:0042E5A0 E903000000              jmp 0042E5A8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E632(U)
|
:0042E5A5 FF45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E5A0(U)
|
:0042E5A8 817DFC80000000          cmp dword ptr [ebp-04], 00000080
:0042E5AF 0F8D82000000            jnl 0042E637
:0042E5B5 6A02                    push 00000002
:0042E5B7 8B45FC                  mov eax, dword ptr [ebp-04]
:0042E5BA 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042E5BD 03C0                    add eax, eax
:0042E5BF 0345F8                  add eax, dword ptr [ebp-08]
:0042E5C2 83C045                  add eax, 00000045
:0042E5C5 50                      push eax
:0042E5C6 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E5C9 E8528DFFFF              call 00427320
:0042E5CE 6A01                    push 00000001
:0042E5D0 8B45FC                  mov eax, dword ptr [ebp-04]
:0042E5D3 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042E5D6 03C0                    add eax, eax
:0042E5D8 0345F8                  add eax, dword ptr [ebp-08]
:0042E5DB 83C047                  add eax, 00000047
:0042E5DE 50                      push eax
:0042E5DF 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E5E2 E8398DFFFF              call 00427320
:0042E5E7 6A01                    push 00000001
:0042E5E9 8B45FC                  mov eax, dword ptr [ebp-04]
:0042E5EC 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042E5EF 03C0                    add eax, eax
:0042E5F1 0345F8                  add eax, dword ptr [ebp-08]
:0042E5F4 83C048                  add eax, 00000048
:0042E5F7 50                      push eax
:0042E5F8 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E5FB E8208DFFFF              call 00427320
:0042E600 6A01                    push 00000001
:0042E602 8B45FC                  mov eax, dword ptr [ebp-04]
:0042E605 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042E608 03C0                    add eax, eax
:0042E60A 0345F8                  add eax, dword ptr [ebp-08]
:0042E60D 83C049                  add eax, 00000049
:0042E610 50                      push eax
:0042E611 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E614 E8078DFFFF              call 00427320
:0042E619 6A01                    push 00000001
:0042E61B 8B45FC                  mov eax, dword ptr [ebp-04]
:0042E61E 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042E621 03C0                    add eax, eax
:0042E623 0345F8                  add eax, dword ptr [ebp-08]
:0042E626 83C04A                  add eax, 0000004A
:0042E629 50                      push eax
:0042E62A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E62D E8EE8CFFFF              call 00427320
:0042E632 E96EFFFFFF              jmp 0042E5A5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E5AF(C)
|
:0042E637 6A02                    push 00000002
:0042E639 8B45F8                  mov eax, dword ptr [ebp-08]
:0042E63C 0549030000              add eax, 00000349
:0042E641 50                      push eax
:0042E642 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E645 E8D68CFFFF              call 00427320
:0042E64A 6A01                    push 00000001
:0042E64C 8B45F8                  mov eax, dword ptr [ebp-08]
:0042E64F 054B030000              add eax, 0000034B
:0042E654 50                      push eax
:0042E655 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E658 E8C38CFFFF              call 00427320
:0042E65D 6A01                    push 00000001
:0042E65F 8B45F8                  mov eax, dword ptr [ebp-08]
:0042E662 054C030000              add eax, 0000034C
:0042E667 50                      push eax
:0042E668 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E66B E8B08CFFFF              call 00427320
:0042E670 6A06                    push 00000006
:0042E672 8B45F8                  mov eax, dword ptr [ebp-08]
:0042E675 054D030000              add eax, 0000034D
:0042E67A 50                      push eax
:0042E67B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E67E E89D8CFFFF              call 00427320
:0042E683 6A02                    push 00000002
:0042E685 8B45F8                  mov eax, dword ptr [ebp-08]
:0042E688 0555030000              add eax, 00000355
:0042E68D 50                      push eax
:0042E68E 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E691 E88A8CFFFF              call 00427320
:0042E696 6A04                    push 00000004
:0042E698 8B45F8                  mov eax, dword ptr [ebp-08]
:0042E69B 0557030000              add eax, 00000357
:0042E6A0 50                      push eax
:0042E6A1 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E6A4 E8778CFFFF              call 00427320
:0042E6A9 6A04                    push 00000004
:0042E6AB 8B45F8                  mov eax, dword ptr [ebp-08]
:0042E6AE 055B030000              add eax, 0000035B
:0042E6B3 50                      push eax
:0042E6B4 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E6B7 E8648CFFFF              call 00427320
:0042E6BC 6A04                    push 00000004
:0042E6BE 8B45F8                  mov eax, dword ptr [ebp-08]
:0042E6C1 055F030000              add eax, 0000035F
:0042E6C6 50                      push eax
:0042E6C7 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E6CA E8518CFFFF              call 00427320
:0042E6CF 6A04                    push 00000004
:0042E6D1 8B45F8                  mov eax, dword ptr [ebp-08]
:0042E6D4 0563030000              add eax, 00000363
:0042E6D9 50                      push eax
:0042E6DA 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E6DD E83E8CFFFF              call 00427320
:0042E6E2 6A04                    push 00000004
:0042E6E4 8B45F8                  mov eax, dword ptr [ebp-08]
:0042E6E7 0567030000              add eax, 00000367
:0042E6EC 50                      push eax
:0042E6ED 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E6F0 E82B8CFFFF              call 00427320
:0042E6F5 C745FC00000000          mov [ebp-04], 00000000
:0042E6FC E903000000              jmp 0042E704

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E80E(U)
|
:0042E701 FF45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E6FC(U)
|
:0042E704 837DFC2D                cmp dword ptr [ebp-04], 0000002D
:0042E708 0F8D05010000            jnl 0042E813
:0042E70E 6A04                    push 00000004
:0042E710 8B45FC                  mov eax, dword ptr [ebp-04]
:0042E713 8BC8                    mov ecx, eax
:0042E715 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042E718 C1E003                  shl eax, 03
:0042E71B 2BC1                    sub eax, ecx
:0042E71D 0345F8                  add eax, dword ptr [ebp-08]
:0042E720 0581030000              add eax, 00000381
:0042E725 50                      push eax
:0042E726 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E729 E8F28BFFFF              call 00427320
:0042E72E 6A01                    push 00000001
:0042E730 8B45FC                  mov eax, dword ptr [ebp-04]
:0042E733 8BC8                    mov ecx, eax
:0042E735 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042E738 C1E003                  shl eax, 03
:0042E73B 2BC1                    sub eax, ecx
:0042E73D 0345F8                  add eax, dword ptr [ebp-08]
:0042E740 0585030000              add eax, 00000385
:0042E745 50                      push eax
:0042E746 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E749 E8D28BFFFF              call 00427320
:0042E74E 6A01                    push 00000001
:0042E750 8B45FC                  mov eax, dword ptr [ebp-04]
:0042E753 8BC8                    mov ecx, eax
:0042E755 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042E758 C1E003                  shl eax, 03
:0042E75B 2BC1                    sub eax, ecx
:0042E75D 0345F8                  add eax, dword ptr [ebp-08]
:0042E760 0586030000              add eax, 00000386
:0042E765 50                      push eax
:0042E766 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E769 E8B28BFFFF              call 00427320
:0042E76E 6A04                    push 00000004
:0042E770 8B45FC                  mov eax, dword ptr [ebp-04]
:0042E773 8BC8                    mov ecx, eax
:0042E775 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042E778 C1E003                  shl eax, 03
:0042E77B 2BC1                    sub eax, ecx
:0042E77D 0345F8                  add eax, dword ptr [ebp-08]
:0042E780 0587030000              add eax, 00000387
:0042E785 50                      push eax
:0042E786 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E789 E8928BFFFF              call 00427320
:0042E78E 6A01                    push 00000001
:0042E790 8B45FC                  mov eax, dword ptr [ebp-04]
:0042E793 8BC8                    mov ecx, eax
:0042E795 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042E798 C1E003                  shl eax, 03
:0042E79B 2BC1                    sub eax, ecx
:0042E79D 0345F8                  add eax, dword ptr [ebp-08]
:0042E7A0 058B030000              add eax, 0000038B
:0042E7A5 50                      push eax
:0042E7A6 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E7A9 E8728BFFFF              call 00427320
:0042E7AE 6A02                    push 00000002
:0042E7B0 8B45FC                  mov eax, dword ptr [ebp-04]
:0042E7B3 8BC8                    mov ecx, eax
:0042E7B5 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042E7B8 C1E003                  shl eax, 03
:0042E7BB 2BC1                    sub eax, ecx
:0042E7BD 0345F8                  add eax, dword ptr [ebp-08]
:0042E7C0 058C030000              add eax, 0000038C
:0042E7C5 50                      push eax
:0042E7C6 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E7C9 E8528BFFFF              call 00427320
:0042E7CE 6A01                    push 00000001
:0042E7D0 8B45FC                  mov eax, dword ptr [ebp-04]
:0042E7D3 8BC8                    mov ecx, eax
:0042E7D5 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042E7D8 C1E003                  shl eax, 03
:0042E7DB 2BC1                    sub eax, ecx
:0042E7DD 0345F8                  add eax, dword ptr [ebp-08]
:0042E7E0 058E030000              add eax, 0000038E
:0042E7E5 50                      push eax
:0042E7E6 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E7E9 E8328BFFFF              call 00427320
:0042E7EE 6A01                    push 00000001
:0042E7F0 8B45FC                  mov eax, dword ptr [ebp-04]
:0042E7F3 8BC8                    mov ecx, eax
:0042E7F5 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042E7F8 C1E003                  shl eax, 03
:0042E7FB 2BC1                    sub eax, ecx
:0042E7FD 0345F8                  add eax, dword ptr [ebp-08]
:0042E800 058F030000              add eax, 0000038F
:0042E805 50                      push eax
:0042E806 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E809 E8128BFFFF              call 00427320
:0042E80E E9EEFEFFFF              jmp 0042E701

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E708(C)
|
:0042E813 6A20                    push 00000020
:0042E815 8B45F8                  mov eax, dword ptr [ebp-08]
:0042E818 83C025                  add eax, 00000025
:0042E81B 50                      push eax
:0042E81C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E81F E8FC8AFFFF              call 00427320
:0042E824 6A21                    push 00000021
:0042E826 8B45F8                  mov eax, dword ptr [ebp-08]
:0042E829 0519090000              add eax, 00000919
:0042E82E 50                      push eax
:0042E82F 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E832 E8E98AFFFF              call 00427320
:0042E837 6881010000              push 00000181
:0042E83C 8B45F8                  mov eax, dword ptr [ebp-08]
:0042E83F 0598070000              add eax, 00000798
:0042E844 50                      push eax
:0042E845 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E848 E8D38AFFFF              call 00427320
:0042E84D 6A01                    push 00000001
:0042E84F 8B45F8                  mov eax, dword ptr [ebp-08]
:0042E852 0596070000              add eax, 00000796
:0042E857 50                      push eax
:0042E858 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E85B E8C08AFFFF              call 00427320
:0042E860 6A01                    push 00000001
:0042E862 8B45F8                  mov eax, dword ptr [ebp-08]
:0042E865 0597070000              add eax, 00000797
:0042E86A 50                      push eax
:0042E86B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E86E E8AD8AFFFF              call 00427320
:0042E873 33C0                    xor eax, eax
:0042E875 E900000000              jmp 0042E87A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E875(U)
|
:0042E87A 5F                      pop edi
:0042E87B 5E                      pop esi
:0042E87C 5B                      pop ebx
:0042E87D C9                      leave
:0042E87E C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0040A16C   , :0040B5CB   
|
:0042E881 55                      push ebp
:0042E882 8BEC                    mov ebp, esp
:0042E884 83EC08                  sub esp, 00000008
:0042E887 53                      push ebx
:0042E888 56                      push esi
:0042E889 57                      push edi
:0042E88A 894DF8                  mov dword ptr [ebp-08], ecx
:0042E88D 6A04                    push 00000004
:0042E88F 8B45F8                  mov eax, dword ptr [ebp-08]
:0042E892 50                      push eax
:0042E893 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E896 E8D5430000              call 00432C70
:0042E89B 6A04                    push 00000004
:0042E89D 8B45F8                  mov eax, dword ptr [ebp-08]
:0042E8A0 83C004                  add eax, 00000004
:0042E8A3 50                      push eax
:0042E8A4 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E8A7 E8C4430000              call 00432C70
:0042E8AC 6A04                    push 00000004
:0042E8AE 8B45F8                  mov eax, dword ptr [ebp-08]
:0042E8B1 83C008                  add eax, 00000008
:0042E8B4 50                      push eax
:0042E8B5 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E8B8 E8B3430000              call 00432C70
:0042E8BD 6A04                    push 00000004
:0042E8BF 8B45F8                  mov eax, dword ptr [ebp-08]
:0042E8C2 83C00C                  add eax, 0000000C
:0042E8C5 50                      push eax
:0042E8C6 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E8C9 E8A2430000              call 00432C70
:0042E8CE 6A02                    push 00000002
:0042E8D0 8B45F8                  mov eax, dword ptr [ebp-08]
:0042E8D3 83C010                  add eax, 00000010
:0042E8D6 50                      push eax
:0042E8D7 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E8DA E891430000              call 00432C70
:0042E8DF 6A02                    push 00000002
:0042E8E1 8B45F8                  mov eax, dword ptr [ebp-08]
:0042E8E4 83C012                  add eax, 00000012
:0042E8E7 50                      push eax
:0042E8E8 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E8EB E880430000              call 00432C70
:0042E8F0 6A02                    push 00000002
:0042E8F2 8B45F8                  mov eax, dword ptr [ebp-08]
:0042E8F5 0545030000              add eax, 00000345
:0042E8FA 50                      push eax
:0042E8FB 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E8FE E86D430000              call 00432C70
:0042E903 6A02                    push 00000002
:0042E905 8B45F8                  mov eax, dword ptr [ebp-08]
:0042E908 0547030000              add eax, 00000347
:0042E90D 50                      push eax
:0042E90E 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E911 E85A430000              call 00432C70
:0042E916 C745FC00000000          mov [ebp-04], 00000000
:0042E91D E903000000              jmp 0042E925

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E9AF(U)
|
:0042E922 FF45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E91D(U)
|
:0042E925 817DFC80000000          cmp dword ptr [ebp-04], 00000080
:0042E92C 0F8382000000            jnb 0042E9B4
:0042E932 6A02                    push 00000002
:0042E934 8B45FC                  mov eax, dword ptr [ebp-04]
:0042E937 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042E93A 03C0                    add eax, eax
:0042E93C 0345F8                  add eax, dword ptr [ebp-08]
:0042E93F 83C045                  add eax, 00000045
:0042E942 50                      push eax
:0042E943 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E946 E825430000              call 00432C70
:0042E94B 6A01                    push 00000001
:0042E94D 8B45FC                  mov eax, dword ptr [ebp-04]
:0042E950 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042E953 03C0                    add eax, eax
:0042E955 0345F8                  add eax, dword ptr [ebp-08]
:0042E958 83C047                  add eax, 00000047
:0042E95B 50                      push eax
:0042E95C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E95F E80C430000              call 00432C70
:0042E964 6A01                    push 00000001
:0042E966 8B45FC                  mov eax, dword ptr [ebp-04]
:0042E969 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042E96C 03C0                    add eax, eax
:0042E96E 0345F8                  add eax, dword ptr [ebp-08]
:0042E971 83C048                  add eax, 00000048
:0042E974 50                      push eax
:0042E975 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E978 E8F3420000              call 00432C70
:0042E97D 6A01                    push 00000001
:0042E97F 8B45FC                  mov eax, dword ptr [ebp-04]
:0042E982 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042E985 03C0                    add eax, eax
:0042E987 0345F8                  add eax, dword ptr [ebp-08]
:0042E98A 83C049                  add eax, 00000049
:0042E98D 50                      push eax
:0042E98E 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E991 E8DA420000              call 00432C70
:0042E996 6A01                    push 00000001
:0042E998 8B45FC                  mov eax, dword ptr [ebp-04]
:0042E99B 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042E99E 03C0                    add eax, eax
:0042E9A0 0345F8                  add eax, dword ptr [ebp-08]
:0042E9A3 83C04A                  add eax, 0000004A
:0042E9A6 50                      push eax
:0042E9A7 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E9AA E8C1420000              call 00432C70
:0042E9AF E96EFFFFFF              jmp 0042E922

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E92C(C)
|
:0042E9B4 6A02                    push 00000002
:0042E9B6 8B45F8                  mov eax, dword ptr [ebp-08]
:0042E9B9 0549030000              add eax, 00000349
:0042E9BE 50                      push eax
:0042E9BF 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E9C2 E8A9420000              call 00432C70
:0042E9C7 6A01                    push 00000001
:0042E9C9 8B45F8                  mov eax, dword ptr [ebp-08]
:0042E9CC 054B030000              add eax, 0000034B
:0042E9D1 50                      push eax
:0042E9D2 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E9D5 E896420000              call 00432C70
:0042E9DA 6A01                    push 00000001
:0042E9DC 8B45F8                  mov eax, dword ptr [ebp-08]
:0042E9DF 054C030000              add eax, 0000034C
:0042E9E4 50                      push eax
:0042E9E5 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E9E8 E883420000              call 00432C70
:0042E9ED 6A06                    push 00000006
:0042E9EF 8B45F8                  mov eax, dword ptr [ebp-08]
:0042E9F2 054D030000              add eax, 0000034D
:0042E9F7 50                      push eax
:0042E9F8 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E9FB E870420000              call 00432C70
:0042EA00 6A02                    push 00000002
:0042EA02 8B45F8                  mov eax, dword ptr [ebp-08]
:0042EA05 0555030000              add eax, 00000355
:0042EA0A 50                      push eax
:0042EA0B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042EA0E E85D420000              call 00432C70
:0042EA13 6A04                    push 00000004
:0042EA15 8B45F8                  mov eax, dword ptr [ebp-08]
:0042EA18 0557030000              add eax, 00000357
:0042EA1D 50                      push eax
:0042EA1E 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042EA21 E84A420000              call 00432C70
:0042EA26 6A04                    push 00000004
:0042EA28 8B45F8                  mov eax, dword ptr [ebp-08]
:0042EA2B 055B030000              add eax, 0000035B
:0042EA30 50                      push eax
:0042EA31 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042EA34 E837420000              call 00432C70
:0042EA39 6A04                    push 00000004
:0042EA3B 8B45F8                  mov eax, dword ptr [ebp-08]
:0042EA3E 055F030000              add eax, 0000035F
:0042EA43 50                      push eax
:0042EA44 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042EA47 E824420000              call 00432C70
:0042EA4C 6A04                    push 00000004
:0042EA4E 8B45F8                  mov eax, dword ptr [ebp-08]
:0042EA51 0563030000              add eax, 00000363
:0042EA56 50                      push eax
:0042EA57 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042EA5A E811420000              call 00432C70
:0042EA5F 6A04                    push 00000004
:0042EA61 8B45F8                  mov eax, dword ptr [ebp-08]
:0042EA64 0567030000              add eax, 00000367
:0042EA69 50                      push eax
:0042EA6A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042EA6D E8FE410000              call 00432C70
:0042EA72 C745FC00000000          mov [ebp-04], 00000000
:0042EA79 E903000000              jmp 0042EA81

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042EB8B(U)
|
:0042EA7E FF45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042EA79(U)
|
:0042EA81 837DFC2D                cmp dword ptr [ebp-04], 0000002D
:0042EA85 0F8305010000            jnb 0042EB90
:0042EA8B 6A04                    push 00000004
:0042EA8D 8B45FC                  mov eax, dword ptr [ebp-04]
:0042EA90 8BC8                    mov ecx, eax
:0042EA92 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042EA95 C1E003                  shl eax, 03
:0042EA98 2BC1                    sub eax, ecx
:0042EA9A 0345F8                  add eax, dword ptr [ebp-08]
:0042EA9D 0581030000              add eax, 00000381
:0042EAA2 50                      push eax
:0042EAA3 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042EAA6 E8C5410000              call 00432C70
:0042EAAB 6A01                    push 00000001
:0042EAAD 8B45FC                  mov eax, dword ptr [ebp-04]
:0042EAB0 8BC8                    mov ecx, eax
:0042EAB2 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042EAB5 C1E003                  shl eax, 03
:0042EAB8 2BC1                    sub eax, ecx
:0042EABA 0345F8                  add eax, dword ptr [ebp-08]
:0042EABD 0585030000              add eax, 00000385
:0042EAC2 50                      push eax
:0042EAC3 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042EAC6 E8A5410000              call 00432C70
:0042EACB 6A01                    push 00000001
:0042EACD 8B45FC                  mov eax, dword ptr [ebp-04]
:0042EAD0 8BC8                    mov ecx, eax
:0042EAD2 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042EAD5 C1E003                  shl eax, 03
:0042EAD8 2BC1                    sub eax, ecx
:0042EADA 0345F8                  add eax, dword ptr [ebp-08]
:0042EADD 0586030000              add eax, 00000386
:0042EAE2 50                      push eax
:0042EAE3 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042EAE6 E885410000              call 00432C70
:0042EAEB 6A04                    push 00000004
:0042EAED 8B45FC                  mov eax, dword ptr [ebp-04]
:0042EAF0 8BC8                    mov ecx, eax
:0042EAF2 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042EAF5 C1E003                  shl eax, 03
:0042EAF8 2BC1                    sub eax, ecx
:0042EAFA 0345F8                  add eax, dword ptr [ebp-08]
:0042EAFD 0587030000              add eax, 00000387
:0042EB02 50                      push eax
:0042EB03 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042EB06 E865410000              call 00432C70
:0042EB0B 6A01                    push 00000001
:0042EB0D 8B45FC                  mov eax, dword ptr [ebp-04]
:0042EB10 8BC8                    mov ecx, eax
:0042EB12 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042EB15 C1E003                  shl eax, 03
:0042EB18 2BC1                    sub eax, ecx
:0042EB1A 0345F8                  add eax, dword ptr [ebp-08]
:0042EB1D 058B030000              add eax, 0000038B
:0042EB22 50                      push eax
:0042EB23 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042EB26 E845410000              call 00432C70
:0042EB2B 6A02                    push 00000002
:0042EB2D 8B45FC                  mov eax, dword ptr [ebp-04]
:0042EB30 8BC8                    mov ecx, eax
:0042EB32 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042EB35 C1E003                  shl eax, 03
:0042EB38 2BC1                    sub eax, ecx
:0042EB3A 0345F8                  add eax, dword ptr [ebp-08]
:0042EB3D 058C030000              add eax, 0000038C
:0042EB42 50                      push eax
:0042EB43 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042EB46 E825410000              call 00432C70
:0042EB4B 6A01                    push 00000001
:0042EB4D 8B45FC                  mov eax, dword ptr [ebp-04]
:0042EB50 8BC8                    mov ecx, eax
:0042EB52 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042EB55 C1E003                  shl eax, 03
:0042EB58 2BC1                    sub eax, ecx
:0042EB5A 0345F8                  add eax, dword ptr [ebp-08]
:0042EB5D 058E030000              add eax, 0000038E
:0042EB62 50                      push eax
:0042EB63 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042EB66 E805410000              call 00432C70
:0042EB6B 6A01                    push 00000001
:0042EB6D 8B45FC                  mov eax, dword ptr [ebp-04]
:0042EB70 8BC8                    mov ecx, eax
:0042EB72 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042EB75 C1E003                  shl eax, 03
:0042EB78 2BC1                    sub eax, ecx
:0042EB7A 0345F8                  add eax, dword ptr [ebp-08]
:0042EB7D 058F030000              add eax, 0000038F
:0042EB82 50                      push eax
:0042EB83 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042EB86 E8E5400000              call 00432C70
:0042EB8B E9EEFEFFFF              jmp 0042EA7E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042EA85(C)
|
:0042EB90 6A20                    push 00000020
:0042EB92 8B45F8                  mov eax, dword ptr [ebp-08]
:0042EB95 83C025                  add eax, 00000025
:0042EB98 50                      push eax
:0042EB99 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042EB9C E8CF400000              call 00432C70
:0042EBA1 6A21                    push 00000021
:0042EBA3 8B45F8                  mov eax, dword ptr [ebp-08]
:0042EBA6 0519090000              add eax, 00000919
:0042EBAB 50                      push eax
:0042EBAC 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042EBAF E8BC400000              call 00432C70
:0042EBB4 6881010000              push 00000181
:0042EBB9 8B45F8                  mov eax, dword ptr [ebp-08]
:0042EBBC 0598070000              add eax, 00000798
:0042EBC1 50                      push eax
:0042EBC2 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042EBC5 E8A6400000              call 00432C70
:0042EBCA 6A01                    push 00000001
:0042EBCC 8B45F8                  mov eax, dword ptr [ebp-08]
:0042EBCF 0596070000              add eax, 00000796
:0042EBD4 50                      push eax
:0042EBD5 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042EBD8 E893400000              call 00432C70
:0042EBDD 6A01                    push 00000001
:0042EBDF 8B45F8                  mov eax, dword ptr [ebp-08]
:0042EBE2 0597070000              add eax, 00000797
:0042EBE7 50                      push eax
:0042EBE8 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042EBEB E880400000              call 00432C70
:0042EBF0 33C0                    xor eax, eax
:0042EBF2 E900000000              jmp 0042EBF7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042EBF2(U)
|
:0042EBF7 5F                      pop edi
:0042EBF8 5E                      pop esi
:0042EBF9 5B                      pop ebx
:0042EBFA C9                      leave
:0042EBFB C20400                  ret 0004



* Referenced by a CALL at Address:
|:00431CDF   
|
:0042EBFE 55                      push ebp
:0042EBFF 8BEC                    mov ebp, esp
:0042EC01 83EC04                  sub esp, 00000004
:0042EC04 53                      push ebx
:0042EC05 56                      push esi
:0042EC06 57                      push edi
:0042EC07 894DFC                  mov dword ptr [ebp-04], ecx
:0042EC0A 6A04                    push 00000004
:0042EC0C 8B4508                  mov eax, dword ptr [ebp+08]
:0042EC0F 50                      push eax
:0042EC10 8B45FC                  mov eax, dword ptr [ebp-04]
:0042EC13 50                      push eax
:0042EC14 E834880100              call 0044744D
:0042EC19 83C40C                  add esp, 0000000C
:0042EC1C 83450804                add dword ptr [ebp+08], 00000004
:0042EC20 6A04                    push 00000004
:0042EC22 8B4508                  mov eax, dword ptr [ebp+08]
:0042EC25 50                      push eax
:0042EC26 8B45FC                  mov eax, dword ptr [ebp-04]
:0042EC29 83C004                  add eax, 00000004
:0042EC2C 50                      push eax
:0042EC2D E81B880100              call 0044744D
:0042EC32 83C40C                  add esp, 0000000C
:0042EC35 83450804                add dword ptr [ebp+08], 00000004
:0042EC39 6A04                    push 00000004
:0042EC3B 8B4508                  mov eax, dword ptr [ebp+08]
:0042EC3E 50                      push eax
:0042EC3F 8B45FC                  mov eax, dword ptr [ebp-04]
:0042EC42 83C008                  add eax, 00000008
:0042EC45 50                      push eax
:0042EC46 E802880100              call 0044744D
:0042EC4B 83C40C                  add esp, 0000000C
:0042EC4E 83450804                add dword ptr [ebp+08], 00000004
:0042EC52 6A04                    push 00000004
:0042EC54 8B4508                  mov eax, dword ptr [ebp+08]
:0042EC57 50                      push eax
:0042EC58 8B45FC                  mov eax, dword ptr [ebp-04]
:0042EC5B 83C00C                  add eax, 0000000C
:0042EC5E 50                      push eax
:0042EC5F E8E9870100              call 0044744D
:0042EC64 83C40C                  add esp, 0000000C
:0042EC67 83450804                add dword ptr [ebp+08], 00000004
:0042EC6B 6A02                    push 00000002
:0042EC6D 8B4508                  mov eax, dword ptr [ebp+08]
:0042EC70 50                      push eax
:0042EC71 8B45FC                  mov eax, dword ptr [ebp-04]
:0042EC74 83C010                  add eax, 00000010
:0042EC77 50                      push eax
:0042EC78 E8D0870100              call 0044744D
:0042EC7D 83C40C                  add esp, 0000000C
:0042EC80 83450802                add dword ptr [ebp+08], 00000002
:0042EC84 6A02                    push 00000002
:0042EC86 8B4508                  mov eax, dword ptr [ebp+08]
:0042EC89 50                      push eax
:0042EC8A 8B45FC                  mov eax, dword ptr [ebp-04]
:0042EC8D 83C012                  add eax, 00000012
:0042EC90 50                      push eax
:0042EC91 E8B7870100              call 0044744D
:0042EC96 83C40C                  add esp, 0000000C
:0042EC99 83450802                add dword ptr [ebp+08], 00000002
:0042EC9D 6A02                    push 00000002
:0042EC9F 8B4508                  mov eax, dword ptr [ebp+08]
:0042ECA2 50                      push eax
:0042ECA3 8B45FC                  mov eax, dword ptr [ebp-04]
:0042ECA6 0545030000              add eax, 00000345
:0042ECAB 50                      push eax
:0042ECAC E89C870100              call 0044744D
:0042ECB1 83C40C                  add esp, 0000000C
:0042ECB4 83450802                add dword ptr [ebp+08], 00000002
:0042ECB8 6A02                    push 00000002
:0042ECBA 8B4508                  mov eax, dword ptr [ebp+08]
:0042ECBD 50                      push eax
:0042ECBE 8B45FC                  mov eax, dword ptr [ebp-04]
:0042ECC1 0547030000              add eax, 00000347
:0042ECC6 50                      push eax
:0042ECC7 E881870100              call 0044744D
:0042ECCC 83C40C                  add esp, 0000000C
:0042ECCF 83450802                add dword ptr [ebp+08], 00000002
:0042ECD3 6800030000              push 00000300
:0042ECD8 8B4508                  mov eax, dword ptr [ebp+08]
:0042ECDB 50                      push eax
:0042ECDC 8B45FC                  mov eax, dword ptr [ebp-04]
:0042ECDF 83C045                  add eax, 00000045
:0042ECE2 50                      push eax
:0042ECE3 E865870100              call 0044744D
:0042ECE8 83C40C                  add esp, 0000000C
:0042ECEB 81450800030000          add dword ptr [ebp+08], 00000300
:0042ECF2 6A36                    push 00000036
:0042ECF4 8B4508                  mov eax, dword ptr [ebp+08]
:0042ECF7 50                      push eax
:0042ECF8 8B45FC                  mov eax, dword ptr [ebp-04]
:0042ECFB 0549030000              add eax, 00000349
:0042ED00 50                      push eax
:0042ED01 E847870100              call 0044744D
:0042ED06 83C40C                  add esp, 0000000C
:0042ED09 83450836                add dword ptr [ebp+08], 00000036
:0042ED0D 680B040000              push 0000040B
:0042ED12 8B4508                  mov eax, dword ptr [ebp+08]
:0042ED15 50                      push eax
:0042ED16 8B45FC                  mov eax, dword ptr [ebp-04]
:0042ED19 0581030000              add eax, 00000381
:0042ED1E 50                      push eax
:0042ED1F E829870100              call 0044744D
:0042ED24 83C40C                  add esp, 0000000C
:0042ED27 8145080B040000          add dword ptr [ebp+08], 0000040B
:0042ED2E 6A20                    push 00000020
:0042ED30 8B4508                  mov eax, dword ptr [ebp+08]
:0042ED33 50                      push eax
:0042ED34 8B45FC                  mov eax, dword ptr [ebp-04]
:0042ED37 83C025                  add eax, 00000025
:0042ED3A 50                      push eax
:0042ED3B E80D870100              call 0044744D
:0042ED40 83C40C                  add esp, 0000000C
:0042ED43 83450820                add dword ptr [ebp+08], 00000020
:0042ED47 6A21                    push 00000021
:0042ED49 8B4508                  mov eax, dword ptr [ebp+08]
:0042ED4C 50                      push eax
:0042ED4D 8B45FC                  mov eax, dword ptr [ebp-04]
:0042ED50 0519090000              add eax, 00000919
:0042ED55 50                      push eax
:0042ED56 E8F2860100              call 0044744D
:0042ED5B 83C40C                  add esp, 0000000C
:0042ED5E 83450821                add dword ptr [ebp+08], 00000021
:0042ED62 6881010000              push 00000181
:0042ED67 8B4508                  mov eax, dword ptr [ebp+08]
:0042ED6A 50                      push eax
:0042ED6B 8B45FC                  mov eax, dword ptr [ebp-04]
:0042ED6E 0598070000              add eax, 00000798
:0042ED73 50                      push eax
:0042ED74 E8D4860100              call 0044744D
:0042ED79 83C40C                  add esp, 0000000C
:0042ED7C 81450881010000          add dword ptr [ebp+08], 00000181
:0042ED83 6A01                    push 00000001
:0042ED85 8B4508                  mov eax, dword ptr [ebp+08]
:0042ED88 50                      push eax
:0042ED89 8B45FC                  mov eax, dword ptr [ebp-04]
:0042ED8C 0596070000              add eax, 00000796
:0042ED91 50                      push eax
:0042ED92 E8B6860100              call 0044744D
:0042ED97 83C40C                  add esp, 0000000C
:0042ED9A FF4508                  inc [ebp+08]
:0042ED9D 6A01                    push 00000001
:0042ED9F 8B4508                  mov eax, dword ptr [ebp+08]
:0042EDA2 50                      push eax
:0042EDA3 8B45FC                  mov eax, dword ptr [ebp-04]
:0042EDA6 0597070000              add eax, 00000797
:0042EDAB 50                      push eax
:0042EDAC E89C860100              call 0044744D
:0042EDB1 83C40C                  add esp, 0000000C
:0042EDB4 FF4508                  inc [ebp+08]
:0042EDB7 8B4508                  mov eax, dword ptr [ebp+08]
:0042EDBA E900000000              jmp 0042EDBF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042EDBA(U)
|
:0042EDBF 5F                      pop edi
:0042EDC0 5E                      pop esi
:0042EDC1 5B                      pop ebx
:0042EDC2 C9                      leave
:0042EDC3 C20400                  ret 0004



* Referenced by a CALL at Address:
|:00425754   
|
:0042EDC6 55                      push ebp
:0042EDC7 8BEC                    mov ebp, esp
:0042EDC9 83EC04                  sub esp, 00000004
:0042EDCC 53                      push ebx
:0042EDCD 56                      push esi
:0042EDCE 57                      push edi
:0042EDCF 894DFC                  mov dword ptr [ebp-04], ecx
:0042EDD2 6A04                    push 00000004
:0042EDD4 8B45FC                  mov eax, dword ptr [ebp-04]
:0042EDD7 50                      push eax
:0042EDD8 8B4508                  mov eax, dword ptr [ebp+08]
:0042EDDB 50                      push eax
:0042EDDC E86C860100              call 0044744D
:0042EDE1 83C40C                  add esp, 0000000C
:0042EDE4 83450804                add dword ptr [ebp+08], 00000004
:0042EDE8 6A04                    push 00000004
:0042EDEA 8B45FC                  mov eax, dword ptr [ebp-04]
:0042EDED 83C004                  add eax, 00000004
:0042EDF0 50                      push eax
:0042EDF1 8B4508                  mov eax, dword ptr [ebp+08]
:0042EDF4 50                      push eax
:0042EDF5 E853860100              call 0044744D
:0042EDFA 83C40C                  add esp, 0000000C
:0042EDFD 83450804                add dword ptr [ebp+08], 00000004
:0042EE01 6A04                    push 00000004
:0042EE03 8B45FC                  mov eax, dword ptr [ebp-04]
:0042EE06 83C008                  add eax, 00000008
:0042EE09 50                      push eax
:0042EE0A 8B4508                  mov eax, dword ptr [ebp+08]
:0042EE0D 50                      push eax
:0042EE0E E83A860100              call 0044744D
:0042EE13 83C40C                  add esp, 0000000C
:0042EE16 83450804                add dword ptr [ebp+08], 00000004
:0042EE1A 6A04                    push 00000004
:0042EE1C 8B45FC                  mov eax, dword ptr [ebp-04]
:0042EE1F 83C00C                  add eax, 0000000C
:0042EE22 50                      push eax
:0042EE23 8B4508                  mov eax, dword ptr [ebp+08]
:0042EE26 50                      push eax
:0042EE27 E821860100              call 0044744D
:0042EE2C 83C40C                  add esp, 0000000C
:0042EE2F 83450804                add dword ptr [ebp+08], 00000004
:0042EE33 6A02                    push 00000002
:0042EE35 8B45FC                  mov eax, dword ptr [ebp-04]
:0042EE38 83C010                  add eax, 00000010
:0042EE3B 50                      push eax
:0042EE3C 8B4508                  mov eax, dword ptr [ebp+08]
:0042EE3F 50                      push eax
:0042EE40 E808860100              call 0044744D
:0042EE45 83C40C                  add esp, 0000000C
:0042EE48 83450802                add dword ptr [ebp+08], 00000002
:0042EE4C 6A02                    push 00000002
:0042EE4E 8B45FC                  mov eax, dword ptr [ebp-04]
:0042EE51 83C012                  add eax, 00000012
:0042EE54 50                      push eax
:0042EE55 8B4508                  mov eax, dword ptr [ebp+08]
:0042EE58 50                      push eax
:0042EE59 E8EF850100              call 0044744D
:0042EE5E 83C40C                  add esp, 0000000C
:0042EE61 83450802                add dword ptr [ebp+08], 00000002
:0042EE65 6A02                    push 00000002
:0042EE67 8B45FC                  mov eax, dword ptr [ebp-04]
:0042EE6A 0545030000              add eax, 00000345
:0042EE6F 50                      push eax
:0042EE70 8B4508                  mov eax, dword ptr [ebp+08]
:0042EE73 50                      push eax
:0042EE74 E8D4850100              call 0044744D
:0042EE79 83C40C                  add esp, 0000000C
:0042EE7C 83450802                add dword ptr [ebp+08], 00000002
:0042EE80 6A02                    push 00000002
:0042EE82 8B45FC                  mov eax, dword ptr [ebp-04]
:0042EE85 0547030000              add eax, 00000347
:0042EE8A 50                      push eax
:0042EE8B 8B4508                  mov eax, dword ptr [ebp+08]
:0042EE8E 50                      push eax
:0042EE8F E8B9850100              call 0044744D
:0042EE94 83C40C                  add esp, 0000000C
:0042EE97 83450802                add dword ptr [ebp+08], 00000002
:0042EE9B 6800030000              push 00000300
:0042EEA0 8B45FC                  mov eax, dword ptr [ebp-04]
:0042EEA3 83C045                  add eax, 00000045
:0042EEA6 50                      push eax
:0042EEA7 8B4508                  mov eax, dword ptr [ebp+08]
:0042EEAA 50                      push eax
:0042EEAB E89D850100              call 0044744D
:0042EEB0 83C40C                  add esp, 0000000C
:0042EEB3 81450800030000          add dword ptr [ebp+08], 00000300
:0042EEBA 6A36                    push 00000036
:0042EEBC 8B45FC                  mov eax, dword ptr [ebp-04]
:0042EEBF 0549030000              add eax, 00000349
:0042EEC4 50                      push eax
:0042EEC5 8B4508                  mov eax, dword ptr [ebp+08]
:0042EEC8 50                      push eax
:0042EEC9 E87F850100              call 0044744D
:0042EECE 83C40C                  add esp, 0000000C
:0042EED1 83450836                add dword ptr [ebp+08], 00000036
:0042EED5 680B040000              push 0000040B
:0042EEDA 8B45FC                  mov eax, dword ptr [ebp-04]
:0042EEDD 0581030000              add eax, 00000381
:0042EEE2 50                      push eax
:0042EEE3 8B4508                  mov eax, dword ptr [ebp+08]
:0042EEE6 50                      push eax
:0042EEE7 E861850100              call 0044744D
:0042EEEC 83C40C                  add esp, 0000000C
:0042EEEF 8145080B040000          add dword ptr [ebp+08], 0000040B
:0042EEF6 6A20                    push 00000020
:0042EEF8 8B45FC                  mov eax, dword ptr [ebp-04]
:0042EEFB 83C025                  add eax, 00000025
:0042EEFE 50                      push eax
:0042EEFF 8B4508                  mov eax, dword ptr [ebp+08]
:0042EF02 50                      push eax
:0042EF03 E845850100              call 0044744D
:0042EF08 83C40C                  add esp, 0000000C
:0042EF0B 83450820                add dword ptr [ebp+08], 00000020
:0042EF0F 6A21                    push 00000021
:0042EF11 8B45FC                  mov eax, dword ptr [ebp-04]
:0042EF14 0519090000              add eax, 00000919
:0042EF19 50                      push eax
:0042EF1A 8B4508                  mov eax, dword ptr [ebp+08]
:0042EF1D 50                      push eax
:0042EF1E E82A850100              call 0044744D
:0042EF23 83C40C                  add esp, 0000000C
:0042EF26 83450821                add dword ptr [ebp+08], 00000021
:0042EF2A 6881010000              push 00000181
:0042EF2F 8B45FC                  mov eax, dword ptr [ebp-04]
:0042EF32 0598070000              add eax, 00000798
:0042EF37 50                      push eax
:0042EF38 8B4508                  mov eax, dword ptr [ebp+08]
:0042EF3B 50                      push eax
:0042EF3C E80C850100              call 0044744D
:0042EF41 83C40C                  add esp, 0000000C
:0042EF44 81450881010000          add dword ptr [ebp+08], 00000181
:0042EF4B 6A01                    push 00000001
:0042EF4D 8B45FC                  mov eax, dword ptr [ebp-04]
:0042EF50 0596070000              add eax, 00000796
:0042EF55 50                      push eax
:0042EF56 8B4508                  mov eax, dword ptr [ebp+08]
:0042EF59 50                      push eax
:0042EF5A E8EE840100              call 0044744D
:0042EF5F 83C40C                  add esp, 0000000C
:0042EF62 FF4508                  inc [ebp+08]
:0042EF65 6A01                    push 00000001
:0042EF67 8B45FC                  mov eax, dword ptr [ebp-04]
:0042EF6A 0597070000              add eax, 00000797
:0042EF6F 50                      push eax
:0042EF70 8B4508                  mov eax, dword ptr [ebp+08]
:0042EF73 50                      push eax
:0042EF74 E8D4840100              call 0044744D
:0042EF79 83C40C                  add esp, 0000000C
:0042EF7C FF4508                  inc [ebp+08]
:0042EF7F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042EF82 E8E1F1FFFF              call 0042E168
:0042EF87 8B4508                  mov eax, dword ptr [ebp+08]
:0042EF8A E900000000              jmp 0042EF8F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042EF8A(U)
|
:0042EF8F 5F                      pop edi
:0042EF90 5E                      pop esi
:0042EF91 5B                      pop ebx
:0042EF92 C9                      leave
:0042EF93 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0042F0B9   , :0042F189   , :0042F25F   , :0042F339   , :0042F413   
|:0042F4F1   , :0042F5C1   , :0042F691   , :0042F767   , :0042F845   
|:0042F91B   
|
:0042EF96 55                      push ebp
:0042EF97 8BEC                    mov ebp, esp
:0042EF99 83EC08                  sub esp, 00000008
:0042EF9C 53                      push ebx
:0042EF9D 56                      push esi
:0042EF9E 57                      push edi
:0042EF9F 894DF8                  mov dword ptr [ebp-08], ecx
:0042EFA2 8B45F8                  mov eax, dword ptr [ebp-08]
:0042EFA5 8B400C                  mov eax, dword ptr [eax+0C]
:0042EFA8 50                      push eax
:0042EFA9 8B45F8                  mov eax, dword ptr [ebp-08]
:0042EFAC 8B4008                  mov eax, dword ptr [eax+08]
:0042EFAF 50                      push eax
:0042EFB0 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042EFB3 83C114                  add ecx, 00000014
:0042EFB6 E820F1FFFF              call 0042E0DB
:0042EFBB 83E07F                  and eax, 0000007F
:0042EFBE 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042EFC1 33D2                    xor edx, edx
:0042EFC3 668B9149030000          mov dx, word ptr [ecx+00000349]
:0042EFCA 3BC2                    cmp eax, edx
:0042EFCC 0F8E9B000000            jle 0042F06D
:0042EFD2 8B45F8                  mov eax, dword ptr [ebp-08]
:0042EFD5 668B8049030000          mov ax, word ptr [eax+00000349]
:0042EFDC 668945FC                mov word ptr [ebp-04], ax
:0042EFE0 8B45F8                  mov eax, dword ptr [ebp-08]
:0042EFE3 66FF8049030000          inc word ptr [eax+00000349]
:0042EFEA 8B45F8                  mov eax, dword ptr [ebp-08]
:0042EFED 8B400C                  mov eax, dword ptr [eax+0C]
:0042EFF0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042EFF3 81E1FFFF0000            and ecx, 0000FFFF
:0042EFF9 03C1                    add eax, ecx
:0042EFFB 50                      push eax
:0042EFFC 8B45F8                  mov eax, dword ptr [ebp-08]
:0042EFFF 8B4008                  mov eax, dword ptr [eax+08]
:0042F002 50                      push eax
:0042F003 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042F006 83C114                  add ecx, 00000014
:0042F009 E8A23B0000              call 00432BB0
:0042F00E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042F011 81C14B030000            add ecx, 0000034B
:0042F017 8B10                    mov edx, dword ptr [eax]
:0042F019 8911                    mov dword ptr [ecx], edx
:0042F01B 8B5004                  mov edx, dword ptr [eax+04]
:0042F01E 895104                  mov dword ptr [ecx+04], edx
:0042F021 668B4008                mov ax, word ptr [eax+08]
:0042F025 66894108                mov word ptr [ecx+08], ax
:0042F029 8B45F8                  mov eax, dword ptr [ebp-08]
:0042F02C 8B4008                  mov eax, dword ptr [eax+08]
:0042F02F 50                      push eax
:0042F030 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042F033 83C114                  add ecx, 00000014
:0042F036 E8653C0000              call 00432CA0
:0042F03B 0FB7C0                  movzx eax, ax
:0042F03E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042F041 33D2                    xor edx, edx
:0042F043 668B9153030000          mov dx, word ptr [ecx+00000353]
:0042F04A 03C2                    add eax, edx
:0042F04C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042F04F 66898155030000          mov word ptr [ecx+00000355], ax
:0042F056 8B45F8                  mov eax, dword ptr [ebp-08]
:0042F059 C7805703000000000000    mov dword ptr [ebx+00000357], 00000000
:0042F063 B801000000              mov eax, 00000001
:0042F068 E907000000              jmp 0042F074

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042EFCC(C)
|
:0042F06D 33C0                    xor eax, eax
:0042F06F E900000000              jmp 0042F074

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042F068(U), :0042F06F(U)
|
:0042F074 5F                      pop edi
:0042F075 5E                      pop esi
:0042F076 5B                      pop ebx
:0042F077 C9                      leave
:0042F078 C3                      ret



* Referenced by a CALL at Addresses:
|:004012B5   , :0040EBD3   , :00415475   , :0042BC17   , :0042BC92   
|:0042BCE0   , :0042C7EE   , :004402B2   , :00441318   , :004436CB   
|:00443A30   
|
:0042F079 55                      push ebp
:0042F07A 8BEC                    mov ebp, esp
:0042F07C 83EC0C                  sub esp, 0000000C
:0042F07F 53                      push ebx
:0042F080 56                      push esi
:0042F081 57                      push edi
:0042F082 894DF4                  mov dword ptr [ebp-0C], ecx
:0042F085 E90A000000              jmp 0042F094
:0042F08A B8FFFF0000              mov eax, 0000FFFF
:0042F08F E9B0000000              jmp 0042F144

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F085(U)
|
:0042F094 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F097 83B85703000000          cmp dword ptr [eax+00000357], 00000000
:0042F09E 0F840A000000            je 0042F0AE
:0042F0A4 B800000100              mov eax, 00010000
:0042F0A9 E996000000              jmp 0042F144

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F09E(C)
|
:0042F0AE 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042F0B1 E82A3D0000              call 00432DE0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F12B(U)
|
:0042F0B6 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042F0B9 E8D8FEFFFF              call 0042EF96
:0042F0BE 85C0                    test eax, eax
:0042F0C0 0F846A000000            je 0042F130
:0042F0C6 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F0C9 33C9                    xor ecx, ecx
:0042F0CB 8A884B030000            mov cl, byte ptr [eax+0000034B]
:0042F0D1 81E180000000            and ecx, 00000080
:0042F0D7 894DFC                  mov dword ptr [ebp-04], ecx
:0042F0DA 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042F0DD E8FE3B0000              call 00432CE0
:0042F0E2 8945F8                  mov dword ptr [ebp-08], eax
:0042F0E5 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F0E8 33C9                    xor ecx, ecx
:0042F0EA 8A884B030000            mov cl, byte ptr [eax+0000034B]
:0042F0F0 83F901                  cmp ecx, 00000001
:0042F0F3 0F8428000000            je 0042F121
:0042F0F9 837DFC00                cmp dword ptr [ebp-04], 00000000
:0042F0FD 0F850A000000            jne 0042F10D
:0042F103 837DF800                cmp dword ptr [ebp-08], 00000000
:0042F107 0F8514000000            jne 0042F121

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F0FD(C)
|
:0042F10D 837DFC00                cmp dword ptr [ebp-04], 00000000
:0042F111 0F8414000000            je 0042F12B
:0042F117 837DF800                cmp dword ptr [ebp-08], 00000000
:0042F11B 0F850A000000            jne 0042F12B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042F0F3(C), :0042F107(C)
|
:0042F121 B800000100              mov eax, 00010000
:0042F126 E919000000              jmp 0042F144

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042F111(C), :0042F11B(C)
|
:0042F12B E986FFFFFF              jmp 0042F0B6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F0C0(C)
|
:0042F130 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F133 C6804B030000FF          mov byte ptr [eax+0000034B], FF
:0042F13A B8FFFF0000              mov eax, 0000FFFF
:0042F13F E900000000              jmp 0042F144

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042F08F(U), :0042F0A9(U), :0042F126(U), :0042F13F(U)
|
:0042F144 5F                      pop edi
:0042F145 5E                      pop esi
:0042F146 5B                      pop ebx
:0042F147 C9                      leave
:0042F148 C3                      ret



* Referenced by a CALL at Addresses:
|:004012CB   , :0040EBE9   , :00415491   
|
:0042F149 55                      push ebp
:0042F14A 8BEC                    mov ebp, esp
:0042F14C 83EC0C                  sub esp, 0000000C
:0042F14F 53                      push ebx
:0042F150 56                      push esi
:0042F151 57                      push edi
:0042F152 894DF4                  mov dword ptr [ebp-0C], ecx
:0042F155 E90A000000              jmp 0042F164
:0042F15A B8FFFF0000              mov eax, 0000FFFF
:0042F15F E9B4000000              jmp 0042F218

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F155(U)
|
:0042F164 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F167 83B85703000000          cmp dword ptr [eax+00000357], 00000000
:0042F16E 0F840A000000            je 0042F17E
:0042F174 B800000100              mov eax, 00010000
:0042F179 E99A000000              jmp 0042F218

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F16E(C)
|
:0042F17E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042F181 E85A3C0000              call 00432DE0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F1FF(U)
|
:0042F186 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042F189 E808FEFFFF              call 0042EF96
:0042F18E 85C0                    test eax, eax
:0042F190 0F846E000000            je 0042F204
:0042F196 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F199 33C9                    xor ecx, ecx
:0042F19B 8A884B030000            mov cl, byte ptr [eax+0000034B]
:0042F1A1 81E180000000            and ecx, 00000080
:0042F1A7 894DFC                  mov dword ptr [ebp-04], ecx
:0042F1AA 8B4508                  mov eax, dword ptr [ebp+08]
:0042F1AD 50                      push eax
:0042F1AE 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042F1B1 E85A3C0000              call 00432E10
:0042F1B6 8945F8                  mov dword ptr [ebp-08], eax
:0042F1B9 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F1BC 33C9                    xor ecx, ecx
:0042F1BE 8A884B030000            mov cl, byte ptr [eax+0000034B]
:0042F1C4 83F901                  cmp ecx, 00000001
:0042F1C7 0F8428000000            je 0042F1F5
:0042F1CD 837DFC00                cmp dword ptr [ebp-04], 00000000
:0042F1D1 0F850A000000            jne 0042F1E1
:0042F1D7 837DF800                cmp dword ptr [ebp-08], 00000000
:0042F1DB 0F8514000000            jne 0042F1F5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F1D1(C)
|
:0042F1E1 837DFC00                cmp dword ptr [ebp-04], 00000000
:0042F1E5 0F8414000000            je 0042F1FF
:0042F1EB 837DF800                cmp dword ptr [ebp-08], 00000000
:0042F1EF 0F850A000000            jne 0042F1FF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042F1C7(C), :0042F1DB(C)
|
:0042F1F5 B800000100              mov eax, 00010000
:0042F1FA E919000000              jmp 0042F218

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042F1E5(C), :0042F1EF(C)
|
:0042F1FF E982FFFFFF              jmp 0042F186

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F190(C)
|
:0042F204 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F207 C6804B030000FF          mov byte ptr [eax+0000034B], FF
:0042F20E B8FFFF0000              mov eax, 0000FFFF
:0042F213 E900000000              jmp 0042F218

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042F15F(U), :0042F179(U), :0042F1FA(U), :0042F213(U)
|
:0042F218 5F                      pop edi
:0042F219 5E                      pop esi
:0042F21A 5B                      pop ebx
:0042F21B C9                      leave
:0042F21C C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0042C720   , :0042C76A   
|
:0042F21F 55                      push ebp
:0042F220 8BEC                    mov ebp, esp
:0042F222 83EC0C                  sub esp, 0000000C
:0042F225 53                      push ebx
:0042F226 56                      push esi
:0042F227 57                      push edi
:0042F228 894DF4                  mov dword ptr [ebp-0C], ecx
:0042F22B E90A000000              jmp 0042F23A
:0042F230 B8FFFF0000              mov eax, 0000FFFF
:0042F235 E9B8000000              jmp 0042F2F2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F22B(U)
|
:0042F23A 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F23D 83B85703000000          cmp dword ptr [eax+00000357], 00000000
:0042F244 0F840A000000            je 0042F254
:0042F24A B800000100              mov eax, 00010000
:0042F24F E99E000000              jmp 0042F2F2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F244(C)
|
:0042F254 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042F257 E8843B0000              call 00432DE0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F2D9(U)
|
:0042F25C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042F25F E832FDFFFF              call 0042EF96
:0042F264 85C0                    test eax, eax
:0042F266 0F8472000000            je 0042F2DE
:0042F26C 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F26F 33C9                    xor ecx, ecx
:0042F271 8A884B030000            mov cl, byte ptr [eax+0000034B]
:0042F277 81E180000000            and ecx, 00000080
:0042F27D 894DFC                  mov dword ptr [ebp-04], ecx
:0042F280 8B450C                  mov eax, dword ptr [ebp+0C]
:0042F283 50                      push eax
:0042F284 8B4508                  mov eax, dword ptr [ebp+08]
:0042F287 50                      push eax
:0042F288 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042F28B E8E03B0000              call 00432E70
:0042F290 8945F8                  mov dword ptr [ebp-08], eax
:0042F293 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F296 33C9                    xor ecx, ecx
:0042F298 8A884B030000            mov cl, byte ptr [eax+0000034B]
:0042F29E 83F901                  cmp ecx, 00000001
:0042F2A1 0F8428000000            je 0042F2CF
:0042F2A7 837DFC00                cmp dword ptr [ebp-04], 00000000
:0042F2AB 0F850A000000            jne 0042F2BB
:0042F2B1 837DF800                cmp dword ptr [ebp-08], 00000000
:0042F2B5 0F8514000000            jne 0042F2CF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F2AB(C)
|
:0042F2BB 837DFC00                cmp dword ptr [ebp-04], 00000000
:0042F2BF 0F8414000000            je 0042F2D9
:0042F2C5 837DF800                cmp dword ptr [ebp-08], 00000000
:0042F2C9 0F850A000000            jne 0042F2D9

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042F2A1(C), :0042F2B5(C)
|
:0042F2CF B800000100              mov eax, 00010000
:0042F2D4 E919000000              jmp 0042F2F2

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042F2BF(C), :0042F2C9(C)
|
:0042F2D9 E97EFFFFFF              jmp 0042F25C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F266(C)
|
:0042F2DE 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F2E1 C6804B030000FF          mov byte ptr [eax+0000034B], FF
:0042F2E8 B8FFFF0000              mov eax, 0000FFFF
:0042F2ED E900000000              jmp 0042F2F2

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042F235(U), :0042F24F(U), :0042F2D4(U), :0042F2ED(U)
|
:0042F2F2 5F                      pop edi
:0042F2F3 5E                      pop esi
:0042F2F4 5B                      pop ebx
:0042F2F5 C9                      leave
:0042F2F6 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:004012F0   , :0040EC0E   , :004154BC   
|
:0042F2F9 55                      push ebp
:0042F2FA 8BEC                    mov ebp, esp
:0042F2FC 83EC0C                  sub esp, 0000000C
:0042F2FF 53                      push ebx
:0042F300 56                      push esi
:0042F301 57                      push edi
:0042F302 894DF4                  mov dword ptr [ebp-0C], ecx
:0042F305 E90A000000              jmp 0042F314
:0042F30A B8FFFF0000              mov eax, 0000FFFF
:0042F30F E9B8000000              jmp 0042F3CC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F305(U)
|
:0042F314 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F317 83B85703000000          cmp dword ptr [eax+00000357], 00000000
:0042F31E 0F840A000000            je 0042F32E
:0042F324 B800000100              mov eax, 00010000
:0042F329 E99E000000              jmp 0042F3CC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F31E(C)
|
:0042F32E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042F331 E8AA3A0000              call 00432DE0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F3B3(U)
|
:0042F336 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042F339 E858FCFFFF              call 0042EF96
:0042F33E 85C0                    test eax, eax
:0042F340 0F8472000000            je 0042F3B8
:0042F346 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F349 33C9                    xor ecx, ecx
:0042F34B 8A884B030000            mov cl, byte ptr [eax+0000034B]
:0042F351 81E180000000            and ecx, 00000080
:0042F357 894DFC                  mov dword ptr [ebp-04], ecx
:0042F35A 8B4508                  mov eax, dword ptr [ebp+08]
:0042F35D 50                      push eax
:0042F35E 8B450C                  mov eax, dword ptr [ebp+0C]
:0042F361 50                      push eax
:0042F362 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042F365 E8863B0000              call 00432EF0
:0042F36A 8945F8                  mov dword ptr [ebp-08], eax
:0042F36D 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F370 33C9                    xor ecx, ecx
:0042F372 8A884B030000            mov cl, byte ptr [eax+0000034B]
:0042F378 83F901                  cmp ecx, 00000001
:0042F37B 0F8428000000            je 0042F3A9
:0042F381 837DFC00                cmp dword ptr [ebp-04], 00000000
:0042F385 0F850A000000            jne 0042F395
:0042F38B 837DF800                cmp dword ptr [ebp-08], 00000000
:0042F38F 0F8514000000            jne 0042F3A9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F385(C)
|
:0042F395 837DFC00                cmp dword ptr [ebp-04], 00000000
:0042F399 0F8414000000            je 0042F3B3
:0042F39F 837DF800                cmp dword ptr [ebp-08], 00000000
:0042F3A3 0F850A000000            jne 0042F3B3

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042F37B(C), :0042F38F(C)
|
:0042F3A9 B800000100              mov eax, 00010000
:0042F3AE E919000000              jmp 0042F3CC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042F399(C), :0042F3A3(C)
|
:0042F3B3 E97EFFFFFF              jmp 0042F336

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F340(C)
|
:0042F3B8 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F3BB C6804B030000FF          mov byte ptr [eax+0000034B], FF
:0042F3C2 B8FFFF0000              mov eax, 0000FFFF
:0042F3C7 E900000000              jmp 0042F3CC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042F30F(U), :0042F329(U), :0042F3AE(U), :0042F3C7(U)
|
:0042F3CC 5F                      pop edi
:0042F3CD 5E                      pop esi
:0042F3CE 5B                      pop ebx
:0042F3CF C9                      leave
:0042F3D0 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0042C60A   , :0042C64B   
|
:0042F3D3 55                      push ebp
:0042F3D4 8BEC                    mov ebp, esp
:0042F3D6 83EC0C                  sub esp, 0000000C
:0042F3D9 53                      push ebx
:0042F3DA 56                      push esi
:0042F3DB 57                      push edi
:0042F3DC 894DF4                  mov dword ptr [ebp-0C], ecx
:0042F3DF E90A000000              jmp 0042F3EE
:0042F3E4 B8FFFF0000              mov eax, 0000FFFF
:0042F3E9 E9BC000000              jmp 0042F4AA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F3DF(U)
|
:0042F3EE 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F3F1 83B85703000000          cmp dword ptr [eax+00000357], 00000000
:0042F3F8 0F840A000000            je 0042F408
:0042F3FE B800000100              mov eax, 00010000
:0042F403 E9A2000000              jmp 0042F4AA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F3F8(C)
|
:0042F408 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042F40B E8D0390000              call 00432DE0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F491(U)
|
:0042F410 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042F413 E87EFBFFFF              call 0042EF96
:0042F418 85C0                    test eax, eax
:0042F41A 0F8476000000            je 0042F496
:0042F420 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F423 33C9                    xor ecx, ecx
:0042F425 8A884B030000            mov cl, byte ptr [eax+0000034B]
:0042F42B 81E180000000            and ecx, 00000080
:0042F431 894DFC                  mov dword ptr [ebp-04], ecx
:0042F434 8B4510                  mov eax, dword ptr [ebp+10]
:0042F437 50                      push eax
:0042F438 8B450C                  mov eax, dword ptr [ebp+0C]
:0042F43B 50                      push eax
:0042F43C 8B4508                  mov eax, dword ptr [ebp+08]
:0042F43F 50                      push eax
:0042F440 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042F443 E8883B0000              call 00432FD0
:0042F448 8945F8                  mov dword ptr [ebp-08], eax
:0042F44B 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F44E 33C9                    xor ecx, ecx
:0042F450 8A884B030000            mov cl, byte ptr [eax+0000034B]
:0042F456 83F901                  cmp ecx, 00000001
:0042F459 0F8428000000            je 0042F487
:0042F45F 837DFC00                cmp dword ptr [ebp-04], 00000000
:0042F463 0F850A000000            jne 0042F473
:0042F469 837DF800                cmp dword ptr [ebp-08], 00000000
:0042F46D 0F8514000000            jne 0042F487

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F463(C)
|
:0042F473 837DFC00                cmp dword ptr [ebp-04], 00000000
:0042F477 0F8414000000            je 0042F491
:0042F47D 837DF800                cmp dword ptr [ebp-08], 00000000
:0042F481 0F850A000000            jne 0042F491

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042F459(C), :0042F46D(C)
|
:0042F487 B800000100              mov eax, 00010000
:0042F48C E919000000              jmp 0042F4AA

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042F477(C), :0042F481(C)
|
:0042F491 E97AFFFFFF              jmp 0042F410

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F41A(C)
|
:0042F496 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F499 C6804B030000FF          mov byte ptr [eax+0000034B], FF
:0042F4A0 B8FFFF0000              mov eax, 0000FFFF
:0042F4A5 E900000000              jmp 0042F4AA

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042F3E9(U), :0042F403(U), :0042F48C(U), :0042F4A5(U)
|
:0042F4AA 5F                      pop edi
:0042F4AB 5E                      pop esi
:0042F4AC 5B                      pop ebx
:0042F4AD C9                      leave
:0042F4AE C20C00                  ret 000C



* Referenced by a CALL at Addresses:
|:0042BBE0   , :004412E8   , :00443A00   
|
:0042F4B1 55                      push ebp
:0042F4B2 8BEC                    mov ebp, esp
:0042F4B4 83EC0C                  sub esp, 0000000C
:0042F4B7 53                      push ebx
:0042F4B8 56                      push esi
:0042F4B9 57                      push edi
:0042F4BA 894DF4                  mov dword ptr [ebp-0C], ecx
:0042F4BD E90A000000              jmp 0042F4CC
:0042F4C2 B8FFFF0000              mov eax, 0000FFFF
:0042F4C7 E9B0000000              jmp 0042F57C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F4BD(U)
|
:0042F4CC 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F4CF 83B85703000000          cmp dword ptr [eax+00000357], 00000000
:0042F4D6 0F840A000000            je 0042F4E6
:0042F4DC B800000100              mov eax, 00010000
:0042F4E1 E996000000              jmp 0042F57C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F4D6(C)
|
:0042F4E6 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042F4E9 E8F2380000              call 00432DE0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F563(U)
|
:0042F4EE 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042F4F1 E8A0FAFFFF              call 0042EF96
:0042F4F6 85C0                    test eax, eax
:0042F4F8 0F846A000000            je 0042F568
:0042F4FE 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F501 33C9                    xor ecx, ecx
:0042F503 8A884B030000            mov cl, byte ptr [eax+0000034B]
:0042F509 81E180000000            and ecx, 00000080
:0042F50F 894DFC                  mov dword ptr [ebp-04], ecx
:0042F512 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042F515 E8463B0000              call 00433060
:0042F51A 8945F8                  mov dword ptr [ebp-08], eax
:0042F51D 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F520 33C9                    xor ecx, ecx
:0042F522 8A884B030000            mov cl, byte ptr [eax+0000034B]
:0042F528 83F901                  cmp ecx, 00000001
:0042F52B 0F8428000000            je 0042F559
:0042F531 837DFC00                cmp dword ptr [ebp-04], 00000000
:0042F535 0F850A000000            jne 0042F545
:0042F53B 837DF800                cmp dword ptr [ebp-08], 00000000
:0042F53F 0F8514000000            jne 0042F559

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F535(C)
|
:0042F545 837DFC00                cmp dword ptr [ebp-04], 00000000
:0042F549 0F8414000000            je 0042F563
:0042F54F 837DF800                cmp dword ptr [ebp-08], 00000000
:0042F553 0F850A000000            jne 0042F563

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042F52B(C), :0042F53F(C)
|
:0042F559 B800000100              mov eax, 00010000
:0042F55E E919000000              jmp 0042F57C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042F549(C), :0042F553(C)
|
:0042F563 E986FFFFFF              jmp 0042F4EE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F4F8(C)
|
:0042F568 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F56B C6804B030000FF          mov byte ptr [eax+0000034B], FF
:0042F572 B8FFFF0000              mov eax, 0000FFFF
:0042F577 E900000000              jmp 0042F57C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042F4C7(U), :0042F4E1(U), :0042F55E(U), :0042F577(U)
|
:0042F57C 5F                      pop edi
:0042F57D 5E                      pop esi
:0042F57E 5B                      pop ebx
:0042F57F C9                      leave
:0042F580 C3                      ret



* Referenced by a CALL at Address:
|:0042BC5B   
|
:0042F581 55                      push ebp
:0042F582 8BEC                    mov ebp, esp
:0042F584 83EC0C                  sub esp, 0000000C
:0042F587 53                      push ebx
:0042F588 56                      push esi
:0042F589 57                      push edi
:0042F58A 894DF4                  mov dword ptr [ebp-0C], ecx
:0042F58D E90A000000              jmp 0042F59C
:0042F592 B8FFFF0000              mov eax, 0000FFFF
:0042F597 E9B0000000              jmp 0042F64C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F58D(U)
|
:0042F59C 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F59F 83B85703000000          cmp dword ptr [eax+00000357], 00000000
:0042F5A6 0F840A000000            je 0042F5B6
:0042F5AC B800000100              mov eax, 00010000
:0042F5B1 E996000000              jmp 0042F64C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F5A6(C)
|
:0042F5B6 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042F5B9 E822380000              call 00432DE0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F633(U)
|
:0042F5BE 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042F5C1 E8D0F9FFFF              call 0042EF96
:0042F5C6 85C0                    test eax, eax
:0042F5C8 0F846A000000            je 0042F638
:0042F5CE 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F5D1 33C9                    xor ecx, ecx
:0042F5D3 8A884B030000            mov cl, byte ptr [eax+0000034B]
:0042F5D9 81E180000000            and ecx, 00000080
:0042F5DF 894DFC                  mov dword ptr [ebp-04], ecx
:0042F5E2 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042F5E5 E8B63A0000              call 004330A0
:0042F5EA 8945F8                  mov dword ptr [ebp-08], eax
:0042F5ED 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F5F0 33C9                    xor ecx, ecx
:0042F5F2 8A884B030000            mov cl, byte ptr [eax+0000034B]
:0042F5F8 83F901                  cmp ecx, 00000001
:0042F5FB 0F8428000000            je 0042F629
:0042F601 837DFC00                cmp dword ptr [ebp-04], 00000000
:0042F605 0F850A000000            jne 0042F615
:0042F60B 837DF800                cmp dword ptr [ebp-08], 00000000
:0042F60F 0F8514000000            jne 0042F629

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F605(C)
|
:0042F615 837DFC00                cmp dword ptr [ebp-04], 00000000
:0042F619 0F8414000000            je 0042F633
:0042F61F 837DF800                cmp dword ptr [ebp-08], 00000000
:0042F623 0F850A000000            jne 0042F633

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042F5FB(C), :0042F60F(C)
|
:0042F629 B800000100              mov eax, 00010000
:0042F62E E919000000              jmp 0042F64C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042F619(C), :0042F623(C)
|
:0042F633 E986FFFFFF              jmp 0042F5BE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F5C8(C)
|
:0042F638 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F63B C6804B030000FF          mov byte ptr [eax+0000034B], FF
:0042F642 B8FFFF0000              mov eax, 0000FFFF
:0042F647 E900000000              jmp 0042F64C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042F597(U), :0042F5B1(U), :0042F62E(U), :0042F647(U)
|
:0042F64C 5F                      pop edi
:0042F64D 5E                      pop esi
:0042F64E 5B                      pop ebx
:0042F64F C9                      leave
:0042F650 C3                      ret



* Referenced by a CALL at Address:
|:0044369B   
|
:0042F651 55                      push ebp
:0042F652 8BEC                    mov ebp, esp
:0042F654 83EC0C                  sub esp, 0000000C
:0042F657 53                      push ebx
:0042F658 56                      push esi
:0042F659 57                      push edi
:0042F65A 894DF4                  mov dword ptr [ebp-0C], ecx
:0042F65D E90A000000              jmp 0042F66C
:0042F662 B8FFFF0000              mov eax, 0000FFFF
:0042F667 E9B4000000              jmp 0042F720

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F65D(U)
|
:0042F66C 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F66F 83B85703000000          cmp dword ptr [eax+00000357], 00000000
:0042F676 0F840A000000            je 0042F686
:0042F67C B800000100              mov eax, 00010000
:0042F681 E99A000000              jmp 0042F720

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F676(C)
|
:0042F686 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042F689 E852370000              call 00432DE0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F707(U)
|
:0042F68E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042F691 E800F9FFFF              call 0042EF96
:0042F696 85C0                    test eax, eax
:0042F698 0F846E000000            je 0042F70C
:0042F69E 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F6A1 33C9                    xor ecx, ecx
:0042F6A3 8A884B030000            mov cl, byte ptr [eax+0000034B]
:0042F6A9 81E180000000            and ecx, 00000080
:0042F6AF 894DFC                  mov dword ptr [ebp-04], ecx
:0042F6B2 8B4508                  mov eax, dword ptr [ebp+08]
:0042F6B5 50                      push eax
:0042F6B6 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042F6B9 E8223A0000              call 004330E0
:0042F6BE 8945F8                  mov dword ptr [ebp-08], eax
:0042F6C1 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F6C4 33C9                    xor ecx, ecx
:0042F6C6 8A884B030000            mov cl, byte ptr [eax+0000034B]
:0042F6CC 83F901                  cmp ecx, 00000001
:0042F6CF 0F8428000000            je 0042F6FD
:0042F6D5 837DFC00                cmp dword ptr [ebp-04], 00000000
:0042F6D9 0F850A000000            jne 0042F6E9
:0042F6DF 837DF800                cmp dword ptr [ebp-08], 00000000
:0042F6E3 0F8514000000            jne 0042F6FD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F6D9(C)
|
:0042F6E9 837DFC00                cmp dword ptr [ebp-04], 00000000
:0042F6ED 0F8414000000            je 0042F707
:0042F6F3 837DF800                cmp dword ptr [ebp-08], 00000000
:0042F6F7 0F850A000000            jne 0042F707

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042F6CF(C), :0042F6E3(C)
|
:0042F6FD B800000100              mov eax, 00010000
:0042F702 E919000000              jmp 0042F720

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042F6ED(C), :0042F6F7(C)
|
:0042F707 E982FFFFFF              jmp 0042F68E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F698(C)
|
:0042F70C 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F70F C6804B030000FF          mov byte ptr [eax+0000034B], FF
:0042F716 B8FFFF0000              mov eax, 0000FFFF
:0042F71B E900000000              jmp 0042F720

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042F667(U), :0042F681(U), :0042F702(U), :0042F71B(U)
|
:0042F720 5F                      pop edi
:0042F721 5E                      pop esi
:0042F722 5B                      pop ebx
:0042F723 C9                      leave
:0042F724 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0042C673   , :0042C6B4   
|
:0042F727 55                      push ebp
:0042F728 8BEC                    mov ebp, esp
:0042F72A 83EC0C                  sub esp, 0000000C
:0042F72D 53                      push ebx
:0042F72E 56                      push esi
:0042F72F 57                      push edi
:0042F730 894DF4                  mov dword ptr [ebp-0C], ecx
:0042F733 E90A000000              jmp 0042F742
:0042F738 B8FFFF0000              mov eax, 0000FFFF
:0042F73D E9BC000000              jmp 0042F7FE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F733(U)
|
:0042F742 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F745 83B85703000000          cmp dword ptr [eax+00000357], 00000000
:0042F74C 0F840A000000            je 0042F75C
:0042F752 B800000100              mov eax, 00010000
:0042F757 E9A2000000              jmp 0042F7FE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F74C(C)
|
:0042F75C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042F75F E87C360000              call 00432DE0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F7E5(U)
|
:0042F764 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042F767 E82AF8FFFF              call 0042EF96
:0042F76C 85C0                    test eax, eax
:0042F76E 0F8476000000            je 0042F7EA
:0042F774 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F777 33C9                    xor ecx, ecx
:0042F779 8A884B030000            mov cl, byte ptr [eax+0000034B]
:0042F77F 81E180000000            and ecx, 00000080
:0042F785 894DFC                  mov dword ptr [ebp-04], ecx
:0042F788 8B4510                  mov eax, dword ptr [ebp+10]
:0042F78B 50                      push eax
:0042F78C 8B450C                  mov eax, dword ptr [ebp+0C]
:0042F78F 50                      push eax
:0042F790 8B4508                  mov eax, dword ptr [ebp+08]
:0042F793 50                      push eax
:0042F794 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042F797 E8A4390000              call 00433140
:0042F79C 8945F8                  mov dword ptr [ebp-08], eax
:0042F79F 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F7A2 33C9                    xor ecx, ecx
:0042F7A4 8A884B030000            mov cl, byte ptr [eax+0000034B]
:0042F7AA 83F901                  cmp ecx, 00000001
:0042F7AD 0F8428000000            je 0042F7DB
:0042F7B3 837DFC00                cmp dword ptr [ebp-04], 00000000
:0042F7B7 0F850A000000            jne 0042F7C7
:0042F7BD 837DF800                cmp dword ptr [ebp-08], 00000000
:0042F7C1 0F8514000000            jne 0042F7DB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F7B7(C)
|
:0042F7C7 837DFC00                cmp dword ptr [ebp-04], 00000000
:0042F7CB 0F8414000000            je 0042F7E5
:0042F7D1 837DF800                cmp dword ptr [ebp-08], 00000000
:0042F7D5 0F850A000000            jne 0042F7E5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042F7AD(C), :0042F7C1(C)
|
:0042F7DB B800000100              mov eax, 00010000
:0042F7E0 E919000000              jmp 0042F7FE

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042F7CB(C), :0042F7D5(C)
|
:0042F7E5 E97AFFFFFF              jmp 0042F764

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F76E(C)
|
:0042F7EA 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F7ED C6804B030000FF          mov byte ptr [eax+0000034B], FF
:0042F7F4 B8FFFF0000              mov eax, 0000FFFF
:0042F7F9 E900000000              jmp 0042F7FE

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042F73D(U), :0042F757(U), :0042F7E0(U), :0042F7F9(U)
|
:0042F7FE 5F                      pop edi
:0042F7FF 5E                      pop esi
:0042F800 5B                      pop ebx
:0042F801 C9                      leave
:0042F802 C20C00                  ret 000C



* Referenced by a CALL at Addresses:
|:0042BD47   , :0042BD93   
|
:0042F805 55                      push ebp
:0042F806 8BEC                    mov ebp, esp
:0042F808 83EC0C                  sub esp, 0000000C
:0042F80B 53                      push ebx
:0042F80C 56                      push esi
:0042F80D 57                      push edi
:0042F80E 894DF4                  mov dword ptr [ebp-0C], ecx
:0042F811 E90A000000              jmp 0042F820
:0042F816 B8FFFF0000              mov eax, 0000FFFF
:0042F81B E9B4000000              jmp 0042F8D4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F811(U)
|
:0042F820 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F823 83B85703000000          cmp dword ptr [eax+00000357], 00000000
:0042F82A 0F840A000000            je 0042F83A
:0042F830 B800000100              mov eax, 00010000
:0042F835 E99A000000              jmp 0042F8D4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F82A(C)
|
:0042F83A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042F83D E89E350000              call 00432DE0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F8BB(U)
|
:0042F842 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042F845 E84CF7FFFF              call 0042EF96
:0042F84A 85C0                    test eax, eax
:0042F84C 0F846E000000            je 0042F8C0
:0042F852 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F855 33C9                    xor ecx, ecx
:0042F857 8A884B030000            mov cl, byte ptr [eax+0000034B]
:0042F85D 81E180000000            and ecx, 00000080
:0042F863 894DFC                  mov dword ptr [ebp-04], ecx
:0042F866 8B4508                  mov eax, dword ptr [ebp+08]
:0042F869 50                      push eax
:0042F86A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042F86D E8BE390000              call 00433230
:0042F872 8945F8                  mov dword ptr [ebp-08], eax
:0042F875 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F878 33C9                    xor ecx, ecx
:0042F87A 8A884B030000            mov cl, byte ptr [eax+0000034B]
:0042F880 83F901                  cmp ecx, 00000001
:0042F883 0F8428000000            je 0042F8B1
:0042F889 837DFC00                cmp dword ptr [ebp-04], 00000000
:0042F88D 0F850A000000            jne 0042F89D
:0042F893 837DF800                cmp dword ptr [ebp-08], 00000000
:0042F897 0F8514000000            jne 0042F8B1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F88D(C)
|
:0042F89D 837DFC00                cmp dword ptr [ebp-04], 00000000
:0042F8A1 0F8414000000            je 0042F8BB
:0042F8A7 837DF800                cmp dword ptr [ebp-08], 00000000
:0042F8AB 0F850A000000            jne 0042F8BB

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042F883(C), :0042F897(C)
|
:0042F8B1 B800000100              mov eax, 00010000
:0042F8B6 E919000000              jmp 0042F8D4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042F8A1(C), :0042F8AB(C)
|
:0042F8BB E982FFFFFF              jmp 0042F842

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F84C(C)
|
:0042F8C0 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F8C3 C6804B030000FF          mov byte ptr [eax+0000034B], FF
:0042F8CA B8FFFF0000              mov eax, 0000FFFF
:0042F8CF E900000000              jmp 0042F8D4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042F81B(U), :0042F835(U), :0042F8B6(U), :0042F8CF(U)
|
:0042F8D4 5F                      pop edi
:0042F8D5 5E                      pop esi
:0042F8D6 5B                      pop ebx
:0042F8D7 C9                      leave
:0042F8D8 C20400                  ret 0004



* Referenced by a CALL at Address:
|:00402CC0   
|
:0042F8DB 55                      push ebp
:0042F8DC 8BEC                    mov ebp, esp
:0042F8DE 83EC0C                  sub esp, 0000000C
:0042F8E1 53                      push ebx
:0042F8E2 56                      push esi
:0042F8E3 57                      push edi
:0042F8E4 894DF4                  mov dword ptr [ebp-0C], ecx
:0042F8E7 E90A000000              jmp 0042F8F6
:0042F8EC B8FFFF0000              mov eax, 0000FFFF
:0042F8F1 E9B0000000              jmp 0042F9A6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F8E7(U)
|
:0042F8F6 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F8F9 83B85703000000          cmp dword ptr [eax+00000357], 00000000
:0042F900 0F840A000000            je 0042F910
:0042F906 B800000100              mov eax, 00010000
:0042F90B E996000000              jmp 0042F9A6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F900(C)
|
:0042F910 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042F913 E8C8340000              call 00432DE0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F98D(U)
|
:0042F918 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042F91B E876F6FFFF              call 0042EF96
:0042F920 85C0                    test eax, eax
:0042F922 0F846A000000            je 0042F992
:0042F928 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F92B 33C9                    xor ecx, ecx
:0042F92D 8A884B030000            mov cl, byte ptr [eax+0000034B]
:0042F933 81E180000000            and ecx, 00000080
:0042F939 894DFC                  mov dword ptr [ebp-04], ecx
:0042F93C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042F93F E89C330000              call 00432CE0
:0042F944 8945F8                  mov dword ptr [ebp-08], eax
:0042F947 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F94A 33C9                    xor ecx, ecx
:0042F94C 8A884B030000            mov cl, byte ptr [eax+0000034B]
:0042F952 83F901                  cmp ecx, 00000001
:0042F955 0F8428000000            je 0042F983
:0042F95B 837DFC00                cmp dword ptr [ebp-04], 00000000
:0042F95F 0F850A000000            jne 0042F96F
:0042F965 837DF800                cmp dword ptr [ebp-08], 00000000
:0042F969 0F8514000000            jne 0042F983

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F95F(C)
|
:0042F96F 837DFC00                cmp dword ptr [ebp-04], 00000000
:0042F973 0F8414000000            je 0042F98D
:0042F979 837DF800                cmp dword ptr [ebp-08], 00000000
:0042F97D 0F850A000000            jne 0042F98D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042F955(C), :0042F969(C)
|
:0042F983 B800000100              mov eax, 00010000
:0042F988 E919000000              jmp 0042F9A6

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042F973(C), :0042F97D(C)
|
:0042F98D E986FFFFFF              jmp 0042F918

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F922(C)
|
:0042F992 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F995 C6804B030000FF          mov byte ptr [eax+0000034B], FF
:0042F99C B8FFFF0000              mov eax, 0000FFFF
:0042F9A1 E900000000              jmp 0042F9A6

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042F8F1(U), :0042F90B(U), :0042F988(U), :0042F9A1(U)
|
:0042F9A6 5F                      pop edi
:0042F9A7 5E                      pop esi
:0042F9A8 5B                      pop ebx
:0042F9A9 C9                      leave
:0042F9AA C20400                  ret 0004



* Referenced by a CALL at Address:
|:0042BBC9   
|
:0042F9AD 55                      push ebp
:0042F9AE 8BEC                    mov ebp, esp
:0042F9B0 83EC04                  sub esp, 00000004
:0042F9B3 53                      push ebx
:0042F9B4 56                      push esi
:0042F9B5 57                      push edi
:0042F9B6 894DFC                  mov dword ptr [ebp-04], ecx
:0042F9B9 8B4508                  mov eax, dword ptr [ebp+08]
:0042F9BC 50                      push eax
:0042F9BD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042F9C0 81C18C070000            add ecx, 0000078C
:0042F9C6 E8C5380000              call 00433290
:0042F9CB 85C0                    test eax, eax
:0042F9CD 0F8407000000            je 0042F9DA
:0042F9D3 33C0                    xor eax, eax
:0042F9D5 E92E000000              jmp 0042FA08

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F9CD(C)
|
:0042F9DA 8B4508                  mov eax, dword ptr [ebp+08]
:0042F9DD 50                      push eax
:0042F9DE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042F9E1 81C190070000            add ecx, 00000790
:0042F9E7 E8A4380000              call 00433290
:0042F9EC 85C0                    test eax, eax
:0042F9EE 0F840A000000            je 0042F9FE
:0042F9F4 B801000000              mov eax, 00000001
:0042F9F9 E90A000000              jmp 0042FA08

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F9EE(C)
|
:0042F9FE B802000000              mov eax, 00000002
:0042FA03 E900000000              jmp 0042FA08

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042F9D5(U), :0042F9F9(U), :0042FA03(U)
|
:0042FA08 5F                      pop edi
:0042FA09 5E                      pop esi
:0042FA0A 5B                      pop ebx
:0042FA0B C9                      leave
:0042FA0C C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:004015A4   , :004255C1   
|
:0042FA0F 55                      push ebp
:0042FA10 8BEC                    mov ebp, esp
:0042FA12 83EC04                  sub esp, 00000004
:0042FA15 53                      push ebx
:0042FA16 56                      push esi
:0042FA17 57                      push edi
:0042FA18 894DFC                  mov dword ptr [ebp-04], ecx
:0042FA1B 8B4508                  mov eax, dword ptr [ebp+08]
:0042FA1E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042FA21 66894110                mov word ptr [ecx+10], ax
:0042FA25 8B450C                  mov eax, dword ptr [ebp+0C]
:0042FA28 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042FA2B 66894112                mov word ptr [ecx+12], ax
:0042FA2F 33C0                    xor eax, eax
:0042FA31 E900000000              jmp 0042FA36

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FA31(U)
|
:0042FA36 5F                      pop edi
:0042FA37 5E                      pop esi
:0042FA38 5B                      pop ebx
:0042FA39 C9                      leave
:0042FA3A C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0040F188   , :004177C5   
|
:0042FA3D 55                      push ebp
:0042FA3E 8BEC                    mov ebp, esp
:0042FA40 83EC08                  sub esp, 00000008
:0042FA43 53                      push ebx
:0042FA44 56                      push esi
:0042FA45 57                      push edi
:0042FA46 894DF8                  mov dword ptr [ebp-08], ecx
:0042FA49 8B4508                  mov eax, dword ptr [ebp+08]
:0042FA4C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042FA4F 66894110                mov word ptr [ecx+10], ax
:0042FA53 8B450C                  mov eax, dword ptr [ebp+0C]
:0042FA56 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042FA59 66894112                mov word ptr [ecx+12], ax
:0042FA5D 8B45F8                  mov eax, dword ptr [ebp-08]
:0042FA60 33C9                    xor ecx, ecx
:0042FA62 668B8845030000          mov cx, word ptr [eax+00000345]
:0042FA69 8B45F8                  mov eax, dword ptr [ebp-08]
:0042FA6C 33D2                    xor edx, edx
:0042FA6E 668B5010                mov dx, word ptr [eax+10]
:0042FA72 3BCA                    cmp ecx, edx
:0042FA74 0F85F3000000            jne 0042FB6D
:0042FA7A 8B45F8                  mov eax, dword ptr [ebp-08]
:0042FA7D 33C9                    xor ecx, ecx
:0042FA7F 668B8847030000          mov cx, word ptr [eax+00000347]
:0042FA86 8B45F8                  mov eax, dword ptr [ebp-08]
:0042FA89 33D2                    xor edx, edx
:0042FA8B 668B5012                mov dx, word ptr [eax+12]
:0042FA8F 3BCA                    cmp ecx, edx
:0042FA91 0F85D6000000            jne 0042FB6D
:0042FA97 8B45F8                  mov eax, dword ptr [ebp-08]
:0042FA9A 83B85F03000000          cmp dword ptr [eax+0000035F], 00000000
:0042FAA1 0F84C1000000            je 0042FB68
:0042FAA7 8B45F8                  mov eax, dword ptr [ebp-08]
:0042FAAA C7805F03000000000000    mov dword ptr [ebx+0000035F], 00000000
:0042FAB4 C745FC00000000          mov [ebp-04], 00000000
:0042FABB E903000000              jmp 0042FAC3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FB4F(U)
|
:0042FAC0 FF45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FABB(U)
|
:0042FAC3 817DFC80000000          cmp dword ptr [ebp-04], 00000080
:0042FACA 0F8D84000000            jnl 0042FB54
:0042FAD0 8B45FC                  mov eax, dword ptr [ebp-04]
:0042FAD3 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042FAD6 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042FAD9 33D2                    xor edx, edx
:0042FADB 668B544145              mov dx, word ptr [ecx+2*eax+45]
:0042FAE0 81FAFFFF0000            cmp edx, 0000FFFF
:0042FAE6 0F8463000000            je 0042FB4F
:0042FAEC 8B45FC                  mov eax, dword ptr [ebp-04]
:0042FAEF 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042FAF2 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042FAF5 33D2                    xor edx, edx
:0042FAF7 668B544145              mov dx, word ptr [ecx+2*eax+45]
:0042FAFC 85D2                    test edx, edx
:0042FAFE 0F844B000000            je 0042FB4F
:0042FB04 6A00                    push 00000000
:0042FB06 8B45FC                  mov eax, dword ptr [ebp-04]
:0042FB09 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042FB0C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042FB0F 33D2                    xor edx, edx
:0042FB11 8A54414A                mov dl, byte ptr [ecx+2*eax+4A]
:0042FB15 52                      push edx
:0042FB16 8B45FC                  mov eax, dword ptr [ebp-04]
:0042FB19 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042FB1C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042FB1F 33D2                    xor edx, edx
:0042FB21 8A544148                mov dl, byte ptr [ecx+2*eax+48]
:0042FB25 52                      push edx
:0042FB26 8B45FC                  mov eax, dword ptr [ebp-04]
:0042FB29 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042FB2C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042FB2F 33D2                    xor edx, edx
:0042FB31 8A544147                mov dl, byte ptr [ecx+2*eax+47]
:0042FB35 52                      push edx
:0042FB36 8B45FC                  mov eax, dword ptr [ebp-04]
:0042FB39 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042FB3C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042FB3F 33D2                    xor edx, edx
:0042FB41 668B544145              mov dx, word ptr [ecx+2*eax+45]
:0042FB46 52                      push edx
:0042FB47 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042FB4A E876270000              call 004322C5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042FAE6(C), :0042FAFE(C)
|
:0042FB4F E96CFFFFFF              jmp 0042FAC0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FACA(C)
|
:0042FB54 8B45F8                  mov eax, dword ptr [ebp-08]
:0042FB57 8B8067030000            mov eax, dword ptr [eax+00000367]
:0042FB5D 50                      push eax
:0042FB5E B990A64600              mov ecx, 0046A690
:0042FB63 E86293FEFF              call 00418ECA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FAA1(C)
|
:0042FB68 E90D000000              jmp 0042FB7A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042FA74(C), :0042FA91(C)
|
:0042FB6D 8B45F8                  mov eax, dword ptr [ebp-08]
:0042FB70 C7805F03000001000000    mov dword ptr [ebx+0000035F], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FB68(U)
|
:0042FB7A 33C0                    xor eax, eax
:0042FB7C E900000000              jmp 0042FB81

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FB7C(U)
|
:0042FB81 5F                      pop edi
:0042FB82 5E                      pop esi
:0042FB83 5B                      pop ebx
:0042FB84 C9                      leave
:0042FB85 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0040133B   , :0040EC59   , :0041551D   , :0042BBFE   , :0042BC35   
|:0042BC79   , :0042BCB0   , :0042BCFE   , :0042BD6C   , :0042BDB8   
|:0042C7B5   , :0042C80C   , :00432D57   , :004402D0   , :00441306   
|:00441336   , :004436B9   , :004436E9   , :00443A1E   , :00443A4E   
|
:0042FB88 55                      push ebp
:0042FB89 8BEC                    mov ebp, esp
:0042FB8B B8D4360000              mov eax, 000036D4
:0042FB90 E8AB880100              call 00448440
:0042FB95 53                      push ebx
:0042FB96 56                      push esi
:0042FB97 57                      push edi
:0042FB98 898D48C9FFFF            mov dword ptr [ebp+FFFFC948], ecx
:0042FB9E C745E801000000          mov [ebp-18], 00000001
:0042FBA5 E90B000000              jmp 0042FBB5
:0042FBAA 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0042FBB0 E89B300000              call 00432C50

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FBA5(U)
|
:0042FBB5 E907000000              jmp 0042FBC1
:0042FBBA 33C0                    xor eax, eax
:0042FBBC E9E8240000              jmp 004320A9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FBB5(U)
|
:0042FBC1 C745F400000000          mov [ebp-0C], 00000000
:0042FBC8 66C745FC0000            mov [ebp-04], 0000
:0042FBCE 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:0042FBD4 33C9                    xor ecx, ecx
:0042FBD6 8A884B030000            mov cl, byte ptr [eax+0000034B]
:0042FBDC 83F901                  cmp ecx, 00000001
:0042FBDF 0F850C000000            jne 0042FBF1
:0042FBE5 C745EC01000000          mov [ebp-14], 00000001
:0042FBEC E907000000              jmp 0042FBF8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FBDF(C)
|
:0042FBF1 C745EC00000000          mov [ebp-14], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FBEC(U)
|
:0042FBF8 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:0042FBFE 83B85703000002          cmp dword ptr [eax+00000357], 00000002
:0042FC05 0F85FD000000            jne 0042FD08
:0042FC0B C745E000000000          mov [ebp-20], 00000000
:0042FC12 C745DC00000000          mov [ebp-24], 00000000
:0042FC19 E903000000              jmp 0042FC21

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FCDA(U)
|
:0042FC1E FF45DC                  inc [ebp-24]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FC19(U)
|
:0042FC21 817DDC80000000          cmp dword ptr [ebp-24], 00000080
:0042FC28 0F8DB1000000            jnl 0042FCDF
:0042FC2E 8B45DC                  mov eax, dword ptr [ebp-24]
:0042FC31 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042FC34 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0042FC3A 33D2                    xor edx, edx
:0042FC3C 668B544145              mov dx, word ptr [ecx+2*eax+45]
:0042FC41 81FAFFFF0000            cmp edx, 0000FFFF
:0042FC47 0F848D000000            je 0042FCDA
:0042FC4D 8B45DC                  mov eax, dword ptr [ebp-24]
:0042FC50 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042FC53 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0042FC59 8D4C4145                lea ecx, dword ptr [ecx+2*eax+45]
:0042FC5D E81E370000              call 00433380
:0042FC62 85C0                    test eax, eax
:0042FC64 0F8470000000            je 0042FCDA
:0042FC6A 8B45DC                  mov eax, dword ptr [ebp-24]
:0042FC6D 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042FC70 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0042FC76 668B444145              mov ax, word ptr [ecx+2*eax+45]
:0042FC7B 50                      push eax
:0042FC7C 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0042FC82 E8472A0000              call 004326CE
:0042FC87 85C0                    test eax, eax
:0042FC89 0F8444000000            je 0042FCD3
:0042FC8F 8B45DC                  mov eax, dword ptr [ebp-24]
:0042FC92 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042FC95 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0042FC9B 33D2                    xor edx, edx
:0042FC9D 8A544149                mov dl, byte ptr [ecx+2*eax+49]
:0042FCA1 80E2FD                  and dl, FD
:0042FCA4 8B45DC                  mov eax, dword ptr [ebp-24]
:0042FCA7 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042FCAA 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0042FCB0 88544149                mov byte ptr [ecx+2*eax+49], dl
:0042FCB4 8B45DC                  mov eax, dword ptr [ebp-24]
:0042FCB7 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042FCBA 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0042FCC0 33D2                    xor edx, edx
:0042FCC2 8A544149                mov dl, byte ptr [ecx+2*eax+49]
:0042FCC6 85D2                    test edx, edx
:0042FCC8 0F8500000000            jne 0042FCCE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FCC8(C)
|
:0042FCCE E907000000              jmp 0042FCDA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FC89(C)
|
:0042FCD3 C745E001000000          mov [ebp-20], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042FC47(C), :0042FC64(C), :0042FCCE(U)
|
:0042FCDA E93FFFFFFF              jmp 0042FC1E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FC28(C)
|
:0042FCDF 837DE000                cmp dword ptr [ebp-20], 00000000
:0042FCE3 0F840A000000            je 0042FCF3
:0042FCE9 B806000000              mov eax, 00000006
:0042FCEE E9B6230000              jmp 004320A9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FCE3(C)
|
:0042FCF3 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:0042FCF9 8B8063030000            mov eax, dword ptr [eax+00000363]
:0042FCFF 50                      push eax
:0042FD00 E868790000              call 0043766D
:0042FD05 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FC05(C)
|
:0042FD08 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:0042FD0E C7805703000000000000    mov dword ptr [ebx+00000357], 00000000
:0042FD18 C745E401000000          mov [ebp-1C], 00000001
:0042FD1F C745F001000000          mov [ebp-10], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042FE40(U), :00432071(U)
|
:0042FD26 837DF000                cmp dword ptr [ebp-10], 00000000
:0042FD2A 0F8446230000            je 00432076
:0042FD30 F745FCFFFF0000          test [ebp-04], 0000FFFF
:0042FD37 0F8408010000            je 0042FE45
:0042FD3D 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0042FD43 E808390000              call 00433650
:0042FD48 8945D4                  mov dword ptr [ebp-2C], eax
:0042FD4B 8B45D4                  mov eax, dword ptr [ebp-2C]
:0042FD4E 898544C9FFFF            mov dword ptr [ebp+FFFFC944], eax
:0042FD54 E9C4000000              jmp 0042FE1D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FE24(C)
|
:0042FD59 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0042FD5F E8EC380000              call 00433650
:0042FD64 83E07F                  and eax, 0000007F
:0042FD67 8945D0                  mov dword ptr [ebp-30], eax
:0042FD6A 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:0042FD70 33C9                    xor ecx, ecx
:0042FD72 668B8855030000          mov cx, word ptr [eax+00000355]
:0042FD79 034DD0                  add ecx, dword ptr [ebp-30]
:0042FD7C 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:0042FD82 66898855030000          mov word ptr [eax+00000355], cx
:0042FD89 E9AE000000              jmp 0042FE3C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FE31(C)
|
:0042FD8E 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0042FD94 E8B7380000              call 00433650
:0042FD99 8945CC                  mov dword ptr [ebp-34], eax
:0042FD9C 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:0042FDA2 33C9                    xor ecx, ecx
:0042FDA4 668B8855030000          mov cx, word ptr [eax+00000355]
:0042FDAB 034DCC                  add ecx, dword ptr [ebp-34]
:0042FDAE 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:0042FDB4 66898855030000          mov word ptr [eax+00000355], cx
:0042FDBB 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0042FDC1 E88A380000              call 00433650
:0042FDC6 8945CC                  mov dword ptr [ebp-34], eax
:0042FDC9 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:0042FDCF 33C9                    xor ecx, ecx
:0042FDD1 668B8855030000          mov cx, word ptr [eax+00000355]
:0042FDD8 034DCC                  add ecx, dword ptr [ebp-34]
:0042FDDB 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:0042FDE1 66898855030000          mov word ptr [eax+00000355], cx
:0042FDE8 E94F000000              jmp 0042FE3C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FE37(U)
|
:0042FDED 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:0042FDF3 33C9                    xor ecx, ecx
:0042FDF5 668B8855030000          mov cx, word ptr [eax+00000355]
:0042FDFC 8B45D4                  mov eax, dword ptr [ebp-2C]
:0042FDFF 030C8510234500          add ecx, dword ptr [4*eax+00452310]
:0042FE06 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:0042FE0C 66898855030000          mov word ptr [eax+00000355], cx
:0042FE13 E924000000              jmp 0042FE3C
:0042FE18 E91F000000              jmp 0042FE3C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FD54(U)
|
:0042FE1D 83BD44C9FFFF20          cmp dword ptr [ebp+FFFFC944], 00000020
:0042FE24 0F842FFFFFFF            je 0042FD59
:0042FE2A 83BD44C9FFFF21          cmp dword ptr [ebp+FFFFC944], 00000021
:0042FE31 0F8457FFFFFF            je 0042FD8E
:0042FE37 E9B1FFFFFF              jmp 0042FDED

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042FD89(U), :0042FDE8(U), :0042FE13(U), :0042FE18(U)
|
:0042FE3C 66FF4DFC                dec [ebp-04]
:0042FE40 E9E1FEFFFF              jmp 0042FD26

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FD37(C)
|
:0042FE45 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0042FE4B E8202F0000              call 00432D70
:0042FE50 8945D8                  mov dword ptr [ebp-28], eax
:0042FE53 837DF400                cmp dword ptr [ebp-0C], 00000000
:0042FE57 0F8411000000            je 0042FE6E
:0042FE5D 837DD808                cmp dword ptr [ebp-28], 00000008
:0042FE61 0F8407000000            je 0042FE6E
:0042FE67 C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042FE57(C), :0042FE61(C)
|
:0042FE6E 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0042FE74 E8D7370000              call 00433650
:0042FE79 898540C9FFFF            mov dword ptr [ebp+FFFFC940], eax
:0042FE7F E9C0200000              jmp 00431F44
:0042FE84 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0042FE8A E811380000              call 004336A0
:0042FE8F 668945F8                mov word ptr [ebp-08], ax
:0042FE93 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0042FE99 E8D22E0000              call 00432D70
:0042FE9E 83F815                  cmp eax, 00000015
:0042FEA1 0F8411000000            je 0042FEB8
:0042FEA7 6A00                    push 00000000
:0042FEA9 8B45F8                  mov eax, dword ptr [ebp-08]
:0042FEAC 50                      push eax
:0042FEAD 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0042FEB3 E8E7220000              call 0043219F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FEA1(C)
|
:0042FEB8 E9B4210000              jmp 00432071
:0042FEBD E8EE770000              call 004376B0
:0042FEC2 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0042FEC8 898163030000            mov dword ptr [ecx+00000363], eax
:0042FECE 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0042FED4 E8C7370000              call 004336A0
:0042FED9 668945C8                mov word ptr [ebp-38], ax
:0042FEDD 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0042FEE3 E868370000              call 00433650
:0042FEE8 668945C0                mov word ptr [ebp-40], ax
:0042FEEC 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0042FEF2 E859370000              call 00433650
:0042FEF7 668945BC                mov word ptr [ebp-44], ax
:0042FEFB 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0042FF01 E84A370000              call 00433650
:0042FF06 668945C4                mov word ptr [ebp-3C], ax
:0042FF0A 8B45C4                  mov eax, dword ptr [ebp-3C]
:0042FF0D 25FFFF0000              and eax, 0000FFFF
:0042FF12 50                      push eax
:0042FF13 8B45BC                  mov eax, dword ptr [ebp-44]
:0042FF16 25FFFF0000              and eax, 0000FFFF
:0042FF1B 50                      push eax
:0042FF1C 8B45C0                  mov eax, dword ptr [ebp-40]
:0042FF1F 25FFFF0000              and eax, 0000FFFF
:0042FF24 50                      push eax
:0042FF25 8B45C8                  mov eax, dword ptr [ebp-38]
:0042FF28 25FFFF0000              and eax, 0000FFFF
:0042FF2D 50                      push eax
:0042FF2E 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0042FF34 E81D250000              call 00432456
:0042FF39 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0042FF3F E82C2E0000              call 00432D70
:0042FF44 83F801                  cmp eax, 00000001
:0042FF47 0F8424000000            je 0042FF71
:0042FF4D 6A00                    push 00000000
:0042FF4F E819770000              call 0043766D
:0042FF54 83C404                  add esp, 00000004
:0042FF57 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:0042FF5D C7805703000002000000    mov dword ptr [ebx+00000357], 00000002
:0042FF67 B805000000              mov eax, 00000005
:0042FF6C E938210000              jmp 004320A9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FF47(C)
|
:0042FF71 E9FB200000              jmp 00432071
:0042FF76 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0042FF7C E8CF360000              call 00433650
:0042FF81 50                      push eax
:0042FF82 B988C04600              mov ecx, 0046C088
:0042FF87 E8B4330000              call 00433340
:0042FF8C E9E0200000              jmp 00432071
:0042FF91 68FF000000              push 000000FF
:0042FF96 680B040000              push 0000040B
:0042FF9B 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:0042FFA1 0581030000              add eax, 00000381
:0042FFA6 50                      push eax
:0042FFA7 E8B7740100              call 00447463
:0042FFAC 83C40C                  add esp, 0000000C
:0042FFAF C7459C00000000          mov [ebp-64], 00000000
:0042FFB6 E903000000              jmp 0042FFBE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FFE6(U)
|
:0042FFBB FF459C                  inc [ebp-64]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FFB6(U)
|
:0042FFBE 837D9C2D                cmp dword ptr [ebp-64], 0000002D
:0042FFC2 0F8D23000000            jnl 0042FFEB
:0042FFC8 8B459C                  mov eax, dword ptr [ebp-64]
:0042FFCB 8BC8                    mov ecx, eax
:0042FFCD 8D0440                  lea eax, dword ptr [eax+2*eax]
:0042FFD0 C1E003                  shl eax, 03
:0042FFD3 2BC1                    sub eax, ecx
:0042FFD5 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0042FFDB C7840881030000FFFF0000  mov dword ptr [eax+ecx+00000381], 0000FFFF
:0042FFE6 E9D0FFFFFF              jmp 0042FFBB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FFC2(C)
|
:0042FFEB 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0042FFF1 E85A360000              call 00433650
:0042FFF6 8945B8                  mov dword ptr [ebp-48], eax
:0042FFF9 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0042FFFF E84C360000              call 00433650
:00430004 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0043000A 888196070000            mov byte ptr [ecx+00000796], al
:00430010 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430016 E835360000              call 00433650
:0043001B 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430021 888197070000            mov byte ptr [ecx+00000797], al
:00430027 837DB800                cmp dword ptr [ebp-48], 00000000
:0043002B 0F8414000000            je 00430045
:00430031 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:00430037 66C7807F0300000100      mov word ptr [ebx+0000037F], 0001
:00430040 E90F000000              jmp 00430054

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043002B(C)
|
:00430045 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:0043004B 66C7807F0300000000      mov word ptr [ebx+0000037F], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430040(U)
|
:00430054 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0043005A E8F1350000              call 00433650
:0043005F 8945A4                  mov dword ptr [ebp-5C], eax
:00430062 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430068 E8E3350000              call 00433650
:0043006D 8945A0                  mov dword ptr [ebp-60], eax
:00430070 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430076 E825360000              call 004336A0
:0043007B 668945B4                mov word ptr [ebp-4C], ax
:0043007F 837DA000                cmp dword ptr [ebp-60], 00000000
:00430083 0F8414000000            je 0043009D
:00430089 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:0043008F 66C7808C0700000100      mov word ptr [ebx+0000078C], 0001
:00430098 E90F000000              jmp 004300AC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430083(C)
|
:0043009D 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:004300A3 66C7808C0700000000      mov word ptr [ebx+0000078C], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430098(U)
|
:004300AC 668B45B4                mov ax, word ptr [ebp-4C]
:004300B0 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:004300B6 6689818E070000          mov word ptr [ecx+0000078E], ax
:004300BD 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:004300C3 E888350000              call 00433650
:004300C8 894594                  mov dword ptr [ebp-6C], eax
:004300CB 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:004300D1 E87A350000              call 00433650
:004300D6 8945AC                  mov dword ptr [ebp-54], eax
:004300D9 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:004300DF E8BC350000              call 004336A0
:004300E4 668945B0                mov word ptr [ebp-50], ax
:004300E8 837DAC00                cmp dword ptr [ebp-54], 00000000
:004300EC 0F8414000000            je 00430106
:004300F2 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:004300F8 66C780900700000100      mov word ptr [ebx+00000790], 0001
:00430101 E90F000000              jmp 00430115

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004300EC(C)
|
:00430106 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:0043010C 66C780900700000000      mov word ptr [ebx+00000790], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430101(U)
|
:00430115 668B45B0                mov ax, word ptr [ebp-50]
:00430119 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0043011F 66898192070000          mov word ptr [ecx+00000792], ax
:00430126 C7459800000000          mov [ebp-68], 00000000
:0043012D C745A800000000          mov [ebp-58], 00000000
:00430134 E903000000              jmp 0043013C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004301E4(U), :004302A0(U)
|
:00430139 FF45A8                  inc [ebp-58]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430134(U)
|
:0043013C 837DA81E                cmp dword ptr [ebp-58], 0000001E
:00430140 0F8D5F010000            jnl 004302A5
:00430146 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0043014C E84F350000              call 004336A0
:00430151 6689458C                mov word ptr [ebp-74], ax
:00430155 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0043015B E8F0340000              call 00433650
:00430160 89857CFFFFFF            mov dword ptr [ebp+FFFFFF7C], eax
:00430166 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0043016C E8DF340000              call 00433650
:00430171 898578FFFFFF            mov dword ptr [ebp+FFFFFF78], eax
:00430177 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0043017D E8CE340000              call 00433650
:00430182 894584                  mov dword ptr [ebp-7C], eax
:00430185 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0043018B E8C0340000              call 00433650
:00430190 898574FFFFFF            mov dword ptr [ebp+FFFFFF74], eax
:00430196 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0043019C E8AF340000              call 00433650
:004301A1 894588                  mov dword ptr [ebp-78], eax
:004301A4 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:004301AA E8A1340000              call 00433650
:004301AF 894580                  mov dword ptr [ebp-80], eax
:004301B2 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:004301B8 E893340000              call 00433650
:004301BD 894590                  mov dword ptr [ebp-70], eax
:004301C0 83BD74FFFFFF00          cmp dword ptr [ebp+FFFFFF74], 00000000
:004301C7 0F841C000000            je 004301E9
:004301CD 8B4588                  mov eax, dword ptr [ebp-78]
:004301D0 50                      push eax
:004301D1 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:004301D7 E824340000              call 00433600
:004301DC 85C0                    test eax, eax
:004301DE 0F8505000000            jne 004301E9
:004301E4 E950FFFFFF              jmp 00430139

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004301C7(C), :004301DE(C)
|
:004301E9 8B458C                  mov eax, dword ptr [ebp-74]
:004301EC 25FFFF0000              and eax, 0000FFFF
:004301F1 83F8FF                  cmp eax, FFFFFFFF
:004301F4 0F84A6000000            je 004302A0
:004301FA 8B458C                  mov eax, dword ptr [ebp-74]
:004301FD 25FFFF0000              and eax, 0000FFFF
:00430202 8B4D98                  mov ecx, dword ptr [ebp-68]
:00430205 8BD1                    mov edx, ecx
:00430207 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:0043020A C1E103                  shl ecx, 03
:0043020D 2BCA                    sub ecx, edx
:0043020F 8B9548C9FFFF            mov edx, dword ptr [ebp+FFFFC948]
:00430215 89841181030000          mov dword ptr [ecx+edx+00000381], eax
:0043021C 8A857CFFFFFF            mov al, byte ptr [ebp+FFFFFF7C]
:00430222 8B4D98                  mov ecx, dword ptr [ebp-68]
:00430225 8BD1                    mov edx, ecx
:00430227 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:0043022A C1E103                  shl ecx, 03
:0043022D 2BCA                    sub ecx, edx
:0043022F 8B9548C9FFFF            mov edx, dword ptr [ebp+FFFFC948]
:00430235 88841185030000          mov byte ptr [ecx+edx+00000385], al
:0043023C 8A8578FFFFFF            mov al, byte ptr [ebp+FFFFFF78]
:00430242 8B4D98                  mov ecx, dword ptr [ebp-68]
:00430245 8BD1                    mov edx, ecx
:00430247 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:0043024A C1E103                  shl ecx, 03
:0043024D 2BCA                    sub ecx, edx
:0043024F 8B9548C9FFFF            mov edx, dword ptr [ebp+FFFFC948]
:00430255 88841186030000          mov byte ptr [ecx+edx+00000386], al
:0043025C 8B4580                  mov eax, dword ptr [ebp-80]
:0043025F 48                      dec eax
:00430260 83F801                  cmp eax, 00000001
:00430263 1BC0                    sbb eax, eax
:00430265 83E004                  and eax, 00000004
:00430268 837D9001                cmp dword ptr [ebp-70], 00000001
:0043026C B900000000              mov ecx, 00000000
:00430271 83D1FF                  adc ecx, FFFFFFFF
:00430274 83E102                  and ecx, 00000002
:00430277 0BC1                    or eax, ecx
:00430279 837D8401                cmp dword ptr [ebp-7C], 00000001
:0043027D 1BC9                    sbb ecx, ecx
:0043027F F7D9                    neg ecx
:00430281 0BC1                    or eax, ecx
:00430283 8B4D98                  mov ecx, dword ptr [ebp-68]
:00430286 8BD1                    mov edx, ecx
:00430288 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:0043028B C1E103                  shl ecx, 03
:0043028E 2BCA                    sub ecx, edx
:00430290 8B9548C9FFFF            mov edx, dword ptr [ebp+FFFFC948]
:00430296 89841187030000          mov dword ptr [ecx+edx+00000387], eax
:0043029D FF4598                  inc [ebp-68]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004301F4(C)
|
:004302A0 E994FEFFFF              jmp 00430139

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430140(C)
|
:004302A5 E9C71D0000              jmp 00432071
:004302AA E9C21D0000              jmp 00432071
:004302AF 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:004302B5 E8F61D0000              call 004320B0
:004302BA 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:004302C0 C7805703000001000000    mov dword ptr [ebx+00000357], 00000001
:004302CA 33C0                    xor eax, eax
:004302CC E9D81D0000              jmp 004320A9
:004302D1 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:004302D7 E8571E0000              call 00432133
:004302DC E9901D0000              jmp 00432071
:004302E1 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:004302E7 E864330000              call 00433650
:004302EC 898570FFFFFF            mov dword ptr [ebp+FFFFFF70], eax
:004302F2 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:004302F8 E853330000              call 00433650
:004302FD 89856CFFFFFF            mov dword ptr [ebp+FFFFFF6C], eax
:00430303 C745F401000000          mov [ebp-0C], 00000001
:0043030A E9621D0000              jmp 00432071
:0043030F E910000000              jmp 00430324
:00430314 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0043031A E881330000              call 004336A0
:0043031F E992000000              jmp 004303B6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043030F(U)
|
:00430324 8D856CFBFFFF            lea eax, dword ptr [ebp+FFFFFB6C]
:0043032A 50                      push eax
:0043032B 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430331 E86A330000              call 004336A0
:00430336 50                      push eax
:00430337 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0043033D E83CDFFFFF              call 0042E27E
:00430342 8D856CFBFFFF            lea eax, dword ptr [ebp+FFFFFB6C]
:00430348 50                      push eax
:00430349 8D856CF7FFFF            lea eax, dword ptr [ebp+FFFFF76C]
:0043034F 50                      push eax
:00430350 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430356 E898DFFFFF              call 0042E2F3
:0043035B 837DF400                cmp dword ptr [ebp-0C], 00000000
:0043035F 0F841A000000            je 0043037F
:00430365 6A20                    push 00000020
:00430367 6A00                    push 00000000
:00430369 8D856CF7FFFF            lea eax, dword ptr [ebp+FFFFF76C]
:0043036F 50                      push eax
:00430370 6A00                    push 00000000
:00430372 E8FF0CFDFF              call 00401076
:00430377 83C410                  add esp, 00000010
:0043037A E937000000              jmp 004303B6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043035F(C)
|
:0043037F 6A20                    push 00000020
:00430381 6A00                    push 00000000
:00430383 8D856CF7FFFF            lea eax, dword ptr [ebp+FFFFF76C]
:00430389 50                      push eax
:0043038A 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:00430390 33C9                    xor ecx, ecx
:00430392 668B4812                mov cx, word ptr [eax+12]
:00430396 81E100F00000            and ecx, 0000F000
:0043039C 81E900300000            sub ecx, 00003000
:004303A2 83F901                  cmp ecx, 00000001
:004303A5 B802000000              mov eax, 00000002
:004303AA 83D0FF                  adc eax, FFFFFFFF
:004303AD 50                      push eax
:004303AE E8C30CFDFF              call 00401076
:004303B3 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043031F(U), :0043037A(U)
|
:004303B6 E9B61C0000              jmp 00432071
:004303BB 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:004303C1 E8DA320000              call 004336A0
:004303C6 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:004303CC 66894112                mov word ptr [ecx+12], ax
:004303D0 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:004303D6 C7805703000001000000    mov dword ptr [ebx+00000357], 00000001
:004303E0 B802000000              mov eax, 00000002
:004303E5 E9BF1C0000              jmp 004320A9
:004303EA 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:004303F0 E8AB320000              call 004336A0
:004303F5 66898568F7FFFF          mov word ptr [ebp+FFFFF768], ax
:004303FC 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430402 E849320000              call 00433650
:00430407 66898560F7FFFF          mov word ptr [ebp+FFFFF760], ax
:0043040E 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430414 E837320000              call 00433650
:00430419 66898558F7FFFF          mov word ptr [ebp+FFFFF758], ax
:00430420 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430426 E825320000              call 00433650
:0043042B 66898564F7FFFF          mov word ptr [ebp+FFFFF764], ax
:00430432 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430438 E813320000              call 00433650
:0043043D 6689855CF7FFFF          mov word ptr [ebp+FFFFF75C], ax
:00430444 8B855CF7FFFF            mov eax, dword ptr [ebp+FFFFF75C]
:0043044A 25FFFF0000              and eax, 0000FFFF
:0043044F 50                      push eax
:00430450 8B8564F7FFFF            mov eax, dword ptr [ebp+FFFFF764]
:00430456 25FFFF0000              and eax, 0000FFFF
:0043045B 50                      push eax
:0043045C 8B8558F7FFFF            mov eax, dword ptr [ebp+FFFFF758]
:00430462 25FFFF0000              and eax, 0000FFFF
:00430467 50                      push eax
:00430468 8B8560F7FFFF            mov eax, dword ptr [ebp+FFFFF760]
:0043046E 25FFFF0000              and eax, 0000FFFF
:00430473 50                      push eax
:00430474 8B8568F7FFFF            mov eax, dword ptr [ebp+FFFFF768]
:0043047A 25FFFF0000              and eax, 0000FFFF
:0043047F 50                      push eax
:00430480 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430486 E83A1E0000              call 004322C5
:0043048B C745E400000000          mov [ebp-1C], 00000000
:00430492 E9DA1B0000              jmp 00432071
:00430497 E910000000              jmp 004304AC
:0043049C 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:004304A2 E8F9310000              call 004336A0
:004304A7 E946000000              jmp 004304F2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430497(U)
|
:004304AC 8D8558F3FFFF            lea eax, dword ptr [ebp+FFFFF358]
:004304B2 50                      push eax
:004304B3 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:004304B9 E8E2310000              call 004336A0
:004304BE 50                      push eax
:004304BF 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:004304C5 E8B4DDFFFF              call 0042E27E
:004304CA 8D8558F3FFFF            lea eax, dword ptr [ebp+FFFFF358]
:004304D0 50                      push eax
:004304D1 8D8558EFFFFF            lea eax, dword ptr [ebp+FFFFEF58]
:004304D7 50                      push eax
:004304D8 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:004304DE E810DEFFFF              call 0042E2F3
:004304E3 8D8558EFFFFF            lea eax, dword ptr [ebp+FFFFEF58]
:004304E9 50                      push eax
:004304EA E80F13FDFF              call 004017FE
:004304EF 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004304A7(U)
|
:004304F2 E97A1B0000              jmp 00432071
:004304F7 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:004304FD E89E310000              call 004336A0
:00430502 66898554EFFFFF          mov word ptr [ebp+FFFFEF54], ax
:00430509 E910000000              jmp 0043051E
:0043050E 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430514 E887310000              call 004336A0
:00430519 E937000000              jmp 00430555

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430509(U)
|
:0043051E 8D8554EBFFFF            lea eax, dword ptr [ebp+FFFFEB54]
:00430524 50                      push eax
:00430525 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0043052B E870310000              call 004336A0
:00430530 50                      push eax
:00430531 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430537 E842DDFFFF              call 0042E27E
:0043053C 8D8554EBFFFF            lea eax, dword ptr [ebp+FFFFEB54]
:00430542 50                      push eax
:00430543 8D8554E7FFFF            lea eax, dword ptr [ebp+FFFFE754]
:00430549 50                      push eax
:0043054A 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430550 E89EDDFFFF              call 0042E2F3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430519(U)
|
:00430555 E9171B0000              jmp 00432071
:0043055A 8D8554E3FFFF            lea eax, dword ptr [ebp+FFFFE354]
:00430560 50                      push eax
:00430561 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430567 E834310000              call 004336A0
:0043056C 50                      push eax
:0043056D 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430573 E806DDFFFF              call 0042E27E
:00430578 8D8554E3FFFF            lea eax, dword ptr [ebp+FFFFE354]
:0043057E 50                      push eax
:0043057F 8D8554DFFFFF            lea eax, dword ptr [ebp+FFFFDF54]
:00430585 50                      push eax
:00430586 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0043058C E862DDFFFF              call 0042E2F3
:00430591 8D8554DFFFFF            lea eax, dword ptr [ebp+FFFFDF54]
:00430597 50                      push eax
:00430598 E84B0CFDFF              call 004011E8
:0043059D 83C404                  add esp, 00000004
:004305A0 E9CC1A0000              jmp 00432071
:004305A5 8D8554DBFFFF            lea eax, dword ptr [ebp+FFFFDB54]
:004305AB 50                      push eax
:004305AC 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:004305B2 E8E9300000              call 004336A0
:004305B7 50                      push eax
:004305B8 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:004305BE E8BBDCFFFF              call 0042E27E
:004305C3 8D8554DBFFFF            lea eax, dword ptr [ebp+FFFFDB54]
:004305C9 50                      push eax
:004305CA 8D8554D7FFFF            lea eax, dword ptr [ebp+FFFFD754]
:004305D0 50                      push eax
:004305D1 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:004305D7 E817DDFFFF              call 0042E2F3
:004305DC 8D8554D7FFFF            lea eax, dword ptr [ebp+FFFFD754]
:004305E2 50                      push eax
:004305E3 E81612FDFF              call 004017FE
:004305E8 83C404                  add esp, 00000004
:004305EB E9811A0000              jmp 00432071
:004305F0 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:004305F6 E855300000              call 00433650
:004305FB 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430601 894108                  mov dword ptr [ecx+08], eax
:00430604 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:0043060A C7400C00000000          mov [eax+0C], 00000000
:00430611 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430617 E8D42E0000              call 004334F0
:0043061C 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430622 E841DBFFFF              call 0042E168
:00430627 C745F000000000          mov [ebp-10], 00000000
:0043062E E93E1A0000              jmp 00432071
:00430633 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430639 E812300000              call 00433650
:0043063E 898550D7FFFF            mov dword ptr [ebp+FFFFD750], eax
:00430644 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0043064A E801300000              call 00433650
:0043064F 89854CD7FFFF            mov dword ptr [ebp+FFFFD74C], eax
:00430655 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0043065B E8F02F0000              call 00433650
:00430660 898548D7FFFF            mov dword ptr [ebp+FFFFD748], eax
:00430666 8B8548D7FFFF            mov eax, dword ptr [ebp+FFFFD748]
:0043066C 50                      push eax
:0043066D 8B854CD7FFFF            mov eax, dword ptr [ebp+FFFFD74C]
:00430673 50                      push eax
:00430674 8B8550D7FFFF            mov eax, dword ptr [ebp+FFFFD750]
:0043067A 50                      push eax
:0043067B E8D58F0000              call 00439655
:00430680 83C40C                  add esp, 0000000C
:00430683 E9E9190000              jmp 00432071
:00430688 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0043068E E80D300000              call 004336A0
:00430693 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430699 66894112                mov word ptr [ecx+12], ax
:0043069D 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:004306A3 E8C8260000              call 00432D70
:004306A8 83E829                  sub eax, 00000029
:004306AB 83F801                  cmp eax, 00000001
:004306AE 1BC0                    sbb eax, eax
:004306B0 F7D8                    neg eax
:004306B2 50                      push eax
:004306B3 B988C04600              mov ecx, 0046C088
:004306B8 E87275FFFF              call 00427C2F
:004306BD 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:004306C3 33C9                    xor ecx, ecx
:004306C5 668B4812                mov cx, word ptr [eax+12]
:004306C9 80E5F0                  and ch, F0
:004306CC 80FD10                  cmp ch, 10
:004306CF 0F8400000000            je 004306D5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004306CF(C)
|
:004306D5 E997190000              jmp 00432071
:004306DA 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:004306E0 E8DB2C0000              call 004333C0
:004306E5 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:004306EB C7400800000000          mov [eax+08], 00000000
:004306F2 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:004306F8 C7400C00000000          mov [eax+0C], 00000000
:004306FF 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430705 E85EDAFFFF              call 0042E168
:0043070A 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:00430710 8B00                    mov eax, dword ptr [eax]
:00430712 50                      push eax
:00430713 B9D0A64600              mov ecx, 0046A6D0
:00430718 E8F32B0000              call 00433310
:0043071D 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:00430723 8B00                    mov eax, dword ptr [eax]
:00430725 50                      push eax
:00430726 E8E395FDFF              call 00409D0E
:0043072B 83C404                  add esp, 00000004
:0043072E C745F000000000          mov [ebp-10], 00000000
:00430735 E937190000              jmp 00432071
:0043073A 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430740 E8AB2C0000              call 004333F0
:00430745 B805000000              mov eax, 00000005
:0043074A E95A190000              jmp 004320A9
:0043074F 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430755 E8F62E0000              call 00433650
:0043075A 898544D7FFFF            mov dword ptr [ebp+FFFFD744], eax
:00430760 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430766 E8E52E0000              call 00433650
:0043076B 898540D7FFFF            mov dword ptr [ebp+FFFFD740], eax
:00430771 81BD44D7FFFF00010000    cmp dword ptr [ebp+FFFFD744], 00000100
:0043077B 0F8C05000000            jl 00430786
:00430781 E9EB180000              jmp 00432071

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043077B(C)
|
:00430786 83BD40D7FFFF01          cmp dword ptr [ebp+FFFFD740], 00000001
:0043078D 1BC0                    sbb eax, eax
:0043078F F7D8                    neg eax
:00430791 50                      push eax
:00430792 8B8544D7FFFF            mov eax, dword ptr [ebp+FFFFD744]
:00430798 50                      push eax
:00430799 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0043079F E87C2D0000              call 00433520
:004307A4 E9C8180000              jmp 00432071
:004307A9 6A01                    push 00000001
:004307AB 8B45F8                  mov eax, dword ptr [ebp-08]
:004307AE 50                      push eax
:004307AF 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:004307B5 E8E5190000              call 0043219F
:004307BA 89853CD7FFFF            mov dword ptr [ebp+FFFFD73C], eax
:004307C0 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:004307C6 E8852E0000              call 00433650
:004307CB 898534D7FFFF            mov dword ptr [ebp+FFFFD734], eax
:004307D1 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:004307D7 E8742E0000              call 00433650
:004307DC 66898538D7FFFF          mov word ptr [ebp+FFFFD738], ax
:004307E3 8B853CD7FFFF            mov eax, dword ptr [ebp+FFFFD73C]
:004307E9 398534D7FFFF            cmp dword ptr [ebp+FFFFD734], eax
:004307EF 0F850B000000            jne 00430800
:004307F5 668B8538D7FFFF          mov ax, word ptr [ebp+FFFFD738]
:004307FC 668945FC                mov word ptr [ebp-04], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004307EF(C)
|
:00430800 E96C180000              jmp 00432071
:00430805 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0043080B E8902E0000              call 004336A0
:00430810 66898530D7FFFF          mov word ptr [ebp+FFFFD730], ax
:00430817 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0043081D E87E2E0000              call 004336A0
:00430822 6689852CD7FFFF          mov word ptr [ebp+FFFFD72C], ax
:00430829 8B852CD7FFFF            mov eax, dword ptr [ebp+FFFFD72C]
:0043082F 50                      push eax
:00430830 8B8530D7FFFF            mov eax, dword ptr [ebp+FFFFD730]
:00430836 50                      push eax
:00430837 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0043083D E8501F0000              call 00432792
:00430842 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430848 E823250000              call 00432D70
:0043084D 83F816                  cmp eax, 00000016
:00430850 0F842D000000            je 00430883
:00430856 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0043085C E80F250000              call 00432D70
:00430861 3DFF000000              cmp eax, 000000FF
:00430866 0F8410000000            je 0043087C
:0043086C 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:00430872 C7805703000002000000    mov dword ptr [ebx+00000357], 00000002

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430866(C)
|
:0043087C C745F000000000          mov [ebp-10], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430850(C)
|
:00430883 E9E9170000              jmp 00432071
:00430888 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0043088E E8BD2D0000              call 00433650
:00430893 85C0                    test eax, eax
:00430895 0F8515000000            jne 004308B0
:0043089B 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:004308A1 C7806303000001000000    mov dword ptr [ebx+00000363], 00000001
:004308AB E910000000              jmp 004308C0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430895(C)
|
:004308B0 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:004308B6 C7806303000000000000    mov dword ptr [ebx+00000363], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004308AB(U)
|
:004308C0 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:004308C6 8B8063030000            mov eax, dword ptr [eax+00000363]
:004308CC 50                      push eax
:004308CD E89B6D0000              call 0043766D
:004308D2 83C404                  add esp, 00000004
:004308D5 E997170000              jmp 00432071
:004308DA 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:004308E0 E8BB2D0000              call 004336A0
:004308E5 66898524D7FFFF          mov word ptr [ebp+FFFFD724], ax
:004308EC 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:004308F2 E8592D0000              call 00433650
:004308F7 888520D7FFFF            mov byte ptr [ebp+FFFFD720], al
:004308FD 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430903 E8482D0000              call 00433650
:00430908 88851CD7FFFF            mov byte ptr [ebp+FFFFD71C], al
:0043090E 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430914 E8372D0000              call 00433650
:00430919 888514D7FFFF            mov byte ptr [ebp+FFFFD714], al
:0043091F 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430925 E8262D0000              call 00433650
:0043092A 888510D7FFFF            mov byte ptr [ebp+FFFFD710], al
:00430930 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430936 E8152D0000              call 00433650
:0043093B 888518D7FFFF            mov byte ptr [ebp+FFFFD718], al
:00430941 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430947 E8042D0000              call 00433650
:0043094C 888528D7FFFF            mov byte ptr [ebp+FFFFD728], al
:00430952 33C0                    xor eax, eax
:00430954 8A8518D7FFFF            mov al, byte ptr [ebp+FFFFD718]
:0043095A 85C0                    test eax, eax
:0043095C 0F8517000000            jne 00430979
:00430962 8B8524D7FFFF            mov eax, dword ptr [ebp+FFFFD724]
:00430968 50                      push eax
:00430969 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0043096F E8F51E0000              call 00432869
:00430974 E945000000              jmp 004309BE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043095C(C)
|
:00430979 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:0043097F 33C9                    xor ecx, ecx
:00430981 668B4812                mov cx, word ptr [eax+12]
:00430985 80E5F0                  and ch, F0
:00430988 80FD30                  cmp ch, 30
:0043098B 0F852D000000            jne 004309BE
:00430991 8B8528D7FFFF            mov eax, dword ptr [ebp+FFFFD728]
:00430997 50                      push eax
:00430998 8B8510D7FFFF            mov eax, dword ptr [ebp+FFFFD710]
:0043099E 50                      push eax
:0043099F 8B8514D7FFFF            mov eax, dword ptr [ebp+FFFFD714]
:004309A5 50                      push eax
:004309A6 8B851CD7FFFF            mov eax, dword ptr [ebp+FFFFD71C]
:004309AC 50                      push eax
:004309AD 8B8520D7FFFF            mov eax, dword ptr [ebp+FFFFD720]
:004309B3 50                      push eax
:004309B4 B988C04600              mov ecx, 0046C088
:004309B9 E8397FFFFF              call 004288F7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00430974(U), :0043098B(C)
|
:004309BE E9AE160000              jmp 00432071
:004309C3 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:004309C9 E8D22C0000              call 004336A0
:004309CE 6689850CD7FFFF          mov word ptr [ebp+FFFFD70C], ax
:004309D5 6A00                    push 00000000
:004309D7 6A00                    push 00000000
:004309D9 6A00                    push 00000000
:004309DB 6A00                    push 00000000
:004309DD 8B850CD7FFFF            mov eax, dword ptr [ebp+FFFFD70C]
:004309E3 25FFFF0000              and eax, 0000FFFF
:004309E8 50                      push eax
:004309E9 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:004309EF E8D1180000              call 004322C5
:004309F4 E978160000              jmp 00432071
:004309F9 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:004309FF E84C2C0000              call 00433650
:00430A04 898504D7FFFF            mov dword ptr [ebp+FFFFD704], eax
:00430A0A C78508D7FFFF00000000    mov dword ptr [ebp+FFFFD708], 00000000
:00430A14 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:00430A1A 33C9                    xor ecx, ecx
:00430A1C 668B4812                mov cx, word ptr [eax+12]
:00430A20 80E5F0                  and ch, F0
:00430A23 80FD30                  cmp ch, 30
:00430A26 0F8510000000            jne 00430A3C
:00430A2C B988C04600              mov ecx, 0046C088
:00430A31 E82A290000              call 00433360
:00430A36 898508D7FFFF            mov dword ptr [ebp+FFFFD708], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430A26(C)
|
:00430A3C 8B8504D7FFFF            mov eax, dword ptr [ebp+FFFFD704]
:00430A42 50                      push eax
:00430A43 8B8508D7FFFF            mov eax, dword ptr [ebp+FFFFD708]
:00430A49 8D0440                  lea eax, dword ptr [eax+2*eax]
:00430A4C 03C0                    add eax, eax
:00430A4E 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:00430A55 E8FEC3FDFF              call 0040CE58
:00430A5A E912160000              jmp 00432071
:00430A5F 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430A65 E8362C0000              call 004336A0
:00430A6A 668985FCD6FFFF          mov word ptr [ebp+FFFFD6FC], ax
:00430A71 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430A77 E8D42B0000              call 00433650
:00430A7C 8985F0D6FFFF            mov dword ptr [ebp+FFFFD6F0], eax
:00430A82 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:00430A88 33C9                    xor ecx, ecx
:00430A8A 668B4812                mov cx, word ptr [eax+12]
:00430A8E 80E5F0                  and ch, F0
:00430A91 80FD30                  cmp ch, 30
:00430A94 0F8405000000            je 00430A9F
:00430A9A E9D2150000              jmp 00432071

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430A94(C)
|
:00430A9F 8B85F0D6FFFF            mov eax, dword ptr [ebp+FFFFD6F0]
:00430AA5 50                      push eax
:00430AA6 8B85FCD6FFFF            mov eax, dword ptr [ebp+FFFFD6FC]
:00430AAC 25FFFF0000              and eax, 0000FFFF
:00430AB1 50                      push eax
:00430AB2 B988C04600              mov ecx, 0046C088
:00430AB7 E88573FFFF              call 00427E41
:00430ABC 8B85F0D6FFFF            mov eax, dword ptr [ebp+FFFFD6F0]
:00430AC2 89853CC9FFFF            mov dword ptr [ebp+FFFFC93C], eax
:00430AC8 E999000000              jmp 00430B66
:00430ACD 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430AD3 E8C82B0000              call 004336A0
:00430AD8 E9BF000000              jmp 00430B9C
:00430ADD 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430AE3 E8B82B0000              call 004336A0
:00430AE8 66898500D7FFFF          mov word ptr [ebp+FFFFD700], ax
:00430AEF 8B8500D7FFFF            mov eax, dword ptr [ebp+FFFFD700]
:00430AF5 25FFFF0000              and eax, 0000FFFF
:00430AFA 50                      push eax
:00430AFB 8B85FCD6FFFF            mov eax, dword ptr [ebp+FFFFD6FC]
:00430B01 25FFFF0000              and eax, 0000FFFF
:00430B06 50                      push eax
:00430B07 B988C04600              mov ecx, 0046C088
:00430B0C E88C7BFFFF              call 0042869D
:00430B11 E986000000              jmp 00430B9C
:00430B16 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430B1C E82F2B0000              call 00433650
:00430B21 8985F8D6FFFF            mov dword ptr [ebp+FFFFD6F8], eax
:00430B27 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430B2D E81E2B0000              call 00433650
:00430B32 8985F4D6FFFF            mov dword ptr [ebp+FFFFD6F4], eax
:00430B38 8B85F4D6FFFF            mov eax, dword ptr [ebp+FFFFD6F4]
:00430B3E 50                      push eax
:00430B3F 8B85F8D6FFFF            mov eax, dword ptr [ebp+FFFFD6F8]
:00430B45 50                      push eax
:00430B46 8B85FCD6FFFF            mov eax, dword ptr [ebp+FFFFD6FC]
:00430B4C 25FFFF0000              and eax, 0000FFFF
:00430B51 50                      push eax
:00430B52 B988C04600              mov ecx, 0046C088
:00430B57 E8E27AFFFF              call 0042863E
:00430B5C E93B000000              jmp 00430B9C
:00430B61 E936000000              jmp 00430B9C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430AC8(U)
|
:00430B66 83BD3CC9FFFF06          cmp dword ptr [ebp+FFFFC93C], 00000006
:00430B6D 0F8729000000            ja 00430B9C
:00430B73 8B853CC9FFFF            mov eax, dword ptr [ebp+FFFFC93C]
:00430B79 FF2485800B4300          jmp dword ptr [4*eax+00430B80]

:00430B80 CD0A4300                DWORD 00430ACD
:00430B84 CD0A4300                DWORD 00430ACD
:00430B88 CD0A4300                DWORD 00430ACD
:00430B8C DD0A4300                DWORD 00430ADD
:00430B90 160B4300                DWORD 00430B16
:00430B94 DD0A4300                DWORD 00430ADD
:00430B98 160B4300                DWORD 00430B16



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00430AD8(U), :00430B11(U), :00430B5C(U), :00430B61(U), :00430B6D(C)
|
:00430B9C E9D0140000              jmp 00432071
:00430BA1 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430BA7 E8F42A0000              call 004336A0
:00430BAC 0FB7C0                  movzx eax, ax
:00430BAF 8985E8D6FFFF            mov dword ptr [ebp+FFFFD6E8], eax
:00430BB5 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430BBB E8902A0000              call 00433650
:00430BC0 8985ECD6FFFF            mov dword ptr [ebp+FFFFD6EC], eax
:00430BC6 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430BCC E87F2A0000              call 00433650
:00430BD1 8985E4D6FFFF            mov dword ptr [ebp+FFFFD6E4], eax
:00430BD7 8B85E4D6FFFF            mov eax, dword ptr [ebp+FFFFD6E4]
:00430BDD 50                      push eax
:00430BDE 8B85ECD6FFFF            mov eax, dword ptr [ebp+FFFFD6EC]
:00430BE4 50                      push eax
:00430BE5 8B85E8D6FFFF            mov eax, dword ptr [ebp+FFFFD6E8]
:00430BEB 50                      push eax
:00430BEC E8CE09FDFF              call 004015BF
:00430BF1 83C40C                  add esp, 0000000C
:00430BF4 E978140000              jmp 00432071
:00430BF9 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430BFF E8FC53FFFF              call 00426000
:00430C04 E968140000              jmp 00432071
:00430C09 E8B94AFEFF              call 004156C7
:00430C0E E95E140000              jmp 00432071
:00430C13 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430C19 E8322A0000              call 00433650
:00430C1E 8985E0D6FFFF            mov dword ptr [ebp+FFFFD6E0], eax
:00430C24 F685E0D6FFFF80          test byte ptr [ebp+FFFFD6E0], 80
:00430C2B 0F8411000000            je 00430C42
:00430C31 6AFF                    push FFFFFFFF
:00430C33 E8670AFDFF              call 0040169F
:00430C38 83C404                  add esp, 00000004
:00430C3B 83A5E0D6FFFF7F          and dword ptr [ebp+FFFFD6E0], 0000007F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430C2B(C)
|
:00430C42 C785DCD6FFFF00000000    mov dword ptr [ebp+FFFFD6DC], 00000000
:00430C4C E906000000              jmp 00430C57

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430C89(U)
|
:00430C51 FF85DCD6FFFF            inc dword ptr [ebp+FFFFD6DC]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430C4C(U)
|
:00430C57 8B85DCD6FFFF            mov eax, dword ptr [ebp+FFFFD6DC]
:00430C5D 3985E0D6FFFF            cmp dword ptr [ebp+FFFFD6E0], eax
:00430C63 0F8E25000000            jle 00430C8E
:00430C69 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430C6F E8DC290000              call 00433650
:00430C74 8985D8D6FFFF            mov dword ptr [ebp+FFFFD6D8], eax
:00430C7A 8B85D8D6FFFF            mov eax, dword ptr [ebp+FFFFD6D8]
:00430C80 50                      push eax
:00430C81 E8190AFDFF              call 0040169F
:00430C86 83C404                  add esp, 00000004
:00430C89 E9C3FFFFFF              jmp 00430C51

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430C63(C)
|
:00430C8E E9DE130000              jmp 00432071
:00430C93 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430C99 E8B2290000              call 00433650
:00430C9E 8985D0D6FFFF            mov dword ptr [ebp+FFFFD6D0], eax
:00430CA4 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430CAA E8A1290000              call 00433650
:00430CAF 8985D4D6FFFF            mov dword ptr [ebp+FFFFD6D4], eax
:00430CB5 C785C4D6FFFF01000000    mov dword ptr [ebp+FFFFD6C4], 00000001
:00430CBF C785CCD6FFFF00000000    mov dword ptr [ebp+FFFFD6CC], 00000000
:00430CC9 E906000000              jmp 00430CD4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430D0F(U)
|
:00430CCE FF85CCD6FFFF            inc dword ptr [ebp+FFFFD6CC]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430CC9(U)
|
:00430CD4 8B85D4D6FFFF            mov eax, dword ptr [ebp+FFFFD6D4]
:00430CDA 3985CCD6FFFF            cmp dword ptr [ebp+FFFFD6CC], eax
:00430CE0 0F8D2E000000            jnl 00430D14
:00430CE6 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430CEC E85F290000              call 00433650
:00430CF1 8985C8D6FFFF            mov dword ptr [ebp+FFFFD6C8], eax
:00430CF7 8B85C8D6FFFF            mov eax, dword ptr [ebp+FFFFD6C8]
:00430CFD 50                      push eax
:00430CFE 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430D04 E8F7280000              call 00433600
:00430D09 2185C4D6FFFF            and dword ptr [ebp+FFFFD6C4], eax
:00430D0F E9BAFFFFFF              jmp 00430CCE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430CE0(C)
|
:00430D14 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430D1A E831290000              call 00433650
:00430D1F 8985D4D6FFFF            mov dword ptr [ebp+FFFFD6D4], eax
:00430D25 C785CCD6FFFF00000000    mov dword ptr [ebp+FFFFD6CC], 00000000
:00430D2F E906000000              jmp 00430D3A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430D8D(U)
|
:00430D34 FF85CCD6FFFF            inc dword ptr [ebp+FFFFD6CC]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430D2F(U)
|
:00430D3A 8B85D4D6FFFF            mov eax, dword ptr [ebp+FFFFD6D4]
:00430D40 3985CCD6FFFF            cmp dword ptr [ebp+FFFFD6CC], eax
:00430D46 0F8D46000000            jnl 00430D92
:00430D4C 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430D52 E8F9280000              call 00433650
:00430D57 8985C8D6FFFF            mov dword ptr [ebp+FFFFD6C8], eax
:00430D5D 8B85C8D6FFFF            mov eax, dword ptr [ebp+FFFFD6C8]
:00430D63 50                      push eax
:00430D64 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430D6A E891280000              call 00433600
:00430D6F 85C0                    test eax, eax
:00430D71 0F850C000000            jne 00430D83
:00430D77 83A5C4D6FFFF01          and dword ptr [ebp+FFFFD6C4], 00000001
:00430D7E E90A000000              jmp 00430D8D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430D71(C)
|
:00430D83 C785C4D6FFFF00000000    mov dword ptr [ebp+FFFFD6C4], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430D7E(U)
|
:00430D8D E9A2FFFFFF              jmp 00430D34

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430D46(C)
|
:00430D92 817D0801000100          cmp dword ptr [ebp+08], 00010001
:00430D99 0F850B000000            jne 00430DAA
:00430D9F 8B85C4D6FFFF            mov eax, dword ptr [ebp+FFFFD6C4]
:00430DA5 E9FF120000              jmp 004320A9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430D99(C)
|
:00430DAA 83BDC4D6FFFF00          cmp dword ptr [ebp+FFFFD6C4], 00000000
:00430DB1 0F850A000000            jne 00430DC1
:00430DB7 8B85D0D6FFFF            mov eax, dword ptr [ebp+FFFFD6D0]
:00430DBD 668945FC                mov word ptr [ebp-04], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430DB1(C)
|
:00430DC1 E9AB120000              jmp 00432071
:00430DC6 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430DCC E87F280000              call 00433650
:00430DD1 8985BCD6FFFF            mov dword ptr [ebp+FFFFD6BC], eax
:00430DD7 C785C0D6FFFF00000000    mov dword ptr [ebp+FFFFD6C0], 00000000
:00430DE1 E906000000              jmp 00430DEC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00430E51(U), :00430E68(U), :00430E8E(U)
|
:00430DE6 FF85C0D6FFFF            inc dword ptr [ebp+FFFFD6C0]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430DE1(U)
|
:00430DEC 83BDC0D6FFFF2D          cmp dword ptr [ebp+FFFFD6C0], 0000002D
:00430DF3 0F8D9A000000            jnl 00430E93
:00430DF9 8B85C0D6FFFF            mov eax, dword ptr [ebp+FFFFD6C0]
:00430DFF 8BC8                    mov ecx, eax
:00430E01 8D0440                  lea eax, dword ptr [eax+2*eax]
:00430E04 C1E003                  shl eax, 03
:00430E07 2BC1                    sub eax, ecx
:00430E09 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430E0F 81BC0881030000FFFF0000  cmp dword ptr [eax+ecx+00000381], 0000FFFF
:00430E1A 0F846E000000            je 00430E8E
:00430E20 8B85C0D6FFFF            mov eax, dword ptr [ebp+FFFFD6C0]
:00430E26 8BC8                    mov ecx, eax
:00430E28 8D0440                  lea eax, dword ptr [eax+2*eax]
:00430E2B C1E003                  shl eax, 03
:00430E2E 2BC1                    sub eax, ecx
:00430E30 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430E36 F684088703000001        test byte ptr [eax+ecx+00000387], 01
:00430E3E 0F8417000000            je 00430E5B
:00430E44 83BDBCD6FFFF00          cmp dword ptr [ebp+FFFFD6BC], 00000000
:00430E4B 0F8405000000            je 00430E56
:00430E51 E990FFFFFF              jmp 00430DE6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430E4B(C)
|
:00430E56 E912000000              jmp 00430E6D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430E3E(C)
|
:00430E5B 83BDBCD6FFFF00          cmp dword ptr [ebp+FFFFD6BC], 00000000
:00430E62 0F8505000000            jne 00430E6D
:00430E68 E979FFFFFF              jmp 00430DE6

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00430E56(U), :00430E62(C)
|
:00430E6D 8B85C0D6FFFF            mov eax, dword ptr [ebp+FFFFD6C0]
:00430E73 8BC8                    mov ecx, eax
:00430E75 8D0440                  lea eax, dword ptr [eax+2*eax]
:00430E78 C1E003                  shl eax, 03
:00430E7B 2BC1                    sub eax, ecx
:00430E7D 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430E83 C7840881030000FFFF0000  mov dword ptr [eax+ecx+00000381], 0000FFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430E1A(C)
|
:00430E8E E953FFFFFF              jmp 00430DE6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430DF3(C)
|
:00430E93 C785C0D6FFFF00000000    mov dword ptr [ebp+FFFFD6C0], 00000000
:00430E9D E906000000              jmp 00430EA8

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00430FEF(U), :00431317(U)
|
:00430EA2 FF85C0D6FFFF            inc dword ptr [ebp+FFFFD6C0]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430E9D(U)
|
:00430EA8 83BDC0D6FFFF1E          cmp dword ptr [ebp+FFFFD6C0], 0000001E
:00430EAF 0F8D67040000            jnl 0043131C
:00430EB5 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430EBB E8E0270000              call 004336A0
:00430EC0 668985B4D6FFFF          mov word ptr [ebp+FFFFD6B4], ax
:00430EC7 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430ECD E87E270000              call 00433650
:00430ED2 89859CD6FFFF            mov dword ptr [ebp+FFFFD69C], eax
:00430ED8 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430EDE E86D270000              call 00433650
:00430EE3 898594D6FFFF            mov dword ptr [ebp+FFFFD694], eax
:00430EE9 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430EEF E85C270000              call 00433650
:00430EF4 89858CD6FFFF            mov dword ptr [ebp+FFFFD68C], eax
:00430EFA 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430F00 E84B270000              call 00433650
:00430F05 8985B0D6FFFF            mov dword ptr [ebp+FFFFD6B0], eax
:00430F0B 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430F11 E83A270000              call 00433650
:00430F16 8985A0D6FFFF            mov dword ptr [ebp+FFFFD6A0], eax
:00430F1C 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430F22 E829270000              call 00433650
:00430F27 8985B8D6FFFF            mov dword ptr [ebp+FFFFD6B8], eax
:00430F2D 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430F33 E818270000              call 00433650
:00430F38 89857CD6FFFF            mov dword ptr [ebp+FFFFD67C], eax
:00430F3E 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430F44 E857270000              call 004336A0
:00430F49 668985A8D6FFFF          mov word ptr [ebp+FFFFD6A8], ax
:00430F50 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430F56 E8F5260000              call 00433650
:00430F5B 898598D6FFFF            mov dword ptr [ebp+FFFFD698], eax
:00430F61 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430F67 E8E4260000              call 00433650
:00430F6C 898588D6FFFF            mov dword ptr [ebp+FFFFD688], eax
:00430F72 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430F78 E8D3260000              call 00433650
:00430F7D 8885ACD6FFFF            mov byte ptr [ebp+FFFFD6AC], al
:00430F83 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430F89 E8C2260000              call 00433650
:00430F8E 8885A4D6FFFF            mov byte ptr [ebp+FFFFD6A4], al
:00430F94 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430F9A E8B1260000              call 00433650
:00430F9F 888590D6FFFF            mov byte ptr [ebp+FFFFD690], al
:00430FA5 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430FAB E8F0260000              call 004336A0
:00430FB0 66898584D6FFFF          mov word ptr [ebp+FFFFD684], ax
:00430FB7 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430FBD E88E260000              call 00433650
:00430FC2 888580D6FFFF            mov byte ptr [ebp+FFFFD680], al
:00430FC8 83BD8CD6FFFF00          cmp dword ptr [ebp+FFFFD68C], 00000000
:00430FCF 0F841F000000            je 00430FF4
:00430FD5 8B85B0D6FFFF            mov eax, dword ptr [ebp+FFFFD6B0]
:00430FDB 50                      push eax
:00430FDC 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00430FE2 E819260000              call 00433600
:00430FE7 85C0                    test eax, eax
:00430FE9 0F8505000000            jne 00430FF4
:00430FEF E9AEFEFFFF              jmp 00430EA2

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00430FCF(C), :00430FE9(C)
|
:00430FF4 8B85B4D6FFFF            mov eax, dword ptr [ebp+FFFFD6B4]
:00430FFA 25FFFF0000              and eax, 0000FFFF
:00430FFF 83F8FF                  cmp eax, FFFFFFFF
:00431002 0F840F030000            je 00431317
:00431008 C78578D6FFFFFFFFFFFF    mov dword ptr [ebp+FFFFD678], FFFFFFFF
:00431012 C78574D6FFFF00000000    mov dword ptr [ebp+FFFFD674], 00000000
:0043101C E906000000              jmp 00431027

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00431074(U)
|
:00431021 FF8574D6FFFF            inc dword ptr [ebp+FFFFD674]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043101C(U)
|
:00431027 83BD74D6FFFF2D          cmp dword ptr [ebp+FFFFD674], 0000002D
:0043102E 0F8D45000000            jnl 00431079
:00431034 8B8574D6FFFF            mov eax, dword ptr [ebp+FFFFD674]
:0043103A 8BC8                    mov ecx, eax
:0043103C 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043103F C1E003                  shl eax, 03
:00431042 2BC1                    sub eax, ecx
:00431044 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0043104A 81BC0881030000FFFF0000  cmp dword ptr [eax+ecx+00000381], 0000FFFF
:00431055 0F8519000000            jne 00431074
:0043105B 83BD78D6FFFFFF          cmp dword ptr [ebp+FFFFD678], FFFFFFFF
:00431062 0F850C000000            jne 00431074
:00431068 8B8574D6FFFF            mov eax, dword ptr [ebp+FFFFD674]
:0043106E 898578D6FFFF            mov dword ptr [ebp+FFFFD678], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00431055(C), :00431062(C)
|
:00431074 E9A8FFFFFF              jmp 00431021

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043102E(C)
|
:00431079 8B85B4D6FFFF            mov eax, dword ptr [ebp+FFFFD6B4]
:0043107F 25FFFF0000              and eax, 0000FFFF
:00431084 8B8D78D6FFFF            mov ecx, dword ptr [ebp+FFFFD678]
:0043108A 8BD1                    mov edx, ecx
:0043108C 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:0043108F C1E103                  shl ecx, 03
:00431092 2BCA                    sub ecx, edx
:00431094 8B9548C9FFFF            mov edx, dword ptr [ebp+FFFFC948]
:0043109A 89841181030000          mov dword ptr [ecx+edx+00000381], eax
:004310A1 8A859CD6FFFF            mov al, byte ptr [ebp+FFFFD69C]
:004310A7 8B8D78D6FFFF            mov ecx, dword ptr [ebp+FFFFD678]
:004310AD 8BD1                    mov edx, ecx
:004310AF 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:004310B2 C1E103                  shl ecx, 03
:004310B5 2BCA                    sub ecx, edx
:004310B7 8B9548C9FFFF            mov edx, dword ptr [ebp+FFFFC948]
:004310BD 88841185030000          mov byte ptr [ecx+edx+00000385], al
:004310C4 8A8594D6FFFF            mov al, byte ptr [ebp+FFFFD694]
:004310CA 8B8D78D6FFFF            mov ecx, dword ptr [ebp+FFFFD678]
:004310D0 8BD1                    mov edx, ecx
:004310D2 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:004310D5 C1E103                  shl ecx, 03
:004310D8 2BCA                    sub ecx, edx
:004310DA 8B9548C9FFFF            mov edx, dword ptr [ebp+FFFFC948]
:004310E0 88841186030000          mov byte ptr [ecx+edx+00000386], al
:004310E7 8B85A0D6FFFF            mov eax, dword ptr [ebp+FFFFD6A0]
:004310ED 48                      dec eax
:004310EE 83F801                  cmp eax, 00000001
:004310F1 1BC0                    sbb eax, eax
:004310F3 83E004                  and eax, 00000004
:004310F6 83BDBCD6FFFF01          cmp dword ptr [ebp+FFFFD6BC], 00000001
:004310FD 1BC9                    sbb ecx, ecx
:004310FF F7D9                    neg ecx
:00431101 0BC1                    or eax, ecx
:00431103 83BDB8D6FFFF01          cmp dword ptr [ebp+FFFFD6B8], 00000001
:0043110A B900000000              mov ecx, 00000000
:0043110F 83D1FF                  adc ecx, FFFFFFFF
:00431112 83E102                  and ecx, 00000002
:00431115 0BC1                    or eax, ecx
:00431117 8B8D78D6FFFF            mov ecx, dword ptr [ebp+FFFFD678]
:0043111D 8BD1                    mov edx, ecx
:0043111F 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:00431122 C1E103                  shl ecx, 03
:00431125 2BCA                    sub ecx, edx
:00431127 8B9548C9FFFF            mov edx, dword ptr [ebp+FFFFC948]
:0043112D 89841187030000          mov dword ptr [ecx+edx+00000387], eax
:00431134 8A857CD6FFFF            mov al, byte ptr [ebp+FFFFD67C]
:0043113A 8B8D78D6FFFF            mov ecx, dword ptr [ebp+FFFFD678]
:00431140 8BD1                    mov edx, ecx
:00431142 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:00431145 C1E103                  shl ecx, 03
:00431148 2BCA                    sub ecx, edx
:0043114A 8B9548C9FFFF            mov edx, dword ptr [ebp+FFFFC948]
:00431150 8884118B030000          mov byte ptr [ecx+edx+0000038B], al
:00431157 8B857CD6FFFF            mov eax, dword ptr [ebp+FFFFD67C]
:0043115D 898538C9FFFF            mov dword ptr [ebp+FFFFC938], eax
:00431163 E97F000000              jmp 004311E7
:00431168 E9B0000000              jmp 0043121D
:0043116D 668B85A8D6FFFF          mov ax, word ptr [ebp+FFFFD6A8]
:00431174 8B8D78D6FFFF            mov ecx, dword ptr [ebp+FFFFD678]
:0043117A 8BD1                    mov edx, ecx
:0043117C 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:0043117F C1E103                  shl ecx, 03
:00431182 2BCA                    sub ecx, edx
:00431184 8B9548C9FFFF            mov edx, dword ptr [ebp+FFFFC948]
:0043118A 668984118C030000        mov word ptr [ecx+edx+0000038C], ax
:00431192 E986000000              jmp 0043121D
:00431197 8A85A8D6FFFF            mov al, byte ptr [ebp+FFFFD6A8]
:0043119D 8B8D78D6FFFF            mov ecx, dword ptr [ebp+FFFFD678]
:004311A3 8BD1                    mov edx, ecx
:004311A5 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:004311A8 C1E103                  shl ecx, 03
:004311AB 2BCA                    sub ecx, edx
:004311AD 8B9548C9FFFF            mov edx, dword ptr [ebp+FFFFC948]
:004311B3 8884118C030000          mov byte ptr [ecx+edx+0000038C], al
:004311BA 8B85A8D6FFFF            mov eax, dword ptr [ebp+FFFFD6A8]
:004311C0 8B8D78D6FFFF            mov ecx, dword ptr [ebp+FFFFD678]
:004311C6 8BD1                    mov edx, ecx
:004311C8 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:004311CB C1E103                  shl ecx, 03
:004311CE 2BCA                    sub ecx, edx
:004311D0 8B9548C9FFFF            mov edx, dword ptr [ebp+FFFFC948]
:004311D6 88A4118D030000          mov byte ptr [ecx+edx+0000038D], ah
:004311DD E93B000000              jmp 0043121D
:004311E2 E936000000              jmp 0043121D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00431163(U)
|
:004311E7 83BD38C9FFFF06          cmp dword ptr [ebp+FFFFC938], 00000006
:004311EE 0F8729000000            ja 0043121D
:004311F4 8B8538C9FFFF            mov eax, dword ptr [ebp+FFFFC938]
:004311FA FF248501124300          jmp dword ptr [4*eax+00431201]

:00431201 68114300                DWORD 00431168
:00431205 68114300                DWORD 00431168
:00431209 68114300                DWORD 00431168
:0043120D 6D114300                DWORD 0043116D
:00431211 97114300                DWORD 00431197
:00431215 6D114300                DWORD 0043116D
:00431219 97114300                DWORD 00431197



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00431168(U), :00431192(U), :004311DD(U), :004311E2(U), :004311EE(C)
|
:0043121D 8A8598D6FFFF            mov al, byte ptr [ebp+FFFFD698]
:00431223 8B8D78D6FFFF            mov ecx, dword ptr [ebp+FFFFD678]
:00431229 8BD1                    mov edx, ecx
:0043122B 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:0043122E C1E103                  shl ecx, 03
:00431231 2BCA                    sub ecx, edx
:00431233 8B9548C9FFFF            mov edx, dword ptr [ebp+FFFFC948]
:00431239 8884118E030000          mov byte ptr [ecx+edx+0000038E], al
:00431240 8A8588D6FFFF            mov al, byte ptr [ebp+FFFFD688]
:00431246 8B8D78D6FFFF            mov ecx, dword ptr [ebp+FFFFD678]
:0043124C 8BD1                    mov edx, ecx
:0043124E 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:00431251 C1E103                  shl ecx, 03
:00431254 2BCA                    sub ecx, edx
:00431256 8B9548C9FFFF            mov edx, dword ptr [ebp+FFFFC948]
:0043125C 8884118F030000          mov byte ptr [ecx+edx+0000038F], al
:00431263 8A85ACD6FFFF            mov al, byte ptr [ebp+FFFFD6AC]
:00431269 8B8D78D6FFFF            mov ecx, dword ptr [ebp+FFFFD678]
:0043126F 8BD1                    mov edx, ecx
:00431271 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:00431274 C1E103                  shl ecx, 03
:00431277 2BCA                    sub ecx, edx
:00431279 8B9548C9FFFF            mov edx, dword ptr [ebp+FFFFC948]
:0043127F 88841190030000          mov byte ptr [ecx+edx+00000390], al
:00431286 8A85A4D6FFFF            mov al, byte ptr [ebp+FFFFD6A4]
:0043128C 8B8D78D6FFFF            mov ecx, dword ptr [ebp+FFFFD678]
:00431292 8BD1                    mov edx, ecx
:00431294 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:00431297 C1E103                  shl ecx, 03
:0043129A 2BCA                    sub ecx, edx
:0043129C 8B9548C9FFFF            mov edx, dword ptr [ebp+FFFFC948]
:004312A2 88841191030000          mov byte ptr [ecx+edx+00000391], al
:004312A9 8A8590D6FFFF            mov al, byte ptr [ebp+FFFFD690]
:004312AF 8B8D78D6FFFF            mov ecx, dword ptr [ebp+FFFFD678]
:004312B5 8BD1                    mov edx, ecx
:004312B7 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:004312BA C1E103                  shl ecx, 03
:004312BD 2BCA                    sub ecx, edx
:004312BF 8B9548C9FFFF            mov edx, dword ptr [ebp+FFFFC948]
:004312C5 88841192030000          mov byte ptr [ecx+edx+00000392], al
:004312CC 8B8584D6FFFF            mov eax, dword ptr [ebp+FFFFD684]
:004312D2 25FFFF0000              and eax, 0000FFFF
:004312D7 8B8D78D6FFFF            mov ecx, dword ptr [ebp+FFFFD678]
:004312DD 8BD1                    mov edx, ecx
:004312DF 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:004312E2 C1E103                  shl ecx, 03
:004312E5 2BCA                    sub ecx, edx
:004312E7 8B9548C9FFFF            mov edx, dword ptr [ebp+FFFFC948]
:004312ED 89841193030000          mov dword ptr [ecx+edx+00000393], eax
:004312F4 8A8580D6FFFF            mov al, byte ptr [ebp+FFFFD680]
:004312FA 8B8D78D6FFFF            mov ecx, dword ptr [ebp+FFFFD678]
:00431300 8BD1                    mov edx, ecx
:00431302 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:00431305 C1E103                  shl ecx, 03
:00431308 2BCA                    sub ecx, edx
:0043130A 8B9548C9FFFF            mov edx, dword ptr [ebp+FFFFC948]
:00431310 88841197030000          mov byte ptr [ecx+edx+00000397], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00431002(C)
|
:00431317 E986FBFFFF              jmp 00430EA2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430EAF(C)
|
:0043131C E9500D0000              jmp 00432071
:00431321 E882270000              call 00433AA8
:00431326 E9460D0000              jmp 00432071
:0043132B 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431331 E86A230000              call 004336A0
:00431336 6689856CD6FFFF          mov word ptr [ebp+FFFFD66C], ax
:0043133D 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431343 E808230000              call 00433650
:00431348 898570D6FFFF            mov dword ptr [ebp+FFFFD670], eax
:0043134E 8B8570D6FFFF            mov eax, dword ptr [ebp+FFFFD670]
:00431354 50                      push eax
:00431355 8B856CD6FFFF            mov eax, dword ptr [ebp+FFFFD66C]
:0043135B 25FFFF0000              and eax, 0000FFFF
:00431360 0D00020000              or eax, 00000200
:00431365 50                      push eax
:00431366 E892DCFEFF              call 0041EFFD
:0043136B 83C408                  add esp, 00000008
:0043136E E9FE0C0000              jmp 00432071
:00431373 8D8564D2FFFF            lea eax, dword ptr [ebp+FFFFD264]
:00431379 50                      push eax
:0043137A 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431380 E81B230000              call 004336A0
:00431385 50                      push eax
:00431386 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0043138C E8EDCEFFFF              call 0042E27E
:00431391 8D8564D2FFFF            lea eax, dword ptr [ebp+FFFFD264]
:00431397 50                      push eax
:00431398 8D8560CEFFFF            lea eax, dword ptr [ebp+FFFFCE60]
:0043139E 50                      push eax
:0043139F 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:004313A5 E849CFFFFF              call 0042E2F3
:004313AA 8D8520CEFFFF            lea eax, dword ptr [ebp+FFFFCE20]
:004313B0 898568D6FFFF            mov dword ptr [ebp+FFFFD668], eax
:004313B6 8D8560CEFFFF            lea eax, dword ptr [ebp+FFFFCE60]
:004313BC 898564D6FFFF            mov dword ptr [ebp+FFFFD664], eax
:004313C2 C7851CCEFFFF00000000    mov dword ptr [ebp+FFFFCE1C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00431493(U)
|
:004313CC 8B8564D6FFFF            mov eax, dword ptr [ebp+FFFFD664]
:004313D2 33C9                    xor ecx, ecx
:004313D4 8A08                    mov cl, byte ptr [eax]
:004313D6 85C9                    test ecx, ecx
:004313D8 0F84BA000000            je 00431498
:004313DE 8B8564D6FFFF            mov eax, dword ptr [ebp+FFFFD664]
:004313E4 8B8D68D6FFFF            mov ecx, dword ptr [ebp+FFFFD668]
:004313EA 8901                    mov dword ptr [ecx], eax
:004313EC 838568D6FFFF04          add dword ptr [ebp+FFFFD668], 00000004
:004313F3 FF851CCEFFFF            inc dword ptr [ebp+FFFFCE1C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00431437(U)
|
:004313F9 8B8564D6FFFF            mov eax, dword ptr [ebp+FFFFD664]
:004313FF 33C9                    xor ecx, ecx
:00431401 8A08                    mov cl, byte ptr [eax]
:00431403 83F90A                  cmp ecx, 0000000A
:00431406 0F8430000000            je 0043143C
:0043140C 8B8564D6FFFF            mov eax, dword ptr [ebp+FFFFD664]
:00431412 33C9                    xor ecx, ecx
:00431414 8A08                    mov cl, byte ptr [eax]
:00431416 83F90D                  cmp ecx, 0000000D
:00431419 0F841D000000            je 0043143C
:0043141F 8B8564D6FFFF            mov eax, dword ptr [ebp+FFFFD664]
:00431425 33C9                    xor ecx, ecx
:00431427 8A08                    mov cl, byte ptr [eax]
:00431429 85C9                    test ecx, ecx
:0043142B 0F840B000000            je 0043143C
:00431431 FF8564D6FFFF            inc dword ptr [ebp+FFFFD664]
:00431437 E9BDFFFFFF              jmp 004313F9

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00431406(C), :00431419(C), :0043142B(C)
|
:0043143C 8B8564D6FFFF            mov eax, dword ptr [ebp+FFFFD664]
:00431442 33C9                    xor ecx, ecx
:00431444 8A08                    mov cl, byte ptr [eax]
:00431446 85C9                    test ecx, ecx
:00431448 0F8505000000            jne 00431453
:0043144E E945000000              jmp 00431498

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00431448(C)
|
:00431453 8B8564D6FFFF            mov eax, dword ptr [ebp+FFFFD664]
:00431459 C60000                  mov byte ptr [eax], 00
:0043145C FF8564D6FFFF            inc dword ptr [ebp+FFFFD664]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043148E(U)
|
:00431462 8B8564D6FFFF            mov eax, dword ptr [ebp+FFFFD664]
:00431468 33C9                    xor ecx, ecx
:0043146A 8A08                    mov cl, byte ptr [eax]
:0043146C 83F90A                  cmp ecx, 0000000A
:0043146F 0F8413000000            je 00431488
:00431475 8B8564D6FFFF            mov eax, dword ptr [ebp+FFFFD664]
:0043147B 33C9                    xor ecx, ecx
:0043147D 8A08                    mov cl, byte ptr [eax]
:0043147F 83F90D                  cmp ecx, 0000000D
:00431482 0F850B000000            jne 00431493

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043146F(C)
|
:00431488 FF8564D6FFFF            inc dword ptr [ebp+FFFFD664]
:0043148E E9CFFFFFFF              jmp 00431462

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00431482(C)
|
:00431493 E934FFFFFF              jmp 004313CC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004313D8(C), :0043144E(U)
|
:00431498 8B8568D6FFFF            mov eax, dword ptr [ebp+FFFFD668]
:0043149E C70000000000            mov dword ptr [eax], 00000000
:004314A4 6A00                    push 00000000
:004314A6 6A00                    push 00000000
:004314A8 6A00                    push 00000000
:004314AA 6A01                    push 00000001
:004314AC 8B851CCEFFFF            mov eax, dword ptr [ebp+FFFFCE1C]
:004314B2 50                      push eax
:004314B3 8D8520CEFFFF            lea eax, dword ptr [ebp+FFFFCE20]
:004314B9 50                      push eax
:004314BA 6A70                    push 00000070
:004314BC 68E0000000              push 000000E0
:004314C1 E82E690000              call 00437DF4
:004314C6 83C420                  add esp, 00000020
:004314C9 33C9                    xor ecx, ecx
:004314CB 8AC8                    mov cl, al
:004314CD 898D60D2FFFF            mov dword ptr [ebp+FFFFD260], ecx
:004314D3 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:004314D9 8B400C                  mov eax, dword ptr [eax+0C]
:004314DC 038560D2FFFF            add eax, dword ptr [ebp+FFFFD260]
:004314E2 40                      inc eax
:004314E3 50                      push eax
:004314E4 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:004314EA 8B4008                  mov eax, dword ptr [eax+08]
:004314ED 50                      push eax
:004314EE 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:004314F4 83C114                  add ecx, 00000014
:004314F7 E8B4160000              call 00432BB0
:004314FC 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431502 81C14B030000            add ecx, 0000034B
:00431508 8B10                    mov edx, dword ptr [eax]
:0043150A 8911                    mov dword ptr [ecx], edx
:0043150C 8B5004                  mov edx, dword ptr [eax+04]
:0043150F 895104                  mov dword ptr [ecx+04], edx
:00431512 668B4008                mov ax, word ptr [eax+08]
:00431516 66894108                mov word ptr [ecx+08], ax
:0043151A 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:00431520 8B4008                  mov eax, dword ptr [eax+08]
:00431523 50                      push eax
:00431524 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0043152A 83C114                  add ecx, 00000014
:0043152D E86E170000              call 00432CA0
:00431532 0FB7C0                  movzx eax, ax
:00431535 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0043153B 33D2                    xor edx, edx
:0043153D 668B9153030000          mov dx, word ptr [ecx+00000353]
:00431544 03C2                    add eax, edx
:00431546 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0043154C 66898155030000          mov word ptr [ecx+00000355], ax
:00431553 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:00431559 C7805703000000000000    mov dword ptr [ebx+00000357], 00000000
:00431563 E9090B0000              jmp 00432071
:00431568 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0043156E E8DD200000              call 00433650
:00431573 898514CEFFFF            mov dword ptr [ebp+FFFFCE14], eax
:00431579 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0043157F E8CC200000              call 00433650
:00431584 898510CEFFFF            mov dword ptr [ebp+FFFFCE10], eax
:0043158A 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431590 E8BB200000              call 00433650
:00431595 898518CEFFFF            mov dword ptr [ebp+FFFFCE18], eax
:0043159B 8B8518CEFFFF            mov eax, dword ptr [ebp+FFFFCE18]
:004315A1 50                      push eax
:004315A2 8B8510CEFFFF            mov eax, dword ptr [ebp+FFFFCE10]
:004315A8 50                      push eax
:004315A9 8B8514CEFFFF            mov eax, dword ptr [ebp+FFFFCE14]
:004315AF 50                      push eax
:004315B0 B988C04600              mov ecx, 0046C088
:004315B5 E8686CFFFF              call 00428222
:004315BA E9B20A0000              jmp 00432071
:004315BF 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:004315C5 E886200000              call 00433650
:004315CA 898508CEFFFF            mov dword ptr [ebp+FFFFCE08], eax
:004315D0 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:004315D6 E875200000              call 00433650
:004315DB 898504CEFFFF            mov dword ptr [ebp+FFFFCE04], eax
:004315E1 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:004315E7 E864200000              call 00433650
:004315EC 89850CCEFFFF            mov dword ptr [ebp+FFFFCE0C], eax
:004315F2 8B850CCEFFFF            mov eax, dword ptr [ebp+FFFFCE0C]
:004315F8 50                      push eax
:004315F9 8B8504CEFFFF            mov eax, dword ptr [ebp+FFFFCE04]
:004315FF 50                      push eax
:00431600 8B8508CEFFFF            mov eax, dword ptr [ebp+FFFFCE08]
:00431606 50                      push eax
:00431607 B988C04600              mov ecx, 0046C088
:0043160C E8C969FFFF              call 00427FDA
:00431611 E95B0A0000              jmp 00432071
:00431616 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0043161C E87F200000              call 004336A0
:00431621 66898500CEFFFF          mov word ptr [ebp+FFFFCE00], ax
:00431628 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0043162E E81D200000              call 00433650
:00431633 8985FCCDFFFF            mov dword ptr [ebp+FFFFCDFC], eax
:00431639 8B85FCCDFFFF            mov eax, dword ptr [ebp+FFFFCDFC]
:0043163F 50                      push eax
:00431640 8B8500CEFFFF            mov eax, dword ptr [ebp+FFFFCE00]
:00431646 25FFFF0000              and eax, 0000FFFF
:0043164B 50                      push eax
:0043164C B988C04600              mov ecx, 0046C088
:00431651 E8646EFFFF              call 004284BA
:00431656 E9160A0000              jmp 00432071
:0043165B 6A03                    push 00000003
:0043165D B988C04600              mov ecx, 0046C088
:00431662 E8C865FFFF              call 00427C2F
:00431667 B807000000              mov eax, 00000007
:0043166C E9380A0000              jmp 004320A9
:00431671 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431677 E8D41F0000              call 00433650
:0043167C 8985F8CDFFFF            mov dword ptr [ebp+FFFFCDF8], eax
:00431682 B808000000              mov eax, 00000008
:00431687 E91D0A0000              jmp 004320A9
:0043168C 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431692 E8B91F0000              call 00433650
:00431697 8985F4CDFFFF            mov dword ptr [ebp+FFFFCDF4], eax
:0043169D 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:004316A3 E8F81F0000              call 004336A0
:004316A8 668985F0CDFFFF          mov word ptr [ebp+FFFFCDF0], ax
:004316AF 8B85F4CDFFFF            mov eax, dword ptr [ebp+FFFFCDF4]
:004316B5 898534C9FFFF            mov dword ptr [ebp+FFFFC934], eax
:004316BB E9A9000000              jmp 00431769
:004316C0 8B85F0CDFFFF            mov eax, dword ptr [ebp+FFFFCDF0]
:004316C6 25FFFF0000              and eax, 0000FFFF
:004316CB 50                      push eax
:004316CC E864D5FEFF              call 0041EC35
:004316D1 83C404                  add esp, 00000004
:004316D4 E9C2000000              jmp 0043179B
:004316D9 8B85F0CDFFFF            mov eax, dword ptr [ebp+FFFFCDF0]
:004316DF 25FFFF0000              and eax, 0000FFFF
:004316E4 50                      push eax
:004316E5 E88CD5FEFF              call 0041EC76
:004316EA 83C404                  add esp, 00000004
:004316ED E9A9000000              jmp 0043179B
:004316F2 8B85F0CDFFFF            mov eax, dword ptr [ebp+FFFFCDF0]
:004316F8 25FFFF0000              and eax, 0000FFFF
:004316FD 50                      push eax
:004316FE E8B9D5FEFF              call 0041ECBC
:00431703 83C404                  add esp, 00000004
:00431706 E990000000              jmp 0043179B
:0043170B E8F2D5FEFF              call 0041ED02
:00431710 E986000000              jmp 0043179B
:00431715 8B85F0CDFFFF            mov eax, dword ptr [ebp+FFFFCDF0]
:0043171B 25FFFF0000              and eax, 0000FFFF
:00431720 50                      push eax
:00431721 E819D9FEFF              call 0041F03F
:00431726 83C404                  add esp, 00000004
:00431729 E96D000000              jmp 0043179B
:0043172E 8B85F0CDFFFF            mov eax, dword ptr [ebp+FFFFCDF0]
:00431734 25FFFF0000              and eax, 0000FFFF
:00431739 50                      push eax
:0043173A B988C04600              mov ecx, 0046C088
:0043173F E87276FFFF              call 00428DB6
:00431744 E952000000              jmp 0043179B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00431770(C)
|
:00431749 8B85F0CDFFFF            mov eax, dword ptr [ebp+FFFFCDF0]
:0043174F 25FFFF0000              and eax, 0000FFFF
:00431754 50                      push eax
:00431755 B9D0A64600              mov ecx, 0046A6D0
:0043175A E8811B0000              call 004332E0
:0043175F E937000000              jmp 0043179B
:00431764 E932000000              jmp 0043179B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004316BB(U)
|
:00431769 83BD34C9FFFF05          cmp dword ptr [ebp+FFFFC934], 00000005
:00431770 0F87D3FFFFFF            ja 00431749
:00431776 8B8534C9FFFF            mov eax, dword ptr [ebp+FFFFC934]
:0043177C FF248583174300          jmp dword ptr [4*eax+00431783]

:00431783 C0164300                DWORD 004316C0
:00431787 D9164300                DWORD 004316D9
:0043178B F2164300                DWORD 004316F2
:0043178F 0B174300                DWORD 0043170B
:00431793 15174300                DWORD 00431715
:00431797 2E174300                DWORD 0043172E



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004316D4(U), :004316ED(U), :00431706(U), :00431710(U), :00431729(U)
|:00431744(U), :0043175F(U), :00431764(U)
|
:0043179B E9D1080000              jmp 00432071
:004317A0 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:004317A6 33C9                    xor ecx, ecx
:004317A8 668B4812                mov cx, word ptr [eax+12]
:004317AC 81E100F00000            and ecx, 0000F000
:004317B2 898D30C9FFFF            mov dword ptr [ebp+FFFFC930], ecx
:004317B8 E91E000000              jmp 004317DB
:004317BD E94B000000              jmp 0043180D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00431802(C)
|
:004317C2 E83F34FEFF              call 00414C06
:004317C7 E941000000              jmp 0043180D
:004317CC E93C000000              jmp 0043180D
:004317D1 E937000000              jmp 0043180D
:004317D6 E932000000              jmp 0043180D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004317B8(U)
|
:004317DB 83BD30C9FFFF00          cmp dword ptr [ebp+FFFFC930], 00000000
:004317E2 0F8425000000            je 0043180D
:004317E8 81BD30C9FFFF00100000    cmp dword ptr [ebp+FFFFC930], 00001000
:004317F2 0F8415000000            je 0043180D
:004317F8 81BD30C9FFFF00200000    cmp dword ptr [ebp+FFFFC930], 00002000
:00431802 0F84BAFFFFFF            je 004317C2
:00431808 E900000000              jmp 0043180D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004317BD(U), :004317C7(U), :004317CC(U), :004317D1(U), :004317D6(U)
|:004317E2(C), :004317F2(C), :00431808(U)
|
:0043180D E95F080000              jmp 00432071
:00431812 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431818 E8331E0000              call 00433650
:0043181D 8985E8CDFFFF            mov dword ptr [ebp+FFFFCDE8], eax
:00431823 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431829 E8221E0000              call 00433650
:0043182E 8985ECCDFFFF            mov dword ptr [ebp+FFFFCDEC], eax
:00431834 8B85ECCDFFFF            mov eax, dword ptr [ebp+FFFFCDEC]
:0043183A 50                      push eax
:0043183B 8B85E8CDFFFF            mov eax, dword ptr [ebp+FFFFCDE8]
:00431841 50                      push eax
:00431842 B988C04600              mov ecx, 0046C088
:00431847 E8D46EFFFF              call 00428720
:0043184C E920080000              jmp 00432071
:00431851 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431857 E8441E0000              call 004336A0
:0043185C 668985E0CDFFFF          mov word ptr [ebp+FFFFCDE0], ax
:00431863 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431869 E8E21D0000              call 00433650
:0043186E 8985DCCDFFFF            mov dword ptr [ebp+FFFFCDDC], eax
:00431874 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0043187A E8D11D0000              call 00433650
:0043187F 8985D8CDFFFF            mov dword ptr [ebp+FFFFCDD8], eax
:00431885 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0043188B E8C01D0000              call 00433650
:00431890 8985E4CDFFFF            mov dword ptr [ebp+FFFFCDE4], eax
:00431896 8B85E0CDFFFF            mov eax, dword ptr [ebp+FFFFCDE0]
:0043189C 25FFFF0000              and eax, 0000FFFF
:004318A1 3DFFFF0000              cmp eax, 0000FFFF
:004318A6 0F8509000000            jne 004318B5
:004318AC 66C785E0CDFFFF0000      mov word ptr [ebp+FFFFCDE0], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004318A6(C)
|
:004318B5 8B85E0CDFFFF            mov eax, dword ptr [ebp+FFFFCDE0]
:004318BB 25FFFF0000              and eax, 0000FFFF
:004318C0 50                      push eax
:004318C1 E8F1FEFCFF              call 004017B7
:004318C6 83C404                  add esp, 00000004
:004318C9 E9A3070000              jmp 00432071
:004318CE 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:004318D4 E8C71D0000              call 004336A0
:004318D9 668985D4CDFFFF          mov word ptr [ebp+FFFFCDD4], ax
:004318E0 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:004318E6 E8651D0000              call 00433650
:004318EB 8985D0CDFFFF            mov dword ptr [ebp+FFFFCDD0], eax
:004318F1 8B85D0CDFFFF            mov eax, dword ptr [ebp+FFFFCDD0]
:004318F7 50                      push eax
:004318F8 8B85D4CDFFFF            mov eax, dword ptr [ebp+FFFFCDD4]
:004318FE 25FFFF0000              and eax, 0000FFFF
:00431903 0D00020000              or eax, 00000200
:00431908 50                      push eax
:00431909 E866FEFCFF              call 00401774
:0043190E 83C408                  add esp, 00000008
:00431911 E95B070000              jmp 00432071
:00431916 8D85D0C9FFFF            lea eax, dword ptr [ebp+FFFFC9D0]
:0043191C 50                      push eax
:0043191D 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431923 E8781D0000              call 004336A0
:00431928 50                      push eax
:00431929 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0043192F E84AC9FFFF              call 0042E27E
:00431934 8D85D0C9FFFF            lea eax, dword ptr [ebp+FFFFC9D0]
:0043193A 50                      push eax
:0043193B 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:00431941 0598070000              add eax, 00000798
:00431946 50                      push eax
:00431947 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0043194D E8A1C9FFFF              call 0042E2F3
:00431952 E91A070000              jmp 00432071
:00431957 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0043195D E8EE1C0000              call 00433650
:00431962 8885C8C9FFFF            mov byte ptr [ebp+FFFFC9C8], al
:00431968 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0043196E E8DD1C0000              call 00433650
:00431973 8885C4C9FFFF            mov byte ptr [ebp+FFFFC9C4], al
:00431979 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:0043197F E8CC1C0000              call 00433650
:00431984 8885C0C9FFFF            mov byte ptr [ebp+FFFFC9C0], al
:0043198A 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431990 E8BB1C0000              call 00433650
:00431995 8885BCC9FFFF            mov byte ptr [ebp+FFFFC9BC], al
:0043199B C785CCC9FFFF00000000    mov dword ptr [ebp+FFFFC9CC], 00000000
:004319A5 33C0                    xor eax, eax
:004319A7 8A85C8C9FFFF            mov al, byte ptr [ebp+FFFFC9C8]
:004319AD 89852CC9FFFF            mov dword ptr [ebp+FFFFC92C], eax
:004319B3 E914010000              jmp 00431ACC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00431AD3(C)
|
:004319B8 B9D0A64600              mov ecx, 0046A6D0
:004319BD E8BED9FEFF              call 0041F380
:004319C2 33C9                    xor ecx, ecx
:004319C4 8A8DC4C9FFFF            mov cl, byte ptr [ebp+FFFFC9C4]
:004319CA 3BC1                    cmp eax, ecx
:004319CC 0F830F000000            jnb 004319E1
:004319D2 C785CCC9FFFF01000000    mov dword ptr [ebp+FFFFC9CC], 00000001
:004319DC E90A000000              jmp 004319EB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004319CC(C)
|
:004319E1 C785CCC9FFFF00000000    mov dword ptr [ebp+FFFFC9CC], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004319DC(U)
|
:004319EB 33C0                    xor eax, eax
:004319ED 8A85C0C9FFFF            mov al, byte ptr [ebp+FFFFC9C0]
:004319F3 3B85CCC9FFFF            cmp eax, dword ptr [ebp+FFFFC9CC]
:004319F9 0F840C000000            je 00431A0B
:004319FF 660FB685BCC9FFFF        movzx ax, byte ptr [ebp+FFFFC9BC]
:00431A07 668945FC                mov word ptr [ebp-04], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004319F9(C)
|
:00431A0B E9E8000000              jmp 00431AF8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00431AE0(C)
|
:00431A10 B9D0A64600              mov ecx, 0046A6D0
:00431A15 E886D9FEFF              call 0041F3A0
:00431A1A 33C9                    xor ecx, ecx
:00431A1C 8A8DC4C9FFFF            mov cl, byte ptr [ebp+FFFFC9C4]
:00431A22 3BC1                    cmp eax, ecx
:00431A24 0F830F000000            jnb 00431A39
:00431A2A C785CCC9FFFF01000000    mov dword ptr [ebp+FFFFC9CC], 00000001
:00431A34 E90A000000              jmp 00431A43

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00431A24(C)
|
:00431A39 C785CCC9FFFF00000000    mov dword ptr [ebp+FFFFC9CC], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00431A34(U)
|
:00431A43 33C0                    xor eax, eax
:00431A45 8A85C0C9FFFF            mov al, byte ptr [ebp+FFFFC9C0]
:00431A4B 3B85CCC9FFFF            cmp eax, dword ptr [ebp+FFFFC9CC]
:00431A51 0F840C000000            je 00431A63
:00431A57 660FB685BCC9FFFF        movzx ax, byte ptr [ebp+FFFFC9BC]
:00431A5F 668945FC                mov word ptr [ebp-04], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00431A51(C)
|
:00431A63 E990000000              jmp 00431AF8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00431AED(C)
|
:00431A68 6A09                    push 00000009
:00431A6A 6A00                    push 00000000
:00431A6C E8AFA3FDFF              call 0040BE20
:00431A71 83C408                  add esp, 00000008
:00431A74 33C9                    xor ecx, ecx
:00431A76 8A8DC4C9FFFF            mov cl, byte ptr [ebp+FFFFC9C4]
:00431A7C 3BC1                    cmp eax, ecx
:00431A7E 0F8D0F000000            jnl 00431A93
:00431A84 C785CCC9FFFF01000000    mov dword ptr [ebp+FFFFC9CC], 00000001
:00431A8E E90A000000              jmp 00431A9D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00431A7E(C)
|
:00431A93 C785CCC9FFFF00000000    mov dword ptr [ebp+FFFFC9CC], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00431A8E(U)
|
:00431A9D 33C0                    xor eax, eax
:00431A9F 8A85C0C9FFFF            mov al, byte ptr [ebp+FFFFC9C0]
:00431AA5 3B85CCC9FFFF            cmp eax, dword ptr [ebp+FFFFC9CC]
:00431AAB 0F840C000000            je 00431ABD
:00431AB1 660FB685BCC9FFFF        movzx ax, byte ptr [ebp+FFFFC9BC]
:00431AB9 668945FC                mov word ptr [ebp-04], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00431AAB(C)
|
:00431ABD E936000000              jmp 00431AF8
:00431AC2 E931000000              jmp 00431AF8
:00431AC7 E92C000000              jmp 00431AF8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004319B3(U)
|
:00431ACC 83BD2CC9FFFF00          cmp dword ptr [ebp+FFFFC92C], 00000000
:00431AD3 0F84DFFEFFFF            je 004319B8
:00431AD9 83BD2CC9FFFF01          cmp dword ptr [ebp+FFFFC92C], 00000001
:00431AE0 0F842AFFFFFF            je 00431A10
:00431AE6 83BD2CC9FFFF02          cmp dword ptr [ebp+FFFFC92C], 00000002
:00431AED 0F8475FFFFFF            je 00431A68
:00431AF3 E900000000              jmp 00431AF8

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00431A0B(U), :00431A63(U), :00431ABD(U), :00431AC2(U), :00431AC7(U)
|:00431AF3(U)
|
:00431AF8 E974050000              jmp 00432071
:00431AFD 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431B03 E8481B0000              call 00433650
:00431B08 8885A0C9FFFF            mov byte ptr [ebp+FFFFC9A0], al
:00431B0E 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431B14 E8871B0000              call 004336A0
:00431B19 668985B0C9FFFF          mov word ptr [ebp+FFFFC9B0], ax
:00431B20 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431B26 E8251B0000              call 00433650
:00431B2B 8885ACC9FFFF            mov byte ptr [ebp+FFFFC9AC], al
:00431B31 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431B37 E8141B0000              call 00433650
:00431B3C 8885A8C9FFFF            mov byte ptr [ebp+FFFFC9A8], al
:00431B42 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431B48 E8031B0000              call 00433650
:00431B4D 88859CC9FFFF            mov byte ptr [ebp+FFFFC99C], al
:00431B53 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431B59 E8F21A0000              call 00433650
:00431B5E 888598C9FFFF            mov byte ptr [ebp+FFFFC998], al
:00431B64 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431B6A E8E11A0000              call 00433650
:00431B6F 8885B4C9FFFF            mov byte ptr [ebp+FFFFC9B4], al
:00431B75 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431B7B E8D01A0000              call 00433650
:00431B80 8885B8C9FFFF            mov byte ptr [ebp+FFFFC9B8], al
:00431B86 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431B8C E8BF1A0000              call 00433650
:00431B91 8885A4C9FFFF            mov byte ptr [ebp+FFFFC9A4], al
:00431B97 33C0                    xor eax, eax
:00431B99 8A85A0C9FFFF            mov al, byte ptr [ebp+FFFFC9A0]
:00431B9F 85C0                    test eax, eax
:00431BA1 0F852B000000            jne 00431BD2
:00431BA7 6A01                    push 00000001
:00431BA9 8B85A4C9FFFF            mov eax, dword ptr [ebp+FFFFC9A4]
:00431BAF 50                      push eax
:00431BB0 8B85B8C9FFFF            mov eax, dword ptr [ebp+FFFFC9B8]
:00431BB6 50                      push eax
:00431BB7 8B85B0C9FFFF            mov eax, dword ptr [ebp+FFFFC9B0]
:00431BBD 25FFFF0000              and eax, 0000FFFF
:00431BC2 50                      push eax
:00431BC3 B988C04600              mov ecx, 0046C088
:00431BC8 E83E6EFFFF              call 00428A0B
:00431BCD E94B000000              jmp 00431C1D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00431BA1(C)
|
:00431BD2 33C0                    xor eax, eax
:00431BD4 8A85A0C9FFFF            mov al, byte ptr [ebp+FFFFC9A0]
:00431BDA 85C0                    test eax, eax
:00431BDC 0F843B000000            je 00431C1D
:00431BE2 8B85A4C9FFFF            mov eax, dword ptr [ebp+FFFFC9A4]
:00431BE8 50                      push eax
:00431BE9 8B85B8C9FFFF            mov eax, dword ptr [ebp+FFFFC9B8]
:00431BEF 50                      push eax
:00431BF0 8B85B4C9FFFF            mov eax, dword ptr [ebp+FFFFC9B4]
:00431BF6 50                      push eax
:00431BF7 8B8598C9FFFF            mov eax, dword ptr [ebp+FFFFC998]
:00431BFD 50                      push eax
:00431BFE 8B859CC9FFFF            mov eax, dword ptr [ebp+FFFFC99C]
:00431C04 50                      push eax
:00431C05 8B85A8C9FFFF            mov eax, dword ptr [ebp+FFFFC9A8]
:00431C0B 50                      push eax
:00431C0C 8B85ACC9FFFF            mov eax, dword ptr [ebp+FFFFC9AC]
:00431C12 50                      push eax
:00431C13 B988C04600              mov ecx, 0046C088
:00431C18 E83A70FFFF              call 00428C57

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00431BCD(U), :00431BDC(C)
|
:00431C1D E94F040000              jmp 00432071
:00431C22 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431C28 E8231A0000              call 00433650
:00431C2D 898590C9FFFF            mov dword ptr [ebp+FFFFC990], eax
:00431C33 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431C39 E8121A0000              call 00433650
:00431C3E 898594C9FFFF            mov dword ptr [ebp+FFFFC994], eax
:00431C44 8B8594C9FFFF            mov eax, dword ptr [ebp+FFFFC994]
:00431C4A 50                      push eax
:00431C4B 8B8590C9FFFF            mov eax, dword ptr [ebp+FFFFC990]
:00431C51 50                      push eax
:00431C52 B994A64600              mov ecx, 0046A694
:00431C57 E81474FEFF              call 00419070
:00431C5C E910040000              jmp 00432071
:00431C61 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431C67 E8E4190000              call 00433650
:00431C6C 89858CC9FFFF            mov dword ptr [ebp+FFFFC98C], eax
:00431C72 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431C78 E8D3190000              call 00433650
:00431C7D 898580C9FFFF            mov dword ptr [ebp+FFFFC980], eax
:00431C83 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431C89 E8C2190000              call 00433650
:00431C8E 898584C9FFFF            mov dword ptr [ebp+FFFFC984], eax
:00431C94 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431C9A E8B1190000              call 00433650
:00431C9F 898588C9FFFF            mov dword ptr [ebp+FFFFC988], eax
:00431CA5 8B8588C9FFFF            mov eax, dword ptr [ebp+FFFFC988]
:00431CAB 50                      push eax
:00431CAC 8B8584C9FFFF            mov eax, dword ptr [ebp+FFFFC984]
:00431CB2 50                      push eax
:00431CB3 8B8580C9FFFF            mov eax, dword ptr [ebp+FFFFC980]
:00431CB9 50                      push eax
:00431CBA 8B858CC9FFFF            mov eax, dword ptr [ebp+FFFFC98C]
:00431CC0 50                      push eax
:00431CC1 E818D0FDFF              call 0040ECDE
:00431CC6 83C410                  add esp, 00000010
:00431CC9 E9A3030000              jmp 00432071
:00431CCE B900E54600              mov ecx, 0046E500
:00431CD3 E80874FDFF              call 004090E0
:00431CD8 50                      push eax
:00431CD9 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431CDF E81ACFFFFF              call 0042EBFE
:00431CE4 50                      push eax
:00431CE5 E84580FDFF              call 00409D2F
:00431CEA 83C404                  add esp, 00000004
:00431CED E97F030000              jmp 00432071
:00431CF2 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431CF8 E8A3190000              call 004336A0
:00431CFD 6689857CC9FFFF          mov word ptr [ebp+FFFFC97C], ax
:00431D04 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431D0A E841190000              call 00433650
:00431D0F 898578C9FFFF            mov dword ptr [ebp+FFFFC978], eax
:00431D15 68FFFF0000              push 0000FFFF
:00431D1A 8B8578C9FFFF            mov eax, dword ptr [ebp+FFFFC978]
:00431D20 50                      push eax
:00431D21 8B857CC9FFFF            mov eax, dword ptr [ebp+FFFFC97C]
:00431D27 25FFFF0000              and eax, 0000FFFF
:00431D2C 0D00020000              or eax, 00000200
:00431D31 50                      push eax
:00431D32 E8C22FFEFF              call 00414CF9
:00431D37 83C40C                  add esp, 0000000C
:00431D3A E932030000              jmp 00432071
:00431D3F 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431D45 E856190000              call 004336A0
:00431D4A 66898574C9FFFF          mov word ptr [ebp+FFFFC974], ax
:00431D51 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431D57 E8F4180000              call 00433650
:00431D5C 89856CC9FFFF            mov dword ptr [ebp+FFFFC96C], eax
:00431D62 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431D68 E8E3180000              call 00433650
:00431D6D 898570C9FFFF            mov dword ptr [ebp+FFFFC970], eax
:00431D73 8B8570C9FFFF            mov eax, dword ptr [ebp+FFFFC970]
:00431D79 50                      push eax
:00431D7A 8B856CC9FFFF            mov eax, dword ptr [ebp+FFFFC96C]
:00431D80 50                      push eax
:00431D81 8B8574C9FFFF            mov eax, dword ptr [ebp+FFFFC974]
:00431D87 25FFFF0000              and eax, 0000FFFF
:00431D8C 0D00020000              or eax, 00000200
:00431D91 50                      push eax
:00431D92 E8622FFEFF              call 00414CF9
:00431D97 83C40C                  add esp, 0000000C
:00431D9A E9D2020000              jmp 00432071
:00431D9F 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431DA5 E8A6180000              call 00433650
:00431DAA 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431DB0 898167030000            mov dword ptr [ecx+00000367], eax
:00431DB6 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:00431DBC 8B8067030000            mov eax, dword ptr [eax+00000367]
:00431DC2 50                      push eax
:00431DC3 B990A64600              mov ecx, 0046A690
:00431DC8 E8FD70FEFF              call 00418ECA
:00431DCD E99F020000              jmp 00432071
:00431DD2 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431DD8 E8C3180000              call 004336A0
:00431DDD 66898568C9FFFF          mov word ptr [ebp+FFFFC968], ax
:00431DE4 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431DEA E861180000              call 00433650
:00431DEF 898564C9FFFF            mov dword ptr [ebp+FFFFC964], eax
:00431DF5 8B8564C9FFFF            mov eax, dword ptr [ebp+FFFFC964]
:00431DFB 50                      push eax
:00431DFC 8B8568C9FFFF            mov eax, dword ptr [ebp+FFFFC968]
:00431E02 25FFFF0000              and eax, 0000FFFF
:00431E07 8D0440                  lea eax, dword ptr [eax+2*eax]
:00431E0A 03C0                    add eax, eax
:00431E0C 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:00431E13 E89CA9FDFF              call 0040C7B4
:00431E18 E954020000              jmp 00432071
:00431E1D 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431E23 E878180000              call 004336A0
:00431E28 6689855CC9FFFF          mov word ptr [ebp+FFFFC95C], ax
:00431E2F 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431E35 E816180000              call 00433650
:00431E3A 898560C9FFFF            mov dword ptr [ebp+FFFFC960], eax
:00431E40 8B8560C9FFFF            mov eax, dword ptr [ebp+FFFFC960]
:00431E46 50                      push eax
:00431E47 8B855CC9FFFF            mov eax, dword ptr [ebp+FFFFC95C]
:00431E4D 25FFFF0000              and eax, 0000FFFF
:00431E52 8D0440                  lea eax, dword ptr [eax+2*eax]
:00431E55 03C0                    add eax, eax
:00431E57 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:00431E5E E84D77FDFF              call 004095B0
:00431E63 E909020000              jmp 00432071
:00431E68 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431E6E E8DD170000              call 00433650
:00431E73 898558C9FFFF            mov dword ptr [ebp+FFFFC958], eax
:00431E79 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431E7F E8CC170000              call 00433650
:00431E84 898554C9FFFF            mov dword ptr [ebp+FFFFC954], eax
:00431E8A 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:00431E90 C7805703000001000000    mov dword ptr [ebx+00000357], 00000001
:00431E9A 33C0                    xor eax, eax
:00431E9C E908020000              jmp 004320A9
:00431EA1 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431EA7 E8F4170000              call 004336A0
:00431EAC 0FB7C0                  movzx eax, ax
:00431EAF 898550C9FFFF            mov dword ptr [ebp+FFFFC950], eax
:00431EB5 E9B7010000              jmp 00432071
:00431EBA 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431EC0 E88B170000              call 00433650
:00431EC5 89854CC9FFFF            mov dword ptr [ebp+FFFFC94C], eax
:00431ECB 83BD4CC9FFFF00          cmp dword ptr [ebp+FFFFC94C], 00000000
:00431ED2 0F841C000000            je 00431EF4
:00431ED8 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:00431EDE C7805703000001000000    mov dword ptr [ebx+00000357], 00000001
:00431EE8 E817E7FDFF              call 00410604
:00431EED 33C0                    xor eax, eax
:00431EEF E9B5010000              jmp 004320A9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00431ED2(C)
|
:00431EF4 E80BE7FDFF              call 00410604
:00431EF9 E973010000              jmp 00432071

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00431F54(C)
|
:00431EFE 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:00431F04 8B400C                  mov eax, dword ptr [eax+0C]
:00431F07 50                      push eax
:00431F08 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:00431F0E 8B4008                  mov eax, dword ptr [eax+08]
:00431F11 50                      push eax
:00431F12 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431F18 83C114                  add ecx, 00000014
:00431F1B E8BBC1FFFF              call 0042E0DB
:00431F20 A880                    test al, 80
:00431F22 0F850B000000            jne 00431F33
:00431F28 8B8D48C9FFFF            mov ecx, dword ptr [ebp+FFFFC948]
:00431F2E E8BD140000              call 004333F0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00431F22(C)
|
:00431F33 C745F000000000          mov [ebp-10], 00000000
:00431F3A E932010000              jmp 00432071
:00431F3F E92D010000              jmp 00432071

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FE7F(U)
|
:00431F44 81BD40C9FFFFFF000000    cmp dword ptr [ebp+FFFFC940], 000000FF
:00431F4E 0F8F1D010000            jg 00432071
:00431F54 0F84A4FFFFFF            je 00431EFE
:00431F5A 83BD40C9FFFF3D          cmp dword ptr [ebp+FFFFC940], 0000003D
:00431F61 0F870A010000            ja 00432071
:00431F67 8B8540C9FFFF            mov eax, dword ptr [ebp+FFFFC940]
:00431F6D FF2485741F4300          jmp dword ptr [4*eax+00431F74]
:00431F74 84FE                    test dh, bh
:00431F76 42                      inc edx
:00431F77 00BDFE420076            add byte ptr [ebp+760042FE], bh
:00431F7D FF4200                  inc [edx+00]
:00431F80 91                      xchg eax,ecx
:00431F81 FF4200                  inc [edx+00]

:00431F84 AA024300                DWORD 004302AA
:00431F88 AF024300                DWORD 004302AF
:00431F8C D1024300                DWORD 004302D1
:00431F90 E1024300                DWORD 004302E1
:00431F94 0F034300                DWORD 0043030F
:00431F98 BB034300                DWORD 004303BB
:00431F9C EA034300                DWORD 004303EA
:00431FA0 97044300                DWORD 00430497
:00431FA4 F7044300                DWORD 004304F7
:00431FA8 5A054300                DWORD 0043055A
:00431FAC A5054300                DWORD 004305A5
:00431FB0 F0054300                DWORD 004305F0
:00431FB4 33064300                DWORD 00430633
:00431FB8 88064300                DWORD 00430688
:00431FBC DA064300                DWORD 004306DA
:00431FC0 3A074300                DWORD 0043073A
:00431FC4 4F074300                DWORD 0043074F
:00431FC8 A9074300                DWORD 004307A9
:00431FCC 05084300                DWORD 00430805
:00431FD0 88084300                DWORD 00430888
:00431FD4 DA084300                DWORD 004308DA
:00431FD8 71204300                DWORD 00432071
:00431FDC C3094300                DWORD 004309C3
:00431FE0 F9094300                DWORD 004309F9
:00431FE4 5F0A4300                DWORD 00430A5F
:00431FE8 A10B4300                DWORD 00430BA1
:00431FEC F90B4300                DWORD 00430BF9
:00431FF0 090C4300                DWORD 00430C09
:00431FF4 130C4300                DWORD 00430C13
:00431FF8 930C4300                DWORD 00430C93
:00431FFC C60D4300                DWORD 00430DC6
:00432000 21134300                DWORD 00431321
:00432004 2B134300                DWORD 0043132B
:00432008 73134300                DWORD 00431373
:0043200C 68154300                DWORD 00431568
:00432010 BF154300                DWORD 004315BF
:00432014 16164300                DWORD 00431616
:00432018 5B164300                DWORD 0043165B
:0043201C 71164300                DWORD 00431671
:00432020 8C164300                DWORD 0043168C
:00432024 A0174300                DWORD 004317A0
:00432028 12184300                DWORD 00431812
:0043202C 51184300                DWORD 00431851
:00432030 CE184300                DWORD 004318CE
:00432034 16194300                DWORD 00431916
:00432038 57194300                DWORD 00431957
:0043203C FD1A4300                DWORD 00431AFD
:00432040 221C4300                DWORD 00431C22
:00432044 F21C4300                DWORD 00431CF2
:00432048 611C4300                DWORD 00431C61
:0043204C CE1C4300                DWORD 00431CCE
:00432050 3F1D4300                DWORD 00431D3F
:00432054 9F1D4300                DWORD 00431D9F
:00432058 D21D4300                DWORD 00431DD2
:0043205C 1D1E4300                DWORD 00431E1D
:00432060 681E4300                DWORD 00431E68
:00432064 A11E4300                DWORD 00431EA1
:00432068 BA1E4300                DWORD 00431EBA


:0043206C E900000000              jmp 00432071

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042FEB8(U), :0042FF71(U), :0042FF8C(U), :004302A5(U), :004302AA(U)
|:004302DC(U), :0043030A(U), :004303B6(U), :00430492(U), :004304F2(U)
|:00430555(U), :004305A0(U), :004305EB(U), :0043062E(U), :00430683(U)
|:004306D5(U), :00430735(U), :00430781(U), :004307A4(U), :00430800(U)
|:00430883(U), :004308D5(U), :004309BE(U), :004309F4(U), :00430A5A(U)
|:00430A9A(U), :00430B9C(U), :00430BF4(U), :00430C04(U), :00430C0E(U)
|:00430C8E(U), :00430DC1(U), :0043131C(U), :00431326(U), :0043136E(U)
|:00431563(U), :004315BA(U), :00431611(U), :00431656(U), :0043180D(U)
|:0043184C(U), :004318C9(U), :00431911(U), :00431952(U), :00431AF8(U)
|:00431C1D(U), :00431C5C(U), :00431CC9(U), :00431CED(U), :00431D3A(U)
|:00431D9A(U), :00431DCD(U), :00431E18(U), :00431E63(U), :00431EB5(U)
|:00431EF9(U), :00431F3A(U), :00431F3F(U), :00431F4E(C), :00431F61(C)
|
:00432071 E9B0DCFFFF              jmp 0042FD26

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FD2A(C)
|
:00432076 837DE400                cmp dword ptr [ebp-1C], 00000000
:0043207A 0F8422000000            je 004320A2
:00432080 8B8548C9FFFF            mov eax, dword ptr [ebp+FFFFC948]
:00432086 33C9                    xor ecx, ecx
:00432088 668B4812                mov cx, word ptr [eax+12]
:0043208C 80E5F0                  and ch, F0
:0043208F 80FD10                  cmp ch, 10
:00432092 0F840A000000            je 004320A2
:00432098 B801000000              mov eax, 00000001
:0043209D E902000000              jmp 004320A4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043207A(C), :00432092(C)
|
:004320A2 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043209D(U)
|
:004320A4 E900000000              jmp 004320A9

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042FBBC(U), :0042FCEE(U), :0042FF6C(U), :004302CC(U), :004303E5(U)
|:0043074A(U), :00430DA5(U), :0043166C(U), :00431687(U), :00431E9C(U)
|:00431EEF(U), :004320A4(U)
|
:004320A9 5F                      pop edi
:004320AA 5E                      pop esi
:004320AB 5B                      pop ebx
:004320AC C9                      leave
:004320AD C20400                  ret 0004



* Referenced by a CALL at Address:
|:004302B5   
|
:004320B0 55                      push ebp
:004320B1 8BEC                    mov ebp, esp
:004320B3 83EC08                  sub esp, 00000008
:004320B6 53                      push ebx
:004320B7 56                      push esi
:004320B8 57                      push edi
:004320B9 894DFC                  mov dword ptr [ebp-04], ecx
:004320BC 8B45FC                  mov eax, dword ptr [ebp-04]
:004320BF 33C9                    xor ecx, ecx
:004320C1 668B4812                mov cx, word ptr [eax+12]
:004320C5 81E100F00000            and ecx, 0000F000
:004320CB 894DF8                  mov dword ptr [ebp-08], ecx
:004320CE E928000000              jmp 004320FB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043210F(C)
|
:004320D3 E8452BFEFF              call 00414C1D
:004320D8 E94A000000              jmp 00432127
:004320DD E945000000              jmp 00432127

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043211C(C)
|
:004320E2 B988C04600              mov ecx, 0046C088
:004320E7 E8D85BFFFF              call 00427CC4
:004320EC E936000000              jmp 00432127
:004320F1 E931000000              jmp 00432127
:004320F6 E92C000000              jmp 00432127

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004320CE(U)
|
:004320FB 817DF800100000          cmp dword ptr [ebp-08], 00001000
:00432102 0F8E1F000000            jle 00432127
:00432108 817DF800200000          cmp dword ptr [ebp-08], 00002000
:0043210F 0F84BEFFFFFF            je 004320D3
:00432115 817DF800300000          cmp dword ptr [ebp-08], 00003000
:0043211C 0F84C0FFFFFF            je 004320E2
:00432122 E900000000              jmp 00432127

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004320D8(U), :004320DD(U), :004320EC(U), :004320F1(U), :004320F6(U)
|:00432102(C), :00432122(U)
|
:00432127 33C0                    xor eax, eax
:00432129 E900000000              jmp 0043212E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432129(U)
|
:0043212E 5F                      pop edi
:0043212F 5E                      pop esi
:00432130 5B                      pop ebx
:00432131 C9                      leave
:00432132 C3                      ret



* Referenced by a CALL at Address:
|:004302D7   
|
:00432133 55                      push ebp
:00432134 8BEC                    mov ebp, esp
:00432136 83EC08                  sub esp, 00000008
:00432139 53                      push ebx
:0043213A 56                      push esi
:0043213B 57                      push edi
:0043213C 894DFC                  mov dword ptr [ebp-04], ecx
:0043213F 8B45FC                  mov eax, dword ptr [ebp-04]
:00432142 33C9                    xor ecx, ecx
:00432144 668B4812                mov cx, word ptr [eax+12]
:00432148 81E100F00000            and ecx, 0000F000
:0043214E 894DF8                  mov dword ptr [ebp-08], ecx
:00432151 E91E000000              jmp 00432174

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432188(C)
|
:00432156 E8A34BFFFF              call 00426CFE
:0043215B E933000000              jmp 00432193
:00432160 E92E000000              jmp 00432193
:00432165 E929000000              jmp 00432193
:0043216A E924000000              jmp 00432193
:0043216F E91F000000              jmp 00432193

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432151(U)
|
:00432174 817DF800100000          cmp dword ptr [ebp-08], 00001000
:0043217B 0F8E12000000            jle 00432193
:00432181 817DF800200000          cmp dword ptr [ebp-08], 00002000
:00432188 0F84C8FFFFFF            je 00432156
:0043218E E900000000              jmp 00432193

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043215B(U), :00432160(U), :00432165(U), :0043216A(U), :0043216F(U)
|:0043217B(C), :0043218E(U)
|
:00432193 33C0                    xor eax, eax
:00432195 E900000000              jmp 0043219A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432195(U)
|
:0043219A 5F                      pop edi
:0043219B 5E                      pop esi
:0043219C 5B                      pop ebx
:0043219D C9                      leave
:0043219E C3                      ret



* Referenced by a CALL at Addresses:
|:0042FEB3   , :004307B5   
|
:0043219F 55                      push ebp
:004321A0 8BEC                    mov ebp, esp
:004321A2 81EC14080000            sub esp, 00000814
:004321A8 53                      push ebx
:004321A9 56                      push esi
:004321AA 57                      push edi
:004321AB 898DECF7FFFF            mov dword ptr [ebp+FFFFF7EC], ecx
:004321B1 8D85F8FBFFFF            lea eax, dword ptr [ebp+FFFFFBF8]
:004321B7 50                      push eax
:004321B8 8B4508                  mov eax, dword ptr [ebp+08]
:004321BB 50                      push eax
:004321BC 8B8DECF7FFFF            mov ecx, dword ptr [ebp+FFFFF7EC]
:004321C2 E8B7C0FFFF              call 0042E27E
:004321C7 8D85F8FBFFFF            lea eax, dword ptr [ebp+FFFFFBF8]
:004321CD 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004322B2(U)
|
:004321D0 8B45F8                  mov eax, dword ptr [ebp-08]
:004321D3 33C9                    xor ecx, ecx
:004321D5 8A4801                  mov cl, byte ptr [eax+01]
:004321D8 C1E108                  shl ecx, 08
:004321DB 8B45F8                  mov eax, dword ptr [ebp-08]
:004321DE 33D2                    xor edx, edx
:004321E0 8A10                    mov dl, byte ptr [eax]
:004321E2 03CA                    add ecx, edx
:004321E4 66894DFC                mov word ptr [ebp-04], cx
:004321E8 8B45FC                  mov eax, dword ptr [ebp-04]
:004321EB 25FFFF0000              and eax, 0000FFFF
:004321F0 3DFFFF0000              cmp eax, 0000FFFF
:004321F5 0F84BC000000            je 004322B7
:004321FB 8345F802                add dword ptr [ebp-08], 00000002
:004321FF 8B45F8                  mov eax, dword ptr [ebp-08]
:00432202 50                      push eax
:00432203 8D85F8F7FFFF            lea eax, dword ptr [ebp+FFFFF7F8]
:00432209 50                      push eax
:0043220A 8B8DECF7FFFF            mov ecx, dword ptr [ebp+FFFFF7EC]
:00432210 E8DEC0FFFF              call 0042E2F3
:00432215 837D0C00                cmp dword ptr [ebp+0C], 00000000
:00432219 0F845A000000            je 00432279
:0043221F F745FCFFFF0000          test [ebp-04], 0000FFFF
:00432226 0F8C1C000000            jl 00432248
:0043222C 8B45FC                  mov eax, dword ptr [ebp-04]
:0043222F 25FFFF0000              and eax, 0000FFFF
:00432234 50                      push eax
:00432235 E89FCCFEFF              call 0041EED9
:0043223A 83C404                  add esp, 00000004
:0043223D 8985F4F7FFFF            mov dword ptr [ebp+FFFFF7F4], eax
:00432243 E90A000000              jmp 00432252

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432226(C)
|
:00432248 C785F4F7FFFF00000000    mov dword ptr [ebp+FFFFF7F4], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432243(U)
|
:00432252 68A0000000              push 000000A0
:00432257 8B85F4F7FFFF            mov eax, dword ptr [ebp+FFFFF7F4]
:0043225D 50                      push eax
:0043225E 8D85F8F7FFFF            lea eax, dword ptr [ebp+FFFFF7F8]
:00432264 50                      push eax
:00432265 6A03                    push 00000003
:00432267 E80AEEFCFF              call 00401076
:0043226C 83C410                  add esp, 00000010
:0043226F E94A000000              jmp 004322BE
:00432274 E916000000              jmp 0043228F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432219(C)
|
:00432279 8B45FC                  mov eax, dword ptr [ebp-04]
:0043227C 50                      push eax
:0043227D 8D85F8F7FFFF            lea eax, dword ptr [ebp+FFFFF7F8]
:00432283 50                      push eax
:00432284 8B8DECF7FFFF            mov ecx, dword ptr [ebp+FFFFF7EC]
:0043228A E861030000              call 004325F0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00432274(U), :004322AD(U)
|
:0043228F 8B45F8                  mov eax, dword ptr [ebp-08]
:00432292 8985F0F7FFFF            mov dword ptr [ebp+FFFFF7F0], eax
:00432298 FF45F8                  inc [ebp-08]
:0043229B 8B85F0F7FFFF            mov eax, dword ptr [ebp+FFFFF7F0]
:004322A1 33C9                    xor ecx, ecx
:004322A3 8A08                    mov cl, byte ptr [eax]
:004322A5 85C9                    test ecx, ecx
:004322A7 0F8405000000            je 004322B2
:004322AD E9DDFFFFFF              jmp 0043228F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004322A7(C)
|
:004322B2 E919FFFFFF              jmp 004321D0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004321F5(C)
|
:004322B7 33C0                    xor eax, eax
:004322B9 E900000000              jmp 004322BE

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043226F(U), :004322B9(U)
|
:004322BE 5F                      pop edi
:004322BF 5E                      pop esi
:004322C0 5B                      pop ebx
:004322C1 C9                      leave
:004322C2 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0042FB4A   , :00430486   , :004309EF   
|
:004322C5 55                      push ebp
:004322C6 8BEC                    mov ebp, esp
:004322C8 83EC18                  sub esp, 00000018
:004322CB 53                      push ebx
:004322CC 56                      push esi
:004322CD 57                      push edi
:004322CE 894DEC                  mov dword ptr [ebp-14], ecx
:004322D1 8B45EC                  mov eax, dword ptr [ebp-14]
:004322D4 33C9                    xor ecx, ecx
:004322D6 668B8845030000          mov cx, word ptr [eax+00000345]
:004322DD 8B45EC                  mov eax, dword ptr [ebp-14]
:004322E0 33D2                    xor edx, edx
:004322E2 668B5010                mov dx, word ptr [eax+10]
:004322E6 3BCA                    cmp ecx, edx
:004322E8 0F851D000000            jne 0043230B
:004322EE 8B45EC                  mov eax, dword ptr [ebp-14]
:004322F1 33C9                    xor ecx, ecx
:004322F3 668B8847030000          mov cx, word ptr [eax+00000347]
:004322FA 8B45EC                  mov eax, dword ptr [ebp-14]
:004322FD 33D2                    xor edx, edx
:004322FF 668B5012                mov dx, word ptr [eax+12]
:00432303 3BCA                    cmp ecx, edx
:00432305 0F842A000000            je 00432335

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004322E8(C)
|
:0043230B 8B45EC                  mov eax, dword ptr [ebp-14]
:0043230E 668B4010                mov ax, word ptr [eax+10]
:00432312 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00432315 66898145030000          mov word ptr [ecx+00000345], ax
:0043231C 8B45EC                  mov eax, dword ptr [ebp-14]
:0043231F 668B4012                mov ax, word ptr [eax+12]
:00432323 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00432326 66898147030000          mov word ptr [ecx+00000347], ax
:0043232D 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00432330 E8CB3CFFFF              call 00426000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432305(C)
|
:00432335 8B4510                  mov eax, dword ptr [ebp+10]
:00432338 50                      push eax
:00432339 8B450C                  mov eax, dword ptr [ebp+0C]
:0043233C 50                      push eax
:0043233D 8D4DF8                  lea ecx, dword ptr [ebp-08]
:00432340 E80BBFFEFF              call 0041E250
:00432345 50                      push eax
:00432346 8B4508                  mov eax, dword ptr [ebp+08]
:00432349 50                      push eax
:0043234A 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043234D E8AE130000              call 00433700
:00432352 8D4802                  lea ecx, dword ptr [eax+02]
:00432355 E836F5FCFF              call 00401890
:0043235A 8B4508                  mov eax, dword ptr [ebp+08]
:0043235D 50                      push eax
:0043235E 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00432361 E89A130000              call 00433700
:00432366 8945F4                  mov dword ptr [ebp-0C], eax
:00432369 8A4514                  mov al, byte ptr [ebp+14]
:0043236C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043236F 884105                  mov byte ptr [ecx+05], al
:00432372 C745FC00000000          mov [ebp-04], 00000000
:00432379 8B45EC                  mov eax, dword ptr [ebp-14]
:0043237C 33C9                    xor ecx, ecx
:0043237E 668B4812                mov cx, word ptr [eax+12]
:00432382 81E100F00000            and ecx, 0000F000
:00432388 894DE8                  mov dword ptr [ebp-18], ecx
:0043238B E96B000000              jmp 004323FB
:00432390 E992000000              jmp 00432427

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043240F(C)
|
:00432395 8B4518                  mov eax, dword ptr [ebp+18]
:00432398 50                      push eax
:00432399 8B4514                  mov eax, dword ptr [ebp+14]
:0043239C 50                      push eax
:0043239D 6A00                    push 00000000
:0043239F 8B4510                  mov eax, dword ptr [ebp+10]
:004323A2 50                      push eax
:004323A3 8B450C                  mov eax, dword ptr [ebp+0C]
:004323A6 50                      push eax
:004323A7 8B4508                  mov eax, dword ptr [ebp+08]
:004323AA 0D00020000              or eax, 00000200
:004323AF 50                      push eax
:004323B0 E84D2EFEFF              call 00415202
:004323B5 83C418                  add esp, 00000018
:004323B8 8945FC                  mov dword ptr [ebp-04], eax
:004323BB 837DFCFF                cmp dword ptr [ebp-04], FFFFFFFF
:004323BF 0F8407000000            je 004323CC
:004323C5 C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004323BF(C)
|
:004323CC E956000000              jmp 00432427
:004323D1 E951000000              jmp 00432427

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043241C(C)
|
:004323D6 8B4510                  mov eax, dword ptr [ebp+10]
:004323D9 50                      push eax
:004323DA 8B450C                  mov eax, dword ptr [ebp+0C]
:004323DD 50                      push eax
:004323DE 8B4508                  mov eax, dword ptr [ebp+08]
:004323E1 50                      push eax
:004323E2 B988C04600              mov ecx, 0046C088
:004323E7 E83355FFFF              call 0042791F
:004323EC E936000000              jmp 00432427
:004323F1 E931000000              jmp 00432427
:004323F6 E92C000000              jmp 00432427

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043238B(U)
|
:004323FB 817DE800100000          cmp dword ptr [ebp-18], 00001000
:00432402 0F8E1F000000            jle 00432427
:00432408 817DE800200000          cmp dword ptr [ebp-18], 00002000
:0043240F 0F8480FFFFFF            je 00432395
:00432415 817DE800300000          cmp dword ptr [ebp-18], 00003000
:0043241C 0F84B4FFFFFF            je 004323D6
:00432422 E900000000              jmp 00432427

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00432390(U), :004323CC(U), :004323D1(U), :004323EC(U), :004323F1(U)
|:004323F6(U), :00432402(C), :00432422(U)
|
:00432427 837DFC00                cmp dword ptr [ebp-04], 00000000
:0043242B 0F8417000000            je 00432448
:00432431 8B4508                  mov eax, dword ptr [ebp+08]
:00432434 50                      push eax
:00432435 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00432438 E8C3120000              call 00433700
:0043243D 8945F0                  mov dword ptr [ebp-10], eax
:00432440 8B45F0                  mov eax, dword ptr [ebp-10]
:00432443 66C700FFFF              mov word ptr [eax], FFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043242B(C)
|
:00432448 33C0                    xor eax, eax
:0043244A E900000000              jmp 0043244F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043244A(U)
|
:0043244F 5F                      pop edi
:00432450 5E                      pop esi
:00432451 5B                      pop ebx
:00432452 C9                      leave
:00432453 C21400                  ret 0014



* Referenced by a CALL at Address:
|:0042FF34   
|
:00432456 55                      push ebp
:00432457 8BEC                    mov ebp, esp
:00432459 83EC1C                  sub esp, 0000001C
:0043245C 53                      push ebx
:0043245D 56                      push esi
:0043245E 57                      push edi
:0043245F 894DE8                  mov dword ptr [ebp-18], ecx
:00432462 8B45E8                  mov eax, dword ptr [ebp-18]
:00432465 33C9                    xor ecx, ecx
:00432467 668B8845030000          mov cx, word ptr [eax+00000345]
:0043246E 8B45E8                  mov eax, dword ptr [ebp-18]
:00432471 33D2                    xor edx, edx
:00432473 668B5010                mov dx, word ptr [eax+10]
:00432477 3BCA                    cmp ecx, edx
:00432479 0F851D000000            jne 0043249C
:0043247F 8B45E8                  mov eax, dword ptr [ebp-18]
:00432482 33C9                    xor ecx, ecx
:00432484 668B8847030000          mov cx, word ptr [eax+00000347]
:0043248B 8B45E8                  mov eax, dword ptr [ebp-18]
:0043248E 33D2                    xor edx, edx
:00432490 668B5012                mov dx, word ptr [eax+12]
:00432494 3BCA                    cmp ecx, edx
:00432496 0F842A000000            je 004324C6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432479(C)
|
:0043249C 8B45E8                  mov eax, dword ptr [ebp-18]
:0043249F 668B4010                mov ax, word ptr [eax+10]
:004324A3 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004324A6 66898145030000          mov word ptr [ecx+00000345], ax
:004324AD 8B45E8                  mov eax, dword ptr [ebp-18]
:004324B0 668B4012                mov ax, word ptr [eax+12]
:004324B4 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004324B7 66898147030000          mov word ptr [ecx+00000347], ax
:004324BE 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004324C1 E83A3BFFFF              call 00426000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432496(C)
|
:004324C6 8B4508                  mov eax, dword ptr [ebp+08]
:004324C9 50                      push eax
:004324CA 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004324CD E82E120000              call 00433700
:004324D2 8945F4                  mov dword ptr [ebp-0C], eax
:004324D5 8B45F4                  mov eax, dword ptr [ebp-0C]
:004324D8 33C9                    xor ecx, ecx
:004324DA 8A4804                  mov cl, byte ptr [eax+04]
:004324DD 80C902                  or cl, 02
:004324E0 8B45F4                  mov eax, dword ptr [ebp-0C]
:004324E3 884804                  mov byte ptr [eax+04], cl
:004324E6 8B4510                  mov eax, dword ptr [ebp+10]
:004324E9 50                      push eax
:004324EA 8B450C                  mov eax, dword ptr [ebp+0C]
:004324ED 50                      push eax
:004324EE 8D4DF8                  lea ecx, dword ptr [ebp-08]
:004324F1 E85ABDFEFF              call 0041E250
:004324F6 50                      push eax
:004324F7 8B4508                  mov eax, dword ptr [ebp+08]
:004324FA 50                      push eax
:004324FB 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004324FE E8FD110000              call 00433700
:00432503 8D4802                  lea ecx, dword ptr [eax+02]
:00432506 E885F3FCFF              call 00401890
:0043250B 8B4508                  mov eax, dword ptr [ebp+08]
:0043250E 50                      push eax
:0043250F 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00432512 E8E9110000              call 00433700
:00432517 8945F0                  mov dword ptr [ebp-10], eax
:0043251A 8A4514                  mov al, byte ptr [ebp+14]
:0043251D 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00432520 884105                  mov byte ptr [ecx+05], al
:00432523 C745FC00000000          mov [ebp-04], 00000000
:0043252A 8B45E8                  mov eax, dword ptr [ebp-18]
:0043252D 33C9                    xor ecx, ecx
:0043252F 668B4812                mov cx, word ptr [eax+12]
:00432533 81E100F00000            and ecx, 0000F000
:00432539 894DE4                  mov dword ptr [ebp-1C], ecx
:0043253C E954000000              jmp 00432595
:00432541 E97B000000              jmp 004325C1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004325A9(C)
|
:00432546 8B4514                  mov eax, dword ptr [ebp+14]
:00432549 50                      push eax
:0043254A 8B4510                  mov eax, dword ptr [ebp+10]
:0043254D 50                      push eax
:0043254E 8B450C                  mov eax, dword ptr [ebp+0C]
:00432551 50                      push eax
:00432552 8B4508                  mov eax, dword ptr [ebp+08]
:00432555 0D00020000              or eax, 00000200
:0043255A 50                      push eax
:0043255B E8CC2DFEFF              call 0041532C
:00432560 83C410                  add esp, 00000010
:00432563 8945FC                  mov dword ptr [ebp-04], eax
:00432566 E956000000              jmp 004325C1
:0043256B E951000000              jmp 004325C1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004325B6(C)
|
:00432570 8B4510                  mov eax, dword ptr [ebp+10]
:00432573 50                      push eax
:00432574 8B450C                  mov eax, dword ptr [ebp+0C]
:00432577 50                      push eax
:00432578 8B4508                  mov eax, dword ptr [ebp+08]
:0043257B 50                      push eax
:0043257C B988C04600              mov ecx, 0046C088
:00432581 E8E254FFFF              call 00427A68
:00432586 E936000000              jmp 004325C1
:0043258B E931000000              jmp 004325C1
:00432590 E92C000000              jmp 004325C1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043253C(U)
|
:00432595 817DE400100000          cmp dword ptr [ebp-1C], 00001000
:0043259C 0F8E1F000000            jle 004325C1
:004325A2 817DE400200000          cmp dword ptr [ebp-1C], 00002000
:004325A9 0F8497FFFFFF            je 00432546
:004325AF 817DE400300000          cmp dword ptr [ebp-1C], 00003000
:004325B6 0F84B4FFFFFF            je 00432570
:004325BC E900000000              jmp 004325C1

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00432541(U), :00432566(U), :0043256B(U), :00432586(U), :0043258B(U)
|:00432590(U), :0043259C(C), :004325BC(U)
|
:004325C1 837DFC00                cmp dword ptr [ebp-04], 00000000
:004325C5 0F8417000000            je 004325E2
:004325CB 8B4508                  mov eax, dword ptr [ebp+08]
:004325CE 50                      push eax
:004325CF 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004325D2 E829110000              call 00433700
:004325D7 8945EC                  mov dword ptr [ebp-14], eax
:004325DA 8B45EC                  mov eax, dword ptr [ebp-14]
:004325DD 66C700FFFF              mov word ptr [eax], FFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004325C5(C)
|
:004325E2 33C0                    xor eax, eax
:004325E4 E900000000              jmp 004325E9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004325E4(U)
|
:004325E9 5F                      pop edi
:004325EA 5E                      pop esi
:004325EB 5B                      pop ebx
:004325EC C9                      leave
:004325ED C21000                  ret 0010



* Referenced by a CALL at Address:
|:0043228A   
|
:004325F0 55                      push ebp
:004325F1 8BEC                    mov ebp, esp
:004325F3 83EC0C                  sub esp, 0000000C
:004325F6 53                      push ebx
:004325F7 56                      push esi
:004325F8 57                      push edi
:004325F9 894DF8                  mov dword ptr [ebp-08], ecx
:004325FC F7450CFFFF0000          test [ebp+0C], 0000FFFF
:00432603 0F8C19000000            jl 00432622
:00432609 8B450C                  mov eax, dword ptr [ebp+0C]
:0043260C 25FFFF0000              and eax, 0000FFFF
:00432611 50                      push eax
:00432612 E8C2C8FEFF              call 0041EED9
:00432617 83C404                  add esp, 00000004
:0043261A 8945FC                  mov dword ptr [ebp-04], eax
:0043261D E907000000              jmp 00432629

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432603(C)
|
:00432622 C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043261D(U)
|
:00432629 8B45F8                  mov eax, dword ptr [ebp-08]
:0043262C 33C9                    xor ecx, ecx
:0043262E 668B4812                mov cx, word ptr [eax+12]
:00432632 81E100F00000            and ecx, 0000F000
:00432638 894DF4                  mov dword ptr [ebp-0C], ecx
:0043263B E93F000000              jmp 0043267F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043268C(C), :00432696(C), :004326A8(C)
|
:00432640 6A20                    push 00000020
:00432642 8B45FC                  mov eax, dword ptr [ebp-04]
:00432645 50                      push eax
:00432646 8B4508                  mov eax, dword ptr [ebp+08]
:00432649 50                      push eax
:0043264A 6A03                    push 00000003
:0043264C E825EAFCFF              call 00401076
:00432651 83C410                  add esp, 00000010
:00432654 E967000000              jmp 004326C0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004326B5(C)
|
:00432659 8B450C                  mov eax, dword ptr [ebp+0C]
:0043265C 25FFFF0000              and eax, 0000FFFF
:00432661 50                      push eax
:00432662 8B4508                  mov eax, dword ptr [ebp+08]
:00432665 50                      push eax
:00432666 B988C04600              mov ecx, 0046C088
:0043266B E86A56FFFF              call 00427CDA
:00432670 E94B000000              jmp 004326C0
:00432675 E946000000              jmp 004326C0
:0043267A E941000000              jmp 004326C0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043263B(U)
|
:0043267F 817DF400100000          cmp dword ptr [ebp-0C], 00001000
:00432686 0F8F15000000            jg 004326A1
:0043268C 0F84AEFFFFFF            je 00432640
:00432692 837DF400                cmp dword ptr [ebp-0C], 00000000
:00432696 0F84A4FFFFFF            je 00432640
:0043269C E91F000000              jmp 004326C0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432686(C)
|
:004326A1 817DF400200000          cmp dword ptr [ebp-0C], 00002000
:004326A8 0F8492FFFFFF            je 00432640
:004326AE 817DF400300000          cmp dword ptr [ebp-0C], 00003000
:004326B5 0F849EFFFFFF            je 00432659
:004326BB E900000000              jmp 004326C0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00432654(U), :00432670(U), :00432675(U), :0043267A(U), :0043269C(U)
|:004326BB(U)
|
:004326C0 33C0                    xor eax, eax
:004326C2 E900000000              jmp 004326C7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004326C2(U)
|
:004326C7 5F                      pop edi
:004326C8 5E                      pop esi
:004326C9 5B                      pop ebx
:004326CA C9                      leave
:004326CB C20800                  ret 0008



* Referenced by a CALL at Address:
|:0042FC82   
|
:004326CE 55                      push ebp
:004326CF 8BEC                    mov ebp, esp
:004326D1 83EC08                  sub esp, 00000008
:004326D4 53                      push ebx
:004326D5 56                      push esi
:004326D6 57                      push edi
:004326D7 894DFC                  mov dword ptr [ebp-04], ecx
:004326DA 8B45FC                  mov eax, dword ptr [ebp-04]
:004326DD 33C9                    xor ecx, ecx
:004326DF 668B4812                mov cx, word ptr [eax+12]
:004326E3 81E100F00000            and ecx, 0000F000
:004326E9 894DF8                  mov dword ptr [ebp-08], ecx
:004326EC E952000000              jmp 00432743

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043275A(C), :0043276C(C)
|
:004326F1 8B4508                  mov eax, dword ptr [ebp+08]
:004326F4 25FFFF0000              and eax, 0000FFFF
:004326F9 0D00020000              or eax, 00000200
:004326FE 50                      push eax
:004326FF E8B92BFEFF              call 004152BD
:00432704 83C404                  add esp, 00000004
:00432707 83F801                  cmp eax, 00000001
:0043270A 0F840A000000            je 0043271A
:00432710 B801000000              mov eax, 00000001
:00432715 E902000000              jmp 0043271C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043270A(C)
|
:0043271A 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432715(U)
|
:0043271C E96A000000              jmp 0043278B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00432750(C), :00432779(C)
|
:00432721 8B4508                  mov eax, dword ptr [ebp+08]
:00432724 25FFFF0000              and eax, 0000FFFF
:00432729 50                      push eax
:0043272A B988C04600              mov ecx, 0046C088
:0043272F E89D54FFFF              call 00427BD1
:00432734 E952000000              jmp 0043278B
:00432739 E946000000              jmp 00432784
:0043273E E941000000              jmp 00432784

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004326EC(U)
|
:00432743 817DF800100000          cmp dword ptr [ebp-08], 00001000
:0043274A 0F8F15000000            jg 00432765
:00432750 0F84CBFFFFFF            je 00432721
:00432756 837DF800                cmp dword ptr [ebp-08], 00000000
:0043275A 0F8491FFFFFF            je 004326F1
:00432760 E91F000000              jmp 00432784

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043274A(C)
|
:00432765 817DF800200000          cmp dword ptr [ebp-08], 00002000
:0043276C 0F847FFFFFFF            je 004326F1
:00432772 817DF800300000          cmp dword ptr [ebp-08], 00003000
:00432779 0F84A2FFFFFF            je 00432721
:0043277F E900000000              jmp 00432784

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00432739(U), :0043273E(U), :00432760(U), :0043277F(U)
|
:00432784 33C0                    xor eax, eax
:00432786 E900000000              jmp 0043278B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043271C(U), :00432734(U), :00432786(U)
|
:0043278B 5F                      pop edi
:0043278C 5E                      pop esi
:0043278D 5B                      pop ebx
:0043278E C9                      leave
:0043278F C20400                  ret 0004



* Referenced by a CALL at Address:
|:0043083D   
|
:00432792 55                      push ebp
:00432793 8BEC                    mov ebp, esp
:00432795 83EC10                  sub esp, 00000010
:00432798 53                      push ebx
:00432799 56                      push esi
:0043279A 57                      push edi
:0043279B 894DF4                  mov dword ptr [ebp-0C], ecx
:0043279E 8B4508                  mov eax, dword ptr [ebp+08]
:004327A1 25FFFF0000              and eax, 0000FFFF
:004327A6 50                      push eax
:004327A7 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004327AA E8510F0000              call 00433700
:004327AF 8945FC                  mov dword ptr [ebp-04], eax
:004327B2 8B45FC                  mov eax, dword ptr [ebp-04]
:004327B5 33C9                    xor ecx, ecx
:004327B7 8A4804                  mov cl, byte ptr [eax+04]
:004327BA 80C902                  or cl, 02
:004327BD 8B45FC                  mov eax, dword ptr [ebp-04]
:004327C0 884804                  mov byte ptr [eax+04], cl
:004327C3 8B450C                  mov eax, dword ptr [ebp+0C]
:004327C6 25FFFF0000              and eax, 0000FFFF
:004327CB 50                      push eax
:004327CC 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004327CF E82C0F0000              call 00433700
:004327D4 8945F8                  mov dword ptr [ebp-08], eax
:004327D7 8B45F8                  mov eax, dword ptr [ebp-08]
:004327DA 33C9                    xor ecx, ecx
:004327DC 8A4804                  mov cl, byte ptr [eax+04]
:004327DF 80C902                  or cl, 02
:004327E2 8B45F8                  mov eax, dword ptr [ebp-08]
:004327E5 884804                  mov byte ptr [eax+04], cl
:004327E8 8B45F4                  mov eax, dword ptr [ebp-0C]
:004327EB 33C9                    xor ecx, ecx
:004327ED 668B4812                mov cx, word ptr [eax+12]
:004327F1 81E100F00000            and ecx, 0000F000
:004327F7 894DF0                  mov dword ptr [ebp-10], ecx
:004327FA E930000000              jmp 0043282F
:004327FF E957000000              jmp 0043285B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432850(C)
|
:00432804 8B450C                  mov eax, dword ptr [ebp+0C]
:00432807 25FFFF0000              and eax, 0000FFFF
:0043280C 50                      push eax
:0043280D 8B4508                  mov eax, dword ptr [ebp+08]
:00432810 25FFFF0000              and eax, 0000FFFF
:00432815 50                      push eax
:00432816 B988C04600              mov ecx, 0046C088
:0043281B E80956FFFF              call 00427E29
:00432820 E936000000              jmp 0043285B
:00432825 E931000000              jmp 0043285B
:0043282A E92C000000              jmp 0043285B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004327FA(U)
|
:0043282F 817DF000100000          cmp dword ptr [ebp-10], 00001000
:00432836 0F8E1F000000            jle 0043285B
:0043283C 817DF000200000          cmp dword ptr [ebp-10], 00002000
:00432843 0F8412000000            je 0043285B
:00432849 817DF000300000          cmp dword ptr [ebp-10], 00003000
:00432850 0F84AEFFFFFF            je 00432804
:00432856 E900000000              jmp 0043285B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004327FF(U), :00432820(U), :00432825(U), :0043282A(U), :00432836(C)
|:00432843(C), :00432856(U)
|
:0043285B 33C0                    xor eax, eax
:0043285D E900000000              jmp 00432862

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043285D(U)
|
:00432862 5F                      pop edi
:00432863 5E                      pop esi
:00432864 5B                      pop ebx
:00432865 C9                      leave
:00432866 C20800                  ret 0008



* Referenced by a CALL at Address:
|:0043096F   
|
:00432869 55                      push ebp
:0043286A 8BEC                    mov ebp, esp
:0043286C 83EC10                  sub esp, 00000010
:0043286F 53                      push ebx
:00432870 56                      push esi
:00432871 57                      push edi
:00432872 894DF4                  mov dword ptr [ebp-0C], ecx
:00432875 8B45F4                  mov eax, dword ptr [ebp-0C]
:00432878 33C9                    xor ecx, ecx
:0043287A 668B8845030000          mov cx, word ptr [eax+00000345]
:00432881 8B45F4                  mov eax, dword ptr [ebp-0C]
:00432884 33D2                    xor edx, edx
:00432886 668B5010                mov dx, word ptr [eax+10]
:0043288A 3BCA                    cmp ecx, edx
:0043288C 0F851D000000            jne 004328AF
:00432892 8B45F4                  mov eax, dword ptr [ebp-0C]
:00432895 33C9                    xor ecx, ecx
:00432897 668B8847030000          mov cx, word ptr [eax+00000347]
:0043289E 8B45F4                  mov eax, dword ptr [ebp-0C]
:004328A1 33D2                    xor edx, edx
:004328A3 668B5012                mov dx, word ptr [eax+12]
:004328A7 3BCA                    cmp ecx, edx
:004328A9 0F842A000000            je 004328D9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043288C(C)
|
:004328AF 8B45F4                  mov eax, dword ptr [ebp-0C]
:004328B2 668B4010                mov ax, word ptr [eax+10]
:004328B6 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004328B9 66898145030000          mov word ptr [ecx+00000345], ax
:004328C0 8B45F4                  mov eax, dword ptr [ebp-0C]
:004328C3 668B4012                mov ax, word ptr [eax+12]
:004328C7 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004328CA 66898147030000          mov word ptr [ecx+00000347], ax
:004328D1 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004328D4 E82737FFFF              call 00426000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004328A9(C)
|
:004328D9 C745FC00000000          mov [ebp-04], 00000000
:004328E0 8B4508                  mov eax, dword ptr [ebp+08]
:004328E3 25FFFF0000              and eax, 0000FFFF
:004328E8 50                      push eax
:004328E9 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004328EC E80F0E0000              call 00433700
:004328F1 8945F8                  mov dword ptr [ebp-08], eax
:004328F4 8B45F8                  mov eax, dword ptr [ebp-08]
:004328F7 66C700FFFF              mov word ptr [eax], FFFF
:004328FC 8B45F4                  mov eax, dword ptr [ebp-0C]
:004328FF 33C9                    xor ecx, ecx
:00432901 668B4812                mov cx, word ptr [eax+12]
:00432905 81E100F00000            and ecx, 0000F000
:0043290B 894DF0                  mov dword ptr [ebp-10], ecx
:0043290E E945000000              jmp 00432958
:00432913 E977000000              jmp 0043298F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432977(C)
|
:00432918 8B4508                  mov eax, dword ptr [ebp+08]
:0043291B 25FFFF0000              and eax, 0000FFFF
:00432920 0D00020000              or eax, 00000200
:00432925 50                      push eax
:00432926 E82A23FEFF              call 00414C55
:0043292B 83C404                  add esp, 00000004
:0043292E 8945FC                  mov dword ptr [ebp-04], eax
:00432931 E959000000              jmp 0043298F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00432965(C), :00432984(C)
|
:00432936 8B4508                  mov eax, dword ptr [ebp+08]
:00432939 25FFFF0000              and eax, 0000FFFF
:0043293E 50                      push eax
:0043293F B988C04600              mov ecx, 0046C088
:00432944 E84D5FFFFF              call 00428896
:00432949 E941000000              jmp 0043298F
:0043294E E93C000000              jmp 0043298F
:00432953 E937000000              jmp 0043298F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043290E(U)
|
:00432958 817DF000100000          cmp dword ptr [ebp-10], 00001000
:0043295F 0F8F0B000000            jg 00432970
:00432965 0F84CBFFFFFF            je 00432936
:0043296B E91F000000              jmp 0043298F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043295F(C)
|
:00432970 817DF000200000          cmp dword ptr [ebp-10], 00002000
:00432977 0F849BFFFFFF            je 00432918
:0043297D 817DF000300000          cmp dword ptr [ebp-10], 00003000
:00432984 0F84ACFFFFFF            je 00432936
:0043298A E900000000              jmp 0043298F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00432913(U), :00432931(U), :00432949(U), :0043294E(U), :00432953(U)
|:0043296B(U), :0043298A(U)
|
:0043298F 837DFC00                cmp dword ptr [ebp-04], 00000000
:00432993 0F8400000000            je 00432999

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432993(C)
|
:00432999 33C0                    xor eax, eax
:0043299B E900000000              jmp 004329A0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043299B(U)
|
:004329A0 5F                      pop edi
:004329A1 5E                      pop esi
:004329A2 5B                      pop ebx
:004329A3 C9                      leave
:004329A4 C20400                  ret 0004



* Referenced by a CALL at Address:
|:00432BC7   
|
:004329A7 55                      push ebp
:004329A8 8BEC                    mov ebp, esp
:004329AA 83EC0C                  sub esp, 0000000C
:004329AD 53                      push ebx
:004329AE 56                      push esi
:004329AF 57                      push edi
:004329B0 894DF4                  mov dword ptr [ebp-0C], ecx
:004329B3 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004329B6 E82567FDFF              call 004090E0
:004329BB 8945FC                  mov dword ptr [ebp-04], eax
:004329BE 8B4508                  mov eax, dword ptr [ebp+08]
:004329C1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004329C4 668B0441                mov ax, word ptr [ecx+2*eax]
:004329C8 668945F8                mov word ptr [ebp-08], ax
:004329CC 8B45F8                  mov eax, dword ptr [ebp-08]
:004329CF 25FFFF0000              and eax, 0000FFFF
:004329D4 0345FC                  add eax, dword ptr [ebp-04]
:004329D7 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004329DA 8D0C89                  lea ecx, dword ptr [ecx+4*ecx]
:004329DD 8D0448                  lea eax, dword ptr [eax+2*ecx]
:004329E0 E900000000              jmp 004329E5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004329E0(U)
|
:004329E5 5F                      pop edi
:004329E6 5E                      pop esi
:004329E7 5B                      pop ebx
:004329E8 C9                      leave
:004329E9 C20800                  ret 0008


:004329EC CC                      int 03
:004329ED CC                      int 03
:004329EE CC                      int 03
:004329EF CC                      int 03

* Referenced by a CALL at Address:
|:0042E0CC   
|
:004329F0 55                      push ebp
:004329F1 8BEC                    mov ebp, esp
:004329F3 83EC04                  sub esp, 00000004
:004329F6 53                      push ebx
:004329F7 56                      push esi
:004329F8 57                      push edi
:004329F9 894DFC                  mov dword ptr [ebp-04], ecx
:004329FC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004329FF 83C114                  add ecx, 00000014
:00432A02 E819000000              call 00432A20
:00432A07 E900000000              jmp 00432A0C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432A07(U)
|
:00432A0C 5F                      pop edi
:00432A0D 5E                      pop esi
:00432A0E 5B                      pop ebx
:00432A0F C9                      leave
:00432A10 C3                      ret


:00432A11 CC                      int 03
:00432A12 CC                      int 03
:00432A13 CC                      int 03
:00432A14 CC                      int 03
:00432A15 CC                      int 03
:00432A16 CC                      int 03
:00432A17 CC                      int 03
:00432A18 CC                      int 03
:00432A19 CC                      int 03
:00432A1A CC                      int 03
:00432A1B CC                      int 03
:00432A1C CC                      int 03
:00432A1D CC                      int 03
:00432A1E CC                      int 03
:00432A1F CC                      int 03

* Referenced by a CALL at Address:
|:00432A02   
|
:00432A20 55                      push ebp
:00432A21 8BEC                    mov ebp, esp
:00432A23 83EC04                  sub esp, 00000004
:00432A26 53                      push ebx
:00432A27 56                      push esi
:00432A28 57                      push edi
:00432A29 894DFC                  mov dword ptr [ebp-04], ecx
:00432A2C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00432A2F E8554C0100              call 00447689
:00432A34 E900000000              jmp 00432A39

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432A34(U)
|
:00432A39 5F                      pop edi
:00432A3A 5E                      pop esi
:00432A3B 5B                      pop ebx
:00432A3C C9                      leave
:00432A3D C3                      ret


:00432A3E CC                      int 03
:00432A3F CC                      int 03

* Referenced by a CALL at Address:
|:0042E095   
|
:00432A40 55                      push ebp
:00432A41 8BEC                    mov ebp, esp
:00432A43 83EC04                  sub esp, 00000004
:00432A46 53                      push ebx
:00432A47 56                      push esi
:00432A48 57                      push edi
:00432A49 894DFC                  mov dword ptr [ebp-04], ecx
:00432A4C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00432A4F 83C114                  add ecx, 00000014
:00432A52 E849000000              call 00432AA0
:00432A57 68202B4300              push 00432B20
:00432A5C 6880000000              push 00000080
:00432A61 6A06                    push 00000006
:00432A63 8B45FC                  mov eax, dword ptr [ebp-04]
:00432A66 83C045                  add eax, 00000045
:00432A69 50                      push eax
:00432A6A E84166FDFF              call 004090B0
:00432A6F 68502B4300              push 00432B50
:00432A74 6A2D                    push 0000002D
:00432A76 6A17                    push 00000017
:00432A78 8B45FC                  mov eax, dword ptr [ebp-04]
:00432A7B 0581030000              add eax, 00000381
:00432A80 50                      push eax
:00432A81 E82A66FDFF              call 004090B0
:00432A86 E900000000              jmp 00432A8B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432A86(U)
|
:00432A8B 8B45FC                  mov eax, dword ptr [ebp-04]
:00432A8E 5F                      pop edi
:00432A8F 5E                      pop esi
:00432A90 5B                      pop ebx
:00432A91 C9                      leave
:00432A92 C3                      ret


:00432A93 CC                      int 03
:00432A94 CC                      int 03
:00432A95 CC                      int 03
:00432A96 CC                      int 03
:00432A97 CC                      int 03
:00432A98 CC                      int 03
:00432A99 CC                      int 03
:00432A9A CC                      int 03
:00432A9B CC                      int 03
:00432A9C CC                      int 03
:00432A9D CC                      int 03
:00432A9E CC                      int 03
:00432A9F CC                      int 03

* Referenced by a CALL at Address:
|:00432A52   
|
:00432AA0 55                      push ebp
:00432AA1 8BEC                    mov ebp, esp
:00432AA3 83EC04                  sub esp, 00000004
:00432AA6 53                      push ebx
:00432AA7 56                      push esi
:00432AA8 57                      push edi
:00432AA9 894DFC                  mov dword ptr [ebp-04], ecx
:00432AAC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00432AAF E81C000000              call 00432AD0
:00432AB4 E900000000              jmp 00432AB9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432AB4(U)
|
:00432AB9 8B45FC                  mov eax, dword ptr [ebp-04]
:00432ABC 5F                      pop edi
:00432ABD 5E                      pop esi
:00432ABE 5B                      pop ebx
:00432ABF C9                      leave
:00432AC0 C3                      ret


:00432AC1 CC                      int 03
:00432AC2 CC                      int 03
:00432AC3 CC                      int 03
:00432AC4 CC                      int 03
:00432AC5 CC                      int 03
:00432AC6 CC                      int 03
:00432AC7 CC                      int 03
:00432AC8 CC                      int 03
:00432AC9 CC                      int 03
:00432ACA CC                      int 03
:00432ACB CC                      int 03
:00432ACC CC                      int 03
:00432ACD CC                      int 03
:00432ACE CC                      int 03
:00432ACF CC                      int 03

* Referenced by a CALL at Addresses:
|:00432AAF   , :00437020   , :0043704F   , :0043707E   , :004370AD   
|:004370DC   , :0043710B   , :0043713A   , :00437169   , :00437198   
|:004371C7   , :004371F6   , :00437225   , :00437254   
|
:00432AD0 55                      push ebp
:00432AD1 8BEC                    mov ebp, esp
:00432AD3 83EC04                  sub esp, 00000004
:00432AD6 53                      push ebx
:00432AD7 56                      push esi
:00432AD8 57                      push edi
:00432AD9 894DFC                  mov dword ptr [ebp-04], ecx
:00432ADC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00432ADF E81C000000              call 00432B00
:00432AE4 8B45FC                  mov eax, dword ptr [ebp-04]
:00432AE7 C6401000                mov [eax+10], 00
:00432AEB E900000000              jmp 00432AF0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432AEB(U)
|
:00432AF0 8B45FC                  mov eax, dword ptr [ebp-04]
:00432AF3 5F                      pop edi
:00432AF4 5E                      pop esi
:00432AF5 5B                      pop ebx
:00432AF6 C9                      leave
:00432AF7 C3                      ret


:00432AF8 CC                      int 03
:00432AF9 CC                      int 03
:00432AFA CC                      int 03
:00432AFB CC                      int 03
:00432AFC CC                      int 03
:00432AFD CC                      int 03
:00432AFE CC                      int 03
:00432AFF CC                      int 03

* Referenced by a CALL at Address:
|:00432ADF   
|
:00432B00 55                      push ebp
:00432B01 8BEC                    mov ebp, esp
:00432B03 83EC04                  sub esp, 00000004
:00432B06 53                      push ebx
:00432B07 56                      push esi
:00432B08 57                      push edi
:00432B09 894DFC                  mov dword ptr [ebp-04], ecx
:00432B0C E900000000              jmp 00432B11

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432B0C(U)
|
:00432B11 8B45FC                  mov eax, dword ptr [ebp-04]
:00432B14 5F                      pop edi
:00432B15 5E                      pop esi
:00432B16 5B                      pop ebx
:00432B17 C9                      leave
:00432B18 C3                      ret


:00432B19 CC                      int 03
:00432B1A CC                      int 03
:00432B1B CC                      int 03
:00432B1C CC                      int 03
:00432B1D CC                      int 03
:00432B1E CC                      int 03
:00432B1F CC                      int 03
:00432B20 55                      push ebp
:00432B21 8BEC                    mov ebp, esp
:00432B23 83EC04                  sub esp, 00000004
:00432B26 53                      push ebx
:00432B27 56                      push esi
:00432B28 57                      push edi
:00432B29 894DFC                  mov dword ptr [ebp-04], ecx
:00432B2C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00432B2F 83C102                  add ecx, 00000002
:00432B32 E839EDFCFF              call 00401870
:00432B37 E900000000              jmp 00432B3C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432B37(U)
|
:00432B3C 8B45FC                  mov eax, dword ptr [ebp-04]
:00432B3F 5F                      pop edi
:00432B40 5E                      pop esi
:00432B41 5B                      pop ebx
:00432B42 C9                      leave
:00432B43 C3                      ret


:00432B44 CC                      int 03
:00432B45 CC                      int 03
:00432B46 CC                      int 03
:00432B47 CC                      int 03
:00432B48 CC                      int 03
:00432B49 CC                      int 03
:00432B4A CC                      int 03
:00432B4B CC                      int 03
:00432B4C CC                      int 03
:00432B4D CC                      int 03
:00432B4E CC                      int 03
:00432B4F CC                      int 03
:00432B50 55                      push ebp
:00432B51 8BEC                    mov ebp, esp
:00432B53 83EC04                  sub esp, 00000004
:00432B56 53                      push ebx
:00432B57 56                      push esi
:00432B58 57                      push edi
:00432B59 894DFC                  mov dword ptr [ebp-04], ecx
:00432B5C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00432B5F E81C000000              call 00432B80
:00432B64 E900000000              jmp 00432B69

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432B64(U)
|
:00432B69 8B45FC                  mov eax, dword ptr [ebp-04]
:00432B6C 5F                      pop edi
:00432B6D 5E                      pop esi
:00432B6E 5B                      pop ebx
:00432B6F C9                      leave
:00432B70 C3                      ret


:00432B71 CC                      int 03
:00432B72 CC                      int 03
:00432B73 CC                      int 03
:00432B74 CC                      int 03
:00432B75 CC                      int 03
:00432B76 CC                      int 03
:00432B77 CC                      int 03
:00432B78 CC                      int 03
:00432B79 CC                      int 03
:00432B7A CC                      int 03
:00432B7B CC                      int 03
:00432B7C CC                      int 03
:00432B7D CC                      int 03
:00432B7E CC                      int 03
:00432B7F CC                      int 03

* Referenced by a CALL at Address:
|:00432B5F   
|
:00432B80 55                      push ebp
:00432B81 8BEC                    mov ebp, esp
:00432B83 83EC04                  sub esp, 00000004
:00432B86 53                      push ebx
:00432B87 56                      push esi
:00432B88 57                      push edi
:00432B89 894DFC                  mov dword ptr [ebp-04], ecx
:00432B8C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00432B8F 83C104                  add ecx, 00000004
:00432B92 E8D9ECFCFF              call 00401870
:00432B97 E900000000              jmp 00432B9C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432B97(U)
|
:00432B9C 8B45FC                  mov eax, dword ptr [ebp-04]
:00432B9F 5F                      pop edi
:00432BA0 5E                      pop esi
:00432BA1 5B                      pop ebx
:00432BA2 C9                      leave
:00432BA3 C3                      ret


:00432BA4 CC                      int 03
:00432BA5 CC                      int 03
:00432BA6 CC                      int 03
:00432BA7 CC                      int 03
:00432BA8 CC                      int 03
:00432BA9 CC                      int 03
:00432BAA CC                      int 03
:00432BAB CC                      int 03
:00432BAC CC                      int 03
:00432BAD CC                      int 03
:00432BAE CC                      int 03
:00432BAF CC                      int 03

* Referenced by a CALL at Addresses:
|:0042E0FC   , :0042F009   , :004314F7   , :00433432   
|
:00432BB0 55                      push ebp
:00432BB1 8BEC                    mov ebp, esp
:00432BB3 83EC04                  sub esp, 00000004
:00432BB6 53                      push ebx
:00432BB7 56                      push esi
:00432BB8 57                      push edi
:00432BB9 894DFC                  mov dword ptr [ebp-04], ecx
:00432BBC 8B450C                  mov eax, dword ptr [ebp+0C]
:00432BBF 50                      push eax
:00432BC0 8B4508                  mov eax, dword ptr [ebp+08]
:00432BC3 50                      push eax
:00432BC4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00432BC7 E8DBFDFFFF              call 004329A7
:00432BCC E900000000              jmp 00432BD1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432BCC(U)
|
:00432BD1 5F                      pop edi
:00432BD2 5E                      pop esi
:00432BD3 5B                      pop ebx
:00432BD4 C9                      leave
:00432BD5 C20800                  ret 0008


:00432BD8 CC                      int 03
:00432BD9 CC                      int 03
:00432BDA CC                      int 03
:00432BDB CC                      int 03
:00432BDC CC                      int 03
:00432BDD CC                      int 03
:00432BDE CC                      int 03
:00432BDF CC                      int 03

* Referenced by a CALL at Addresses:
|:0042E138   , :0043343E   
|
:00432BE0 55                      push ebp
:00432BE1 8BEC                    mov ebp, esp
:00432BE3 83EC04                  sub esp, 00000004
:00432BE6 53                      push ebx
:00432BE7 56                      push esi
:00432BE8 57                      push edi
:00432BE9 894DFC                  mov dword ptr [ebp-04], ecx
:00432BEC 8B4508                  mov eax, dword ptr [ebp+08]
:00432BEF 8038FF                  cmp byte ptr [eax], FF
:00432BF2 0F850A000000            jne 00432C02
:00432BF8 B801000000              mov eax, 00000001
:00432BFD E902000000              jmp 00432C04

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432BF2(C)
|
:00432C02 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432BFD(U)
|
:00432C04 E900000000              jmp 00432C09

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432C04(U)
|
:00432C09 5F                      pop edi
:00432C0A 5E                      pop esi
:00432C0B 5B                      pop ebx
:00432C0C C9                      leave
:00432C0D C20400                  ret 0004



* Referenced by a CALL at Address:
|:0042E1E7   
|
:00432C10 55                      push ebp
:00432C11 8BEC                    mov ebp, esp
:00432C13 83EC04                  sub esp, 00000004
:00432C16 53                      push ebx
:00432C17 56                      push esi
:00432C18 57                      push edi
:00432C19 894DFC                  mov dword ptr [ebp-04], ecx
:00432C1C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00432C1F E8BC64FDFF              call 004090E0
:00432C24 50                      push eax
:00432C25 8B450C                  mov eax, dword ptr [ebp+0C]
:00432C28 25FFFF0000              and eax, 0000FFFF
:00432C2D 50                      push eax
:00432C2E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00432C31 E84B4AFFFF              call 00427681
:00432C36 33C0                    xor eax, eax
:00432C38 E900000000              jmp 00432C3D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432C38(U)
|
:00432C3D 5F                      pop edi
:00432C3E 5E                      pop esi
:00432C3F 5B                      pop ebx
:00432C40 C9                      leave
:00432C41 C20800                  ret 0008


:00432C44 CC                      int 03
:00432C45 CC                      int 03
:00432C46 CC                      int 03
:00432C47 CC                      int 03
:00432C48 CC                      int 03
:00432C49 CC                      int 03
:00432C4A CC                      int 03
:00432C4B CC                      int 03
:00432C4C CC                      int 03
:00432C4D CC                      int 03
:00432C4E CC                      int 03
:00432C4F CC                      int 03

* Referenced by a CALL at Addresses:
|:0042E4CD   , :0042FBB0   
|
:00432C50 55                      push ebp
:00432C51 8BEC                    mov ebp, esp
:00432C53 83EC04                  sub esp, 00000004
:00432C56 53                      push ebx
:00432C57 56                      push esi
:00432C58 57                      push edi
:00432C59 894DFC                  mov dword ptr [ebp-04], ecx
:00432C5C E900000000              jmp 00432C61

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432C5C(U)
|
:00432C61 5F                      pop edi
:00432C62 5E                      pop esi
:00432C63 5B                      pop ebx
:00432C64 C9                      leave
:00432C65 C3                      ret


:00432C66 CC                      int 03
:00432C67 CC                      int 03
:00432C68 CC                      int 03
:00432C69 CC                      int 03
:00432C6A CC                      int 03
:00432C6B CC                      int 03
:00432C6C CC                      int 03
:00432C6D CC                      int 03
:00432C6E CC                      int 03
:00432C6F CC                      int 03

* Referenced by a CALL at Addresses:
|:0042E896   , :0042E8A7   , :0042E8B8   , :0042E8C9   , :0042E8DA   
|:0042E8EB   , :0042E8FE   , :0042E911   , :0042E946   , :0042E95F   
|:0042E978   , :0042E991   , :0042E9AA   , :0042E9C2   , :0042E9D5   
|:0042E9E8   , :0042E9FB   , :0042EA0E   , :0042EA21   , :0042EA34   
|:0042EA47   , :0042EA5A   , :0042EA6D   , :0042EAA6   , :0042EAC6   
|:0042EAE6   , :0042EB06   , :0042EB26   , :0042EB46   , :0042EB66   
|:0042EB86   , :0042EB9C   , :0042EBAF   , :0042EBC5   , :0042EBD8   
|:0042EBEB   
|
:00432C70 55                      push ebp
:00432C71 8BEC                    mov ebp, esp
:00432C73 83EC04                  sub esp, 00000004
:00432C76 53                      push ebx
:00432C77 56                      push esi
:00432C78 57                      push edi
:00432C79 894DFC                  mov dword ptr [ebp-04], ecx
:00432C7C 8B450C                  mov eax, dword ptr [ebp+0C]
:00432C7F 50                      push eax
:00432C80 8B4508                  mov eax, dword ptr [ebp+08]
:00432C83 50                      push eax
:00432C84 8B45FC                  mov eax, dword ptr [ebp-04]
:00432C87 8B00                    mov eax, dword ptr [eax]
:00432C89 50                      push eax
:00432C8A E8EC4B0100              call 0044787B
:00432C8F 83C40C                  add esp, 0000000C
:00432C92 E900000000              jmp 00432C97

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432C92(U)
|
:00432C97 5F                      pop edi
:00432C98 5E                      pop esi
:00432C99 5B                      pop ebx
:00432C9A C9                      leave
:00432C9B C20800                  ret 0008


:00432C9E CC                      int 03
:00432C9F CC                      int 03

* Referenced by a CALL at Addresses:
|:0042F036   , :0043152D   , :00433489   
|
:00432CA0 55                      push ebp
:00432CA1 8BEC                    mov ebp, esp
:00432CA3 83EC0C                  sub esp, 0000000C
:00432CA6 53                      push ebx
:00432CA7 56                      push esi
:00432CA8 57                      push edi
:00432CA9 894DF4                  mov dword ptr [ebp-0C], ecx
:00432CAC 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00432CAF E82C64FDFF              call 004090E0
:00432CB4 8945FC                  mov dword ptr [ebp-04], eax
:00432CB7 8B4D08                  mov ecx, dword ptr [ebp+08]
:00432CBA 8B55FC                  mov edx, dword ptr [ebp-04]
:00432CBD 668B0C4A                mov cx, word ptr [edx+2*ecx]
:00432CC1 66894DF8                mov word ptr [ebp-08], cx
:00432CC5 668B45F8                mov ax, word ptr [ebp-08]
:00432CC9 E900000000              jmp 00432CCE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432CC9(U)
|
:00432CCE 5F                      pop edi
:00432CCF 5E                      pop esi
:00432CD0 5B                      pop ebx
:00432CD1 C9                      leave
:00432CD2 C20400                  ret 0004


:00432CD5 CC                      int 03
:00432CD6 CC                      int 03
:00432CD7 CC                      int 03
:00432CD8 CC                      int 03
:00432CD9 CC                      int 03
:00432CDA CC                      int 03
:00432CDB CC                      int 03
:00432CDC CC                      int 03
:00432CDD CC                      int 03
:00432CDE CC                      int 03
:00432CDF CC                      int 03

* Referenced by a CALL at Addresses:
|:0042F0DD   , :0042F93F   
|
:00432CE0 55                      push ebp
:00432CE1 8BEC                    mov ebp, esp
:00432CE3 83EC08                  sub esp, 00000008
:00432CE6 53                      push ebx
:00432CE7 56                      push esi
:00432CE8 57                      push edi
:00432CE9 894DF8                  mov dword ptr [ebp-08], ecx
:00432CEC 8B45F8                  mov eax, dword ptr [ebp-08]
:00432CEF 33C9                    xor ecx, ecx
:00432CF1 8A884B030000            mov cl, byte ptr [eax+0000034B]
:00432CF7 F6C17F                  test cl, 7F
:00432CFA 0F850C000000            jne 00432D0C
:00432D00 C745FC01000000          mov [ebp-04], 00000001
:00432D07 E907000000              jmp 00432D13

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432CFA(C)
|
:00432D0C C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432D07(U)
|
:00432D13 837DFC00                cmp dword ptr [ebp-04], 00000000
:00432D17 0F8442000000            je 00432D5F
:00432D1D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00432D20 E84B000000              call 00432D70
:00432D25 83F821                  cmp eax, 00000021
:00432D28 0F8531000000            jne 00432D5F
:00432D2E 8B45F8                  mov eax, dword ptr [ebp-08]
:00432D31 8B400C                  mov eax, dword ptr [eax+0C]
:00432D34 50                      push eax
:00432D35 8B45F8                  mov eax, dword ptr [ebp-08]
:00432D38 8B4008                  mov eax, dword ptr [eax+08]
:00432D3B 50                      push eax
:00432D3C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00432D3F 83C114                  add ecx, 00000014
:00432D42 E894B3FFFF              call 0042E0DB
:00432D47 A880                    test al, 80
:00432D49 0F8410000000            je 00432D5F
:00432D4F 6801000100              push 00010001
:00432D54 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00432D57 E82CCEFFFF              call 0042FB88
:00432D5C 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00432D17(C), :00432D28(C), :00432D49(C)
|
:00432D5F 8B45FC                  mov eax, dword ptr [ebp-04]
:00432D62 E900000000              jmp 00432D67

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432D62(U)
|
:00432D67 5F                      pop edi
:00432D68 5E                      pop esi
:00432D69 5B                      pop ebx
:00432D6A C9                      leave
:00432D6B C3                      ret


:00432D6C CC                      int 03
:00432D6D CC                      int 03
:00432D6E CC                      int 03
:00432D6F CC                      int 03

* Referenced by a CALL at Addresses:
|:0042FE4B   , :0042FE99   , :0042FF3F   , :004306A3   , :00430848   
|:0043085C   , :00432D20   
|
:00432D70 55                      push ebp
:00432D71 8BEC                    mov ebp, esp
:00432D73 83EC08                  sub esp, 00000008
:00432D76 53                      push ebx
:00432D77 56                      push esi
:00432D78 57                      push edi
:00432D79 894DF8                  mov dword ptr [ebp-08], ecx
:00432D7C 8B45F8                  mov eax, dword ptr [ebp-08]
:00432D7F 33C9                    xor ecx, ecx
:00432D81 668B8855030000          mov cx, word ptr [eax+00000355]
:00432D88 51                      push ecx
:00432D89 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00432D8C 83C114                  add ecx, 00000014
:00432D8F E81C000000              call 00432DB0
:00432D94 33C9                    xor ecx, ecx
:00432D96 8A08                    mov cl, byte ptr [eax]
:00432D98 894DFC                  mov dword ptr [ebp-04], ecx
:00432D9B 8B45FC                  mov eax, dword ptr [ebp-04]
:00432D9E E900000000              jmp 00432DA3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432D9E(U)
|
:00432DA3 5F                      pop edi
:00432DA4 5E                      pop esi
:00432DA5 5B                      pop ebx
:00432DA6 C9                      leave
:00432DA7 C3                      ret


:00432DA8 CC                      int 03
:00432DA9 CC                      int 03
:00432DAA CC                      int 03
:00432DAB CC                      int 03
:00432DAC CC                      int 03
:00432DAD CC                      int 03
:00432DAE CC                      int 03
:00432DAF CC                      int 03

* Referenced by a CALL at Addresses:
|:00432D8F   , :0043366F   , :004336BF   
|
:00432DB0 55                      push ebp
:00432DB1 8BEC                    mov ebp, esp
:00432DB3 83EC04                  sub esp, 00000004
:00432DB6 53                      push ebx
:00432DB7 56                      push esi
:00432DB8 57                      push edi
:00432DB9 894DFC                  mov dword ptr [ebp-04], ecx
:00432DBC 6A04                    push 00000004
:00432DBE 6A00                    push 00000000
:00432DC0 8B4508                  mov eax, dword ptr [ebp+08]
:00432DC3 50                      push eax
:00432DC4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00432DC7 E854490100              call 00447720
:00432DCC E900000000              jmp 00432DD1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432DCC(U)
|
:00432DD1 5F                      pop edi
:00432DD2 5E                      pop esi
:00432DD3 5B                      pop ebx
:00432DD4 C9                      leave
:00432DD5 C20400                  ret 0004


:00432DD8 CC                      int 03
:00432DD9 CC                      int 03
:00432DDA CC                      int 03
:00432DDB CC                      int 03
:00432DDC CC                      int 03
:00432DDD CC                      int 03
:00432DDE CC                      int 03
:00432DDF CC                      int 03

* Referenced by a CALL at Addresses:
|:0042F0B1   , :0042F181   , :0042F257   , :0042F331   , :0042F40B   
|:0042F4E9   , :0042F5B9   , :0042F689   , :0042F75F   , :0042F83D   
|:0042F913   
|
:00432DE0 55                      push ebp
:00432DE1 8BEC                    mov ebp, esp
:00432DE3 83EC04                  sub esp, 00000004
:00432DE6 53                      push ebx
:00432DE7 56                      push esi
:00432DE8 57                      push edi
:00432DE9 894DFC                  mov dword ptr [ebp-04], ecx
:00432DEC 8B45FC                  mov eax, dword ptr [ebp-04]
:00432DEF 66C780490300000000      mov word ptr [ebx+00000349], 0000
:00432DF8 E900000000              jmp 00432DFD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432DF8(U)
|
:00432DFD 5F                      pop edi
:00432DFE 5E                      pop esi
:00432DFF 5B                      pop ebx
:00432E00 C9                      leave
:00432E01 C3                      ret


:00432E02 CC                      int 03
:00432E03 CC                      int 03
:00432E04 CC                      int 03
:00432E05 CC                      int 03
:00432E06 CC                      int 03
:00432E07 CC                      int 03
:00432E08 CC                      int 03
:00432E09 CC                      int 03
:00432E0A CC                      int 03
:00432E0B CC                      int 03
:00432E0C CC                      int 03
:00432E0D CC                      int 03
:00432E0E CC                      int 03
:00432E0F CC                      int 03

* Referenced by a CALL at Address:
|:0042F1B1   
|
:00432E10 55                      push ebp
:00432E11 8BEC                    mov ebp, esp
:00432E13 83EC04                  sub esp, 00000004
:00432E16 53                      push ebx
:00432E17 56                      push esi
:00432E18 57                      push edi
:00432E19 894DFC                  mov dword ptr [ebp-04], ecx
:00432E1C 8B45FC                  mov eax, dword ptr [ebp-04]
:00432E1F 33C9                    xor ecx, ecx
:00432E21 8A884B030000            mov cl, byte ptr [eax+0000034B]
:00432E27 80E17F                  and cl, 7F
:00432E2A 80F903                  cmp cl, 03
:00432E2D 0F8526000000            jne 00432E59
:00432E33 8B45FC                  mov eax, dword ptr [ebp-04]
:00432E36 33C9                    xor ecx, ecx
:00432E38 668B884D030000          mov cx, word ptr [eax+0000034D]
:00432E3F 8B4508                  mov eax, dword ptr [ebp+08]
:00432E42 25FFFF0000              and eax, 0000FFFF
:00432E47 3BC8                    cmp ecx, eax
:00432E49 0F850A000000            jne 00432E59
:00432E4F B801000000              mov eax, 00000001
:00432E54 E902000000              jmp 00432E5B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00432E2D(C), :00432E49(C)
|
:00432E59 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432E54(U)
|
:00432E5B E900000000              jmp 00432E60

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432E5B(U)
|
:00432E60 5F                      pop edi
:00432E61 5E                      pop esi
:00432E62 5B                      pop ebx
:00432E63 C9                      leave
:00432E64 C20400                  ret 0004


:00432E67 CC                      int 03
:00432E68 CC                      int 03
:00432E69 CC                      int 03
:00432E6A CC                      int 03
:00432E6B CC                      int 03
:00432E6C CC                      int 03
:00432E6D CC                      int 03
:00432E6E CC                      int 03
:00432E6F CC                      int 03

* Referenced by a CALL at Address:
|:0042F28B   
|
:00432E70 55                      push ebp
:00432E71 8BEC                    mov ebp, esp
:00432E73 83EC04                  sub esp, 00000004
:00432E76 53                      push ebx
:00432E77 56                      push esi
:00432E78 57                      push edi
:00432E79 894DFC                  mov dword ptr [ebp-04], ecx
:00432E7C 8B45FC                  mov eax, dword ptr [ebp-04]
:00432E7F 33C9                    xor ecx, ecx
:00432E81 8A884B030000            mov cl, byte ptr [eax+0000034B]
:00432E87 80E17F                  and cl, 7F
:00432E8A 80F904                  cmp cl, 04
:00432E8D 0F8542000000            jne 00432ED5
:00432E93 8B45FC                  mov eax, dword ptr [ebp-04]
:00432E96 33C9                    xor ecx, ecx
:00432E98 668B884D030000          mov cx, word ptr [eax+0000034D]
:00432E9F 8B4508                  mov eax, dword ptr [ebp+08]
:00432EA2 25FFFF0000              and eax, 0000FFFF
:00432EA7 3BC8                    cmp ecx, eax
:00432EA9 0F8526000000            jne 00432ED5
:00432EAF 8B45FC                  mov eax, dword ptr [ebp-04]
:00432EB2 33C9                    xor ecx, ecx
:00432EB4 668B884F030000          mov cx, word ptr [eax+0000034F]
:00432EBB 8B450C                  mov eax, dword ptr [ebp+0C]
:00432EBE 25FFFF0000              and eax, 0000FFFF
:00432EC3 3BC8                    cmp ecx, eax
:00432EC5 0F850A000000            jne 00432ED5
:00432ECB B801000000              mov eax, 00000001
:00432ED0 E902000000              jmp 00432ED7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00432E8D(C), :00432EA9(C), :00432EC5(C)
|
:00432ED5 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432ED0(U)
|
:00432ED7 E900000000              jmp 00432EDC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432ED7(U)
|
:00432EDC 5F                      pop edi
:00432EDD 5E                      pop esi
:00432EDE 5B                      pop ebx
:00432EDF C9                      leave
:00432EE0 C20800                  ret 0008


:00432EE3 CC                      int 03
:00432EE4 CC                      int 03
:00432EE5 CC                      int 03
:00432EE6 CC                      int 03
:00432EE7 CC                      int 03
:00432EE8 CC                      int 03
:00432EE9 CC                      int 03
:00432EEA CC                      int 03
:00432EEB CC                      int 03
:00432EEC CC                      int 03
:00432EED CC                      int 03
:00432EEE CC                      int 03
:00432EEF CC                      int 03

* Referenced by a CALL at Address:
|:0042F365   
|
:00432EF0 55                      push ebp
:00432EF1 8BEC                    mov ebp, esp
:00432EF3 83EC08                  sub esp, 00000008
:00432EF6 53                      push ebx
:00432EF7 56                      push esi
:00432EF8 57                      push edi
:00432EF9 894DF8                  mov dword ptr [ebp-08], ecx
:00432EFC 8B45F8                  mov eax, dword ptr [ebp-08]
:00432EFF 33C9                    xor ecx, ecx
:00432F01 8A884B030000            mov cl, byte ptr [eax+0000034B]
:00432F07 80E17F                  and cl, 7F
:00432F0A 80F902                  cmp cl, 02
:00432F0D 0F8550000000            jne 00432F63
:00432F13 8B45F8                  mov eax, dword ptr [ebp-08]
:00432F16 33C9                    xor ecx, ecx
:00432F18 668B884D030000          mov cx, word ptr [eax+0000034D]
:00432F1F 8B4508                  mov eax, dword ptr [ebp+08]
:00432F22 25FFFF0000              and eax, 0000FFFF
:00432F27 3BC8                    cmp ecx, eax
:00432F29 0F8528000000            jne 00432F57
:00432F2F 8B45F8                  mov eax, dword ptr [ebp-08]
:00432F32 33C9                    xor ecx, ecx
:00432F34 668B884F030000          mov cx, word ptr [eax+0000034F]
:00432F3B 8B450C                  mov eax, dword ptr [ebp+0C]
:00432F3E 25FFFF0000              and eax, 0000FFFF
:00432F43 3BC8                    cmp ecx, eax
:00432F45 0F850C000000            jne 00432F57
:00432F4B C745FC01000000          mov [ebp-04], 00000001
:00432F52 E907000000              jmp 00432F5E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00432F29(C), :00432F45(C)
|
:00432F57 C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432F52(U)
|
:00432F5E E95B000000              jmp 00432FBE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432F0D(C)
|
:00432F63 8B45F8                  mov eax, dword ptr [ebp-08]
:00432F66 33C9                    xor ecx, ecx
:00432F68 8A884B030000            mov cl, byte ptr [eax+0000034B]
:00432F6E 80E17F                  and cl, 7F
:00432F71 80F905                  cmp cl, 05
:00432F74 0F853D000000            jne 00432FB7
:00432F7A 8B45F8                  mov eax, dword ptr [ebp-08]
:00432F7D 33C9                    xor ecx, ecx
:00432F7F 668B4812                mov cx, word ptr [eax+12]
:00432F83 80E5F0                  and ch, F0
:00432F86 80FD10                  cmp ch, 10
:00432F89 0F8528000000            jne 00432FB7
:00432F8F 8B45F8                  mov eax, dword ptr [ebp-08]
:00432F92 33C9                    xor ecx, ecx
:00432F94 668B884D030000          mov cx, word ptr [eax+0000034D]
:00432F9B 8B450C                  mov eax, dword ptr [ebp+0C]
:00432F9E 25FFFF0000              and eax, 0000FFFF
:00432FA3 3BC8                    cmp ecx, eax
:00432FA5 0F850C000000            jne 00432FB7
:00432FAB C745FC01000000          mov [ebp-04], 00000001
:00432FB2 E907000000              jmp 00432FBE

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00432F74(C), :00432F89(C), :00432FA5(C)
|
:00432FB7 C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00432F5E(U), :00432FB2(U)
|
:00432FBE 8B45FC                  mov eax, dword ptr [ebp-04]
:00432FC1 E900000000              jmp 00432FC6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432FC1(U)
|
:00432FC6 5F                      pop edi
:00432FC7 5E                      pop esi
:00432FC8 5B                      pop ebx
:00432FC9 C9                      leave
:00432FCA C20800                  ret 0008


:00432FCD CC                      int 03
:00432FCE CC                      int 03
:00432FCF CC                      int 03

* Referenced by a CALL at Address:
|:0042F443   
|
:00432FD0 55                      push ebp
:00432FD1 8BEC                    mov ebp, esp
:00432FD3 83EC04                  sub esp, 00000004
:00432FD6 53                      push ebx
:00432FD7 56                      push esi
:00432FD8 57                      push edi
:00432FD9 894DFC                  mov dword ptr [ebp-04], ecx
:00432FDC 8B45FC                  mov eax, dword ptr [ebp-04]
:00432FDF 33C9                    xor ecx, ecx
:00432FE1 8A884B030000            mov cl, byte ptr [eax+0000034B]
:00432FE7 80E17F                  and cl, 7F
:00432FEA 80F906                  cmp cl, 06
:00432FED 0F8553000000            jne 00433046
:00432FF3 8B45FC                  mov eax, dword ptr [ebp-04]
:00432FF6 33C9                    xor ecx, ecx
:00432FF8 668B884D030000          mov cx, word ptr [eax+0000034D]
:00432FFF 8B4508                  mov eax, dword ptr [ebp+08]
:00433002 25FFFF0000              and eax, 0000FFFF
:00433007 3BC8                    cmp ecx, eax
:00433009 0F8537000000            jne 00433046
:0043300F 8B450C                  mov eax, dword ptr [ebp+0C]
:00433012 25FFFF0000              and eax, 0000FFFF
:00433017 C1E008                  shl eax, 08
:0043301A 0FB7C0                  movzx eax, ax
:0043301D 8B4D10                  mov ecx, dword ptr [ebp+10]
:00433020 81E1FFFF0000            and ecx, 0000FFFF
:00433026 0BC1                    or eax, ecx
:00433028 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043302B 33D2                    xor edx, edx
:0043302D 668B914F030000          mov dx, word ptr [ecx+0000034F]
:00433034 3BC2                    cmp eax, edx
:00433036 0F850A000000            jne 00433046
:0043303C B801000000              mov eax, 00000001
:00433041 E902000000              jmp 00433048

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00432FED(C), :00433009(C), :00433036(C)
|
:00433046 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433041(U)
|
:00433048 E900000000              jmp 0043304D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433048(U)
|
:0043304D 5F                      pop edi
:0043304E 5E                      pop esi
:0043304F 5B                      pop ebx
:00433050 C9                      leave
:00433051 C20C00                  ret 000C


:00433054 CC                      int 03
:00433055 CC                      int 03
:00433056 CC                      int 03
:00433057 CC                      int 03
:00433058 CC                      int 03
:00433059 CC                      int 03
:0043305A CC                      int 03
:0043305B CC                      int 03
:0043305C CC                      int 03
:0043305D CC                      int 03
:0043305E CC                      int 03
:0043305F CC                      int 03

* Referenced by a CALL at Address:
|:0042F515   
|
:00433060 55                      push ebp
:00433061 8BEC                    mov ebp, esp
:00433063 83EC04                  sub esp, 00000004
:00433066 53                      push ebx
:00433067 56                      push esi
:00433068 57                      push edi
:00433069 894DFC                  mov dword ptr [ebp-04], ecx
:0043306C 8B45FC                  mov eax, dword ptr [ebp-04]
:0043306F 33C9                    xor ecx, ecx
:00433071 8A884B030000            mov cl, byte ptr [eax+0000034B]
:00433077 80E17F                  and cl, 7F
:0043307A 80F907                  cmp cl, 07
:0043307D 0F850A000000            jne 0043308D
:00433083 B801000000              mov eax, 00000001
:00433088 E902000000              jmp 0043308F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043307D(C)
|
:0043308D 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433088(U)
|
:0043308F E900000000              jmp 00433094

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043308F(U)
|
:00433094 5F                      pop edi
:00433095 5E                      pop esi
:00433096 5B                      pop ebx
:00433097 C9                      leave
:00433098 C3                      ret


:00433099 CC                      int 03
:0043309A CC                      int 03
:0043309B CC                      int 03
:0043309C CC                      int 03
:0043309D CC                      int 03
:0043309E CC                      int 03
:0043309F CC                      int 03

* Referenced by a CALL at Address:
|:0042F5E5   
|
:004330A0 55                      push ebp
:004330A1 8BEC                    mov ebp, esp
:004330A3 83EC04                  sub esp, 00000004
:004330A6 53                      push ebx
:004330A7 56                      push esi
:004330A8 57                      push edi
:004330A9 894DFC                  mov dword ptr [ebp-04], ecx
:004330AC 8B45FC                  mov eax, dword ptr [ebp-04]
:004330AF 33C9                    xor ecx, ecx
:004330B1 8A884B030000            mov cl, byte ptr [eax+0000034B]
:004330B7 80E17F                  and cl, 7F
:004330BA 80F908                  cmp cl, 08
:004330BD 0F850A000000            jne 004330CD
:004330C3 B801000000              mov eax, 00000001
:004330C8 E902000000              jmp 004330CF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004330BD(C)
|
:004330CD 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004330C8(U)
|
:004330CF E900000000              jmp 004330D4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004330CF(U)
|
:004330D4 5F                      pop edi
:004330D5 5E                      pop esi
:004330D6 5B                      pop ebx
:004330D7 C9                      leave
:004330D8 C3                      ret


:004330D9 CC                      int 03
:004330DA CC                      int 03
:004330DB CC                      int 03
:004330DC CC                      int 03
:004330DD CC                      int 03
:004330DE CC                      int 03
:004330DF CC                      int 03

* Referenced by a CALL at Address:
|:0042F6B9   
|
:004330E0 55                      push ebp
:004330E1 8BEC                    mov ebp, esp
:004330E3 83EC04                  sub esp, 00000004
:004330E6 53                      push ebx
:004330E7 56                      push esi
:004330E8 57                      push edi
:004330E9 894DFC                  mov dword ptr [ebp-04], ecx
:004330EC 8B45FC                  mov eax, dword ptr [ebp-04]
:004330EF 33C9                    xor ecx, ecx
:004330F1 8A884B030000            mov cl, byte ptr [eax+0000034B]
:004330F7 80E17F                  and cl, 7F
:004330FA 80F909                  cmp cl, 09
:004330FD 0F8526000000            jne 00433129
:00433103 8B45FC                  mov eax, dword ptr [ebp-04]
:00433106 33C9                    xor ecx, ecx
:00433108 668B884D030000          mov cx, word ptr [eax+0000034D]
:0043310F 8B4508                  mov eax, dword ptr [ebp+08]
:00433112 25FFFF0000              and eax, 0000FFFF
:00433117 3BC8                    cmp ecx, eax
:00433119 0F850A000000            jne 00433129
:0043311F B801000000              mov eax, 00000001
:00433124 E902000000              jmp 0043312B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004330FD(C), :00433119(C)
|
:00433129 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433124(U)
|
:0043312B E900000000              jmp 00433130

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043312B(U)
|
:00433130 5F                      pop edi
:00433131 5E                      pop esi
:00433132 5B                      pop ebx
:00433133 C9                      leave
:00433134 C20400                  ret 0004


:00433137 CC                      int 03
:00433138 CC                      int 03
:00433139 CC                      int 03
:0043313A CC                      int 03
:0043313B CC                      int 03
:0043313C CC                      int 03
:0043313D CC                      int 03
:0043313E CC                      int 03
:0043313F CC                      int 03

* Referenced by a CALL at Address:
|:0042F797   
|
:00433140 55                      push ebp
:00433141 8BEC                    mov ebp, esp
:00433143 83EC14                  sub esp, 00000014
:00433146 53                      push ebx
:00433147 56                      push esi
:00433148 57                      push edi
:00433149 894DEC                  mov dword ptr [ebp-14], ecx
:0043314C 8B45EC                  mov eax, dword ptr [ebp-14]
:0043314F 33C9                    xor ecx, ecx
:00433151 668B884F030000          mov cx, word ptr [eax+0000034F]
:00433158 C1E908                  shr ecx, 08
:0043315B 81E1FF000000            and ecx, 000000FF
:00433161 894DFC                  mov dword ptr [ebp-04], ecx
:00433164 8B45EC                  mov eax, dword ptr [ebp-14]
:00433167 33C9                    xor ecx, ecx
:00433169 668B884F030000          mov cx, word ptr [eax+0000034F]
:00433170 81E1FF000000            and ecx, 000000FF
:00433176 894DF4                  mov dword ptr [ebp-0C], ecx
:00433179 8B45EC                  mov eax, dword ptr [ebp-14]
:0043317C 33C9                    xor ecx, ecx
:0043317E 668B8851030000          mov cx, word ptr [eax+00000351]
:00433185 C1E908                  shr ecx, 08
:00433188 81E1FF000000            and ecx, 000000FF
:0043318E 894DF8                  mov dword ptr [ebp-08], ecx
:00433191 8B45EC                  mov eax, dword ptr [ebp-14]
:00433194 33C9                    xor ecx, ecx
:00433196 668B8851030000          mov cx, word ptr [eax+00000351]
:0043319D 81E1FF000000            and ecx, 000000FF
:004331A3 894DF0                  mov dword ptr [ebp-10], ecx
:004331A6 8B45EC                  mov eax, dword ptr [ebp-14]
:004331A9 33C9                    xor ecx, ecx
:004331AB 8A884B030000            mov cl, byte ptr [eax+0000034B]
:004331B1 80E17F                  and cl, 7F
:004331B4 80F90B                  cmp cl, 0B
:004331B7 0F8556000000            jne 00433213
:004331BD 8B45EC                  mov eax, dword ptr [ebp-14]
:004331C0 33C9                    xor ecx, ecx
:004331C2 668B884D030000          mov cx, word ptr [eax+0000034D]
:004331C9 8B4508                  mov eax, dword ptr [ebp+08]
:004331CC 25FFFF0000              and eax, 0000FFFF
:004331D1 3BC8                    cmp ecx, eax
:004331D3 0F853A000000            jne 00433213
:004331D9 8B45FC                  mov eax, dword ptr [ebp-04]
:004331DC 39450C                  cmp dword ptr [ebp+0C], eax
:004331DF 0F8C2E000000            jl 00433213
:004331E5 8B45F8                  mov eax, dword ptr [ebp-08]
:004331E8 39450C                  cmp dword ptr [ebp+0C], eax
:004331EB 0F8F22000000            jg 00433213
:004331F1 8B45F4                  mov eax, dword ptr [ebp-0C]
:004331F4 394510                  cmp dword ptr [ebp+10], eax
:004331F7 0F8C16000000            jl 00433213
:004331FD 8B45F0                  mov eax, dword ptr [ebp-10]
:00433200 394510                  cmp dword ptr [ebp+10], eax
:00433203 0F8F0A000000            jg 00433213
:00433209 B801000000              mov eax, 00000001
:0043320E E902000000              jmp 00433215

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004331B7(C), :004331D3(C), :004331DF(C), :004331EB(C), :004331F7(C)
|:00433203(C)
|
:00433213 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043320E(U)
|
:00433215 E900000000              jmp 0043321A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433215(U)
|
:0043321A 5F                      pop edi
:0043321B 5E                      pop esi
:0043321C 5B                      pop ebx
:0043321D C9                      leave
:0043321E C20C00                  ret 000C


:00433221 CC                      int 03
:00433222 CC                      int 03
:00433223 CC                      int 03
:00433224 CC                      int 03
:00433225 CC                      int 03
:00433226 CC                      int 03
:00433227 CC                      int 03
:00433228 CC                      int 03
:00433229 CC                      int 03
:0043322A CC                      int 03
:0043322B CC                      int 03
:0043322C CC                      int 03
:0043322D CC                      int 03
:0043322E CC                      int 03
:0043322F CC                      int 03

* Referenced by a CALL at Address:
|:0042F86D   
|
:00433230 55                      push ebp
:00433231 8BEC                    mov ebp, esp
:00433233 83EC04                  sub esp, 00000004
:00433236 53                      push ebx
:00433237 56                      push esi
:00433238 57                      push edi
:00433239 894DFC                  mov dword ptr [ebp-04], ecx
:0043323C 8B45FC                  mov eax, dword ptr [ebp-04]
:0043323F 33C9                    xor ecx, ecx
:00433241 8A884B030000            mov cl, byte ptr [eax+0000034B]
:00433247 80E17F                  and cl, 7F
:0043324A 80F90C                  cmp cl, 0C
:0043324D 0F8526000000            jne 00433279
:00433253 8B45FC                  mov eax, dword ptr [ebp-04]
:00433256 33C9                    xor ecx, ecx
:00433258 668B884D030000          mov cx, word ptr [eax+0000034D]
:0043325F 8B4508                  mov eax, dword ptr [ebp+08]
:00433262 25FFFF0000              and eax, 0000FFFF
:00433267 3BC8                    cmp ecx, eax
:00433269 0F850A000000            jne 00433279
:0043326F B801000000              mov eax, 00000001
:00433274 E902000000              jmp 0043327B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043324D(C), :00433269(C)
|
:00433279 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433274(U)
|
:0043327B E900000000              jmp 00433280

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043327B(U)
|
:00433280 5F                      pop edi
:00433281 5E                      pop esi
:00433282 5B                      pop ebx
:00433283 C9                      leave
:00433284 C20400                  ret 0004


:00433287 CC                      int 03
:00433288 CC                      int 03
:00433289 CC                      int 03
:0043328A CC                      int 03
:0043328B CC                      int 03
:0043328C CC                      int 03
:0043328D CC                      int 03
:0043328E CC                      int 03
:0043328F CC                      int 03

* Referenced by a CALL at Addresses:
|:0042F9C6   , :0042F9E7   
|
:00433290 55                      push ebp
:00433291 8BEC                    mov ebp, esp
:00433293 83EC04                  sub esp, 00000004
:00433296 53                      push ebx
:00433297 56                      push esi
:00433298 57                      push edi
:00433299 894DFC                  mov dword ptr [ebp-04], ecx
:0043329C 8B45FC                  mov eax, dword ptr [ebp-04]
:0043329F 33C9                    xor ecx, ecx
:004332A1 668B08                  mov cx, word ptr [eax]
:004332A4 F6C101                  test cl, 01
:004332A7 0F8423000000            je 004332D0
:004332AD 8B45FC                  mov eax, dword ptr [ebp-04]
:004332B0 33C9                    xor ecx, ecx
:004332B2 668B4802                mov cx, word ptr [eax+02]
:004332B6 8B4508                  mov eax, dword ptr [ebp+08]
:004332B9 25FFFF0000              and eax, 0000FFFF
:004332BE 3BC8                    cmp ecx, eax
:004332C0 0F850A000000            jne 004332D0
:004332C6 B801000000              mov eax, 00000001
:004332CB E902000000              jmp 004332D2

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004332A7(C), :004332C0(C)
|
:004332D0 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004332CB(U)
|
:004332D2 E900000000              jmp 004332D7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004332D2(U)
|
:004332D7 5F                      pop edi
:004332D8 5E                      pop esi
:004332D9 5B                      pop ebx
:004332DA C9                      leave
:004332DB C20400                  ret 0004


:004332DE CC                      int 03
:004332DF CC                      int 03

* Referenced by a CALL at Address:
|:0043175A   
|
:004332E0 55                      push ebp
:004332E1 8BEC                    mov ebp, esp
:004332E3 83EC04                  sub esp, 00000004
:004332E6 53                      push ebx
:004332E7 56                      push esi
:004332E8 57                      push edi
:004332E9 894DFC                  mov dword ptr [ebp-04], ecx
:004332EC 8A4508                  mov al, byte ptr [ebp+08]
:004332EF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004332F2 884113                  mov byte ptr [ecx+13], al
:004332F5 E900000000              jmp 004332FA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004332F5(U)
|
:004332FA 5F                      pop edi
:004332FB 5E                      pop esi
:004332FC 5B                      pop ebx
:004332FD C9                      leave
:004332FE C20400                  ret 0004


:00433301 CC                      int 03
:00433302 CC                      int 03
:00433303 CC                      int 03
:00433304 CC                      int 03
:00433305 CC                      int 03
:00433306 CC                      int 03
:00433307 CC                      int 03
:00433308 CC                      int 03
:00433309 CC                      int 03
:0043330A CC                      int 03
:0043330B CC                      int 03
:0043330C CC                      int 03
:0043330D CC                      int 03
:0043330E CC                      int 03
:0043330F CC                      int 03

* Referenced by a CALL at Address:
|:00430718   
|
:00433310 55                      push ebp
:00433311 8BEC                    mov ebp, esp
:00433313 83EC04                  sub esp, 00000004
:00433316 53                      push ebx
:00433317 56                      push esi
:00433318 57                      push edi
:00433319 894DFC                  mov dword ptr [ebp-04], ecx
:0043331C 8A4508                  mov al, byte ptr [ebp+08]
:0043331F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00433322 884116                  mov byte ptr [ecx+16], al
:00433325 E900000000              jmp 0043332A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433325(U)
|
:0043332A 5F                      pop edi
:0043332B 5E                      pop esi
:0043332C 5B                      pop ebx
:0043332D C9                      leave
:0043332E C20400                  ret 0004


:00433331 CC                      int 03
:00433332 CC                      int 03
:00433333 CC                      int 03
:00433334 CC                      int 03
:00433335 CC                      int 03
:00433336 CC                      int 03
:00433337 CC                      int 03
:00433338 CC                      int 03
:00433339 CC                      int 03
:0043333A CC                      int 03
:0043333B CC                      int 03
:0043333C CC                      int 03
:0043333D CC                      int 03
:0043333E CC                      int 03
:0043333F CC                      int 03

* Referenced by a CALL at Address:
|:0042FF87   
|
:00433340 55                      push ebp
:00433341 8BEC                    mov ebp, esp
:00433343 83EC04                  sub esp, 00000004
:00433346 53                      push ebx
:00433347 56                      push esi
:00433348 57                      push edi
:00433349 894DFC                  mov dword ptr [ebp-04], ecx
:0043334C 8A4508                  mov al, byte ptr [ebp+08]
:0043334F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00433352 8801                    mov byte ptr [ecx], al
:00433354 E900000000              jmp 00433359

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433354(U)
|
:00433359 5F                      pop edi
:0043335A 5E                      pop esi
:0043335B 5B                      pop ebx
:0043335C C9                      leave
:0043335D C20400                  ret 0004



* Referenced by a CALL at Address:
|:00430A31   
|
:00433360 55                      push ebp
:00433361 8BEC                    mov ebp, esp
:00433363 83EC04                  sub esp, 00000004
:00433366 53                      push ebx
:00433367 56                      push esi
:00433368 57                      push edi
:00433369 894DFC                  mov dword ptr [ebp-04], ecx
:0043336C 8B45FC                  mov eax, dword ptr [ebp-04]
:0043336F 8B4009                  mov eax, dword ptr [eax+09]
:00433372 E900000000              jmp 00433377

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433372(U)
|
:00433377 5F                      pop edi
:00433378 5E                      pop esi
:00433379 5B                      pop ebx
:0043337A C9                      leave
:0043337B C3                      ret


:0043337C CC                      int 03
:0043337D CC                      int 03
:0043337E CC                      int 03
:0043337F CC                      int 03

* Referenced by a CALL at Address:
|:0042FC5D   
|
:00433380 55                      push ebp
:00433381 8BEC                    mov ebp, esp
:00433383 83EC04                  sub esp, 00000004
:00433386 53                      push ebx
:00433387 56                      push esi
:00433388 57                      push edi
:00433389 894DFC                  mov dword ptr [ebp-04], ecx
:0043338C 8B45FC                  mov eax, dword ptr [ebp-04]
:0043338F 33C9                    xor ecx, ecx
:00433391 8A4804                  mov cl, byte ptr [eax+04]
:00433394 F6C102                  test cl, 02
:00433397 0F840A000000            je 004333A7
:0043339D B801000000              mov eax, 00000001
:004333A2 E902000000              jmp 004333A9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433397(C)
|
:004333A7 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004333A2(U)
|
:004333A9 E900000000              jmp 004333AE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004333A9(U)
|
:004333AE 5F                      pop edi
:004333AF 5E                      pop esi
:004333B0 5B                      pop ebx
:004333B1 C9                      leave
:004333B2 C3                      ret


:004333B3 CC                      int 03
:004333B4 CC                      int 03
:004333B5 CC                      int 03
:004333B6 CC                      int 03
:004333B7 CC                      int 03
:004333B8 CC                      int 03
:004333B9 CC                      int 03
:004333BA CC                      int 03
:004333BB CC                      int 03
:004333BC CC                      int 03
:004333BD CC                      int 03
:004333BE CC                      int 03
:004333BF CC                      int 03

* Referenced by a CALL at Address:
|:004306E0   
|
:004333C0 55                      push ebp
:004333C1 8BEC                    mov ebp, esp
:004333C3 83EC04                  sub esp, 00000004
:004333C6 53                      push ebx
:004333C7 56                      push esi
:004333C8 57                      push edi
:004333C9 894DFC                  mov dword ptr [ebp-04], ecx
:004333CC 8B45FC                  mov eax, dword ptr [ebp-04]
:004333CF C7400400000000          mov [eax+04], 00000000
:004333D6 8B45FC                  mov eax, dword ptr [ebp-04]
:004333D9 FF00                    inc dword ptr [eax]
:004333DB E900000000              jmp 004333E0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004333DB(U)
|
:004333E0 5F                      pop edi
:004333E1 5E                      pop esi
:004333E2 5B                      pop ebx
:004333E3 C9                      leave
:004333E4 C3                      ret


:004333E5 CC                      int 03
:004333E6 CC                      int 03
:004333E7 CC                      int 03
:004333E8 CC                      int 03
:004333E9 CC                      int 03
:004333EA CC                      int 03
:004333EB CC                      int 03
:004333EC CC                      int 03
:004333ED CC                      int 03
:004333EE CC                      int 03
:004333EF CC                      int 03

* Referenced by a CALL at Addresses:
|:00430740   , :00431F2E   
|
:004333F0 55                      push ebp
:004333F1 8BEC                    mov ebp, esp
:004333F3 83EC04                  sub esp, 00000004
:004333F6 53                      push ebx
:004333F7 56                      push esi
:004333F8 57                      push edi
:004333F9 894DFC                  mov dword ptr [ebp-04], ecx
:004333FC 8B45FC                  mov eax, dword ptr [ebp-04]
:004333FF 8B400C                  mov eax, dword ptr [eax+0C]
:00433402 50                      push eax
:00433403 8B45FC                  mov eax, dword ptr [ebp-04]
:00433406 8B4008                  mov eax, dword ptr [eax+08]
:00433409 50                      push eax
:0043340A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043340D 83C114                  add ecx, 00000014
:00433410 E8C6ACFFFF              call 0042E0DB
:00433415 83E07F                  and eax, 0000007F
:00433418 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043341B 01410C                  add dword ptr [ecx+0C], eax
:0043341E 8B45FC                  mov eax, dword ptr [ebp-04]
:00433421 8B400C                  mov eax, dword ptr [eax+0C]
:00433424 50                      push eax
:00433425 8B45FC                  mov eax, dword ptr [ebp-04]
:00433428 8B4008                  mov eax, dword ptr [eax+08]
:0043342B 50                      push eax
:0043342C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043342F 83C114                  add ecx, 00000014
:00433432 E879F7FFFF              call 00432BB0
:00433437 50                      push eax
:00433438 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043343B 83C114                  add ecx, 00000014
:0043343E E89DF7FFFF              call 00432BE0
:00433443 85C0                    test eax, eax
:00433445 0F8408000000            je 00433453
:0043344B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043344E E80D000000              call 00433460

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433445(C)
|
:00433453 E900000000              jmp 00433458

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433453(U)
|
:00433458 5F                      pop edi
:00433459 5E                      pop esi
:0043345A 5B                      pop ebx
:0043345B C9                      leave
:0043345C C3                      ret


:0043345D CC                      int 03
:0043345E CC                      int 03
:0043345F CC                      int 03

* Referenced by a CALL at Address:
|:0043344E   
|
:00433460 55                      push ebp
:00433461 8BEC                    mov ebp, esp
:00433463 83EC04                  sub esp, 00000004
:00433466 53                      push ebx
:00433467 56                      push esi
:00433468 57                      push edi
:00433469 894DFC                  mov dword ptr [ebp-04], ecx
:0043346C 8B45FC                  mov eax, dword ptr [ebp-04]
:0043346F C7400C00000000          mov [eax+0C], 00000000
:00433476 8B45FC                  mov eax, dword ptr [ebp-04]
:00433479 FF4008                  inc [eax+08]
:0043347C 8B45FC                  mov eax, dword ptr [ebp-04]
:0043347F 8B4008                  mov eax, dword ptr [eax+08]
:00433482 50                      push eax
:00433483 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00433486 83C114                  add ecx, 00000014
:00433489 E812F8FFFF              call 00432CA0
:0043348E 0FB7C0                  movzx eax, ax
:00433491 3DFFFF0000              cmp eax, 0000FFFF
:00433496 0F8510000000            jne 004334AC
:0043349C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043349F E81C000000              call 004334C0
:004334A4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004334A7 E8BCACFFFF              call 0042E168

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433496(C)
|
:004334AC E900000000              jmp 004334B1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004334AC(U)
|
:004334B1 5F                      pop edi
:004334B2 5E                      pop esi
:004334B3 5B                      pop ebx
:004334B4 C9                      leave
:004334B5 C3                      ret


:004334B6 CC                      int 03
:004334B7 CC                      int 03
:004334B8 CC                      int 03
:004334B9 CC                      int 03
:004334BA CC                      int 03
:004334BB CC                      int 03
:004334BC CC                      int 03
:004334BD CC                      int 03
:004334BE CC                      int 03
:004334BF CC                      int 03

* Referenced by a CALL at Address:
|:0043349F   
|
:004334C0 55                      push ebp
:004334C1 8BEC                    mov ebp, esp
:004334C3 83EC04                  sub esp, 00000004
:004334C6 53                      push ebx
:004334C7 56                      push esi
:004334C8 57                      push edi
:004334C9 894DFC                  mov dword ptr [ebp-04], ecx
:004334CC 8B45FC                  mov eax, dword ptr [ebp-04]
:004334CF C7400800000000          mov [eax+08], 00000000
:004334D6 8B45FC                  mov eax, dword ptr [ebp-04]
:004334D9 FF4004                  inc [eax+04]
:004334DC E900000000              jmp 004334E1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004334DC(U)
|
:004334E1 5F                      pop edi
:004334E2 5E                      pop esi
:004334E3 5B                      pop ebx
:004334E4 C9                      leave
:004334E5 C3                      ret


:004334E6 CC                      int 03
:004334E7 CC                      int 03
:004334E8 CC                      int 03
:004334E9 CC                      int 03
:004334EA CC                      int 03
:004334EB CC                      int 03
:004334EC CC                      int 03
:004334ED CC                      int 03
:004334EE CC                      int 03
:004334EF CC                      int 03

* Referenced by a CALL at Address:
|:00430617   
|
:004334F0 55                      push ebp
:004334F1 8BEC                    mov ebp, esp
:004334F3 83EC04                  sub esp, 00000004
:004334F6 53                      push ebx
:004334F7 56                      push esi
:004334F8 57                      push edi
:004334F9 894DFC                  mov dword ptr [ebp-04], ecx
:004334FC 8B45FC                  mov eax, dword ptr [ebp-04]
:004334FF 66C78055030000FFFF      mov word ptr [ebx+00000355], FFFF
:00433508 E900000000              jmp 0043350D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433508(U)
|
:0043350D 5F                      pop edi
:0043350E 5E                      pop esi
:0043350F 5B                      pop ebx
:00433510 C9                      leave
:00433511 C3                      ret


:00433512 CC                      int 03
:00433513 CC                      int 03
:00433514 CC                      int 03
:00433515 CC                      int 03
:00433516 CC                      int 03
:00433517 CC                      int 03
:00433518 CC                      int 03
:00433519 CC                      int 03
:0043351A CC                      int 03
:0043351B CC                      int 03
:0043351C CC                      int 03
:0043351D CC                      int 03
:0043351E CC                      int 03
:0043351F CC                      int 03

* Referenced by a CALL at Address:
|:0043079F   
|
:00433520 55                      push ebp
:00433521 8BEC                    mov ebp, esp
:00433523 83EC04                  sub esp, 00000004
:00433526 53                      push ebx
:00433527 56                      push esi
:00433528 57                      push edi
:00433529 894DFC                  mov dword ptr [ebp-04], ecx
:0043352C 837D0C00                cmp dword ptr [ebp+0C], 00000000
:00433530 0F8411000000            je 00433547
:00433536 8B4508                  mov eax, dword ptr [ebp+08]
:00433539 50                      push eax
:0043353A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043353D E81E000000              call 00433560
:00433542 E90C000000              jmp 00433553

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433530(C)
|
:00433547 8B4508                  mov eax, dword ptr [ebp+08]
:0043354A 50                      push eax
:0043354B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043354E E85D000000              call 004335B0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433542(U)
|
:00433553 E900000000              jmp 00433558

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433553(U)
|
:00433558 5F                      pop edi
:00433559 5E                      pop esi
:0043355A 5B                      pop ebx
:0043355B C9                      leave
:0043355C C20800                  ret 0008


:0043355F CC                      int 03

* Referenced by a CALL at Address:
|:0043353D   
|
:00433560 55                      push ebp
:00433561 8BEC                    mov ebp, esp
:00433563 83EC04                  sub esp, 00000004
:00433566 53                      push ebx
:00433567 56                      push esi
:00433568 57                      push edi
:00433569 894DFC                  mov dword ptr [ebp-04], ecx
:0043356C 8B4508                  mov eax, dword ptr [ebp+08]
:0043356F 99                      cdq
:00433570 83E207                  and edx, 00000007
:00433573 03C2                    add eax, edx
:00433575 C1F803                  sar eax, 03
:00433578 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043357B 33DB                    xor ebx, ebx
:0043357D 8A5C0125                mov bl, byte ptr [ecx+eax+25]
:00433581 B880000000              mov eax, 00000080
:00433586 8B4D08                  mov ecx, dword ptr [ebp+08]
:00433589 80E107                  and cl, 07
:0043358C D3F8                    sar eax, cl
:0043358E 0AD8                    or bl, al
:00433590 8B4508                  mov eax, dword ptr [ebp+08]
:00433593 99                      cdq
:00433594 83E207                  and edx, 00000007
:00433597 03C2                    add eax, edx
:00433599 C1F803                  sar eax, 03
:0043359C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043359F 885C0125                mov byte ptr [ecx+eax+25], bl
:004335A3 E900000000              jmp 004335A8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004335A3(U)
|
:004335A8 5F                      pop edi
:004335A9 5E                      pop esi
:004335AA 5B                      pop ebx
:004335AB C9                      leave
:004335AC C20400                  ret 0004


:004335AF CC                      int 03

* Referenced by a CALL at Address:
|:0043354E   
|
:004335B0 55                      push ebp
:004335B1 8BEC                    mov ebp, esp
:004335B3 83EC04                  sub esp, 00000004
:004335B6 53                      push ebx
:004335B7 56                      push esi
:004335B8 57                      push edi
:004335B9 894DFC                  mov dword ptr [ebp-04], ecx
:004335BC 8B4508                  mov eax, dword ptr [ebp+08]
:004335BF 99                      cdq
:004335C0 83E207                  and edx, 00000007
:004335C3 03C2                    add eax, edx
:004335C5 C1F803                  sar eax, 03
:004335C8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004335CB 33DB                    xor ebx, ebx
:004335CD 8A5C0125                mov bl, byte ptr [ecx+eax+25]
:004335D1 B87FFF0000              mov eax, 0000FF7F
:004335D6 8B4D08                  mov ecx, dword ptr [ebp+08]
:004335D9 80E107                  and cl, 07
:004335DC D3F8                    sar eax, cl
:004335DE 23D8                    and ebx, eax
:004335E0 8B4508                  mov eax, dword ptr [ebp+08]
:004335E3 99                      cdq
:004335E4 83E207                  and edx, 00000007
:004335E7 03C2                    add eax, edx
:004335E9 C1F803                  sar eax, 03
:004335EC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004335EF 885C0125                mov byte ptr [ecx+eax+25], bl
:004335F3 E900000000              jmp 004335F8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004335F3(U)
|
:004335F8 5F                      pop edi
:004335F9 5E                      pop esi
:004335FA 5B                      pop ebx
:004335FB C9                      leave
:004335FC C20400                  ret 0004


:004335FF CC                      int 03

* Referenced by a CALL at Addresses:
|:004301D7   , :00430D04   , :00430D6A   , :00430FE2   
|
:00433600 55                      push ebp
:00433601 8BEC                    mov ebp, esp
:00433603 83EC04                  sub esp, 00000004
:00433606 53                      push ebx
:00433607 56                      push esi
:00433608 57                      push edi
:00433609 894DFC                  mov dword ptr [ebp-04], ecx
:0043360C 8B4508                  mov eax, dword ptr [ebp+08]
:0043360F 99                      cdq
:00433610 83E207                  and edx, 00000007
:00433613 03C2                    add eax, edx
:00433615 C1F803                  sar eax, 03
:00433618 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043361B 33D2                    xor edx, edx
:0043361D 8A540125                mov dl, byte ptr [ecx+eax+25]
:00433621 B880000000              mov eax, 00000080
:00433626 8B4D08                  mov ecx, dword ptr [ebp+08]
:00433629 80E107                  and cl, 07
:0043362C D3F8                    sar eax, cl
:0043362E 85D0                    test eax, edx
:00433630 0F840A000000            je 00433640
:00433636 B801000000              mov eax, 00000001
:0043363B E902000000              jmp 00433642

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433630(C)
|
:00433640 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043363B(U)
|
:00433642 E900000000              jmp 00433647

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433642(U)
|
:00433647 5F                      pop edi
:00433648 5E                      pop esi
:00433649 5B                      pop ebx
:0043364A C9                      leave
:0043364B C20400                  ret 0004


:0043364E CC                      int 03
:0043364F CC                      int 03

* Referenced by a CALL at Addresses:
|:0042FD43   , :0042FD5F   , :0042FD94   , :0042FDC1   , :0042FE74   
|:0042FEE3   , :0042FEF2   , :0042FF01   , :0042FF7C   , :0042FFF1   
|:0042FFFF   , :00430016   , :0043005A   , :00430068   , :004300C3   
|:004300D1   , :0043015B   , :0043016C   , :0043017D   , :0043018B   
|:0043019C   , :004301AA   , :004301B8   , :004302E7   , :004302F8   
|:00430402   , :00430414   , :00430426   , :00430438   , :004305F6   
|:00430639   , :0043064A   , :0043065B   , :00430755   , :00430766   
|:004307C6   , :004307D7   , :0043088E   , :004308F2   , :00430903   
|:00430914   , :00430925   , :00430936   , :00430947   , :004309FF   
|:00430A77   , :00430B1C   , :00430B2D   , :00430BBB   , :00430BCC   
|:00430C19   , :00430C6F   , :00430C99   , :00430CAA   , :00430CEC   
|:00430D1A   , :00430D52   , :00430DCC   , :00430ECD   , :00430EDE   
|:00430EEF   , :00430F00   , :00430F11   , :00430F22   , :00430F33   
|:00430F56   , :00430F67   , :00430F78   , :00430F89   , :00430F9A   
|:00430FBD   , :00431343   , :0043156E   , :0043157F   , :00431590   
|:004315C5   , :004315D6   , :004315E7   , :0043162E   , :00431677   
|:00431692   , :00431818   , :00431829   , :00431869   , :0043187A   
|:0043188B   , :004318E6   , :0043195D   , :0043196E   , :0043197F   
|:00431990   , :00431B03   , :00431B26   , :00431B37   , :00431B48   
|:00431B59   , :00431B6A   , :00431B7B   , :00431B8C   , :00431C28   
|:00431C39   , :00431C67   , :00431C78   , :00431C89   , :00431C9A   
|:00431D0A   , :00431D57   , :00431D68   , :00431DA5   , :00431DEA   
|:00431E35   , :00431E6E   , :00431E7F   , :00431EC0   
|
:00433650 55                      push ebp
:00433651 8BEC                    mov ebp, esp
:00433653 83EC08                  sub esp, 00000008
:00433656 53                      push ebx
:00433657 56                      push esi
:00433658 57                      push edi
:00433659 894DF8                  mov dword ptr [ebp-08], ecx
:0043365C 8B45F8                  mov eax, dword ptr [ebp-08]
:0043365F 33C9                    xor ecx, ecx
:00433661 668B8855030000          mov cx, word ptr [eax+00000355]
:00433668 51                      push ecx
:00433669 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043366C 83C114                  add ecx, 00000014
:0043366F E83CF7FFFF              call 00432DB0
:00433674 33C9                    xor ecx, ecx
:00433676 8A08                    mov cl, byte ptr [eax]
:00433678 894DFC                  mov dword ptr [ebp-04], ecx
:0043367B 8B45F8                  mov eax, dword ptr [ebp-08]
:0043367E 33C9                    xor ecx, ecx
:00433680 668B8855030000          mov cx, word ptr [eax+00000355]
:00433687 41                      inc ecx
:00433688 8B45F8                  mov eax, dword ptr [ebp-08]
:0043368B 66898855030000          mov word ptr [eax+00000355], cx
:00433692 8B45FC                  mov eax, dword ptr [ebp-04]
:00433695 E900000000              jmp 0043369A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433695(U)
|
:0043369A 5F                      pop edi
:0043369B 5E                      pop esi
:0043369C 5B                      pop ebx
:0043369D C9                      leave
:0043369E C3                      ret


:0043369F CC                      int 03

* Referenced by a CALL at Addresses:
|:0042FE8A   , :0042FED4   , :00430076   , :004300DF   , :0043014C   
|:0043031A   , :00430331   , :004303C1   , :004303F0   , :004304A2   
|:004304B9   , :004304FD   , :00430514   , :0043052B   , :00430567   
|:004305B2   , :0043068E   , :0043080B   , :0043081D   , :004308E0   
|:004309C9   , :00430A65   , :00430AD3   , :00430AE3   , :00430BA7   
|:00430EBB   , :00430F44   , :00430FAB   , :00431331   , :00431380   
|:0043161C   , :004316A3   , :00431857   , :004318D4   , :00431923   
|:00431B14   , :00431CF8   , :00431D45   , :00431DD8   , :00431E23   
|:00431EA7   
|
:004336A0 55                      push ebp
:004336A1 8BEC                    mov ebp, esp
:004336A3 83EC08                  sub esp, 00000008
:004336A6 53                      push ebx
:004336A7 56                      push esi
:004336A8 57                      push edi
:004336A9 894DF8                  mov dword ptr [ebp-08], ecx
:004336AC 8B45F8                  mov eax, dword ptr [ebp-08]
:004336AF 33C9                    xor ecx, ecx
:004336B1 668B8855030000          mov cx, word ptr [eax+00000355]
:004336B8 51                      push ecx
:004336B9 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004336BC 83C114                  add ecx, 00000014
:004336BF E8ECF6FFFF              call 00432DB0
:004336C4 668B08                  mov cx, word ptr [eax]
:004336C7 66894DFC                mov word ptr [ebp-04], cx
:004336CB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004336CE 33D2                    xor edx, edx
:004336D0 668B9155030000          mov dx, word ptr [ecx+00000355]
:004336D7 83C202                  add edx, 00000002
:004336DA 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004336DD 66899155030000          mov word ptr [ecx+00000355], dx
:004336E4 668B45FC                mov ax, word ptr [ebp-04]
:004336E8 E900000000              jmp 004336ED

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004336E8(U)
|
:004336ED 5F                      pop edi
:004336EE 5E                      pop esi
:004336EF 5B                      pop ebx
:004336F0 C9                      leave
:004336F1 C3                      ret


:004336F2 CC                      int 03
:004336F3 CC                      int 03
:004336F4 CC                      int 03
:004336F5 CC                      int 03
:004336F6 CC                      int 03
:004336F7 CC                      int 03
:004336F8 CC                      int 03
:004336F9 CC                      int 03
:004336FA CC                      int 03
:004336FB CC                      int 03
:004336FC CC                      int 03
:004336FD CC                      int 03
:004336FE CC                      int 03
:004336FF CC                      int 03

* Referenced by a CALL at Addresses:
|:0043234D   , :00432361   , :00432438   , :004324CD   , :004324FE   
|:00432512   , :004325D2   , :004327AA   , :004327CF   , :004328EC   
|
:00433700 55                      push ebp
:00433701 8BEC                    mov ebp, esp
:00433703 83EC14                  sub esp, 00000014
:00433706 53                      push ebx
:00433707 56                      push esi
:00433708 57                      push edi
:00433709 894DEC                  mov dword ptr [ebp-14], ecx
:0043370C 8B45EC                  mov eax, dword ptr [ebp-14]
:0043370F 83C045                  add eax, 00000045
:00433712 8945FC                  mov dword ptr [ebp-04], eax
:00433715 C745F800000000          mov [ebp-08], 00000000
:0043371C C745F400000000          mov [ebp-0C], 00000000
:00433723 E907000000              jmp 0043372F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433780(U)
|
:00433728 8345FC06                add dword ptr [ebp-04], 00000006
:0043372C FF45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433723(U)
|
:0043372F 817DF480000000          cmp dword ptr [ebp-0C], 00000080
:00433736 0F8D49000000            jnl 00433785
:0043373C 8B45FC                  mov eax, dword ptr [ebp-04]
:0043373F 33C9                    xor ecx, ecx
:00433741 668B08                  mov cx, word ptr [eax]
:00433744 8B4508                  mov eax, dword ptr [ebp+08]
:00433747 25FFFF0000              and eax, 0000FFFF
:0043374C 3BC8                    cmp ecx, eax
:0043374E 0F8508000000            jne 0043375C
:00433754 8B45FC                  mov eax, dword ptr [ebp-04]
:00433757 E977000000              jmp 004337D3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043374E(C)
|
:0043375C 837DF800                cmp dword ptr [ebp-08], 00000000
:00433760 0F851A000000            jne 00433780
:00433766 8B45FC                  mov eax, dword ptr [ebp-04]
:00433769 33C9                    xor ecx, ecx
:0043376B 668B08                  mov cx, word ptr [eax]
:0043376E 81F9FFFF0000            cmp ecx, 0000FFFF
:00433774 0F8506000000            jne 00433780
:0043377A 8B45FC                  mov eax, dword ptr [ebp-04]
:0043377D 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00433760(C), :00433774(C)
|
:00433780 E9A3FFFFFF              jmp 00433728

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433736(C)
|
:00433785 837DF800                cmp dword ptr [ebp-08], 00000000
:00433789 0F843D000000            je 004337CC
:0043378F 8B4508                  mov eax, dword ptr [ebp+08]
:00433792 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00433795 668901                  mov word ptr [ecx], ax
:00433798 8B45F8                  mov eax, dword ptr [ebp-08]
:0043379B C6400400                mov [eax+04], 00
:0043379F 68FF000000              push 000000FF
:004337A4 68FF000000              push 000000FF
:004337A9 8D4DF0                  lea ecx, dword ptr [ebp-10]
:004337AC E89FAAFEFF              call 0041E250
:004337B1 50                      push eax
:004337B2 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004337B5 83C102                  add ecx, 00000002
:004337B8 E8D3E0FCFF              call 00401890
:004337BD 8B45F8                  mov eax, dword ptr [ebp-08]
:004337C0 C6400500                mov [eax+05], 00
:004337C4 8B45F8                  mov eax, dword ptr [ebp-08]
:004337C7 E907000000              jmp 004337D3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433789(C)
|
:004337CC 33C0                    xor eax, eax
:004337CE E900000000              jmp 004337D3

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00433757(U), :004337C7(U), :004337CE(U)
|
:004337D3 5F                      pop edi
:004337D4 5E                      pop esi
:004337D5 5B                      pop ebx
:004337D6 C9                      leave
:004337D7 C20400                  ret 0004


:004337DA CC                      int 03
:004337DB CC                      int 03
:004337DC CC                      int 03
:004337DD CC                      int 03
:004337DE CC                      int 03
:004337DF CC                      int 03
:004337E0 55                      push ebp
:004337E1 8BEC                    mov ebp, esp
:004337E3 53                      push ebx
:004337E4 56                      push esi
:004337E5 57                      push edi
:004337E6 8B4508                  mov eax, dword ptr [ebp+08]
:004337E9 A308244500              mov dword ptr [00452408], eax
:004337EE 33C0                    xor eax, eax
:004337F0 E900000000              jmp 004337F5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004337F0(U)
|
:004337F5 5F                      pop edi
:004337F6 5E                      pop esi
:004337F7 5B                      pop ebx
:004337F8 C9                      leave
:004337F9 C3                      ret



* Referenced by a CALL at Addresses:
|:00433E27   , :00433E31   , :00435663   , :0043621E   
|
:004337FA 55                      push ebp
:004337FB 8BEC                    mov ebp, esp
:004337FD 81EC20010000            sub esp, 00000120
:00433803 53                      push ebx
:00433804 56                      push esi
:00433805 57                      push edi
:00433806 C745FC00000000          mov [ebp-04], 00000000
:0043380D 6800010000              push 00000100
:00433812 8D85FCFEFFFF            lea eax, dword ptr [ebp+FFFFFEFC]
:00433818 50                      push eax
:00433819 6870524500              push 00455270
:0043381E E82A3C0100              call 0044744D
:00433823 83C40C                  add esp, 0000000C
:00433826 C785E8FEFFFF00000000    mov dword ptr [ebp+FFFFFEE8], 00000000
:00433830 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:00433836 8985ECFEFFFF            mov dword ptr [ebp+FFFFFEEC], eax
:0043383C E906000000              jmp 00433847

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433896(U)
|
:00433841 FF85ECFEFFFF            inc dword ptr [ebp+FFFFFEEC]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043383C(U)
|
:00433847 81BDECFEFFFF80000000    cmp dword ptr [ebp+FFFFFEEC], 00000080
:00433851 0F8344000000            jnb 0043389B
:00433857 8B85ECFEFFFF            mov eax, dword ptr [ebp+FFFFFEEC]
:0043385D 8B8445FCFEFFFF          mov eax, dword ptr [ebp+2*eax-00000104]
:00433864 25FFFF0000              and eax, 0000FFFF
:00433869 3DFFFF0000              cmp eax, 0000FFFF
:0043386E 0F8422000000            je 00433896
:00433874 8B85ECFEFFFF            mov eax, dword ptr [ebp+FFFFFEEC]
:0043387A 668B8445FCFEFFFF        mov ax, word ptr [ebp+2*eax-00000104]
:00433882 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:00433888 6689044D70524500        mov word ptr [2*ecx+00455270], ax
:00433890 FF85E8FEFFFF            inc dword ptr [ebp+FFFFFEE8]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043386E(C)
|
:00433896 E9A6FFFFFF              jmp 00433841

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433851(C)
|
:0043389B 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:004338A1 8985ECFEFFFF            mov dword ptr [ebp+FFFFFEEC], eax
:004338A7 E906000000              jmp 004338B2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004338D2(U)
|
:004338AC FF85ECFEFFFF            inc dword ptr [ebp+FFFFFEEC]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004338A7(U)
|
:004338B2 81BDECFEFFFF80000000    cmp dword ptr [ebp+FFFFFEEC], 00000080
:004338BC 0F8315000000            jnb 004338D7
:004338C2 8B85ECFEFFFF            mov eax, dword ptr [ebp+FFFFFEEC]
:004338C8 66C7044570524500FFFF    mov word ptr [2*eax+00455270], FFFF
:004338D2 E9D5FFFFFF              jmp 004338AC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004338BC(C)
|
:004338D7 83BDE8FEFFFF02          cmp dword ptr [ebp+FFFFFEE8], 00000002
:004338DE 0F8305000000            jnb 004338E9
:004338E4 E9BA010000              jmp 00433AA3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004338DE(C)
|
:004338E9 C785ECFEFFFF00000000    mov dword ptr [ebp+FFFFFEEC], 00000000
:004338F3 E906000000              jmp 004338FE

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043392A(U), :00433A99(U)
|
:004338F8 FF85ECFEFFFF            inc dword ptr [ebp+FFFFFEEC]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004338F3(U)
|
:004338FE 81BDECFEFFFF80000000    cmp dword ptr [ebp+FFFFFEEC], 00000080
:00433908 0F8390010000            jnb 00433A9E
:0043390E 8B85ECFEFFFF            mov eax, dword ptr [ebp+FFFFFEEC]
:00433914 33C9                    xor ecx, ecx
:00433916 668B0C4570524500        mov cx, word ptr [2*eax+00455270]
:0043391E 81F9FFFF0000            cmp ecx, 0000FFFF
:00433924 0F8505000000            jne 0043392F
:0043392A E9C9FFFFFF              jmp 004338F8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433924(C)
|
:0043392F 8B85ECFEFFFF            mov eax, dword ptr [ebp+FFFFFEEC]
:00433935 40                      inc eax
:00433936 8985E8FEFFFF            mov dword ptr [ebp+FFFFFEE8], eax
:0043393C E906000000              jmp 00433947

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433A94(U)
|
:00433941 FF85E8FEFFFF            inc dword ptr [ebp+FFFFFEE8]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043393C(U)
|
:00433947 81BDE8FEFFFF80000000    cmp dword ptr [ebp+FFFFFEE8], 00000080
:00433951 0F8342010000            jnb 00433A99
:00433957 8B85ECFEFFFF            mov eax, dword ptr [ebp+FFFFFEEC]
:0043395D 33C9                    xor ecx, ecx
:0043395F 668B0C4570524500        mov cx, word ptr [2*eax+00455270]
:00433967 51                      push ecx
:00433968 E86CB5FEFF              call 0041EED9
:0043396D 83C404                  add esp, 00000004
:00433970 8985F0FEFFFF            mov dword ptr [ebp+FFFFFEF0], eax
:00433976 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:0043397C 33C9                    xor ecx, ecx
:0043397E 668B0C4570524500        mov cx, word ptr [2*eax+00455270]
:00433986 81F9FFFF0000            cmp ecx, 0000FFFF
:0043398C 0F8505000000            jne 00433997
:00433992 E902010000              jmp 00433A99

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043398C(C)
|
:00433997 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:0043399D 33C9                    xor ecx, ecx
:0043399F 668B0C4570524500        mov cx, word ptr [2*eax+00455270]
:004339A7 51                      push ecx
:004339A8 E82CB5FEFF              call 0041EED9
:004339AD 83C404                  add esp, 00000004
:004339B0 8985F8FEFFFF            mov dword ptr [ebp+FFFFFEF8], eax
:004339B6 8B4508                  mov eax, dword ptr [ebp+08]
:004339B9 50                      push eax
:004339BA 8B85ECFEFFFF            mov eax, dword ptr [ebp+FFFFFEEC]
:004339C0 33C9                    xor ecx, ecx
:004339C2 668B0C4570524500        mov cx, word ptr [2*eax+00455270]
:004339CA 51                      push ecx
:004339CB E85084FDFF              call 0040BE20
:004339D0 83C408                  add esp, 00000008
:004339D3 8985E4FEFFFF            mov dword ptr [ebp+FFFFFEE4], eax
:004339D9 8B4508                  mov eax, dword ptr [ebp+08]
:004339DC 50                      push eax
:004339DD 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:004339E3 33C9                    xor ecx, ecx
:004339E5 668B0C4570524500        mov cx, word ptr [2*eax+00455270]
:004339ED 51                      push ecx
:004339EE E82D84FDFF              call 0040BE20
:004339F3 83C408                  add esp, 00000008
:004339F6 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:004339FC C745FC00000000          mov [ebp-04], 00000000
:00433A03 837D080A                cmp dword ptr [ebp+08], 0000000A
:00433A07 0F851E000000            jne 00433A2B
:00433A0D 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:00433A13 3985E0FEFFFF            cmp dword ptr [ebp+FFFFFEE0], eax
:00433A19 0F8307000000            jnb 00433A26
:00433A1F C745FC01000000          mov [ebp-04], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433A19(C)
|
:00433A26 E919000000              jmp 00433A44

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433A07(C)
|
:00433A2B 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:00433A31 3985E0FEFFFF            cmp dword ptr [ebp+FFFFFEE0], eax
:00433A37 0F8607000000            jbe 00433A44
:00433A3D C745FC01000000          mov [ebp-04], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00433A26(U), :00433A37(C)
|
:00433A44 837DFC00                cmp dword ptr [ebp-04], 00000000
:00433A48 0F8446000000            je 00433A94
:00433A4E 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:00433A54 33C9                    xor ecx, ecx
:00433A56 668B0C4570524500        mov cx, word ptr [2*eax+00455270]
:00433A5E 898DF4FEFFFF            mov dword ptr [ebp+FFFFFEF4], ecx
:00433A64 8B85ECFEFFFF            mov eax, dword ptr [ebp+FFFFFEEC]
:00433A6A 668B044570524500        mov ax, word ptr [2*eax+00455270]
:00433A72 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:00433A78 6689044D70524500        mov word ptr [2*ecx+00455270], ax
:00433A80 8B85F4FEFFFF            mov eax, dword ptr [ebp+FFFFFEF4]
:00433A86 8B8DECFEFFFF            mov ecx, dword ptr [ebp+FFFFFEEC]
:00433A8C 6689044D70524500        mov word ptr [2*ecx+00455270], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433A48(C)
|
:00433A94 E9A8FEFFFF              jmp 00433941

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00433951(C), :00433992(U)
|
:00433A99 E95AFEFFFF              jmp 004338F8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433908(C)
|
:00433A9E E900000000              jmp 00433AA3

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004338E4(U), :00433A9E(U)
|
:00433AA3 5F                      pop edi
:00433AA4 5E                      pop esi
:00433AA5 5B                      pop ebx
:00433AA6 C9                      leave
:00433AA7 C3                      ret



* Referenced by a CALL at Address:
|:00431321   
|
:00433AA8 55                      push ebp
:00433AA9 8BEC                    mov ebp, esp
:00433AAB 83EC08                  sub esp, 00000008
:00433AAE 53                      push ebx
:00433AAF 56                      push esi
:00433AB0 57                      push edi
:00433AB1 68E00B0000              push 00000BE0
:00433AB6 E8861FFFFF              call 00425A41
:00433ABB 83C404                  add esp, 00000004
:00433ABE B988534500              mov ecx, 00455388
:00433AC3 E870E4FCFF              call 00401F38
:00433AC8 E851D5FCFF              call 0040101E
:00433ACD 8845FC                  mov byte ptr [ebp-04], al
:00433AD0 E8DB3B0000              call 004376B0
:00433AD5 8945F8                  mov dword ptr [ebp-08], eax
:00433AD8 E834020000              call 00433D11
:00433ADD 6A03                    push 00000003
:00433ADF B900AA4600              mov ecx, 0046AA00
:00433AE4 E837DDFCFF              call 00401820
:00433AE9 33C0                    xor eax, eax
:00433AEB 66A1F0CD4600            mov ax, word ptr [0046CDF0]
:00433AF1 50                      push eax
:00433AF2 33C0                    xor eax, eax
:00433AF4 66A118CE4600            mov ax, word ptr [0046CE18]
:00433AFA 50                      push eax
:00433AFB E8161A0000              call 00435516
:00433B00 83C408                  add esp, 00000008
:00433B03 E843000000              call 00433B4B
:00433B08 8B45F8                  mov eax, dword ptr [ebp-08]
:00433B0B 50                      push eax
:00433B0C E85C3B0000              call 0043766D
:00433B11 83C404                  add esp, 00000004
:00433B14 8B45FC                  mov eax, dword ptr [ebp-04]
:00433B17 50                      push eax
:00433B18 B900AA4600              mov ecx, 0046AA00
:00433B1D E8FEDCFCFF              call 00401820
:00433B22 B988534500              mov ecx, 00455388
:00433B27 E852E4FCFF              call 00401F7E
:00433B2C 33C0                    xor eax, eax
:00433B2E 8A45FC                  mov al, byte ptr [ebp-04]
:00433B31 83F802                  cmp eax, 00000002
:00433B34 0F8505000000            jne 00433B3F
:00433B3A E8C710FEFF              call 00414C06

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433B34(C)
|
:00433B3F 33C0                    xor eax, eax
:00433B41 E900000000              jmp 00433B46

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433B41(U)
|
:00433B46 5F                      pop edi
:00433B47 5E                      pop esi
:00433B48 5B                      pop ebx
:00433B49 C9                      leave
:00433B4A C3                      ret



* Referenced by a CALL at Address:
|:00433B03   
|
:00433B4B 55                      push ebp
:00433B4C 8BEC                    mov ebp, esp
:00433B4E 83EC14                  sub esp, 00000014
:00433B51 53                      push ebx
:00433B52 56                      push esi
:00433B53 57                      push edi
:00433B54 E8EF000000              call 00433C48
:00433B59 C745EC00000000          mov [ebp-14], 00000000
:00433B60 33C0                    xor eax, eax
:00433B62 66A118CE4600            mov ax, word ptr [0046CE18]
:00433B68 8945F4                  mov dword ptr [ebp-0C], eax
:00433B6B E903000000              jmp 00433B73

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433BF1(U)
|
:00433B70 FF45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433B6B(U)
|
:00433B73 817DF480000000          cmp dword ptr [ebp-0C], 00000080
:00433B7A 0F8376000000            jnb 00433BF6
:00433B80 8B45F4                  mov eax, dword ptr [ebp-0C]
:00433B83 33C9                    xor ecx, ecx
:00433B85 668B0C4570524500        mov cx, word ptr [2*eax+00455270]
:00433B8D 894DF0                  mov dword ptr [ebp-10], ecx
:00433B90 817DF0FFFF0000          cmp dword ptr [ebp-10], 0000FFFF
:00433B97 0F8454000000            je 00433BF1
:00433B9D 8B45EC                  mov eax, dword ptr [ebp-14]
:00433BA0 50                      push eax
:00433BA1 B9B0C44600              mov ecx, 0046C4B0
:00433BA6 E8957FFDFF              call 0040BB40
:00433BAB 8945FC                  mov dword ptr [ebp-04], eax
:00433BAE 8B45EC                  mov eax, dword ptr [ebp-14]
:00433BB1 8945F8                  mov dword ptr [ebp-08], eax
:00433BB4 E907000000              jmp 00433BC0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433BEC(U)
|
:00433BB9 FF45F8                  inc [ebp-08]
:00433BBC 8345FC17                add dword ptr [ebp-04], 00000017

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433BB4(U)
|
:00433BC0 837DF82D                cmp dword ptr [ebp-08], 0000002D
:00433BC4 0F8327000000            jnb 00433BF1
:00433BCA 8B45FC                  mov eax, dword ptr [ebp-04]
:00433BCD 813800040000            cmp dword ptr [eax], 00000400
:00433BD3 0F8C13000000            jl 00433BEC
:00433BD9 8B45F8                  mov eax, dword ptr [ebp-08]
:00433BDC 8945EC                  mov dword ptr [ebp-14], eax
:00433BDF 8B45F0                  mov eax, dword ptr [ebp-10]
:00433BE2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00433BE5 8901                    mov dword ptr [ecx], eax
:00433BE7 E905000000              jmp 00433BF1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433BD3(C)
|
:00433BEC E9C8FFFFFF              jmp 00433BB9

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00433B97(C), :00433BC4(C), :00433BE7(U)
|
:00433BF1 E97AFFFFFF              jmp 00433B70

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433B7A(C)
|
:00433BF6 6A00                    push 00000000
:00433BF8 B9B0C44600              mov ecx, 0046C4B0
:00433BFD E83E7FFDFF              call 0040BB40
:00433C02 8945FC                  mov dword ptr [ebp-04], eax
:00433C05 8B45EC                  mov eax, dword ptr [ebp-14]
:00433C08 8945F8                  mov dword ptr [ebp-08], eax
:00433C0B E907000000              jmp 00433C17

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433C39(U)
|
:00433C10 FF45F8                  inc [ebp-08]
:00433C13 8345FC17                add dword ptr [ebp-04], 00000017

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433C0B(U)
|
:00433C17 837DF82D                cmp dword ptr [ebp-08], 0000002D
:00433C1B 0F831D000000            jnb 00433C3E
:00433C21 8B45FC                  mov eax, dword ptr [ebp-04]
:00433C24 813800040000            cmp dword ptr [eax], 00000400
:00433C2A 0F8C09000000            jl 00433C39
:00433C30 8B45FC                  mov eax, dword ptr [ebp-04]
:00433C33 C700FFFF0000            mov dword ptr [eax], 0000FFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433C2A(C)
|
:00433C39 E9D2FFFFFF              jmp 00433C10

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433C1B(C)
|
:00433C3E E900000000              jmp 00433C43

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433C3E(U)
|
:00433C43 5F                      pop edi
:00433C44 5E                      pop esi
:00433C45 5B                      pop ebx
:00433C46 C9                      leave
:00433C47 C3                      ret



* Referenced by a CALL at Address:
|:00433B54   
|
:00433C48 55                      push ebp
:00433C49 8BEC                    mov ebp, esp
:00433C4B 83EC10                  sub esp, 00000010
:00433C4E 53                      push ebx
:00433C4F 56                      push esi
:00433C50 57                      push edi
:00433C51 68FF000000              push 000000FF
:00433C56 6800010000              push 00000100
:00433C5B 6870524500              push 00455270
:00433C60 E8FE370100              call 00447463
:00433C65 83C40C                  add esp, 0000000C
:00433C68 C745F000000000          mov [ebp-10], 00000000
:00433C6F 33C0                    xor eax, eax
:00433C71 66A118CE4600            mov ax, word ptr [0046CE18]
:00433C77 8945F8                  mov dword ptr [ebp-08], eax
:00433C7A E903000000              jmp 00433C82

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433CAF(U)
|
:00433C7F FF45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433C7A(U)
|
:00433C82 33C0                    xor eax, eax
:00433C84 66A11CCE4600            mov ax, word ptr [0046CE1C]
:00433C8A 3B45F8                  cmp eax, dword ptr [ebp-08]
:00433C8D 0F8621000000            jbe 00433CB4
:00433C93 8B45F8                  mov eax, dword ptr [ebp-08]
:00433C96 33C9                    xor ecx, ecx
:00433C98 668B0C45F8CD4600        mov cx, word ptr [2*eax+0046CDF8]
:00433CA0 81F9FFFF0000            cmp ecx, 0000FFFF
:00433CA6 0F8403000000            je 00433CAF
:00433CAC FF45F0                  inc [ebp-10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433CA6(C)
|
:00433CAF E9CBFFFFFF              jmp 00433C7F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433C8D(C)
|
:00433CB4 C745FC00000000          mov [ebp-04], 00000000
:00433CBB C745F800000000          mov [ebp-08], 00000000
:00433CC2 E903000000              jmp 00433CCA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433D02(U)
|
:00433CC7 FF45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433CC2(U)
|
:00433CCA 837DF80F                cmp dword ptr [ebp-08], 0000000F
:00433CCE 0F8333000000            jnb 00433D07
:00433CD4 8B45F8                  mov eax, dword ptr [ebp-08]
:00433CD7 33C9                    xor ecx, ecx
:00433CD9 668B0C45F8CD4600        mov cx, word ptr [2*eax+0046CDF8]
:00433CE1 894DF4                  mov dword ptr [ebp-0C], ecx
:00433CE4 817DF4FFFF0000          cmp dword ptr [ebp-0C], 0000FFFF
:00433CEB 0F8411000000            je 00433D02
:00433CF1 8B45F4                  mov eax, dword ptr [ebp-0C]
:00433CF4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00433CF7 6689044D70524500        mov word ptr [2*ecx+00455270], ax
:00433CFF FF45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433CEB(C)
|
:00433D02 E9C0FFFFFF              jmp 00433CC7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433CCE(C)
|
:00433D07 E900000000              jmp 00433D0C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433D07(U)
|
:00433D0C 5F                      pop edi
:00433D0D 5E                      pop esi
:00433D0E 5B                      pop ebx
:00433D0F C9                      leave
:00433D10 C3                      ret



* Referenced by a CALL at Address:
|:00433AD8   
|
:00433D11 55                      push ebp
:00433D12 8BEC                    mov ebp, esp
:00433D14 83EC10                  sub esp, 00000010
:00433D17 53                      push ebx
:00433D18 56                      push esi
:00433D19 57                      push edi
:00433D1A 68FF000000              push 000000FF
:00433D1F 6A1E                    push 0000001E
:00433D21 68F8CD4600              push 0046CDF8
:00433D26 E838370100              call 00447463
:00433D2B 83C40C                  add esp, 0000000C
:00433D2E 6A01                    push 00000001
:00433D30 E838390000              call 0043766D
:00433D35 83C404                  add esp, 00000004
:00433D38 6A00                    push 00000000
:00433D3A E84921FFFF              call 00425E88
:00433D3F 83C404                  add esp, 00000004
:00433D42 E8FC000000              call 00433E43
:00433D47 6A00                    push 00000000
:00433D49 E83A21FFFF              call 00425E88
:00433D4E 83C404                  add esp, 00000004
:00433D51 6A00                    push 00000000
:00433D53 E824020000              call 00433F7C
:00433D58 83C404                  add esp, 00000004
:00433D5B 8945F4                  mov dword ptr [ebp-0C], eax
:00433D5E 68FF000000              push 000000FF
:00433D63 6800010000              push 00000100
:00433D68 6870524500              push 00455270
:00433D6D E8F1360100              call 00447463
:00433D72 83C40C                  add esp, 0000000C
:00433D75 C745F000000000          mov [ebp-10], 00000000
:00433D7C 8B45F0                  mov eax, dword ptr [ebp-10]
:00433D7F 8945F8                  mov dword ptr [ebp-08], eax
:00433D82 E903000000              jmp 00433D8A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433E06(U)
|
:00433D87 FF45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433D82(U)
|
:00433D8A 817DF800020000          cmp dword ptr [ebp-08], 00000200
:00433D91 0F8374000000            jnb 00433E0B
:00433D97 8B45F8                  mov eax, dword ptr [ebp-08]
:00433D9A 8D0440                  lea eax, dword ptr [eax+2*eax]
:00433D9D 03C0                    add eax, eax
:00433D9F 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:00433DA6 E8A5D0FDFF              call 00410E50
:00433DAB 8845FC                  mov byte ptr [ebp-04], al
:00433DAE 33C0                    xor eax, eax
:00433DB0 8A45FC                  mov al, byte ptr [ebp-04]
:00433DB3 85C0                    test eax, eax
:00433DB5 0F840E000000            je 00433DC9
:00433DBB 33C0                    xor eax, eax
:00433DBD 8A45FC                  mov al, byte ptr [ebp-04]
:00433DC0 83F806                  cmp eax, 00000006
:00433DC3 0F853D000000            jne 00433E06

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433DB5(C)
|
:00433DC9 8B45F8                  mov eax, dword ptr [ebp-08]
:00433DCC 50                      push eax
:00433DCD E805020000              call 00433FD7
:00433DD2 83C404                  add esp, 00000004
:00433DD5 83F82D                  cmp eax, 0000002D
:00433DD8 0F8405000000            je 00433DE3
:00433DDE E911000000              jmp 00433DF4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433DD8(C)
|
:00433DE3 8B45F8                  mov eax, dword ptr [ebp-08]
:00433DE6 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00433DE9 6689044D70524500        mov word ptr [2*ecx+00455270], ax
:00433DF1 FF45F0                  inc [ebp-10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433DDE(U)
|
:00433DF4 817DF080000000          cmp dword ptr [ebp-10], 00000080
:00433DFB 0F8505000000            jne 00433E06
:00433E01 E905000000              jmp 00433E0B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00433DC3(C), :00433DFB(C)
|
:00433E06 E97CFFFFFF              jmp 00433D87

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00433D91(C), :00433E01(U)
|
:00433E0B 33C0                    xor eax, eax
:00433E0D 66A1F0CD4600            mov ax, word ptr [0046CDF0]
:00433E13 3B45F0                  cmp eax, dword ptr [ebp-10]
:00433E16 0F8609000000            jbe 00433E25
:00433E1C 8B45F0                  mov eax, dword ptr [ebp-10]
:00433E1F 66A3F0CD4600            mov word ptr [0046CDF0], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433E16(C)
|
:00433E25 6A0A                    push 0000000A
:00433E27 E8CEF9FFFF              call 004337FA
:00433E2C 83C404                  add esp, 00000004
:00433E2F 6A09                    push 00000009
:00433E31 E8C4F9FFFF              call 004337FA
:00433E36 83C404                  add esp, 00000004
:00433E39 E900000000              jmp 00433E3E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433E39(U)
|
:00433E3E 5F                      pop edi
:00433E3F 5E                      pop esi
:00433E40 5B                      pop ebx
:00433E41 C9                      leave
:00433E42 C3                      ret



* Referenced by a CALL at Address:
|:00433D42   
|
:00433E43 55                      push ebp
:00433E44 8BEC                    mov ebp, esp
:00433E46 83EC14                  sub esp, 00000014
:00433E49 53                      push ebx
:00433E4A 56                      push esi
:00433E4B 57                      push edi
:00433E4C 68FF000000              push 000000FF
:00433E51 6A1E                    push 0000001E
:00433E53 68F8CD4600              push 0046CDF8
:00433E58 E806360100              call 00447463
:00433E5D 83C40C                  add esp, 0000000C
:00433E60 6A00                    push 00000000
:00433E62 B9B0C44600              mov ecx, 0046C4B0
:00433E67 E8D47CFDFF              call 0040BB40
:00433E6C 8945F4                  mov dword ptr [ebp-0C], eax
:00433E6F 66C70518CE46000000      mov word ptr [0046CE18], 0000
:00433E78 66C7051CCE46000000      mov word ptr [0046CE1C], 0000
:00433E81 C645F800                mov [ebp-08], 00
:00433E85 C745F000000000          mov [ebp-10], 00000000
:00433E8C E907000000              jmp 00433E98

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433F54(U)
|
:00433E91 FF45F0                  inc [ebp-10]
:00433E94 8345F417                add dword ptr [ebp-0C], 00000017

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433E8C(U)
|
:00433E98 837DF02D                cmp dword ptr [ebp-10], 0000002D
:00433E9C 0F8DB7000000            jnl 00433F59
:00433EA2 8B45F4                  mov eax, dword ptr [ebp-0C]
:00433EA5 8B00                    mov eax, dword ptr [eax]
:00433EA7 8945EC                  mov dword ptr [ebp-14], eax
:00433EAA 817DECFFFF0000          cmp dword ptr [ebp-14], 0000FFFF
:00433EB1 0F849D000000            je 00433F54
:00433EB7 8B45EC                  mov eax, dword ptr [ebp-14]
:00433EBA 50                      push eax
:00433EBB E819B0FEFF              call 0041EED9
:00433EC0 83C404                  add esp, 00000004
:00433EC3 8945FC                  mov dword ptr [ebp-04], eax
:00433EC6 817DEC00040000          cmp dword ptr [ebp-14], 00000400
:00433ECD 0F8D11000000            jnl 00433EE4
:00433ED3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00433ED6 E8B558FDFF              call 00409790
:00433EDB 50                      push eax
:00433EDC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00433EDF E8DC9FFDFF              call 0040DEC0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433ECD(C)
|
:00433EE4 8B45F4                  mov eax, dword ptr [ebp-0C]
:00433EE7 F6400601                test [eax+06], 01
:00433EEB 0F8563000000            jne 00433F54
:00433EF1 817DEC00040000          cmp dword ptr [ebp-14], 00000400
:00433EF8 0F8C0C000000            jl 00433F0A
:00433EFE 66FF051CCE4600          inc word ptr [0046CE1C]
:00433F05 E94A000000              jmp 00433F54

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433EF8(C)
|
:00433F0A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00433F0D E83ECFFDFF              call 00410E50
:00433F12 33C9                    xor ecx, ecx
:00433F14 8AC8                    mov cl, al
:00433F16 85C9                    test ecx, ecx
:00433F18 0F8415000000            je 00433F33
:00433F1E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00433F21 E82ACFFDFF              call 00410E50
:00433F26 33C9                    xor ecx, ecx
:00433F28 8AC8                    mov cl, al
:00433F2A 83F906                  cmp ecx, 00000006
:00433F2D 0F8521000000            jne 00433F54

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433F18(C)
|
:00433F33 66FF051CCE4600          inc word ptr [0046CE1C]
:00433F3A 8B45EC                  mov eax, dword ptr [ebp-14]
:00433F3D 33C9                    xor ecx, ecx
:00433F3F 8A4DF8                  mov cl, byte ptr [ebp-08]
:00433F42 6689044DF8CD4600        mov word ptr [2*ecx+0046CDF8], ax
:00433F4A FE45F8                  inc [ebp-08]
:00433F4D 66FF0518CE4600          inc word ptr [0046CE18]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00433EB1(C), :00433EEB(C), :00433F05(U), :00433F2D(C)
|
:00433F54 E938FFFFFF              jmp 00433E91

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433E9C(C)
|
:00433F59 33C0                    xor eax, eax
:00433F5B 66A11CCE4600            mov ax, word ptr [0046CE1C]
:00433F61 33C9                    xor ecx, ecx
:00433F63 668B0D18CE4600          mov cx, word ptr [0046CE18]
:00433F6A 2BC1                    sub eax, ecx
:00433F6C 66A3F0CD4600            mov word ptr [0046CDF0], ax
:00433F72 E900000000              jmp 00433F77

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433F72(U)
|
:00433F77 5F                      pop edi
:00433F78 5E                      pop esi
:00433F79 5B                      pop ebx
:00433F7A C9                      leave
:00433F7B C3                      ret



* Referenced by a CALL at Address:
|:00433D53   
|
:00433F7C 55                      push ebp
:00433F7D 8BEC                    mov ebp, esp
:00433F7F 83EC04                  sub esp, 00000004
:00433F82 53                      push ebx
:00433F83 56                      push esi
:00433F84 57                      push edi
:00433F85 C745FC00000000          mov [ebp-04], 00000000
:00433F8C E903000000              jmp 00433F94

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433FC3(U)
|
:00433F91 FF45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433F8C(U)
|
:00433F94 33C0                    xor eax, eax
:00433F96 66A11CCE4600            mov ax, word ptr [0046CE1C]
:00433F9C 3B45FC                  cmp eax, dword ptr [ebp-04]
:00433F9F 0F8623000000            jbe 00433FC8
:00433FA5 8B45FC                  mov eax, dword ptr [ebp-04]
:00433FA8 33C9                    xor ecx, ecx
:00433FAA 668B0C45F8CD4600        mov cx, word ptr [2*eax+0046CDF8]
:00433FB2 3B4D08                  cmp ecx, dword ptr [ebp+08]
:00433FB5 0F8508000000            jne 00433FC3
:00433FBB 8B45FC                  mov eax, dword ptr [ebp-04]
:00433FBE E90F000000              jmp 00433FD2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433FB5(C)
|
:00433FC3 E9C9FFFFFF              jmp 00433F91

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433F9F(C)
|
:00433FC8 B8FFFF0000              mov eax, 0000FFFF
:00433FCD E900000000              jmp 00433FD2

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00433FBE(U), :00433FCD(U)
|
:00433FD2 5F                      pop edi
:00433FD3 5E                      pop esi
:00433FD4 5B                      pop ebx
:00433FD5 C9                      leave
:00433FD6 C3                      ret



* Referenced by a CALL at Address:
|:00433DCD   
|
:00433FD7 55                      push ebp
:00433FD8 8BEC                    mov ebp, esp
:00433FDA 83EC08                  sub esp, 00000008
:00433FDD 53                      push ebx
:00433FDE 56                      push esi
:00433FDF 57                      push edi
:00433FE0 6A00                    push 00000000
:00433FE2 B9B0C44600              mov ecx, 0046C4B0
:00433FE7 E8547BFDFF              call 0040BB40
:00433FEC 8945F8                  mov dword ptr [ebp-08], eax
:00433FEF C745FC00000000          mov [ebp-04], 00000000
:00433FF6 E907000000              jmp 00434002

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043401F(U)
|
:00433FFB FF45FC                  inc [ebp-04]
:00433FFE 8345F817                add dword ptr [ebp-08], 00000017

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433FF6(U)
|
:00434002 837DFC2D                cmp dword ptr [ebp-04], 0000002D
:00434006 0F8318000000            jnb 00434024
:0043400C 8B45F8                  mov eax, dword ptr [ebp-08]
:0043400F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00434012 3908                    cmp dword ptr [eax], ecx
:00434014 0F8505000000            jne 0043401F
:0043401A E905000000              jmp 00434024

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434014(C)
|
:0043401F E9D7FFFFFF              jmp 00433FFB

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00434006(C), :0043401A(U)
|
:00434024 8B45FC                  mov eax, dword ptr [ebp-04]
:00434027 E900000000              jmp 0043402C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434027(U)
|
:0043402C 5F                      pop edi
:0043402D 5E                      pop esi
:0043402E 5B                      pop ebx
:0043402F C9                      leave
:00434030 C3                      ret


:00434031 CC                      int 03
:00434032 CC                      int 03
:00434033 CC                      int 03
:00434034 CC                      int 03
:00434035 CC                      int 03
:00434036 CC                      int 03
:00434037 CC                      int 03
:00434038 CC                      int 03
:00434039 CC                      int 03
:0043403A CC                      int 03
:0043403B CC                      int 03
:0043403C CC                      int 03
:0043403D CC                      int 03
:0043403E CC                      int 03
:0043403F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040302B   , :004340B3   , :0043436B   , :00435CC2   
|
:00434040 55                      push ebp
:00434041 8BEC                    mov ebp, esp
:00434043 53                      push ebx
:00434044 56                      push esi
:00434045 57                      push edi
:00434046 6A00                    push 00000000
:00434048 6A00                    push 00000000
:0043404A 6A04                    push 00000004
:0043404C E8AE0C0100              call 00444CFF
:00434051 83C40C                  add esp, 0000000C
:00434054 8B4510                  mov eax, dword ptr [ebp+10]
:00434057 50                      push eax
:00434058 6A30                    push 00000030
:0043405A 6A30                    push 00000030
:0043405C 8B450C                  mov eax, dword ptr [ebp+0C]
:0043405F 50                      push eax
:00434060 8B4508                  mov eax, dword ptr [ebp+08]
:00434063 50                      push eax
:00434064 E836170100              call 0044579F
:00434069 83C414                  add esp, 00000014
:0043406C E900000000              jmp 00434071

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043406C(U)
|
:00434071 5F                      pop edi
:00434072 5E                      pop esi
:00434073 5B                      pop ebx
:00434074 C9                      leave
:00434075 C3                      ret



* Referenced by a CALL at Address:
|:00434670   
|
:00434076 55                      push ebp
:00434077 8BEC                    mov ebp, esp
:00434079 83EC04                  sub esp, 00000004
:0043407C 53                      push ebx
:0043407D 56                      push esi
:0043407E 57                      push edi
:0043407F 6A04                    push 00000004
:00434081 6A00                    push 00000000
:00434083 8B4510                  mov eax, dword ptr [ebp+10]
:00434086 50                      push eax
:00434087 E8AE80FDFF              call 0040C13A
:0043408C 83C404                  add esp, 00000004
:0043408F 33C9                    xor ecx, ecx
:00434091 8AC8                    mov cl, al
:00434093 8D0CC9                  lea ecx, dword ptr [ecx+8*ecx]
:00434096 C1E108                  shl ecx, 08
:00434099 51                      push ecx
:0043409A B980E34600              mov ecx, 0046E380
:0043409F E87C360100              call 00447720
:004340A4 8945FC                  mov dword ptr [ebp-04], eax
:004340A7 8B45FC                  mov eax, dword ptr [ebp-04]
:004340AA 50                      push eax
:004340AB 8B450C                  mov eax, dword ptr [ebp+0C]
:004340AE 50                      push eax
:004340AF 8B4508                  mov eax, dword ptr [ebp+08]
:004340B2 50                      push eax
:004340B3 E888FFFFFF              call 00434040
:004340B8 83C40C                  add esp, 0000000C
:004340BB E900000000              jmp 004340C0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004340BB(U)
|
:004340C0 5F                      pop edi
:004340C1 5E                      pop esi
:004340C2 5B                      pop ebx
:004340C3 C9                      leave
:004340C4 C3                      ret



* Referenced by a CALL at Address:
|:00435161   
|
:004340C5 55                      push ebp
:004340C6 8BEC                    mov ebp, esp
:004340C8 81EC10010000            sub esp, 00000110
:004340CE 53                      push ebx
:004340CF 56                      push esi
:004340D0 57                      push edi
:004340D1 8D4DF8                  lea ecx, dword ptr [ebp-08]
:004340D4 E81753FDFF              call 004093F0
:004340D9 6A04                    push 00000004
:004340DB 6A00                    push 00000000
:004340DD 6A00                    push 00000000
:004340DF B980E34600              mov ecx, 0046E380
:004340E4 E837360100              call 00447720
:004340E9 8945FC                  mov dword ptr [ebp-04], eax
:004340EC A1442F4500              mov eax, dword ptr [00452F44]
:004340F1 50                      push eax

* Possible StringData Ref from Data Obj ->"C:ITEM.E2"
                                  |
:004340F2 68482C4500              push 00452C48
:004340F7 8D4DF8                  lea ecx, dword ptr [ebp-08]
:004340FA E8B8340100              call 004475B7
:004340FF 6800F30000              push 0000F300
:00434104 8B45FC                  mov eax, dword ptr [ebp-04]
:00434107 50                      push eax
:00434108 6A00                    push 00000000
:0043410A 8D4DF8                  lea ecx, dword ptr [ebp-08]
:0043410D E83E53FDFF              call 00409450
:00434112 8D4DF8                  lea ecx, dword ptr [ebp-08]
:00434115 E80653FDFF              call 00409420
:0043411A 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:00434120 E84B55FDFF              call 00409670

* Possible StringData Ref from Data Obj ->"C:CHR_BS.E2"
                                  |
:00434125 68682C4500              push 00452C68
:0043412A 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:00434130 E8DA33FFFF              call 0042750F
:00434135 85C0                    test eax, eax
:00434137 0F84A4000000            je 004341E1
:0043413D 6A04                    push 00000004
:0043413F 6A00                    push 00000000
:00434141 6800F30000              push 0000F300
:00434146 B980E34600              mov ecx, 0046E380
:0043414B E8D0350100              call 00447720
:00434150 8945FC                  mov dword ptr [ebp-04], eax
:00434153 C745F400000000          mov [ebp-0C], 00000000
:0043415A E90A000000              jmp 00434169

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434188(U)
|
:0043415F FF45F4                  inc [ebp-0C]
:00434162 8145FC00090000          add dword ptr [ebp-04], 00000900

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043415A(U)
|
:00434169 837DF420                cmp dword ptr [ebp-0C], 00000020
:0043416D 0F831A000000            jnb 0043418D
:00434173 8B45FC                  mov eax, dword ptr [ebp-04]
:00434176 50                      push eax
:00434177 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043417A 03C0                    add eax, eax
:0043417C 50                      push eax
:0043417D 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:00434183 E8F934FFFF              call 00427681
:00434188 E9D2FFFFFF              jmp 0043415F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043416D(C)
|
:0043418D C745F448000000          mov [ebp-0C], 00000048
:00434194 E90A000000              jmp 004341A3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004341C0(U)
|
:00434199 FF45F4                  inc [ebp-0C]
:0043419C 8145FC00090000          add dword ptr [ebp-04], 00000900

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434194(U)
|
:004341A3 837DF44A                cmp dword ptr [ebp-0C], 0000004A
:004341A7 0F8718000000            ja 004341C5
:004341AD 8B45FC                  mov eax, dword ptr [ebp-04]
:004341B0 50                      push eax
:004341B1 8B45F4                  mov eax, dword ptr [ebp-0C]
:004341B4 50                      push eax
:004341B5 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:004341BB E8C134FFFF              call 00427681
:004341C0 E9D4FFFFFF              jmp 00434199

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004341A7(C)
|
:004341C5 8B45FC                  mov eax, dword ptr [ebp-04]
:004341C8 50                      push eax
:004341C9 6A4E                    push 0000004E
:004341CB 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:004341D1 E8AB34FFFF              call 00427681
:004341D6 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:004341DC E83F52FDFF              call 00409420

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434137(C)
|
:004341E1 E900000000              jmp 004341E6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004341E1(U)
|
:004341E6 5F                      pop edi
:004341E7 5E                      pop esi
:004341E8 5B                      pop ebx
:004341E9 C9                      leave
:004341EA C3                      ret



* Referenced by a CALL at Addresses:
|:00434339   , :004357B8   
|
:004341EB 55                      push ebp
:004341EC 8BEC                    mov ebp, esp
:004341EE 83EC04                  sub esp, 00000004
:004341F1 53                      push ebx
:004341F2 56                      push esi
:004341F3 57                      push edi
:004341F4 8B4508                  mov eax, dword ptr [ebp+08]
:004341F7 8945FC                  mov dword ptr [ebp-04], eax
:004341FA E93A000000              jmp 00434239
:004341FF B020                    mov al, 20
:00434201 E91D010000              jmp 00434323
:00434206 B021                    mov al, 21
:00434208 E916010000              jmp 00434323
:0043420D B022                    mov al, 22
:0043420F E90F010000              jmp 00434323
:00434214 B023                    mov al, 23
:00434216 E908010000              jmp 00434323

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434240(C)
|
:0043421B 8B4508                  mov eax, dword ptr [ebp+08]
:0043421E 8D0440                  lea eax, dword ptr [eax+2*eax]
:00434221 03C0                    add eax, eax
:00434223 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:0043422A E8A150FDFF              call 004092D0
:0043422F E9EF000000              jmp 00434323
:00434234 E9EA000000              jmp 00434323

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004341FA(U)
|
:00434239 817DFCB6000000          cmp dword ptr [ebp-04], 000000B6
:00434240 0F87D5FFFFFF            ja 0043421B
:00434246 8B45FC                  mov eax, dword ptr [ebp-04]
:00434249 33C9                    xor ecx, ecx
:0043424B 8A886C424300            mov cl, byte ptr [eax+0043426C]
:00434251 FF248D58424300          jmp dword ptr [4*ecx+00434258]

:00434258 FF414300                DWORD 004341FF
:0043425C 06424300                DWORD 00434206
:00434260 0D424300                DWORD 0043420D
:00434264 14424300                DWORD 00434214
:00434268 1B424300                DWORD 0043421B


:0043426C 000404                  add byte ptr [esp+eax], al
:0043426F 0401                    add al, 01
:00434271 0402                    add al, 02
:00434273 0404                    add al, 04
:00434275 0404                    add al, 04
:00434277 0404                    add al, 04
:00434279 0404                    add al, 04
:0043427B 0404                    add al, 04
:0043427D 0404                    add al, 04
:0043427F 0404                    add al, 04
:00434281 0404                    add al, 04
:00434283 0404                    add al, 04
:00434285 0404                    add al, 04
:00434287 0404                    add al, 04
:00434289 0404                    add al, 04
:0043428B 0404                    add al, 04
:0043428D 0404                    add al, 04
:0043428F 0404                    add al, 04
:00434291 0404                    add al, 04
:00434293 0404                    add al, 04
:00434295 0404                    add al, 04
:00434297 0404                    add al, 04
:00434299 0404                    add al, 04
:0043429B 0404                    add al, 04
:0043429D 0404                    add al, 04
:0043429F 0404                    add al, 04
:004342A1 0404                    add al, 04
:004342A3 0404                    add al, 04
:004342A5 0404                    add al, 04
:004342A7 0404                    add al, 04
:004342A9 0404                    add al, 04
:004342AB 0404                    add al, 04
:004342AD 0404                    add al, 04
:004342AF 0404                    add al, 04
:004342B1 0404                    add al, 04
:004342B3 0404                    add al, 04
:004342B5 0404                    add al, 04
:004342B7 0404                    add al, 04
:004342B9 0404                    add al, 04
:004342BB 0404                    add al, 04
:004342BD 0404                    add al, 04
:004342BF 0404                    add al, 04
:004342C1 0404                    add al, 04
:004342C3 0404                    add al, 04
:004342C5 0404                    add al, 04
:004342C7 0404                    add al, 04
:004342C9 0404                    add al, 04
:004342CB 0404                    add al, 04
:004342CD 0404                    add al, 04
:004342CF 0404                    add al, 04
:004342D1 0404                    add al, 04
:004342D3 0404                    add al, 04
:004342D5 0404                    add al, 04
:004342D7 0404                    add al, 04
:004342D9 0404                    add al, 04
:004342DB 0404                    add al, 04
:004342DD 0404                    add al, 04
:004342DF 0404                    add al, 04
:004342E1 0404                    add al, 04
:004342E3 0404                    add al, 04
:004342E5 0404                    add al, 04
:004342E7 0404                    add al, 04
:004342E9 0404                    add al, 04
:004342EB 0404                    add al, 04
:004342ED 0404                    add al, 04
:004342EF 0404                    add al, 04
:004342F1 0404                    add al, 04
:004342F3 0404                    add al, 04
:004342F5 0404                    add al, 04
:004342F7 0404                    add al, 04
:004342F9 0404                    add al, 04
:004342FB 0404                    add al, 04
:004342FD 0404                    add al, 04
:004342FF 0404                    add al, 04
:00434301 0404                    add al, 04
:00434303 0404                    add al, 04
:00434305 0404                    add al, 04
:00434307 0404                    add al, 04
:00434309 0404                    add al, 04
:0043430B 0404                    add al, 04
:0043430D 0404                    add al, 04
:0043430F 0404                    add al, 04
:00434311 0404                    add al, 04
:00434313 0404                    add al, 04
:00434315 0404                    add al, 04
:00434317 0404                    add al, 04
:00434319 0404                    add al, 04
:0043431B 0404                    add al, 04
:0043431D 0404                    add al, 04
:0043431F 0404                    add al, 04
:00434321 0403                    add al, 03

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00434201(U), :00434208(U), :0043420F(U), :00434216(U), :0043422F(U)
|:00434234(U)
|
:00434323 5F                      pop edi
:00434324 5E                      pop esi
:00434325 5B                      pop ebx
:00434326 C9                      leave
:00434327 C3                      ret



* Referenced by a CALL at Addresses:
|:0043453E   , :00435940   
|
:00434328 55                      push ebp
:00434329 8BEC                    mov ebp, esp
:0043432B 83EC04                  sub esp, 00000004
:0043432E 53                      push ebx
:0043432F 56                      push esi
:00434330 57                      push edi
:00434331 6A04                    push 00000004
:00434333 6A00                    push 00000000
:00434335 8B4510                  mov eax, dword ptr [ebp+10]
:00434338 50                      push eax
:00434339 E8ADFEFFFF              call 004341EB
:0043433E 83C404                  add esp, 00000004
:00434341 33C9                    xor ecx, ecx
:00434343 8AC8                    mov cl, al
:00434345 8D0CC9                  lea ecx, dword ptr [ecx+8*ecx]
:00434348 C1E108                  shl ecx, 08
:0043434B 81C100F30000            add ecx, 0000F300
:00434351 51                      push ecx
:00434352 B980E34600              mov ecx, 0046E380
:00434357 E8C4330100              call 00447720
:0043435C 8945FC                  mov dword ptr [ebp-04], eax
:0043435F 8B45FC                  mov eax, dword ptr [ebp-04]
:00434362 50                      push eax
:00434363 8B450C                  mov eax, dword ptr [ebp+0C]
:00434366 50                      push eax
:00434367 8B4508                  mov eax, dword ptr [ebp+08]
:0043436A 50                      push eax
:0043436B E8D0FCFFFF              call 00434040
:00434370 83C40C                  add esp, 0000000C
:00434373 8B4510                  mov eax, dword ptr [ebp+10]
:00434376 50                      push eax
:00434377 E86C7AFDFF              call 0040BDE8
:0043437C 83C404                  add esp, 00000004
:0043437F 8945FC                  mov dword ptr [ebp-04], eax
:00434382 8B450C                  mov eax, dword ptr [ebp+0C]
:00434385 83C030                  add eax, 00000030
:00434388 50                      push eax
:00434389 BB06000000              mov ebx, 00000006
:0043438E 8B45FC                  mov eax, dword ptr [ebp-04]
:00434391 50                      push eax
:00434392 E813300100              call 004473AA
:00434397 83C404                  add esp, 00000004
:0043439A 2BD8                    sub ebx, eax
:0043439C C1EB01                  shr ebx, 01
:0043439F 8B4508                  mov eax, dword ptr [ebp+08]
:004343A2 C1E803                  shr eax, 03
:004343A5 03D8                    add ebx, eax
:004343A7 53                      push ebx
:004343A8 B910BC4600              mov ecx, 0046BC10
:004343AD E855B8FEFF              call 0041FC07
:004343B2 8B45FC                  mov eax, dword ptr [ebp-04]
:004343B5 50                      push eax

* Possible StringData Ref from Data Obj ->"B0M4%s"
                                  |
:004343B6 6840284500              push 00452840
:004343BB 6810BC4600              push 0046BC10
:004343C0 E85EC7FEFF              call 00420B23
:004343C5 83C40C                  add esp, 0000000C
:004343C8 6A01                    push 00000001
:004343CA B910BC4600              mov ecx, 0046BC10
:004343CF E88CBAFEFF              call 0041FE60
:004343D4 6A02                    push 00000002
:004343D6 B910BC4600              mov ecx, 0046BC10
:004343DB E852BAFEFF              call 0041FE32
:004343E0 6A07                    push 00000007
:004343E2 B910BC4600              mov ecx, 0046BC10
:004343E7 E8E7B8FEFF              call 0041FCD3
:004343EC 8B450C                  mov eax, dword ptr [ebp+0C]
:004343EF 83C020                  add eax, 00000020
:004343F2 50                      push eax
:004343F3 8B4508                  mov eax, dword ptr [ebp+08]
:004343F6 C1E803                  shr eax, 03
:004343F9 50                      push eax
:004343FA B910BC4600              mov ecx, 0046BC10
:004343FF E803B8FEFF              call 0041FC07
:00434404 8B4510                  mov eax, dword ptr [ebp+10]
:00434407 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043440A 03C0                    add eax, eax
:0043440C 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:00434413 E8684EFDFF              call 00409280
:00434418 33C9                    xor ecx, ecx
:0043441A 8AC8                    mov cl, al
:0043441C 51                      push ecx

* Possible StringData Ref from Data Obj ->"M4Lv.%3dM0"
                                  |
:0043441D 684C284500              push 0045284C
:00434422 6810BC4600              push 0046BC10
:00434427 E8F7C6FEFF              call 00420B23
:0043442C 83C40C                  add esp, 0000000C
:0043442F 6A00                    push 00000000
:00434431 B910BC4600              mov ecx, 0046BC10
:00434436 E825BAFEFF              call 0041FE60
:0043443B 6A07                    push 00000007
:0043443D B910BC4600              mov ecx, 0046BC10
:00434442 E88CB8FEFF              call 0041FCD3
:00434447 E900000000              jmp 0043444C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434447(U)
|
:0043444C 5F                      pop edi
:0043444D 5E                      pop esi
:0043444E 5B                      pop ebx
:0043444F C9                      leave
:00434450 C3                      ret



* Referenced by a CALL at Addresses:
|:00434509   , :0043451A   , :00434622   , :00434633   , :004347BE   
|:004347CF   , :00435B00   , :00435B18   
|
:00434451 55                      push ebp
:00434452 8BEC                    mov ebp, esp
:00434454 53                      push ebx
:00434455 56                      push esi
:00434456 57                      push edi
:00434457 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0043445B 0F8417000000            je 00434478
:00434461 B903000000              mov ecx, 00000003
:00434466 8B4508                  mov eax, dword ptr [ebp+08]
:00434469 2BD2                    sub edx, edx
:0043446B F7F1                    div ecx
:0043446D C1E006                  shl eax, 06
:00434470 83C038                  add eax, 00000038
:00434473 E921000000              jmp 00434499

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043445B(C)
|
:00434478 B903000000              mov ecx, 00000003
:0043447D 8B4508                  mov eax, dword ptr [ebp+08]
:00434480 2BD2                    sub edx, edx
:00434482 F7F1                    div ecx
:00434484 8D04D500000000          lea eax, dword ptr [8*edx+00000000]
:0043448B 2BC2                    sub eax, edx
:0043448D 8D04C5D0010000          lea eax, dword ptr [8*eax+000001D0]
:00434494 E900000000              jmp 00434499

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00434473(U), :00434494(U)
|
:00434499 5F                      pop edi
:0043449A 5E                      pop esi
:0043449B 5B                      pop ebx
:0043449C C9                      leave
:0043449D C3                      ret



* Referenced by a CALL at Addresses:
|:0043475B   , :0043476C   , :004358DC   , :004358ED   , :00435B32   
|:00435B47   
|
:0043449E 55                      push ebp
:0043449F 8BEC                    mov ebp, esp
:004344A1 53                      push ebx
:004344A2 56                      push esi
:004344A3 57                      push edi
:004344A4 837D0C00                cmp dword ptr [ebp+0C], 00000000
:004344A8 0F8417000000            je 004344C5
:004344AE B907000000              mov ecx, 00000007
:004344B3 8B4508                  mov eax, dword ptr [ebp+08]
:004344B6 2BD2                    sub edx, edx
:004344B8 F7F1                    div ecx
:004344BA C1E006                  shl eax, 06
:004344BD 83C038                  add eax, 00000038
:004344C0 E921000000              jmp 004344E6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004344A8(C)
|
:004344C5 B907000000              mov ecx, 00000007
:004344CA 8B4508                  mov eax, dword ptr [ebp+08]
:004344CD 2BD2                    sub edx, edx
:004344CF F7F1                    div ecx
:004344D1 8D04D500000000          lea eax, dword ptr [8*edx+00000000]
:004344D8 2BC2                    sub eax, edx
:004344DA 8D04C510000000          lea eax, dword ptr [8*eax+00000010]
:004344E1 E900000000              jmp 004344E6

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004344C0(U), :004344E1(U)
|
:004344E6 5F                      pop edi
:004344E7 5E                      pop esi
:004344E8 5B                      pop ebx
:004344E9 C9                      leave
:004344EA C3                      ret



* Referenced by a CALL at Address:
|:00434A2F   
|
:004344EB 55                      push ebp
:004344EC 8BEC                    mov ebp, esp
:004344EE 83EC08                  sub esp, 00000008
:004344F1 53                      push ebx
:004344F2 56                      push esi
:004344F3 57                      push edi
:004344F4 837D0C0F                cmp dword ptr [ebp+0C], 0000000F
:004344F8 0F8605000000            jbe 00434503
:004344FE E966000000              jmp 00434569

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004344F8(C)
|
:00434503 6A00                    push 00000000
:00434505 8B450C                  mov eax, dword ptr [ebp+0C]
:00434508 50                      push eax
:00434509 E843FFFFFF              call 00434451
:0043450E 83C408                  add esp, 00000008
:00434511 8945FC                  mov dword ptr [ebp-04], eax
:00434514 6A01                    push 00000001
:00434516 8B450C                  mov eax, dword ptr [ebp+0C]
:00434519 50                      push eax
:0043451A E832FFFFFF              call 00434451
:0043451F 83C408                  add esp, 00000008
:00434522 8945F8                  mov dword ptr [ebp-08], eax
:00434525 817D08FFFF0000          cmp dword ptr [ebp+08], 0000FFFF
:0043452C 0F8419000000            je 0043454B
:00434532 8B4508                  mov eax, dword ptr [ebp+08]
:00434535 50                      push eax
:00434536 8B45F8                  mov eax, dword ptr [ebp-08]
:00434539 50                      push eax
:0043453A 8B45FC                  mov eax, dword ptr [ebp-04]
:0043453D 50                      push eax
:0043453E E8E5FDFFFF              call 00434328
:00434543 83C40C                  add esp, 0000000C
:00434546 E91E000000              jmp 00434569

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043452C(C)
|
:0043454B 68FFFF0000              push 0000FFFF
:00434550 6A40                    push 00000040
:00434552 6A30                    push 00000030
:00434554 8B45F8                  mov eax, dword ptr [ebp-08]
:00434557 50                      push eax
:00434558 8B45FC                  mov eax, dword ptr [ebp-04]
:0043455B 50                      push eax
:0043455C E8A92CFFFF              call 0042720A
:00434561 83C414                  add esp, 00000014
:00434564 E900000000              jmp 00434569

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004344FE(U), :00434546(U), :00434564(U)
|
:00434569 5F                      pop edi
:0043456A 5E                      pop esi
:0043456B 5B                      pop ebx
:0043456C C9                      leave
:0043456D C3                      ret



* Referenced by a CALL at Addresses:
|:0043469E   , :00436564   , :00436613   , :00436827   , :004369E8   
|
:0043456E 55                      push ebp
:0043456F 8BEC                    mov ebp, esp
:00434571 53                      push ebx
:00434572 56                      push esi
:00434573 57                      push edi
:00434574 817D08FF000000          cmp dword ptr [ebp+08], 000000FF
:0043457B 0F8207000000            jb 00434588
:00434581 33C0                    xor eax, eax
:00434583 E927000000              jmp 004345AF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043457B(C)
|
:00434588 8B4508                  mov eax, dword ptr [ebp+08]
:0043458B 8BC8                    mov ecx, eax
:0043458D C1E004                  shl eax, 04
:00434590 8D8C0818AA4600          lea ecx, dword ptr [eax+ecx+0046AA18]
:00434597 E8C4290000              call 00436F60
:0043459C 33C9                    xor ecx, ecx
:0043459E 8AC8                    mov cl, al
:004345A0 8D0C89                  lea ecx, dword ptr [ecx+4*ecx]
:004345A3 8D044D00000000          lea eax, dword ptr [2*ecx+00000000]
:004345AA E900000000              jmp 004345AF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00434583(U), :004345AA(U)
|
:004345AF 5F                      pop edi
:004345B0 5E                      pop esi
:004345B1 5B                      pop ebx
:004345B2 C9                      leave
:004345B3 C3                      ret



* Referenced by a CALL at Addresses:
|:004364AE   , :00436674   
|
:004345B4 55                      push ebp
:004345B5 8BEC                    mov ebp, esp
:004345B7 83EC04                  sub esp, 00000004
:004345BA 53                      push ebx
:004345BB 56                      push esi
:004345BC 57                      push edi
:004345BD 817D08FF000000          cmp dword ptr [ebp+08], 000000FF
:004345C4 0F8207000000            jb 004345D1
:004345CA 33C0                    xor eax, eax
:004345CC E92E000000              jmp 004345FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004345C4(C)
|
:004345D1 8B4508                  mov eax, dword ptr [ebp+08]
:004345D4 8BC8                    mov ecx, eax
:004345D6 C1E004                  shl eax, 04
:004345D9 8D8C0818AA4600          lea ecx, dword ptr [eax+ecx+0046AA18]
:004345E0 E87B290000              call 00436F60
:004345E5 33C9                    xor ecx, ecx
:004345E7 8AC8                    mov cl, al
:004345E9 894DFC                  mov dword ptr [ebp-04], ecx
:004345EC 8B45FC                  mov eax, dword ptr [ebp-04]
:004345EF 03C0                    add eax, eax
:004345F1 8D0440                  lea eax, dword ptr [eax+2*eax]
:004345F4 8D0480                  lea eax, dword ptr [eax+4*eax]
:004345F7 C1E802                  shr eax, 02
:004345FA E900000000              jmp 004345FF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004345CC(U), :004345FA(U)
|
:004345FF 5F                      pop edi
:00434600 5E                      pop esi
:00434601 5B                      pop ebx
:00434602 C9                      leave
:00434603 C3                      ret



* Referenced by a CALL at Address:
|:00436B16   
|
:00434604 55                      push ebp
:00434605 8BEC                    mov ebp, esp
:00434607 83EC08                  sub esp, 00000008
:0043460A 53                      push ebx
:0043460B 56                      push esi
:0043460C 57                      push edi
:0043460D 837D0C0F                cmp dword ptr [ebp+0C], 0000000F
:00434611 0F8205000000            jb 0043461C
:00434617 E9A7000000              jmp 004346C3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434611(C)
|
:0043461C 6A00                    push 00000000
:0043461E 8B450C                  mov eax, dword ptr [ebp+0C]
:00434621 50                      push eax
:00434622 E82AFEFFFF              call 00434451
:00434627 83C408                  add esp, 00000008
:0043462A 8945FC                  mov dword ptr [ebp-04], eax
:0043462D 6A01                    push 00000001
:0043462F 8B450C                  mov eax, dword ptr [ebp+0C]
:00434632 50                      push eax
:00434633 E819FEFFFF              call 00434451
:00434638 83C408                  add esp, 00000008
:0043463B 8945F8                  mov dword ptr [ebp-08], eax
:0043463E 68FFFF0000              push 0000FFFF
:00434643 6A40                    push 00000040
:00434645 6A30                    push 00000030
:00434647 8B45F8                  mov eax, dword ptr [ebp-08]
:0043464A 50                      push eax
:0043464B 8B45FC                  mov eax, dword ptr [ebp-04]
:0043464E 50                      push eax
:0043464F E8B62BFFFF              call 0042720A
:00434654 83C414                  add esp, 00000014
:00434657 817D08FF000000          cmp dword ptr [ebp+08], 000000FF
:0043465E 0F845A000000            je 004346BE
:00434664 8B4508                  mov eax, dword ptr [ebp+08]
:00434667 50                      push eax
:00434668 8B45F8                  mov eax, dword ptr [ebp-08]
:0043466B 50                      push eax
:0043466C 8B45FC                  mov eax, dword ptr [ebp-04]
:0043466F 50                      push eax
:00434670 E801FAFFFF              call 00434076
:00434675 83C40C                  add esp, 0000000C
:00434678 8B45F8                  mov eax, dword ptr [ebp-08]
:0043467B 83C030                  add eax, 00000030
:0043467E 50                      push eax
:0043467F 8B45FC                  mov eax, dword ptr [ebp-04]
:00434682 C1E803                  shr eax, 03
:00434685 50                      push eax
:00434686 B910BC4600              mov ecx, 0046BC10
:0043468B E877B5FEFF              call 0041FC07
:00434690 837D1000                cmp dword ptr [ebp+10], 00000000
:00434694 0F841F000000            je 004346B9
:0043469A 8B4508                  mov eax, dword ptr [ebp+08]
:0043469D 50                      push eax
:0043469E E8CBFEFFFF              call 0043456E
:004346A3 83C404                  add esp, 00000004
:004346A6 50                      push eax

* Possible StringData Ref from Data Obj ->"M4%3dM0"
                                  |
:004346A7 685C284500              push 0045285C
:004346AC 6810BC4600              push 0046BC10
:004346B1 E86DC4FEFF              call 00420B23
:004346B6 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434694(C)
|
:004346B9 E905000000              jmp 004346C3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043465E(C)
|
:004346BE E900000000              jmp 004346C3

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00434617(U), :004346B9(U), :004346BE(U)
|
:004346C3 5F                      pop edi
:004346C4 5E                      pop esi
:004346C5 5B                      pop ebx
:004346C6 C9                      leave
:004346C7 C3                      ret



* Referenced by a CALL at Addresses:
|:00435539   , :0043614B   
|
:004346C8 55                      push ebp
:004346C9 8BEC                    mov ebp, esp
:004346CB 83EC0C                  sub esp, 0000000C
:004346CE 53                      push ebx
:004346CF 56                      push esi
:004346D0 57                      push edi
:004346D1 68FF000000              push 000000FF
:004346D6 B988534500              mov ecx, 00455388
:004346DB E828D7FCFF              call 00401E08
:004346E0 68FE000000              push 000000FE
:004346E5 6A02                    push 00000002
:004346E7 6A0A                    push 0000000A
:004346E9 6A00                    push 00000000
:004346EB 6A45                    push 00000045
:004346ED B988534500              mov ecx, 00455388
:004346F2 E84ED7FCFF              call 00401E45
:004346F7 C745F400000000          mov [ebp-0C], 00000000
:004346FE E903000000              jmp 00434706

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434737(U)
|
:00434703 FF45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004346FE(U)
|
:00434706 837DF40B                cmp dword ptr [ebp-0C], 0000000B
:0043470A 0F832C000000            jnb 0043473C
:00434710 8B45F4                  mov eax, dword ptr [ebp-0C]
:00434713 83C055                  add eax, 00000055
:00434716 50                      push eax
:00434717 6A02                    push 00000002
:00434719 6A03                    push 00000003
:0043471B 6A00                    push 00000000
:0043471D 8B45F4                  mov eax, dword ptr [ebp-0C]
:00434720 8D0440                  lea eax, dword ptr [eax+2*eax]
:00434723 C1E003                  shl eax, 03
:00434726 83C008                  add eax, 00000008
:00434729 C1E803                  shr eax, 03
:0043472C 50                      push eax
:0043472D B988534500              mov ecx, 00455388
:00434732 E80ED7FCFF              call 00401E45
:00434737 E9C7FFFFFF              jmp 00434703

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043470A(C)
|
:0043473C C745F400000000          mov [ebp-0C], 00000000
:00434743 E903000000              jmp 0043474B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043479A(U)
|
:00434748 FF45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434743(U)
|
:0043474B 837DF423                cmp dword ptr [ebp-0C], 00000023
:0043474F 0F834A000000            jnb 0043479F
:00434755 6A00                    push 00000000
:00434757 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043475A 50                      push eax
:0043475B E83EFDFFFF              call 0043449E
:00434760 83C408                  add esp, 00000008
:00434763 8945FC                  mov dword ptr [ebp-04], eax
:00434766 6A01                    push 00000001
:00434768 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043476B 50                      push eax
:0043476C E82DFDFFFF              call 0043449E
:00434771 83C408                  add esp, 00000008
:00434774 8945F8                  mov dword ptr [ebp-08], eax
:00434777 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043477A 50                      push eax
:0043477B 6A03                    push 00000003
:0043477D 6A06                    push 00000006
:0043477F 8B45F8                  mov eax, dword ptr [ebp-08]
:00434782 83C008                  add eax, 00000008
:00434785 C1E804                  shr eax, 04
:00434788 50                      push eax
:00434789 8B45FC                  mov eax, dword ptr [ebp-04]
:0043478C C1E803                  shr eax, 03
:0043478F 50                      push eax
:00434790 B988534500              mov ecx, 00455388
:00434795 E8ABD6FCFF              call 00401E45
:0043479A E9A9FFFFFF              jmp 00434748

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043474F(C)
|
:0043479F C745F400000000          mov [ebp-0C], 00000000
:004347A6 E903000000              jmp 004347AE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434800(U)
|
:004347AB FF45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004347A6(U)
|
:004347AE 837DF40F                cmp dword ptr [ebp-0C], 0000000F
:004347B2 0F834D000000            jnb 00434805
:004347B8 6A00                    push 00000000
:004347BA 8B45F4                  mov eax, dword ptr [ebp-0C]
:004347BD 50                      push eax
:004347BE E88EFCFFFF              call 00434451
:004347C3 83C408                  add esp, 00000008
:004347C6 8945FC                  mov dword ptr [ebp-04], eax
:004347C9 6A01                    push 00000001
:004347CB 8B45F4                  mov eax, dword ptr [ebp-0C]
:004347CE 50                      push eax
:004347CF E87DFCFFFF              call 00434451
:004347D4 83C408                  add esp, 00000008
:004347D7 8945F8                  mov dword ptr [ebp-08], eax
:004347DA 8B45F4                  mov eax, dword ptr [ebp-0C]
:004347DD 83C040                  add eax, 00000040
:004347E0 50                      push eax
:004347E1 6A03                    push 00000003
:004347E3 6A06                    push 00000006
:004347E5 8B45F8                  mov eax, dword ptr [ebp-08]
:004347E8 83C008                  add eax, 00000008
:004347EB C1E804                  shr eax, 04
:004347EE 50                      push eax
:004347EF 8B45FC                  mov eax, dword ptr [ebp-04]
:004347F2 C1E803                  shr eax, 03
:004347F5 50                      push eax
:004347F6 B988534500              mov ecx, 00455388
:004347FB E845D6FCFF              call 00401E45
:00434800 E9A6FFFFFF              jmp 004347AB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004347B2(C)
|
:00434805 C745F400000000          mov [ebp-0C], 00000000
:0043480C E903000000              jmp 00434814

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043484B(U)
|
:00434811 FF45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043480C(U)
|
:00434814 837DF405                cmp dword ptr [ebp-0C], 00000005
:00434818 0F8332000000            jnb 00434850
:0043481E 8B45F4                  mov eax, dword ptr [ebp-0C]
:00434821 C1E006                  shl eax, 06
:00434824 83C038                  add eax, 00000038
:00434827 8945F8                  mov dword ptr [ebp-08], eax
:0043482A 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043482D 83C050                  add eax, 00000050
:00434830 50                      push eax
:00434831 6A03                    push 00000003
:00434833 6A06                    push 00000006
:00434835 8B45F8                  mov eax, dword ptr [ebp-08]
:00434838 83C008                  add eax, 00000008
:0043483B C1E804                  shr eax, 04
:0043483E 50                      push eax
:0043483F 6A33                    push 00000033
:00434841 B988534500              mov ecx, 00455388
:00434846 E8FAD5FCFF              call 00401E45
:0043484B E9C1FFFFFF              jmp 00434811

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434818(C)
|
:00434850 E900000000              jmp 00434855

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434850(U)
|
:00434855 5F                      pop edi
:00434856 5E                      pop esi
:00434857 5B                      pop ebx
:00434858 C9                      leave
:00434859 C3                      ret



* Referenced by a CALL at Address:
|:00434936   
|
:0043485A 55                      push ebp
:0043485B 8BEC                    mov ebp, esp
:0043485D 53                      push ebx
:0043485E 56                      push esi
:0043485F 57                      push edi
:00434860 6A04                    push 00000004
:00434862 6A00                    push 00000000
:00434864 8B4508                  mov eax, dword ptr [ebp+08]
:00434867 03C0                    add eax, eax
:00434869 03450C                  add eax, dword ptr [ebp+0C]
:0043486C 8D44C012                lea eax, dword ptr [eax+8*eax+12]
:00434870 C1E008                  shl eax, 08
:00434873 0500AB0000              add eax, 0000AB00
:00434878 50                      push eax
:00434879 B980E34600              mov ecx, 0046E380
:0043487E E89D2E0100              call 00447720
:00434883 50                      push eax
:00434884 6A30                    push 00000030
:00434886 6A30                    push 00000030
:00434888 8B4508                  mov eax, dword ptr [ebp+08]
:0043488B 83C002                  add eax, 00000002
:0043488E C1E006                  shl eax, 06
:00434891 83C038                  add eax, 00000038
:00434894 50                      push eax
:00434895 6898010000              push 00000198
:0043489A E8000F0100              call 0044579F
:0043489F 83C414                  add esp, 00000014
:004348A2 E900000000              jmp 004348A7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004348A2(U)
|
:004348A7 5F                      pop edi
:004348A8 5E                      pop esi
:004348A9 5B                      pop ebx
:004348AA C9                      leave
:004348AB C3                      ret



* Referenced by a CALL at Addresses:
|:004351D6   , :004362BA   , :00436E08   
|
:004348AC 55                      push ebp
:004348AD 8BEC                    mov ebp, esp
:004348AF 83EC04                  sub esp, 00000004
:004348B2 53                      push ebx
:004348B3 56                      push esi
:004348B4 57                      push edi
:004348B5 E870CEFCFF              call 0040172A
:004348BA 6A0C                    push 0000000C
:004348BC 6A3E                    push 0000003E
:004348BE B910BC4600              mov ecx, 0046BC10
:004348C3 E83FB3FEFF              call 0041FC07
:004348C8 8B4508                  mov eax, dword ptr [ebp+08]
:004348CB 8B048568284500          mov eax, dword ptr [4*eax+00452868]
:004348D2 50                      push eax

* Possible StringData Ref from Data Obj ->"C7M4%s"
                                  |
:004348D3 688C284500              push 0045288C
:004348D8 6810BC4600              push 0046BC10
:004348DD E841C2FEFF              call 00420B23
:004348E2 83C40C                  add esp, 0000000C
:004348E5 6A00                    push 00000000
:004348E7 6A00                    push 00000000
:004348E9 6A00                    push 00000000
:004348EB E80F040100              call 00444CFF
:004348F0 83C40C                  add esp, 0000000C
:004348F3 68FFFF0000              push 0000FFFF
:004348F8 6A70                    push 00000070
:004348FA 6A30                    push 00000030
:004348FC 6A38                    push 00000038
:004348FE 6898010000              push 00000198
:00434903 E80229FFFF              call 0042720A
:00434908 83C414                  add esp, 00000014
:0043490B C745FC00000000          mov [ebp-04], 00000000
:00434912 E903000000              jmp 0043491A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043493E(U)
|
:00434917 FF45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434912(U)
|
:0043491A 837DFC03                cmp dword ptr [ebp-04], 00000003
:0043491E 0F831F000000            jnb 00434943
:00434924 8B4508                  mov eax, dword ptr [ebp+08]
:00434927 2B45FC                  sub eax, dword ptr [ebp-04]
:0043492A 83F801                  cmp eax, 00000001
:0043492D 1BC0                    sbb eax, eax
:0043492F F7D8                    neg eax
:00434931 50                      push eax
:00434932 8B45FC                  mov eax, dword ptr [ebp-04]
:00434935 50                      push eax
:00434936 E81FFFFFFF              call 0043485A
:0043493B 83C408                  add esp, 00000008
:0043493E E9D4FFFFFF              jmp 00434917

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043491E(C)
|
:00434943 6A00                    push 00000000
:00434945 6A00                    push 00000000
:00434947 6A04                    push 00000004
:00434949 E8B1030100              call 00444CFF
:0043494E 83C40C                  add esp, 0000000C
:00434951 C745FC00000000          mov [ebp-04], 00000000
:00434958 E903000000              jmp 00434960

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004349CB(U)
|
:0043495D FF45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434958(U)
|
:00434960 837DFC02                cmp dword ptr [ebp-04], 00000002
:00434964 0F8366000000            jnb 004349D0
:0043496A 837DFC00                cmp dword ptr [ebp-04], 00000000
:0043496E 0F850A000000            jne 0043497E
:00434974 837D0800                cmp dword ptr [ebp+08], 00000000
:00434978 0F844D000000            je 004349CB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043496E(C)
|
:0043497E 837DFC01                cmp dword ptr [ebp-04], 00000001
:00434982 0F850A000000            jne 00434992
:00434988 837D0802                cmp dword ptr [ebp+08], 00000002
:0043498C 0F8439000000            je 004349CB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434982(C)
|
:00434992 6A04                    push 00000004
:00434994 6A00                    push 00000000
:00434996 8B45FC                  mov eax, dword ptr [ebp-04]
:00434999 8D04C0                  lea eax, dword ptr [eax+8*eax]
:0043499C C1E008                  shl eax, 08
:0043499F 0500AB0000              add eax, 0000AB00
:004349A4 50                      push eax
:004349A5 B980E34600              mov ecx, 0046E380
:004349AA E8712D0100              call 00447720
:004349AF 50                      push eax
:004349B0 6A30                    push 00000030
:004349B2 6A30                    push 00000030
:004349B4 8B45FC                  mov eax, dword ptr [ebp-04]
:004349B7 C1E006                  shl eax, 06
:004349BA 83C038                  add eax, 00000038
:004349BD 50                      push eax
:004349BE 6898010000              push 00000198
:004349C3 E8D70D0100              call 0044579F
:004349C8 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00434978(C), :0043498C(C)
|
:004349CB E98DFFFFFF              jmp 0043495D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434964(C)
|
:004349D0 E900000000              jmp 004349D5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004349D0(U)
|
:004349D5 5F                      pop edi
:004349D6 5E                      pop esi
:004349D7 5B                      pop ebx
:004349D8 C9                      leave
:004349D9 C3                      ret



* Referenced by a CALL at Addresses:
|:00435560   , :00435843   
|
:004349DA 55                      push ebp
:004349DB 8BEC                    mov ebp, esp
:004349DD 83EC0C                  sub esp, 0000000C
:004349E0 53                      push ebx
:004349E1 56                      push esi
:004349E2 57                      push edi
:004349E3 E8AF25FFFF              call 00426F97
:004349E8 C745FC00000000          mov [ebp-04], 00000000
:004349EF 8B45FC                  mov eax, dword ptr [ebp-04]
:004349F2 8945F4                  mov dword ptr [ebp-0C], eax
:004349F5 E903000000              jmp 004349FD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434A37(U)
|
:004349FA FF45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004349F5(U)
|
:004349FD 837DF40F                cmp dword ptr [ebp-0C], 0000000F
:00434A01 0F8335000000            jnb 00434A3C
:00434A07 8B45F4                  mov eax, dword ptr [ebp-0C]
:00434A0A 33C9                    xor ecx, ecx
:00434A0C 668B0C45F8CD4600        mov cx, word ptr [2*eax+0046CDF8]
:00434A14 894DF8                  mov dword ptr [ebp-08], ecx
:00434A17 817DF8FFFF0000          cmp dword ptr [ebp-08], 0000FFFF
:00434A1E 0F8403000000            je 00434A27
:00434A24 FF45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434A1E(C)
|
:00434A27 8B45F4                  mov eax, dword ptr [ebp-0C]
:00434A2A 50                      push eax
:00434A2B 8B45F8                  mov eax, dword ptr [ebp-08]
:00434A2E 50                      push eax
:00434A2F E8B7FAFFFF              call 004344EB
:00434A34 83C408                  add esp, 00000008
:00434A37 E9BEFFFFFF              jmp 004349FA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434A01(C)
|
:00434A3C E87625FFFF              call 00426FB7
:00434A41 68FFFF0000              push 0000FFFF
:00434A46 6A10                    push 00000010
:00434A48 6890000000              push 00000090
:00434A4D 688A010000              push 0000018A
:00434A52 68E0010000              push 000001E0
:00434A57 E8AE27FFFF              call 0042720A
:00434A5C 83C414                  add esp, 00000014
:00434A5F 688A010000              push 0000018A
:00434A64 6A3C                    push 0000003C
:00434A66 B910BC4600              mov ecx, 0046BC10
:00434A6B E897B1FEFF              call 0041FC07
:00434A70 8B4508                  mov eax, dword ptr [ebp+08]
:00434A73 50                      push eax
:00434A74 8B45FC                  mov eax, dword ptr [ebp-04]
:00434A77 50                      push eax

* Possible StringData Ref from Data Obj ->"M4ս佫%3d /%3dM0"
                                  |
:00434A78 6898284500              push 00452898
:00434A7D 6810BC4600              push 0046BC10
:00434A82 E89CC0FEFF              call 00420B23
:00434A87 83C410                  add esp, 00000010
:00434A8A 8B45FC                  mov eax, dword ptr [ebp-04]
:00434A8D E900000000              jmp 00434A92

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434A8D(U)
|
:00434A92 5F                      pop edi
:00434A93 5E                      pop esi
:00434A94 5B                      pop ebx
:00434A95 C9                      leave
:00434A96 C3                      ret



* Referenced by a CALL at Addresses:
|:00436142   , :00436A64   
|
:00434A97 55                      push ebp
:00434A98 8BEC                    mov ebp, esp
:00434A9A 53                      push ebx
:00434A9B 56                      push esi
:00434A9C 57                      push edi
:00434A9D 68FFFF0000              push 0000FFFF
:00434AA2 6A10                    push 00000010
:00434AA4 6890000000              push 00000090
:00434AA9 689C010000              push 0000019C
:00434AAE 68E0010000              push 000001E0
:00434AB3 E85227FFFF              call 0042720A
:00434AB8 83C414                  add esp, 00000014
:00434ABB 689C010000              push 0000019C
:00434AC0 6A3C                    push 0000003C
:00434AC2 B910BC4600              mov ecx, 0046BC10
:00434AC7 E83BB1FEFF              call 0041FC07
:00434ACC B9D0A64600              mov ecx, 0046A6D0
:00434AD1 E86AA9FEFF              call 0041F440
:00434AD6 50                      push eax

* Possible StringData Ref from Data Obj ->"M4ֽ%5uM0"
                                  |
:00434AD7 68B0284500              push 004528B0
:00434ADC 6810BC4600              push 0046BC10
:00434AE1 E83DC0FEFF              call 00420B23
:00434AE6 83C40C                  add esp, 0000000C
:00434AE9 E900000000              jmp 00434AEE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434AE9(U)
|
:00434AEE 5F                      pop edi
:00434AEF 5E                      pop esi
:00434AF0 5B                      pop ebx
:00434AF1 C9                      leave
:00434AF2 C3                      ret



* Referenced by a CALL at Addresses:
|:00434B75   , :00434C42   , :00436C63   
|
:00434AF3 55                      push ebp
:00434AF4 8BEC                    mov ebp, esp
:00434AF6 53                      push ebx
:00434AF7 56                      push esi
:00434AF8 57                      push edi
:00434AF9 8B450C                  mov eax, dword ptr [ebp+0C]
:00434AFC 50                      push eax
:00434AFD 8B4508                  mov eax, dword ptr [ebp+08]
:00434B00 8D0440                  lea eax, dword ptr [eax+2*eax]
:00434B03 03C0                    add eax, eax
:00434B05 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:00434B0C E8EF49FDFF              call 00409500
:00434B11 E900000000              jmp 00434B16

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434B11(U)
|
:00434B16 5F                      pop edi
:00434B17 5E                      pop esi
:00434B18 5B                      pop ebx
:00434B19 C9                      leave
:00434B1A C3                      ret



* Referenced by a CALL at Addresses:
|:00434BB7   , :00434CB4   
|
:00434B1B 55                      push ebp
:00434B1C 8BEC                    mov ebp, esp
:00434B1E 53                      push ebx
:00434B1F 56                      push esi
:00434B20 57                      push edi
:00434B21 8B4510                  mov eax, dword ptr [ebp+10]
:00434B24 50                      push eax
:00434B25 8B450C                  mov eax, dword ptr [ebp+0C]
:00434B28 50                      push eax
:00434B29 8B4508                  mov eax, dword ptr [ebp+08]
:00434B2C 8D0440                  lea eax, dword ptr [eax+2*eax]
:00434B2F 03C0                    add eax, eax
:00434B31 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:00434B38 E8F349FDFF              call 00409530
:00434B3D E900000000              jmp 00434B42

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434B3D(U)
|
:00434B42 5F                      pop edi
:00434B43 5E                      pop esi
:00434B44 5B                      pop ebx
:00434B45 C9                      leave
:00434B46 C3                      ret



* Referenced by a CALL at Addresses:
|:00436516   , :004367AC   , :00436A29   
|
:00434B47 55                      push ebp
:00434B48 8BEC                    mov ebp, esp
:00434B4A 83EC0C                  sub esp, 0000000C
:00434B4D 53                      push ebx
:00434B4E 56                      push esi
:00434B4F 57                      push edi
:00434B50 C645F4FF                mov [ebp-0C], FF
:00434B54 C745F800000000          mov [ebp-08], 00000000
:00434B5B E903000000              jmp 00434B63

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434B99(U)
|
:00434B60 FF45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434B5B(U)
|
:00434B63 837DF80F                cmp dword ptr [ebp-08], 0000000F
:00434B67 0F8331000000            jnb 00434B9E
:00434B6D 8B45F8                  mov eax, dword ptr [ebp-08]
:00434B70 50                      push eax
:00434B71 8B450C                  mov eax, dword ptr [ebp+0C]
:00434B74 50                      push eax
:00434B75 E879FFFFFF              call 00434AF3
:00434B7A 83C408                  add esp, 00000008
:00434B7D 8845FC                  mov byte ptr [ebp-04], al
:00434B80 33C0                    xor eax, eax
:00434B82 8A45FC                  mov al, byte ptr [ebp-04]
:00434B85 3B4508                  cmp eax, dword ptr [ebp+08]
:00434B88 0F850B000000            jne 00434B99
:00434B8E 8A45F8                  mov al, byte ptr [ebp-08]
:00434B91 8845F4                  mov byte ptr [ebp-0C], al
:00434B94 E905000000              jmp 00434B9E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434B88(C)
|
:00434B99 E9C2FFFFFF              jmp 00434B60

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00434B67(C), :00434B94(U)
|
:00434B9E 837DF80F                cmp dword ptr [ebp-08], 0000000F
:00434BA2 0F8500000000            jne 00434BA8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434BA2(C)
|
:00434BA8 68FF000000              push 000000FF
:00434BAD 33C0                    xor eax, eax
:00434BAF 8A45F4                  mov al, byte ptr [ebp-0C]
:00434BB2 50                      push eax
:00434BB3 8B450C                  mov eax, dword ptr [ebp+0C]
:00434BB6 50                      push eax
:00434BB7 E85FFFFFFF              call 00434B1B
:00434BBC 83C40C                  add esp, 0000000C
:00434BBF E900000000              jmp 00434BC4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434BBF(U)
|
:00434BC4 5F                      pop edi
:00434BC5 5E                      pop esi
:00434BC6 5B                      pop ebx
:00434BC7 C9                      leave
:00434BC8 C3                      ret



* Referenced by a CALL at Address:
|:00436919   
|
:00434BC9 55                      push ebp
:00434BCA 8BEC                    mov ebp, esp
:00434BCC 83EC04                  sub esp, 00000004
:00434BCF 53                      push ebx
:00434BD0 56                      push esi
:00434BD1 57                      push edi
:00434BD2 8B4508                  mov eax, dword ptr [ebp+08]
:00434BD5 8D0440                  lea eax, dword ptr [eax+2*eax]
:00434BD8 03C0                    add eax, eax
:00434BDA 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:00434BE1 E8A280FDFF              call 0040CC88
:00434BE6 8845FC                  mov byte ptr [ebp-04], al
:00434BE9 33C0                    xor eax, eax
:00434BEB 8A45FC                  mov al, byte ptr [ebp-04]
:00434BEE 83F80F                  cmp eax, 0000000F
:00434BF1 0F8D0A000000            jnl 00434C01
:00434BF7 B801000000              mov eax, 00000001
:00434BFC E902000000              jmp 00434C03

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434BF1(C)
|
:00434C01 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434BFC(U)
|
:00434C03 E900000000              jmp 00434C08

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434C03(U)
|
:00434C08 5F                      pop edi
:00434C09 5E                      pop esi
:00434C0A 5B                      pop ebx
:00434C0B C9                      leave
:00434C0C C3                      ret



* Referenced by a CALL at Address:
|:004369C2   
|
:00434C0D 55                      push ebp
:00434C0E 8BEC                    mov ebp, esp
:00434C10 83EC20                  sub esp, 00000020
:00434C13 53                      push ebx
:00434C14 56                      push esi
:00434C15 57                      push edi
:00434C16 C645F4FF                mov [ebp-0C], FF
:00434C1A C745E000000000          mov [ebp-20], 00000000
:00434C21 C745F800000000          mov [ebp-08], 00000000
:00434C28 E903000000              jmp 00434C30

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434C8A(U)
|
:00434C2D FF45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434C28(U)
|
:00434C30 837DF80F                cmp dword ptr [ebp-08], 0000000F
:00434C34 0F8355000000            jnb 00434C8F
:00434C3A 8B45F8                  mov eax, dword ptr [ebp-08]
:00434C3D 50                      push eax
:00434C3E 8B450C                  mov eax, dword ptr [ebp+0C]
:00434C41 50                      push eax
:00434C42 E8ACFEFFFF              call 00434AF3
:00434C47 83C408                  add esp, 00000008
:00434C4A 8845FC                  mov byte ptr [ebp-04], al
:00434C4D 33C0                    xor eax, eax
:00434C4F 8A45FC                  mov al, byte ptr [ebp-04]
:00434C52 3DFF000000              cmp eax, 000000FF
:00434C57 0F8412000000            je 00434C6F
:00434C5D 8A45F8                  mov al, byte ptr [ebp-08]
:00434C60 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00434C63 88440DE4                mov byte ptr [ebp+ecx-1C], al
:00434C67 FF45E0                  inc [ebp-20]
:00434C6A E91B000000              jmp 00434C8A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434C57(C)
|
:00434C6F 33C0                    xor eax, eax
:00434C71 8A45F4                  mov al, byte ptr [ebp-0C]
:00434C74 3DFF000000              cmp eax, 000000FF
:00434C79 0F850B000000            jne 00434C8A
:00434C7F 8A45F8                  mov al, byte ptr [ebp-08]
:00434C82 8845F4                  mov byte ptr [ebp-0C], al
:00434C85 E905000000              jmp 00434C8F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00434C6A(U), :00434C79(C)
|
:00434C8A E99EFFFFFF              jmp 00434C2D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00434C34(C), :00434C85(U)
|
:00434C8F 33C0                    xor eax, eax
:00434C91 8A45F4                  mov al, byte ptr [ebp-0C]
:00434C94 3DFF000000              cmp eax, 000000FF
:00434C99 0F8507000000            jne 00434CA6
:00434C9F 33C0                    xor eax, eax
:00434CA1 E920000000              jmp 00434CC6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434C99(C)
|
:00434CA6 8B4508                  mov eax, dword ptr [ebp+08]
:00434CA9 50                      push eax
:00434CAA 33C0                    xor eax, eax
:00434CAC 8A45F4                  mov al, byte ptr [ebp-0C]
:00434CAF 50                      push eax
:00434CB0 8B450C                  mov eax, dword ptr [ebp+0C]
:00434CB3 50                      push eax
:00434CB4 E862FEFFFF              call 00434B1B
:00434CB9 83C40C                  add esp, 0000000C
:00434CBC B801000000              mov eax, 00000001
:00434CC1 E900000000              jmp 00434CC6

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00434CA1(U), :00434CC1(U)
|
:00434CC6 5F                      pop edi
:00434CC7 5E                      pop esi
:00434CC8 5B                      pop ebx
:00434CC9 C9                      leave
:00434CCA C3                      ret



* Referenced by a CALL at Address:
|:00435595   
|
:00434CCB 55                      push ebp
:00434CCC 8BEC                    mov ebp, esp
:00434CCE 83EC04                  sub esp, 00000004
:00434CD1 53                      push ebx
:00434CD2 56                      push esi
:00434CD3 57                      push edi
:00434CD4 A07C534500              mov al, byte ptr [0045537C]
:00434CD9 8845FC                  mov byte ptr [ebp-04], al
:00434CDC B988534500              mov ecx, 00455388
:00434CE1 E8F0D1FCFF              call 00401ED6
:00434CE6 A27C534500              mov byte ptr [0045537C], al
:00434CEB 33C0                    xor eax, eax
:00434CED A07C534500              mov al, byte ptr [0045537C]
:00434CF2 33C9                    xor ecx, ecx
:00434CF4 8A4DFC                  mov cl, byte ptr [ebp-04]
:00434CF7 3BC1                    cmp eax, ecx
:00434CF9 0F8414000000            je 00434D13
:00434CFF 6A03                    push 00000003
:00434D01 6A01                    push 00000001
:00434D03 33C0                    xor eax, eax
:00434D05 A07C534500              mov al, byte ptr [0045537C]
:00434D0A 50                      push eax
:00434D0B E812000000              call 00434D22
:00434D10 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434CF9(C)
|
:00434D13 A07C534500              mov al, byte ptr [0045537C]
:00434D18 E900000000              jmp 00434D1D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434D18(U)
|
:00434D1D 5F                      pop edi
:00434D1E 5E                      pop esi
:00434D1F 5B                      pop ebx
:00434D20 C9                      leave
:00434D21 C3                      ret



* Referenced by a CALL at Addresses:
|:00434D0B   , :00435C67   , :00436191   
|
:00434D22 55                      push ebp
:00434D23 8BEC                    mov ebp, esp
:00434D25 83EC28                  sub esp, 00000028
:00434D28 53                      push ebx
:00434D29 56                      push esi
:00434D2A 57                      push edi
:00434D2B E8D2C9FCFF              call 00401702
:00434D30 817D08FF000000          cmp dword ptr [ebp+08], 000000FF
:00434D37 0F8505000000            jne 00434D42
:00434D3D E904030000              jmp 00435046

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434D37(C)
|
:00434D42 817D08FE000000          cmp dword ptr [ebp+08], 000000FE
:00434D49 0F852E000000            jne 00434D7D
:00434D4F 837D1003                cmp dword ptr [ebp+10], 00000003
:00434D53 0F850C000000            jne 00434D65

* Possible StringData Ref from Data Obj ->""
                                  |
:00434D59 C745DCC0284500          mov [ebp-24], 004528C0
:00434D60 E907000000              jmp 00434D6C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434D53(C)
|

* Possible StringData Ref from Data Obj ->""
                                  |
:00434D65 C745DCCC284500          mov [ebp-24], 004528CC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434D60(U)
|
:00434D6C 8B45DC                  mov eax, dword ptr [ebp-24]
:00434D6F 50                      push eax
:00434D70 E822C4FCFF              call 00401197
:00434D75 83C404                  add esp, 00000004
:00434D78 E9C9020000              jmp 00435046

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434D49(C)
|
:00434D7D 837D0861                cmp dword ptr [ebp+08], 00000061
:00434D81 0F8205000000            jb 00434D8C
:00434D87 E9B5020000              jmp 00435041

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434D81(C)
|
:00434D8C 837D0855                cmp dword ptr [ebp+08], 00000055
:00434D90 0F829C000000            jb 00434E32
:00434D96 8B4508                  mov eax, dword ptr [ebp+08]
:00434D99 83E855                  sub eax, 00000055
:00434D9C 8845FC                  mov byte ptr [ebp-04], al

* Possible StringData Ref from Data Obj ->""
                                  |
:00434D9F 68D4284500              push 004528D4
:00434DA4 8D45E4                  lea eax, dword ptr [ebp-1C]
:00434DA7 50                      push eax
:00434DA8 E820260100              call 004473CD
:00434DAD 83C408                  add esp, 00000008
:00434DB0 33C0                    xor eax, eax
:00434DB2 8A45FC                  mov al, byte ptr [ebp-04]
:00434DB5 83F809                  cmp eax, 00000009
:00434DB8 0F8C14000000            jl 00434DD2
:00434DBE 33C0                    xor eax, eax
:00434DC0 8A45FC                  mov al, byte ptr [ebp-04]
:00434DC3 8B048504244500          mov eax, dword ptr [4*eax+00452404]
:00434DCA 8945D8                  mov dword ptr [ebp-28], eax
:00434DCD E92E000000              jmp 00434E00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434DB8(C)
|
:00434DD2 33C0                    xor eax, eax
:00434DD4 8A45FC                  mov al, byte ptr [ebp-04]
:00434DD7 B906000000              mov ecx, 00000006
:00434DDC 99                      cdq
:00434DDD F7F9                    idiv ecx
:00434DDF 8D0C9500000000          lea ecx, dword ptr [4*edx+00000000]
:00434DE6 33C0                    xor eax, eax
:00434DE8 8A45FC                  mov al, byte ptr [ebp-04]
:00434DEB BB06000000              mov ebx, 00000006
:00434DF0 99                      cdq
:00434DF1 F7FB                    idiv ebx
:00434DF3 8D0440                  lea eax, dword ptr [eax+2*eax]
:00434DF6 8B84C1C82C4500          mov eax, dword ptr [ecx+8*eax+00452CC8]
:00434DFD 8945D8                  mov dword ptr [ebp-28], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434DCD(U)
|
:00434E00 8B45D8                  mov eax, dword ptr [ebp-28]
:00434E03 50                      push eax
:00434E04 8D45E4                  lea eax, dword ptr [ebp-1C]
:00434E07 50                      push eax
:00434E08 E8E3250100              call 004473F0
:00434E0D 83C408                  add esp, 00000008

* Possible StringData Ref from Data Obj ->""
                                  |
:00434E10 68D8284500              push 004528D8
:00434E15 8D45E4                  lea eax, dword ptr [ebp-1C]
:00434E18 50                      push eax
:00434E19 E8D2250100              call 004473F0
:00434E1E 83C408                  add esp, 00000008
:00434E21 8D45E4                  lea eax, dword ptr [ebp-1C]
:00434E24 50                      push eax
:00434E25 E86DC3FCFF              call 00401197
:00434E2A 83C404                  add esp, 00000004
:00434E2D E90F020000              jmp 00435041

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434D90(C)
|
:00434E32 837D0850                cmp dword ptr [ebp+08], 00000050
:00434E36 0F8222000000            jb 00434E5E
:00434E3C 837D1003                cmp dword ptr [ebp+10], 00000003
:00434E40 0F8413000000            je 00434E59
:00434E46 8B4508                  mov eax, dword ptr [ebp+08]
:00434E49 8B0485D0224500          mov eax, dword ptr [4*eax+004522D0]
:00434E50 50                      push eax
:00434E51 E841C3FCFF              call 00401197
:00434E56 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434E40(C)
|
:00434E59 E9E3010000              jmp 00435041

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434E36(C)
|
:00434E5E 837D0840                cmp dword ptr [ebp+08], 00000040
:00434E62 0F82B7000000            jb 00434F1F
:00434E68 837D1003                cmp dword ptr [ebp+10], 00000003
:00434E6C 0F8558000000            jne 00434ECA
:00434E72 8B4508                  mov eax, dword ptr [ebp+08]
:00434E75 33C9                    xor ecx, ecx
:00434E77 668B0C4578CD4600        mov cx, word ptr [2*eax+0046CD78]
:00434E7F 894DE0                  mov dword ptr [ebp-20], ecx
:00434E82 817DE0FFFF0000          cmp dword ptr [ebp-20], 0000FFFF
:00434E89 0F8436000000            je 00434EC5

* Possible StringData Ref from Data Obj ->""
                                  |
:00434E8F 68E0284500              push 004528E0
:00434E94 8D45E4                  lea eax, dword ptr [ebp-1C]
:00434E97 50                      push eax
:00434E98 E830250100              call 004473CD
:00434E9D 83C408                  add esp, 00000008
:00434EA0 8B45E0                  mov eax, dword ptr [ebp-20]
:00434EA3 50                      push eax
:00434EA4 E83F6FFDFF              call 0040BDE8
:00434EA9 83C404                  add esp, 00000004
:00434EAC 50                      push eax
:00434EAD 8D45E4                  lea eax, dword ptr [ebp-1C]
:00434EB0 50                      push eax
:00434EB1 E83A250100              call 004473F0
:00434EB6 83C408                  add esp, 00000008
:00434EB9 8D45E4                  lea eax, dword ptr [ebp-1C]
:00434EBC 50                      push eax
:00434EBD E8D5C2FCFF              call 00401197
:00434EC2 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434E89(C)
|
:00434EC5 E950000000              jmp 00434F1A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434E6C(C)
|
:00434ECA 837D0C00                cmp dword ptr [ebp+0C], 00000000
:00434ECE 0F8446000000            je 00434F1A
:00434ED4 8B4508                  mov eax, dword ptr [ebp+08]
:00434ED7 83E840                  sub eax, 00000040
:00434EDA 8845FC                  mov byte ptr [ebp-04], al
:00434EDD 33C0                    xor eax, eax
:00434EDF 8A45FC                  mov al, byte ptr [ebp-04]
:00434EE2 33C9                    xor ecx, ecx
:00434EE4 8A8828CE4600            mov cl, byte ptr [eax+0046CE28]
:00434EEA 81F9FF000000            cmp ecx, 000000FF
:00434EF0 0F8505000000            jne 00434EFB
:00434EF6 E94B010000              jmp 00435046

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434EF0(C)
|
:00434EFB 33C0                    xor eax, eax
:00434EFD 8A45FC                  mov al, byte ptr [ebp-04]
:00434F00 33C9                    xor ecx, ecx
:00434F02 8A8828CE4600            mov cl, byte ptr [eax+0046CE28]
:00434F08 51                      push ecx
:00434F09 E80097FEFF              call 0041E60E
:00434F0E 83C404                  add esp, 00000004
:00434F11 50                      push eax
:00434F12 E880C2FCFF              call 00401197
:00434F17 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00434EC5(U), :00434ECE(C)
|
:00434F1A E922010000              jmp 00435041

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434E62(C)
|
:00434F1F 8B4508                  mov eax, dword ptr [ebp+08]
:00434F22 33C9                    xor ecx, ecx
:00434F24 668B0C4570524500        mov cx, word ptr [2*eax+00455270]
:00434F2C 81F9FFFF0000            cmp ecx, 0000FFFF
:00434F32 0F8505000000            jne 00434F3D
:00434F38 E909010000              jmp 00435046

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434F32(C)
|
:00434F3D 8B4508                  mov eax, dword ptr [ebp+08]
:00434F40 33C9                    xor ecx, ecx
:00434F42 668B0C4570524500        mov cx, word ptr [2*eax+00455270]
:00434F4A 51                      push ecx
:00434F4B E8986EFDFF              call 0040BDE8
:00434F50 83C404                  add esp, 00000004
:00434F53 50                      push eax
:00434F54 8D45E4                  lea eax, dword ptr [ebp-1C]
:00434F57 50                      push eax
:00434F58 E870240100              call 004473CD
:00434F5D 83C408                  add esp, 00000008
:00434F60 837D1003                cmp dword ptr [ebp+10], 00000003
:00434F64 0F854A000000            jne 00434FB4

* Possible StringData Ref from Data Obj ->""
                                  |
:00434F6A 68E8284500              push 004528E8
:00434F6F 8D45E4                  lea eax, dword ptr [ebp-1C]
:00434F72 50                      push eax
:00434F73 E855240100              call 004473CD
:00434F78 83C408                  add esp, 00000008
:00434F7B 8B4508                  mov eax, dword ptr [ebp+08]
:00434F7E 33C9                    xor ecx, ecx
:00434F80 668B0C4570524500        mov cx, word ptr [2*eax+00455270]
:00434F88 51                      push ecx
:00434F89 E85A6EFDFF              call 0040BDE8
:00434F8E 83C404                  add esp, 00000004
:00434F91 50                      push eax
:00434F92 8D45E4                  lea eax, dword ptr [ebp-1C]
:00434F95 50                      push eax
:00434F96 E855240100              call 004473F0
:00434F9B 83C408                  add esp, 00000008

* Possible StringData Ref from Data Obj ->"ս"
                                  |
:00434F9E 68EC284500              push 004528EC
:00434FA3 8D45E4                  lea eax, dword ptr [ebp-1C]
:00434FA6 50                      push eax
:00434FA7 E844240100              call 004473F0
:00434FAC 83C408                  add esp, 00000008
:00434FAF E981000000              jmp 00435035

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434F64(C)
|
:00434FB4 837D1001                cmp dword ptr [ebp+10], 00000001
:00434FB8 0F8539000000            jne 00434FF7

* Possible StringData Ref from Data Obj ->"ѡ"
                                  |
:00434FBE 68F4284500              push 004528F4
:00434FC3 8D45E4                  lea eax, dword ptr [ebp-1C]
:00434FC6 50                      push eax
:00434FC7 E801240100              call 004473CD
:00434FCC 83C408                  add esp, 00000008
:00434FCF 8B4508                  mov eax, dword ptr [ebp+08]
:00434FD2 33C9                    xor ecx, ecx
:00434FD4 668B0C4570524500        mov cx, word ptr [2*eax+00455270]
:00434FDC 51                      push ecx
:00434FDD E8066EFDFF              call 0040BDE8
:00434FE2 83C404                  add esp, 00000004
:00434FE5 50                      push eax
:00434FE6 8D45E4                  lea eax, dword ptr [ebp-1C]
:00434FE9 50                      push eax
:00434FEA E801240100              call 004473F0
:00434FEF 83C408                  add esp, 00000008
:00434FF2 E93E000000              jmp 00435035

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434FB8(C)
|
:00434FF7 837D0C00                cmp dword ptr [ebp+0C], 00000000
:00434FFB 0F8534000000            jne 00435035

* Possible StringData Ref from Data Obj ->""
                                  |
:00435001 68FC284500              push 004528FC
:00435006 8D45E4                  lea eax, dword ptr [ebp-1C]
:00435009 50                      push eax
:0043500A E8BE230100              call 004473CD
:0043500F 83C408                  add esp, 00000008
:00435012 8B4508                  mov eax, dword ptr [ebp+08]
:00435015 33C9                    xor ecx, ecx
:00435017 668B0C4570524500        mov cx, word ptr [2*eax+00455270]
:0043501F 51                      push ecx
:00435020 E8C36DFDFF              call 0040BDE8
:00435025 83C404                  add esp, 00000004
:00435028 50                      push eax
:00435029 8D45E4                  lea eax, dword ptr [ebp-1C]
:0043502C 50                      push eax
:0043502D E8BE230100              call 004473F0
:00435032 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00434FAF(U), :00434FF2(U), :00434FFB(C)
|
:00435035 8D45E4                  lea eax, dword ptr [ebp-1C]
:00435038 50                      push eax
:00435039 E859C1FCFF              call 00401197
:0043503E 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00434D87(U), :00434E2D(U), :00434E59(U), :00434F1A(U)
|
:00435041 E900000000              jmp 00435046

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00434D3D(U), :00434D78(U), :00434EF6(U), :00434F38(U), :00435041(U)
|
:00435046 5F                      pop edi
:00435047 5E                      pop esi
:00435048 5B                      pop ebx
:00435049 C9                      leave
:0043504A C3                      ret



* Referenced by a CALL at Address:
|:00435434   
|
:0043504B 55                      push ebp
:0043504C 8BEC                    mov ebp, esp
:0043504E 83EC08                  sub esp, 00000008
:00435051 53                      push ebx
:00435052 56                      push esi
:00435053 57                      push edi
:00435054 C745F800000000          mov [ebp-08], 00000000
:0043505B C645FC00                mov [ebp-04], 00
:0043505F E903000000              jmp 00435067

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435098(U)
|
:00435064 FE45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043505F(U)
|
:00435067 33C0                    xor eax, eax
:00435069 8A45FC                  mov al, byte ptr [ebp-04]
:0043506C 83F80F                  cmp eax, 0000000F
:0043506F 0F8D28000000            jnl 0043509D
:00435075 33C0                    xor eax, eax
:00435077 8A45FC                  mov al, byte ptr [ebp-04]
:0043507A 33C9                    xor ecx, ecx
:0043507C 668B0C45F8CD4600        mov cx, word ptr [2*eax+0046CDF8]
:00435084 81F9FFFF0000            cmp ecx, 0000FFFF
:0043508A 0F8505000000            jne 00435095
:00435090 E908000000              jmp 0043509D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043508A(C)
|
:00435095 FF45F8                  inc [ebp-08]
:00435098 E9C7FFFFFF              jmp 00435064

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043506F(C), :00435090(U)
|
:0043509D 8B450C                  mov eax, dword ptr [ebp+0C]
:004350A0 3945F8                  cmp dword ptr [ebp-08], eax
:004350A3 0F850C000000            jne 004350B5
:004350A9 E83D000000              call 004350EB
:004350AE 33C0                    xor eax, eax
:004350B0 E931000000              jmp 004350E6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004350A3(C)
|
:004350B5 817D08FFFF0000          cmp dword ptr [ebp+08], 0000FFFF
:004350BC 0F841D000000            je 004350DF
:004350C2 8B4508                  mov eax, dword ptr [ebp+08]
:004350C5 33C9                    xor ecx, ecx
:004350C7 8A4DFC                  mov cl, byte ptr [ebp-04]
:004350CA 6689044DF8CD4600        mov word ptr [2*ecx+0046CDF8], ax
:004350D2 FF45F8                  inc [ebp-08]
:004350D5 B801000000              mov eax, 00000001
:004350DA E907000000              jmp 004350E6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004350BC(C)
|
:004350DF 33C0                    xor eax, eax
:004350E1 E900000000              jmp 004350E6

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004350B0(U), :004350DA(U), :004350E1(U)
|
:004350E6 5F                      pop edi
:004350E7 5E                      pop esi
:004350E8 5B                      pop ebx
:004350E9 C9                      leave
:004350EA C3                      ret



* Referenced by a CALL at Addresses:
|:004350A9   , :00435A8C   
|
:004350EB 55                      push ebp
:004350EC 8BEC                    mov ebp, esp
:004350EE 53                      push ebx
:004350EF 56                      push esi
:004350F0 57                      push edi
:004350F1 6A02                    push 00000002
:004350F3 B994A64600              mov ecx, 0046A694
:004350F8 E8273FFEFF              call 00419024

* Possible StringData Ref from Data Obj ->"ٳսˡ"
                                  |
:004350FD 6804294500              push 00452904
:00435102 6A00                    push 00000000
:00435104 E82C3E0000              call 00438F35
:00435109 83C408                  add esp, 00000008
:0043510C E900000000              jmp 00435111

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043510C(U)
|
:00435111 5F                      pop edi
:00435112 5E                      pop esi
:00435113 5B                      pop ebx
:00435114 C9                      leave
:00435115 C3                      ret



* Referenced by a CALL at Address:
|:00436D84   
|
:00435116 55                      push ebp
:00435117 8BEC                    mov ebp, esp
:00435119 83EC04                  sub esp, 00000004
:0043511C 53                      push ebx
:0043511D 56                      push esi
:0043511E 57                      push edi
:0043511F C745FC00000000          mov [ebp-04], 00000000
:00435126 E903000000              jmp 0043512E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435142(U)
|
:0043512B FF45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435126(U)
|
:0043512E 837DFC0F                cmp dword ptr [ebp-04], 0000000F
:00435132 0F830F000000            jnb 00435147
:00435138 8B45FC                  mov eax, dword ptr [ebp-04]
:0043513B C68028CE4600FF          mov byte ptr [eax+0046CE28], FF
:00435142 E9E4FFFFFF              jmp 0043512B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435132(C)
|
:00435147 E900000000              jmp 0043514C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435147(U)
|
:0043514C 5F                      pop edi
:0043514D 5E                      pop esi
:0043514E 5B                      pop ebx
:0043514F C9                      leave
:00435150 C3                      ret



* Referenced by a CALL at Addresses:
|:0043554A   , :00436D95   
|
:00435151 55                      push ebp
:00435152 8BEC                    mov ebp, esp
:00435154 53                      push ebx
:00435155 56                      push esi
:00435156 57                      push edi
:00435157 6A00                    push 00000000
:00435159 E8BE1AFFFF              call 00426C1C
:0043515E 83C404                  add esp, 00000004
:00435161 E85FEFFFFF              call 004340C5
:00435166 837D0803                cmp dword ptr [ebp+08], 00000003
:0043516A 0F8473000000            je 004351E3
:00435170 6A00                    push 00000000
:00435172 6A02                    push 00000002
:00435174 6890010000              push 00000190
:00435179 6880020000              push 00000280
:0043517E 6A28                    push 00000028
:00435180 6A00                    push 00000000
:00435182 B958BC4600              mov ecx, 0046BC58
:00435187 E8DEBBFEFF              call 00420D6A
:0043518C 6A00                    push 00000000
:0043518E 6A07                    push 00000007
:00435190 6880000000              push 00000080
:00435195 6A40                    push 00000040
:00435197 6A30                    push 00000030
:00435199 6890010000              push 00000190
:0043519E B958BC4600              mov ecx, 0046BC58
:004351A3 E8C2BBFEFF              call 00420D6A
:004351A8 6A00                    push 00000000
:004351AA 6A07                    push 00000007
:004351AC 68D0000000              push 000000D0
:004351B1 6A40                    push 00000040
:004351B3 68B0000000              push 000000B0
:004351B8 6890010000              push 00000190
:004351BD B958BC4600              mov ecx, 0046BC58
:004351C2 E8A3BBFEFF              call 00420D6A

* Possible StringData Ref from Data Obj ->""
                                  |
:004351C7 6814294500              push 00452914
:004351CC E840010000              call 00435311
:004351D1 83C404                  add esp, 00000004
:004351D4 6A02                    push 00000002
:004351D6 E8D1F6FFFF              call 004348AC
:004351DB 83C404                  add esp, 00000004
:004351DE E948000000              jmp 0043522B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043516A(C)
|
:004351E3 6A00                    push 00000000
:004351E5 6A02                    push 00000002
:004351E7 6860010000              push 00000160
:004351EC 68B8010000              push 000001B8
:004351F1 6A28                    push 00000028
:004351F3 6A00                    push 00000000
:004351F5 B958BC4600              mov ecx, 0046BC58
:004351FA E86BBBFEFF              call 00420D6A
:004351FF 6A00                    push 00000000
:00435201 6A02                    push 00000002
:00435203 6860010000              push 00000160
:00435208 68D0000000              push 000000D0
:0043520D 6A28                    push 00000028
:0043520F 68B0010000              push 000001B0
:00435214 B958BC4600              mov ecx, 0046BC58
:00435219 E84CBBFEFF              call 00420D6A

* Possible StringData Ref from Data Obj ->""
                                  |
:0043521E 681C294500              push 0045291C
:00435223 E8E9000000              call 00435311
:00435228 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004351DE(U)
|
:0043522B 6A00                    push 00000000
:0043522D 6A02                    push 00000002
:0043522F 6A38                    push 00000038
:00435231 68D0010000              push 000001D0
:00435236 6880010000              push 00000180
:0043523B 6A00                    push 00000000
:0043523D B958BC4600              mov ecx, 0046BC58
:00435242 E823BBFEFF              call 00420D6A
:00435247 6A00                    push 00000000
:00435249 6A02                    push 00000002
:0043524B 6A38                    push 00000038
:0043524D 68B8000000              push 000000B8
:00435252 6880010000              push 00000180
:00435257 68C8010000              push 000001C8
:0043525C B958BC4600              mov ecx, 0046BC58
:00435261 E804BBFEFF              call 00420D6A
:00435266 837D0803                cmp dword ptr [ebp+08], 00000003
:0043526A 0F850F000000            jne 0043527F
:00435270 6A01                    push 00000001

* Possible StringData Ref from Data Obj ->"佫μս"
                                  |
:00435272 6828294500              push 00452928
:00435277 E80D000000              call 00435289
:0043527C 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043526A(C)
|
:0043527F E900000000              jmp 00435284

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043527F(U)
|
:00435284 5F                      pop edi
:00435285 5E                      pop esi
:00435286 5B                      pop ebx
:00435287 C9                      leave
:00435288 C3                      ret



* Referenced by a CALL at Addresses:
|:00435277   , :00436103   , :00436118   
|
:00435289 55                      push ebp
:0043528A 8BEC                    mov ebp, esp
:0043528C 83EC04                  sub esp, 00000004
:0043528F 53                      push ebx
:00435290 56                      push esi
:00435291 57                      push edi
:00435292 837D0C00                cmp dword ptr [ebp+0C], 00000000
:00435296 0F840C000000            je 004352A8
:0043529C C745FC8A010000          mov [ebp-04], 0000018A
:004352A3 E907000000              jmp 004352AF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435296(C)
|
:004352A8 C745FC9C010000          mov [ebp-04], 0000019C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004352A3(U)
|
:004352AF 68FFFF0000              push 0000FFFF
:004352B4 6A10                    push 00000010
:004352B6 68B0010000              push 000001B0
:004352BB 8B45FC                  mov eax, dword ptr [ebp-04]
:004352BE 50                      push eax
:004352BF 6A18                    push 00000018
:004352C1 E8441FFFFF              call 0042720A
:004352C6 83C414                  add esp, 00000014
:004352C9 6A03                    push 00000003
:004352CB B910BC4600              mov ecx, 0046BC10
:004352D0 E862A9FEFF              call 0041FC37
:004352D5 8B45FC                  mov eax, dword ptr [ebp-04]
:004352D8 50                      push eax
:004352D9 6A03                    push 00000003
:004352DB B910BC4600              mov ecx, 0046BC10
:004352E0 E822A9FEFF              call 0041FC07
:004352E5 6A07                    push 00000007
:004352E7 B910BC4600              mov ecx, 0046BC10
:004352EC E8E2A9FEFF              call 0041FCD3
:004352F1 8B4508                  mov eax, dword ptr [ebp+08]
:004352F4 50                      push eax

* Possible StringData Ref from Data Obj ->"M4%sM0"
                                  |
:004352F5 6840294500              push 00452940
:004352FA 6810BC4600              push 0046BC10
:004352FF E81FB8FEFF              call 00420B23
:00435304 83C40C                  add esp, 0000000C
:00435307 E900000000              jmp 0043530C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435307(U)
|
:0043530C 5F                      pop edi
:0043530D 5E                      pop esi
:0043530E 5B                      pop ebx
:0043530F C9                      leave
:00435310 C3                      ret



* Referenced by a CALL at Addresses:
|:004351CC   , :00435223   
|
:00435311 55                      push ebp
:00435312 8BEC                    mov ebp, esp
:00435314 83EC04                  sub esp, 00000004
:00435317 53                      push ebx
:00435318 56                      push esi
:00435319 57                      push edi
:0043531A 6A04                    push 00000004
:0043531C 6A00                    push 00000000
:0043531E 68C09F0000              push 00009FC0
:00435323 B940CF4600              mov ecx, 0046CF40
:00435328 E8F3230100              call 00447720
:0043532D 50                      push eax
:0043532E 6A14                    push 00000014
:00435330 6A08                    push 00000008
:00435332 6A0A                    push 0000000A
:00435334 6828020000              push 00000228
:00435339 E861040100              call 0044579F
:0043533E 83C414                  add esp, 00000014
:00435341 C745FC30020000          mov [ebp-04], 00000230
:00435348 E904000000              jmp 00435351

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435384(U)
|
:0043534D 8345FC08                add dword ptr [ebp-04], 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435348(U)
|
:00435351 817DFC68020000          cmp dword ptr [ebp-04], 00000268
:00435358 0F872B000000            ja 00435389
:0043535E 6A04                    push 00000004
:00435360 6A00                    push 00000000
:00435362 68209F0000              push 00009F20
:00435367 B940CF4600              mov ecx, 0046CF40
:0043536C E8AF230100              call 00447720
:00435371 50                      push eax
:00435372 6A14                    push 00000014
:00435374 6A08                    push 00000008
:00435376 6A0A                    push 0000000A
:00435378 8B45FC                  mov eax, dword ptr [ebp-04]
:0043537B 50                      push eax
:0043537C E81E040100              call 0044579F
:00435381 83C414                  add esp, 00000014
:00435384 E9C4FFFFFF              jmp 0043534D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435358(C)
|
:00435389 6A04                    push 00000004
:0043538B 6A00                    push 00000000
:0043538D 68809E0000              push 00009E80
:00435392 B940CF4600              mov ecx, 0046CF40
:00435397 E884230100              call 00447720
:0043539C 50                      push eax
:0043539D 6A14                    push 00000014
:0043539F 6A08                    push 00000008
:004353A1 6A0A                    push 0000000A
:004353A3 6870020000              push 00000270
:004353A8 E8F2030100              call 0044579F
:004353AD 83C414                  add esp, 00000014
:004353B0 6A0D                    push 0000000D
:004353B2 6A46                    push 00000046
:004353B4 B910BC4600              mov ecx, 0046BC10
:004353B9 E849A8FEFF              call 0041FC07
:004353BE 8B4508                  mov eax, dword ptr [ebp+08]
:004353C1 50                      push eax

* Possible StringData Ref from Data Obj ->"M4%sM0"
                                  |
:004353C2 684C294500              push 0045294C
:004353C7 6810BC4600              push 0046BC10
:004353CC E852B7FEFF              call 00420B23
:004353D1 83C40C                  add esp, 0000000C
:004353D4 E900000000              jmp 004353D9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004353D4(U)
|
:004353D9 5F                      pop edi
:004353DA 5E                      pop esi
:004353DB 5B                      pop ebx
:004353DC C9                      leave
:004353DD C3                      ret



* Referenced by a CALL at Address:
|:0043582D   
|
:004353DE 55                      push ebp
:004353DF 8BEC                    mov ebp, esp
:004353E1 53                      push ebx
:004353E2 56                      push esi
:004353E3 57                      push edi
:004353E4 837D0840                cmp dword ptr [ebp+08], 00000040
:004353E8 0F8234000000            jb 00435422
:004353EE 836D0840                sub dword ptr [ebp+08], 00000040
:004353F2 8B4508                  mov eax, dword ptr [ebp+08]
:004353F5 33C9                    xor ecx, ecx
:004353F7 668B0C45F8CD4600        mov cx, word ptr [2*eax+0046CDF8]
:004353FF 51                      push ecx
:00435400 E856000000              call 0043545B
:00435405 83C404                  add esp, 00000004
:00435408 85C0                    test eax, eax
:0043540A 0F840D000000            je 0043541D
:00435410 8B4508                  mov eax, dword ptr [ebp+08]
:00435413 66C70445F8CD4600FFFF    mov word ptr [2*eax+0046CDF8], FFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043540A(C)
|
:0043541D E92F000000              jmp 00435451

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004353E8(C)
|
:00435422 8B450C                  mov eax, dword ptr [ebp+0C]
:00435425 50                      push eax
:00435426 8B4508                  mov eax, dword ptr [ebp+08]
:00435429 33C9                    xor ecx, ecx
:0043542B 668B0C4570524500        mov cx, word ptr [2*eax+00455270]
:00435433 51                      push ecx
:00435434 E812FCFFFF              call 0043504B
:00435439 83C408                  add esp, 00000008
:0043543C 85C0                    test eax, eax
:0043543E 0F840D000000            je 00435451
:00435444 8B4508                  mov eax, dword ptr [ebp+08]
:00435447 66C7044570524500FFFF    mov word ptr [2*eax+00455270], FFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043541D(U), :0043543E(C)
|
:00435451 E900000000              jmp 00435456

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435451(U)
|
:00435456 5F                      pop edi
:00435457 5E                      pop esi
:00435458 5B                      pop ebx
:00435459 C9                      leave
:0043545A C3                      ret



* Referenced by a CALL at Address:
|:00435400   
|
:0043545B 55                      push ebp
:0043545C 8BEC                    mov ebp, esp
:0043545E 83EC04                  sub esp, 00000004
:00435461 53                      push ebx
:00435462 56                      push esi
:00435463 57                      push edi
:00435464 817D08FFFF0000          cmp dword ptr [ebp+08], 0000FFFF
:0043546B 0F8507000000            jne 00435478
:00435471 33C0                    xor eax, eax
:00435473 E96E000000              jmp 004354E6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043546B(C)
|
:00435478 C645FC00                mov [ebp-04], 00
:0043547C E903000000              jmp 00435484

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004354B2(U)
|
:00435481 FE45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043547C(U)
|
:00435484 33C0                    xor eax, eax
:00435486 8A45FC                  mov al, byte ptr [ebp-04]
:00435489 83F823                  cmp eax, 00000023
:0043548C 0F8D25000000            jnl 004354B7
:00435492 33C0                    xor eax, eax
:00435494 8A45FC                  mov al, byte ptr [ebp-04]
:00435497 33C9                    xor ecx, ecx
:00435499 668B0C4570524500        mov cx, word ptr [2*eax+00455270]
:004354A1 81F9FFFF0000            cmp ecx, 0000FFFF
:004354A7 0F8505000000            jne 004354B2
:004354AD E905000000              jmp 004354B7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004354A7(C)
|
:004354B2 E9CAFFFFFF              jmp 00435481

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043548C(C), :004354AD(U)
|
:004354B7 33C0                    xor eax, eax
:004354B9 8A45FC                  mov al, byte ptr [ebp-04]
:004354BC 83F823                  cmp eax, 00000023
:004354BF 0F841A000000            je 004354DF
:004354C5 8B4508                  mov eax, dword ptr [ebp+08]
:004354C8 33C9                    xor ecx, ecx
:004354CA 8A4DFC                  mov cl, byte ptr [ebp-04]
:004354CD 6689044D70524500        mov word ptr [2*ecx+00455270], ax
:004354D5 B801000000              mov eax, 00000001
:004354DA E907000000              jmp 004354E6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004354BF(C)
|
:004354DF 33C0                    xor eax, eax
:004354E1 E900000000              jmp 004354E6

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00435473(U), :004354DA(U), :004354E1(U)
|
:004354E6 5F                      pop edi
:004354E7 5E                      pop esi
:004354E8 5B                      pop ebx
:004354E9 C9                      leave
:004354EA C3                      ret



* Referenced by a CALL at Addresses:
|:004355BF   , :00435601   , :00435861   
|
:004354EB 55                      push ebp
:004354EC 8BEC                    mov ebp, esp
:004354EE 53                      push ebx
:004354EF 56                      push esi
:004354F0 57                      push edi
:004354F1 6A01                    push 00000001
:004354F3 B994A64600              mov ecx, 0046A694
:004354F8 E8273BFEFF              call 00419024

* Possible StringData Ref from Data Obj ->"ӱ"
                                  |
:004354FD 6858294500              push 00452958
:00435502 6A01                    push 00000001
:00435504 E82C3A0000              call 00438F35
:00435509 83C408                  add esp, 00000008
:0043550C E900000000              jmp 00435511

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043550C(U)
|
:00435511 5F                      pop edi
:00435512 5E                      pop esi
:00435513 5B                      pop ebx
:00435514 C9                      leave
:00435515 C3                      ret



* Referenced by a CALL at Address:
|:00433AFB   
|
:00435516 55                      push ebp
:00435517 8BEC                    mov ebp, esp
:00435519 83EC1C                  sub esp, 0000001C
:0043551C 53                      push ebx
:0043551D 56                      push esi
:0043551E 57                      push edi
:0043551F C745FC01000000          mov [ebp-04], 00000001
:00435526 C70520CE4600FFFF0000    mov dword ptr [0046CE20], 0000FFFF
:00435530 8B450C                  mov eax, dword ptr [ebp+0C]
:00435533 034508                  add eax, dword ptr [ebp+08]
:00435536 8945F0                  mov dword ptr [ebp-10], eax
:00435539 E88AF1FFFF              call 004346C8
:0043553E E8BB17FFFF              call 00426CFE
:00435543 E89106FFFF              call 00425BD9
:00435548 6A03                    push 00000003
:0043554A E802FCFFFF              call 00435151
:0043554F 83C404                  add esp, 00000004
:00435552 6A03                    push 00000003
:00435554 E856030000              call 004358AF
:00435559 83C404                  add esp, 00000004
:0043555C 8B45F0                  mov eax, dword ptr [ebp-10]
:0043555F 50                      push eax
:00435560 E875F4FFFF              call 004349DA
:00435565 83C404                  add esp, 00000004
:00435568 E8101AFFFF              call 00426F7D
:0043556D C745E4FFFF0000          mov [ebp-1C], 0000FFFF
:00435574 E8011E0000              call 0043737A
:00435579 E8E11D0000              call 0043735F
:0043557E 8945EC                  mov dword ptr [ebp-14], eax
:00435581 C7056852450000000000    mov dword ptr [00455268], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004355D1(U), :00435613(U), :0043562A(U), :0043567A(U), :0043568E(U)
|:004356D4(U), :0043572D(U), :0043578B(U), :004357AB(U), :00435873(U)
|
:0043558B B988534500              mov ecx, 00455388
:00435590 E85DC7FCFF              call 00401CF2
:00435595 E831F7FFFF              call 00434CCB
:0043559A 33C9                    xor ecx, ecx
:0043559C 8AC8                    mov cl, al
:0043559E 894DF4                  mov dword ptr [ebp-0C], ecx
:004355A1 B9C0524700              mov ecx, 004752C0
:004355A6 E8991F0100              call 00447544
:004355AB 85C0                    test eax, eax
:004355AD 0F8423000000            je 004355D6
:004355B3 6A00                    push 00000000
:004355B5 B994A64600              mov ecx, 0046A694
:004355BA E8653AFEFF              call 00419024
:004355BF E827FFFFFF              call 004354EB
:004355C4 85C0                    test eax, eax
:004355C6 0F8405000000            je 004355D1
:004355CC E9A7020000              jmp 00435878

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004355C6(C)
|
:004355D1 E9B5FFFFFF              jmp 0043558B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004355AD(C)
|
:004355D6 817DF4FE000000          cmp dword ptr [ebp-0C], 000000FE
:004355DD 0F853A000000            jne 0043561D
:004355E3 B9C0524700              mov ecx, 004752C0
:004355E8 E8321F0100              call 0044751F
:004355ED 85C0                    test eax, eax
:004355EF 0F841E000000            je 00435613
:004355F5 6A01                    push 00000001
:004355F7 B994A64600              mov ecx, 0046A694
:004355FC E8233AFEFF              call 00419024
:00435601 E8E5FEFFFF              call 004354EB
:00435606 85C0                    test eax, eax
:00435608 0F8405000000            je 00435613
:0043560E E965020000              jmp 00435878

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004355EF(C), :00435608(C)
|
:00435613 E973FFFFFF              jmp 0043558B
:00435618 E9BC000000              jmp 004356D9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004355DD(C)
|
:0043561D 817DF4FF000000          cmp dword ptr [ebp-0C], 000000FF
:00435624 0F850A000000            jne 00435634
:0043562A E95CFFFFFF              jmp 0043558B
:0043562F E9A5000000              jmp 004356D9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435624(C)
|
:00435634 837DF455                cmp dword ptr [ebp-0C], 00000055
:00435638 0F8246000000            jb 00435684
:0043563E B9C0524700              mov ecx, 004752C0
:00435643 E8D71E0100              call 0044751F
:00435648 85C0                    test eax, eax
:0043564A 0F842A000000            je 0043567A
:00435650 6A2A                    push 0000002A
:00435652 B994A64600              mov ecx, 0046A694
:00435657 E8C839FEFF              call 00419024
:0043565C 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043565F 83E855                  sub eax, 00000055
:00435662 50                      push eax
:00435663 E892E1FFFF              call 004337FA
:00435668 83C404                  add esp, 00000004
:0043566B 6A03                    push 00000003
:0043566D E83D020000              call 004358AF
:00435672 83C404                  add esp, 00000004
:00435675 E86D1E0000              call 004374E7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043564A(C)
|
:0043567A E90CFFFFFF              jmp 0043558B
:0043567F E955000000              jmp 004356D9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435638(C)
|
:00435684 837DF450                cmp dword ptr [ebp-0C], 00000050
:00435688 0F820A000000            jb 00435698
:0043568E E9F8FEFFFF              jmp 0043558B
:00435693 E941000000              jmp 004356D9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435688(C)
|
:00435698 837DF440                cmp dword ptr [ebp-0C], 00000040
:0043569C 0F8215000000            jb 004356B7
:004356A2 8B45F4                  mov eax, dword ptr [ebp-0C]
:004356A5 33C9                    xor ecx, ecx
:004356A7 668B0C4578CD4600        mov cx, word ptr [2*eax+0046CD78]
:004356AF 894DE8                  mov dword ptr [ebp-18], ecx
:004356B2 E910000000              jmp 004356C7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043569C(C)
|
:004356B7 8B45F4                  mov eax, dword ptr [ebp-0C]
:004356BA 33C9                    xor ecx, ecx
:004356BC 668B0C4570524500        mov cx, word ptr [2*eax+00455270]
:004356C4 894DE8                  mov dword ptr [ebp-18], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004356B2(U)
|
:004356C7 817DE8FFFF0000          cmp dword ptr [ebp-18], 0000FFFF
:004356CE 0F8505000000            jne 004356D9
:004356D4 E9B2FEFFFF              jmp 0043558B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00435618(U), :0043562F(U), :0043567F(U), :00435693(U), :004356CE(C)
|
:004356D9 B9C0524700              mov ecx, 004752C0
:004356DE E83C1E0100              call 0044751F
:004356E3 85C0                    test eax, eax
:004356E5 0F845A000000            je 00435745
:004356EB E86F1C0000              call 0043735F
:004356F0 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004356F3 83C110                  add ecx, 00000010
:004356F6 3BC1                    cmp eax, ecx
:004356F8 0F8339000000            jnb 00435737
:004356FE 8B45E4                  mov eax, dword ptr [ebp-1C]
:00435701 3945E8                  cmp dword ptr [ebp-18], eax
:00435704 0F8528000000            jne 00435732
:0043570A 6A00                    push 00000000
:0043570C B994A64600              mov ecx, 0046A694
:00435711 E80E39FEFF              call 00419024
:00435716 6A01                    push 00000001
:00435718 8B45E8                  mov eax, dword ptr [ebp-18]
:0043571B 50                      push eax
:0043571C E8B897FEFF              call 0041EED9
:00435721 83C404                  add esp, 00000004
:00435724 50                      push eax
:00435725 E83A980000              call 0043EF64
:0043572A 83C408                  add esp, 00000008
:0043572D E959FEFFFF              jmp 0043558B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435704(C)
|
:00435732 E90E000000              jmp 00435745

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004356F8(C)
|
:00435737 8B45E8                  mov eax, dword ptr [ebp-18]
:0043573A 8945E4                  mov dword ptr [ebp-1C], eax
:0043573D E81D1C0000              call 0043735F
:00435742 8945EC                  mov dword ptr [ebp-14], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004356E5(C), :00435732(U)
|
:00435745 B9C0524700              mov ecx, 004752C0
:0043574A E8D01D0100              call 0044751F
:0043574F 85C0                    test eax, eax
:00435751 0F841C010000            je 00435873
:00435757 837DF440                cmp dword ptr [ebp-0C], 00000040
:0043575B 0F8234000000            jb 00435795
:00435761 8B45F4                  mov eax, dword ptr [ebp-0C]
:00435764 83E840                  sub eax, 00000040
:00435767 3B4508                  cmp eax, dword ptr [ebp+08]
:0043576A 0F8320000000            jnb 00435790
:00435770 6A02                    push 00000002
:00435772 B994A64600              mov ecx, 0046A694
:00435777 E8A838FEFF              call 00419024

* Possible StringData Ref from Data Obj ->"ܽ佫"
                                  |
:0043577C 686C294500              push 0045296C
:00435781 6A00                    push 00000000
:00435783 E8AD370000              call 00438F35
:00435788 83C408                  add esp, 00000008
:0043578B E9FBFDFFFF              jmp 0043558B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043576A(C)
|
:00435790 E91B000000              jmp 004357B0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043575B(C)
|
:00435795 6A01                    push 00000001
:00435797 8B45F0                  mov eax, dword ptr [ebp-10]
:0043579A 50                      push eax
:0043579B E889020000              call 00435A29
:004357A0 83C408                  add esp, 00000008
:004357A3 85C0                    test eax, eax
:004357A5 0F8505000000            jne 004357B0
:004357AB E9DBFDFFFF              jmp 0043558B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00435790(U), :004357A5(C)
|
:004357B0 6A04                    push 00000004
:004357B2 6A00                    push 00000000
:004357B4 8B45E8                  mov eax, dword ptr [ebp-18]
:004357B7 50                      push eax
:004357B8 E82EEAFFFF              call 004341EB
:004357BD 83C404                  add esp, 00000004
:004357C0 33C9                    xor ecx, ecx
:004357C2 8AC8                    mov cl, al
:004357C4 8D0CC9                  lea ecx, dword ptr [ecx+8*ecx]
:004357C7 C1E108                  shl ecx, 08
:004357CA 81C100F30000            add ecx, 0000F300
:004357D0 51                      push ecx
:004357D1 B980E34600              mov ecx, 0046E380
:004357D6 E8451F0100              call 00447720
:004357DB 8945F8                  mov dword ptr [ebp-08], eax
:004357DE 6A03                    push 00000003
:004357E0 6A01                    push 00000001
:004357E2 8B45F8                  mov eax, dword ptr [ebp-08]
:004357E5 50                      push eax
:004357E6 E8BC020000              call 00435AA7
:004357EB 83C40C                  add esp, 0000000C
:004357EE 8945FC                  mov dword ptr [ebp-04], eax
:004357F1 837DFC00                cmp dword ptr [ebp-04], 00000000
:004357F5 0F840A000000            je 00435805
:004357FB 837DF440                cmp dword ptr [ebp-0C], 00000040
:004357FF 0F8314000000            jnb 00435819

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004357F5(C)
|
:00435805 837DFC00                cmp dword ptr [ebp-04], 00000000
:00435809 0F8526000000            jne 00435835
:0043580F 837DF440                cmp dword ptr [ebp-0C], 00000040
:00435813 0F831C000000            jnb 00435835

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004357FF(C)
|
:00435819 6A05                    push 00000005
:0043581B B994A64600              mov ecx, 0046A694
:00435820 E8FF37FEFF              call 00419024
:00435825 8B45F0                  mov eax, dword ptr [ebp-10]
:00435828 50                      push eax
:00435829 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043582C 50                      push eax
:0043582D E8ACFBFFFF              call 004353DE
:00435832 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00435809(C), :00435813(C)
|
:00435835 6A03                    push 00000003
:00435837 E873000000              call 004358AF
:0043583C 83C404                  add esp, 00000004
:0043583F 8B45F0                  mov eax, dword ptr [ebp-10]
:00435842 50                      push eax
:00435843 E892F1FFFF              call 004349DA
:00435848 83C404                  add esp, 00000004
:0043584B 6A00                    push 00000000
:0043584D 8B45F0                  mov eax, dword ptr [ebp-10]
:00435850 50                      push eax
:00435851 E8D3010000              call 00435A29
:00435856 83C408                  add esp, 00000008
:00435859 85C0                    test eax, eax
:0043585B 0F8512000000            jne 00435873
:00435861 E885FCFFFF              call 004354EB
:00435866 85C0                    test eax, eax
:00435868 0F8405000000            je 00435873
:0043586E E905000000              jmp 00435878

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00435751(C), :0043585B(C), :00435868(C)
|
:00435873 E913FDFFFF              jmp 0043558B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004355CC(U), :0043560E(U), :0043586E(U)
|
:00435878 6A01                    push 00000001
:0043587A E89D13FFFF              call 00426C1C
:0043587F 83C404                  add esp, 00000004
:00435882 E890B9FCFF              call 00401217
:00435887 6A00                    push 00000000
:00435889 E83D02FFFF              call 00425ACB
:0043588E 83C404                  add esp, 00000004
:00435891 C70564F94600FFFFFFFF    mov dword ptr [0046F964], FFFFFFFF
:0043589B C705982B4500FFFF0000    mov dword ptr [00452B98], 0000FFFF
:004358A5 E900000000              jmp 004358AA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004358A5(U)
|
:004358AA 5F                      pop edi
:004358AB 5E                      pop esi
:004358AC 5B                      pop ebx
:004358AD C9                      leave
:004358AE C3                      ret



* Referenced by a CALL at Addresses:
|:00435554   , :0043566D   , :00435837   , :0043612E   , :0043622A   
|:00436CB2   
|
:004358AF 55                      push ebp
:004358B0 8BEC                    mov ebp, esp
:004358B2 83EC0C                  sub esp, 0000000C
:004358B5 53                      push ebx
:004358B6 56                      push esi
:004358B7 57                      push edi
:004358B8 E8DA16FFFF              call 00426F97
:004358BD C745F400000000          mov [ebp-0C], 00000000
:004358C4 E903000000              jmp 004358CC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043597B(U)
|
:004358C9 FF45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004358C4(U)
|
:004358CC 837DF423                cmp dword ptr [ebp-0C], 00000023
:004358D0 0F83AA000000            jnb 00435980
:004358D6 6A00                    push 00000000
:004358D8 8B45F4                  mov eax, dword ptr [ebp-0C]
:004358DB 50                      push eax
:004358DC E8BDEBFFFF              call 0043449E
:004358E1 83C408                  add esp, 00000008
:004358E4 8945FC                  mov dword ptr [ebp-04], eax
:004358E7 6A01                    push 00000001
:004358E9 8B45F4                  mov eax, dword ptr [ebp-0C]
:004358EC 50                      push eax
:004358ED E8ACEBFFFF              call 0043449E
:004358F2 83C408                  add esp, 00000008
:004358F5 8945F8                  mov dword ptr [ebp-08], eax
:004358F8 68FFFF0000              push 0000FFFF
:004358FD 6A40                    push 00000040
:004358FF 6A30                    push 00000030
:00435901 8B45F8                  mov eax, dword ptr [ebp-08]
:00435904 50                      push eax
:00435905 8B45FC                  mov eax, dword ptr [ebp-04]
:00435908 50                      push eax
:00435909 E8FC18FFFF              call 0042720A
:0043590E 83C414                  add esp, 00000014
:00435911 8B45F4                  mov eax, dword ptr [ebp-0C]
:00435914 33C9                    xor ecx, ecx
:00435916 668B0C4570524500        mov cx, word ptr [2*eax+00455270]
:0043591E 81F9FFFF0000            cmp ecx, 0000FFFF
:00435924 0F8451000000            je 0043597B
:0043592A 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043592D 33C9                    xor ecx, ecx
:0043592F 668B0C4570524500        mov cx, word ptr [2*eax+00455270]
:00435937 51                      push ecx
:00435938 8B45F8                  mov eax, dword ptr [ebp-08]
:0043593B 50                      push eax
:0043593C 8B45FC                  mov eax, dword ptr [ebp-04]
:0043593F 50                      push eax
:00435940 E8E3E9FFFF              call 00434328
:00435945 83C40C                  add esp, 0000000C
:00435948 837D0801                cmp dword ptr [ebp+08], 00000001
:0043594C 0F8529000000            jne 0043597B
:00435952 8B45F4                  mov eax, dword ptr [ebp-0C]
:00435955 33C9                    xor ecx, ecx
:00435957 668B0C4570524500        mov cx, word ptr [2*eax+00455270]
:0043595F 3B0D20CE4600            cmp ecx, dword ptr [0046CE20]
:00435965 0F8510000000            jne 0043597B
:0043596B 8B45F8                  mov eax, dword ptr [ebp-08]
:0043596E 50                      push eax
:0043596F 8B45FC                  mov eax, dword ptr [ebp-04]
:00435972 50                      push eax
:00435973 E817000000              call 0043598F
:00435978 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00435924(C), :0043594C(C), :00435965(C)
|
:0043597B E949FFFFFF              jmp 004358C9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004358D0(C)
|
:00435980 E83216FFFF              call 00426FB7
:00435985 E900000000              jmp 0043598A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435985(U)
|
:0043598A 5F                      pop edi
:0043598B 5E                      pop esi
:0043598C 5B                      pop ebx
:0043598D C9                      leave
:0043598E C3                      ret



* Referenced by a CALL at Address:
|:00435973   
|
:0043598F 55                      push ebp
:00435990 8BEC                    mov ebp, esp
:00435992 83EC04                  sub esp, 00000004
:00435995 53                      push ebx
:00435996 56                      push esi
:00435997 57                      push edi
:00435998 A120CE4600              mov eax, dword ptr [0046CE20]
:0043599D 50                      push eax
:0043599E E84564FDFF              call 0040BDE8
:004359A3 83C404                  add esp, 00000004
:004359A6 8945FC                  mov dword ptr [ebp-04], eax
:004359A9 8B450C                  mov eax, dword ptr [ebp+0C]
:004359AC 83C030                  add eax, 00000030
:004359AF 50                      push eax
:004359B0 BB06000000              mov ebx, 00000006
:004359B5 8B45FC                  mov eax, dword ptr [ebp-04]
:004359B8 50                      push eax
:004359B9 E8EC190100              call 004473AA
:004359BE 83C404                  add esp, 00000004
:004359C1 2BD8                    sub ebx, eax
:004359C3 C1EB01                  shr ebx, 01
:004359C6 8B4508                  mov eax, dword ptr [ebp+08]
:004359C9 C1E803                  shr eax, 03
:004359CC 03D8                    add ebx, eax
:004359CE 53                      push ebx
:004359CF B910BC4600              mov ecx, 0046BC10
:004359D4 E82EA2FEFF              call 0041FC07
:004359D9 6A01                    push 00000001
:004359DB B910BC4600              mov ecx, 0046BC10
:004359E0 E87BA4FEFF              call 0041FE60
:004359E5 6A00                    push 00000000
:004359E7 B910BC4600              mov ecx, 0046BC10
:004359EC E841A4FEFF              call 0041FE32
:004359F1 6A05                    push 00000005
:004359F3 B910BC4600              mov ecx, 0046BC10
:004359F8 E8D6A2FEFF              call 0041FCD3
:004359FD 8B45FC                  mov eax, dword ptr [ebp-04]
:00435A00 50                      push eax

* Possible StringData Ref from Data Obj ->"M4%sC7"
                                  |
:00435A01 6880294500              push 00452980
:00435A06 6810BC4600              push 0046BC10
:00435A0B E813B1FEFF              call 00420B23
:00435A10 83C40C                  add esp, 0000000C
:00435A13 6A00                    push 00000000
:00435A15 B910BC4600              mov ecx, 0046BC10
:00435A1A E841A4FEFF              call 0041FE60
:00435A1F E900000000              jmp 00435A24

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435A1F(U)
|
:00435A24 5F                      pop edi
:00435A25 5E                      pop esi
:00435A26 5B                      pop ebx
:00435A27 C9                      leave
:00435A28 C3                      ret



* Referenced by a CALL at Addresses:
|:0043579B   , :00435851   
|
:00435A29 55                      push ebp
:00435A2A 8BEC                    mov ebp, esp
:00435A2C 83EC08                  sub esp, 00000008
:00435A2F 53                      push ebx
:00435A30 56                      push esi
:00435A31 57                      push edi
:00435A32 C745F800000000          mov [ebp-08], 00000000
:00435A39 C645FC00                mov [ebp-04], 00
:00435A3D E903000000              jmp 00435A45

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435A71(U)
|
:00435A42 FE45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435A3D(U)
|
:00435A45 33C0                    xor eax, eax
:00435A47 8A45FC                  mov al, byte ptr [ebp-04]
:00435A4A 83F80F                  cmp eax, 0000000F
:00435A4D 0F8D23000000            jnl 00435A76
:00435A53 33C0                    xor eax, eax
:00435A55 8A45FC                  mov al, byte ptr [ebp-04]
:00435A58 33C9                    xor ecx, ecx
:00435A5A 668B0C45F8CD4600        mov cx, word ptr [2*eax+0046CDF8]
:00435A62 81F9FFFF0000            cmp ecx, 0000FFFF
:00435A68 0F8403000000            je 00435A71
:00435A6E FF45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435A68(C)
|
:00435A71 E9CCFFFFFF              jmp 00435A42

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435A4D(C)
|
:00435A76 8B45F8                  mov eax, dword ptr [ebp-08]
:00435A79 394508                  cmp dword ptr [ebp+08], eax
:00435A7C 0F8716000000            ja 00435A98
:00435A82 837D0C00                cmp dword ptr [ebp+0C], 00000000
:00435A86 0F8405000000            je 00435A91
:00435A8C E85AF6FFFF              call 004350EB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435A86(C)
|
:00435A91 33C0                    xor eax, eax
:00435A93 E90A000000              jmp 00435AA2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435A7C(C)
|
:00435A98 B801000000              mov eax, 00000001
:00435A9D E900000000              jmp 00435AA2

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00435A93(U), :00435A9D(U)
|
:00435AA2 5F                      pop edi
:00435AA3 5E                      pop esi
:00435AA4 5B                      pop ebx
:00435AA5 C9                      leave
:00435AA6 C3                      ret



* Referenced by a CALL at Addresses:
|:004357E6   , :00436447   
|
:00435AA7 55                      push ebp
:00435AA8 8BEC                    mov ebp, esp
:00435AAA 83EC28                  sub esp, 00000028
:00435AAD 53                      push ebx
:00435AAE 56                      push esi
:00435AAF 57                      push edi
:00435AB0 C745ECFFFF0000          mov [ebp-14], 0000FFFF
:00435AB7 6A04                    push 00000004
:00435AB9 6A00                    push 00000000
:00435ABB 6800400200              push 00024000
:00435AC0 B980E34600              mov ecx, 0046E380
:00435AC5 E8561C0100              call 00447720
:00435ACA 8945FC                  mov dword ptr [ebp-04], eax
:00435ACD 6A04                    push 00000004
:00435ACF 6A00                    push 00000000
:00435AD1 6800500200              push 00025000
:00435AD6 B980E34600              mov ecx, 0046E380
:00435ADB E8401C0100              call 00447720
:00435AE0 8945F8                  mov dword ptr [ebp-08], eax
:00435AE3 33C0                    xor eax, eax
:00435AE5 A07C534500              mov al, byte ptr [0045537C]
:00435AEA 83F840                  cmp eax, 00000040
:00435AED 0F8C35000000            jl 00435B28
:00435AF3 6A00                    push 00000000
:00435AF5 33C0                    xor eax, eax
:00435AF7 A07C534500              mov al, byte ptr [0045537C]
:00435AFC 83E840                  sub eax, 00000040
:00435AFF 50                      push eax
:00435B00 E84CE9FFFF              call 00434451
:00435B05 83C408                  add esp, 00000008
:00435B08 8945DC                  mov dword ptr [ebp-24], eax
:00435B0B 6A01                    push 00000001
:00435B0D 33C0                    xor eax, eax
:00435B0F A07C534500              mov al, byte ptr [0045537C]
:00435B14 83E840                  sub eax, 00000040
:00435B17 50                      push eax
:00435B18 E834E9FFFF              call 00434451
:00435B1D 83C408                  add esp, 00000008
:00435B20 8945D8                  mov dword ptr [ebp-28], eax
:00435B23 E92A000000              jmp 00435B52

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435AED(C)
|
:00435B28 6A00                    push 00000000
:00435B2A 33C0                    xor eax, eax
:00435B2C A07C534500              mov al, byte ptr [0045537C]
:00435B31 50                      push eax
:00435B32 E867E9FFFF              call 0043449E
:00435B37 83C408                  add esp, 00000008
:00435B3A 8945DC                  mov dword ptr [ebp-24], eax
:00435B3D 6A01                    push 00000001
:00435B3F 33C0                    xor eax, eax
:00435B41 A07C534500              mov al, byte ptr [0045537C]
:00435B46 50                      push eax
:00435B47 E852E9FFFF              call 0043449E
:00435B4C 83C408                  add esp, 00000008
:00435B4F 8945D8                  mov dword ptr [ebp-28], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435B23(U)
|
:00435B52 E84014FFFF              call 00426F97
:00435B57 8B45FC                  mov eax, dword ptr [ebp-04]
:00435B5A 50                      push eax
:00435B5B 8B45D8                  mov eax, dword ptr [ebp-28]
:00435B5E 50                      push eax
:00435B5F 8B45DC                  mov eax, dword ptr [ebp-24]
:00435B62 50                      push eax
:00435B63 E8F0010000              call 00435D58
:00435B68 83C40C                  add esp, 0000000C
:00435B6B 8B45F8                  mov eax, dword ptr [ebp-08]
:00435B6E 50                      push eax
:00435B6F 6A30                    push 00000030
:00435B71 6A30                    push 00000030
:00435B73 8B45D8                  mov eax, dword ptr [ebp-28]
:00435B76 50                      push eax
:00435B77 8B45DC                  mov eax, dword ptr [ebp-24]
:00435B7A 50                      push eax
:00435B7B E8DBFD0000              call 0044595B
:00435B80 83C414                  add esp, 00000014
:00435B83 8B45FC                  mov eax, dword ptr [ebp-04]
:00435B86 50                      push eax
:00435B87 6A30                    push 00000030
:00435B89 6A30                    push 00000030
:00435B8B 8B45D8                  mov eax, dword ptr [ebp-28]
:00435B8E 50                      push eax
:00435B8F 8B45DC                  mov eax, dword ptr [ebp-24]
:00435B92 50                      push eax
:00435B93 E807FC0000              call 0044579F
:00435B98 83C414                  add esp, 00000014
:00435B9B E81714FFFF              call 00426FB7
:00435BA0 B988534500              mov ecx, 00455388
:00435BA5 E8F638FDFF              call 004094A0
:00435BAA 8945F4                  mov dword ptr [ebp-0C], eax
:00435BAD B988534500              mov ecx, 00455388
:00435BB2 E80939FDFF              call 004094C0
:00435BB7 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435CDB(C)
|
:00435BBA 6A00                    push 00000000
:00435BBC 6A00                    push 00000000
:00435BBE 6A00                    push 00000000
:00435BC0 E83AF10000              call 00444CFF
:00435BC5 83C40C                  add esp, 0000000C
:00435BC8 B988534500              mov ecx, 00455388
:00435BCD E820C1FCFF              call 00401CF2
:00435BD2 B988534500              mov ecx, 00455388
:00435BD7 E8FAC2FCFF              call 00401ED6
:00435BDC A27C534500              mov byte ptr [0045537C], al
:00435BE1 33C0                    xor eax, eax
:00435BE3 A07C534500              mov al, byte ptr [0045537C]
:00435BE8 8945E4                  mov dword ptr [ebp-1C], eax
:00435BEB B988534500              mov ecx, 00455388
:00435BF0 E8AB38FDFF              call 004094A0
:00435BF5 8945E8                  mov dword ptr [ebp-18], eax
:00435BF8 B988534500              mov ecx, 00455388
:00435BFD E8BE38FDFF              call 004094C0
:00435C02 8945E0                  mov dword ptr [ebp-20], eax
:00435C05 8B45E8                  mov eax, dword ptr [ebp-18]
:00435C08 3945F4                  cmp dword ptr [ebp-0C], eax
:00435C0B 0F850C000000            jne 00435C1D
:00435C11 8B45E0                  mov eax, dword ptr [ebp-20]
:00435C14 3945F0                  cmp dword ptr [ebp-10], eax
:00435C17 0F84B2000000            je 00435CCF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435C0B(C)
|
:00435C1D E87513FFFF              call 00426F97
:00435C22 8B45F8                  mov eax, dword ptr [ebp-08]
:00435C25 50                      push eax
:00435C26 6A30                    push 00000030
:00435C28 6A30                    push 00000030
:00435C2A 8B45D8                  mov eax, dword ptr [ebp-28]
:00435C2D 50                      push eax
:00435C2E 8B45DC                  mov eax, dword ptr [ebp-24]
:00435C31 50                      push eax
:00435C32 E868FB0000              call 0044579F
:00435C37 83C414                  add esp, 00000014
:00435C3A 33C0                    xor eax, eax
:00435C3C A07C534500              mov al, byte ptr [0045537C]
:00435C41 3B45EC                  cmp eax, dword ptr [ebp-14]
:00435C44 0F8434000000            je 00435C7E
:00435C4A 837D0C00                cmp dword ptr [ebp+0C], 00000000
:00435C4E 0F8520000000            jne 00435C74
:00435C54 E83E13FFFF              call 00426F97
:00435C59 8B4510                  mov eax, dword ptr [ebp+10]
:00435C5C 50                      push eax
:00435C5D 6A00                    push 00000000
:00435C5F 33C0                    xor eax, eax
:00435C61 A07C534500              mov al, byte ptr [0045537C]
:00435C66 50                      push eax
:00435C67 E8B6F0FFFF              call 00434D22
:00435C6C 83C40C                  add esp, 0000000C
:00435C6F E84313FFFF              call 00426FB7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435C4E(C)
|
:00435C74 33C0                    xor eax, eax
:00435C76 A07C534500              mov al, byte ptr [0045537C]
:00435C7B 8945EC                  mov dword ptr [ebp-14], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435C44(C)
|
:00435C7E 8B45E8                  mov eax, dword ptr [ebp-18]
:00435C81 83E818                  sub eax, 00000018
:00435C84 8945DC                  mov dword ptr [ebp-24], eax
:00435C87 8B45E0                  mov eax, dword ptr [ebp-20]
:00435C8A 83E818                  sub eax, 00000018
:00435C8D 8945D8                  mov dword ptr [ebp-28], eax
:00435C90 8B45F8                  mov eax, dword ptr [ebp-08]
:00435C93 50                      push eax
:00435C94 6A30                    push 00000030
:00435C96 6A30                    push 00000030
:00435C98 8B45D8                  mov eax, dword ptr [ebp-28]
:00435C9B 50                      push eax
:00435C9C 8B45DC                  mov eax, dword ptr [ebp-24]
:00435C9F 50                      push eax
:00435CA0 E8B6FC0000              call 0044595B
:00435CA5 83C414                  add esp, 00000014
:00435CA8 6A00                    push 00000000
:00435CAA 6A00                    push 00000000
:00435CAC 6A04                    push 00000004
:00435CAE E84CF00000              call 00444CFF
:00435CB3 83C40C                  add esp, 0000000C
:00435CB6 8B4508                  mov eax, dword ptr [ebp+08]
:00435CB9 50                      push eax
:00435CBA 8B45D8                  mov eax, dword ptr [ebp-28]
:00435CBD 50                      push eax
:00435CBE 8B45DC                  mov eax, dword ptr [ebp-24]
:00435CC1 50                      push eax
:00435CC2 E879E3FFFF              call 00434040
:00435CC7 83C40C                  add esp, 0000000C
:00435CCA E8E812FFFF              call 00426FB7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435C17(C)
|
:00435CCF B9C0524700              mov ecx, 004752C0
:00435CD4 E846180100              call 0044751F
:00435CD9 85C0                    test eax, eax
:00435CDB 0F85D9FEFFFF            jne 00435BBA
:00435CE1 6A00                    push 00000000
:00435CE3 6A00                    push 00000000
:00435CE5 6A00                    push 00000000
:00435CE7 E813F00000              call 00444CFF
:00435CEC 83C40C                  add esp, 0000000C
:00435CEF E8A312FFFF              call 00426F97
:00435CF4 8B45F8                  mov eax, dword ptr [ebp-08]
:00435CF7 50                      push eax
:00435CF8 6A30                    push 00000030
:00435CFA 6A30                    push 00000030
:00435CFC 8B45D8                  mov eax, dword ptr [ebp-28]
:00435CFF 50                      push eax
:00435D00 8B45DC                  mov eax, dword ptr [ebp-24]
:00435D03 50                      push eax
:00435D04 E896FA0000              call 0044579F
:00435D09 83C414                  add esp, 00000014
:00435D0C E8A612FFFF              call 00426FB7
:00435D11 B988534500              mov ecx, 00455388
:00435D16 E88537FDFF              call 004094A0
:00435D1B 8945E8                  mov dword ptr [ebp-18], eax
:00435D1E 837D0C00                cmp dword ptr [ebp+0C], 00000000
:00435D22 0F8423000000            je 00435D4B
:00435D28 817DE8B0010000          cmp dword ptr [ebp-18], 000001B0
:00435D2F 0F8207000000            jb 00435D3C
:00435D35 33C0                    xor eax, eax
:00435D37 E905000000              jmp 00435D41

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435D2F(C)
|
:00435D3C B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435D37(U)
|
:00435D41 E90D000000              jmp 00435D53
:00435D46 E908000000              jmp 00435D53

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435D22(C)
|
:00435D4B 8B45E4                  mov eax, dword ptr [ebp-1C]
:00435D4E E900000000              jmp 00435D53

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00435D41(U), :00435D46(U), :00435D4E(U)
|
:00435D53 5F                      pop edi
:00435D54 5E                      pop esi
:00435D55 5B                      pop ebx
:00435D56 C9                      leave
:00435D57 C3                      ret



* Referenced by a CALL at Address:
|:00435B63   
|
:00435D58 55                      push ebp
:00435D59 8BEC                    mov ebp, esp
:00435D5B 53                      push ebx
:00435D5C 56                      push esi
:00435D5D 57                      push edi
:00435D5E 8B4510                  mov eax, dword ptr [ebp+10]
:00435D61 50                      push eax
:00435D62 6A40                    push 00000040
:00435D64 6A30                    push 00000030
:00435D66 8B450C                  mov eax, dword ptr [ebp+0C]
:00435D69 50                      push eax
:00435D6A 8B4508                  mov eax, dword ptr [ebp+08]
:00435D6D 50                      push eax
:00435D6E E8E8FB0000              call 0044595B
:00435D73 83C414                  add esp, 00000014
:00435D76 68FFFF0000              push 0000FFFF
:00435D7B 6A40                    push 00000040
:00435D7D 6A30                    push 00000030
:00435D7F 8B450C                  mov eax, dword ptr [ebp+0C]
:00435D82 50                      push eax
:00435D83 8B4508                  mov eax, dword ptr [ebp+08]
:00435D86 50                      push eax
:00435D87 E87E14FFFF              call 0042720A
:00435D8C 83C414                  add esp, 00000014
:00435D8F E900000000              jmp 00435D94

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435D8F(U)
|
:00435D94 5F                      pop edi
:00435D95 5E                      pop esi
:00435D96 5B                      pop ebx
:00435D97 C9                      leave
:00435D98 C3                      ret



* Referenced by a CALL at Addresses:
|:0043661C   , :004369F1   
|
:00435D99 55                      push ebp
:00435D9A 8BEC                    mov ebp, esp
:00435D9C 83EC04                  sub esp, 00000004
:00435D9F 53                      push ebx
:00435DA0 56                      push esi
:00435DA1 57                      push edi
:00435DA2 B9D0A64600              mov ecx, 0046A6D0
:00435DA7 E89496FEFF              call 0041F440
:00435DAC 8945FC                  mov dword ptr [ebp-04], eax
:00435DAF 8B4508                  mov eax, dword ptr [ebp+08]
:00435DB2 50                      push eax
:00435DB3 8B45FC                  mov eax, dword ptr [ebp-04]
:00435DB6 50                      push eax
:00435DB7 E80F150100              call 004472CB
:00435DBC 83C408                  add esp, 00000008
:00435DBF 8945FC                  mov dword ptr [ebp-04], eax
:00435DC2 8B45FC                  mov eax, dword ptr [ebp-04]
:00435DC5 50                      push eax
:00435DC6 B9D0A64600              mov ecx, 0046A6D0
:00435DCB E8F027FEFF              call 004185C0
:00435DD0 E900000000              jmp 00435DD5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435DD0(U)
|
:00435DD5 5F                      pop edi
:00435DD6 5E                      pop esi
:00435DD7 5B                      pop ebx
:00435DD8 C9                      leave
:00435DD9 C3                      ret


:00435DDA 55                      push ebp
:00435DDB 8BEC                    mov ebp, esp
:00435DDD 53                      push ebx
:00435DDE 56                      push esi
:00435DDF 57                      push edi
:00435DE0 68A8010000              push 000001A8
:00435DE5 6A03                    push 00000003
:00435DE7 B910BC4600              mov ecx, 0046BC10
:00435DEC E8169EFEFF              call 0041FC07
:00435DF1 8B4508                  mov eax, dword ptr [ebp+08]
:00435DF4 50                      push eax
:00435DF5 6810BC4600              push 0046BC10
:00435DFA E888ACFEFF              call 00420A87
:00435DFF 83C408                  add esp, 00000008
:00435E02 E900000000              jmp 00435E07

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435E02(U)
|
:00435E07 5F                      pop edi
:00435E08 5E                      pop esi
:00435E09 5B                      pop ebx
:00435E0A C9                      leave
:00435E0B C3                      ret



* Referenced by a CALL at Address:
|:00436D9D   
|
:00435E0C 55                      push ebp
:00435E0D 8BEC                    mov ebp, esp
:00435E0F 83EC0C                  sub esp, 0000000C
:00435E12 53                      push ebx
:00435E13 56                      push esi
:00435E14 57                      push edi
:00435E15 68FF000000              push 000000FF
:00435E1A 6800010000              push 00000100
:00435E1F 6870524500              push 00455270
:00435E24 E83A160100              call 00447463
:00435E29 83C40C                  add esp, 0000000C
:00435E2C C745FCE8564500          mov [ebp-04], 004556E8
:00435E33 C745F400000000          mov [ebp-0C], 00000000
:00435E3A 8B45F4                  mov eax, dword ptr [ebp-0C]
:00435E3D 8945F8                  mov dword ptr [ebp-08], eax
:00435E40 E907000000              jmp 00435E4C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435EA2(U)
|
:00435E45 FF45F8                  inc [ebp-08]
:00435E48 8345FC36                add dword ptr [ebp-04], 00000036

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435E40(U)
|
:00435E4C 817DF800020000          cmp dword ptr [ebp-08], 00000200
:00435E53 0F834E000000            jnb 00435EA7
:00435E59 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00435E5C E8EFAFFDFF              call 00410E50
:00435E61 33C9                    xor ecx, ecx
:00435E63 8AC8                    mov cl, al
:00435E65 83F906                  cmp ecx, 00000006
:00435E68 0F8414000000            je 00435E82
:00435E6E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00435E71 E8DAAFFDFF              call 00410E50
:00435E76 33C9                    xor ecx, ecx
:00435E78 8AC8                    mov cl, al
:00435E7A 85C9                    test ecx, ecx
:00435E7C 0F8511000000            jne 00435E93

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435E68(C)
|
:00435E82 8B45F8                  mov eax, dword ptr [ebp-08]
:00435E85 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00435E88 6689044D70524500        mov word ptr [2*ecx+00455270], ax
:00435E90 FF45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435E7C(C)
|
:00435E93 837DF440                cmp dword ptr [ebp-0C], 00000040
:00435E97 0F8205000000            jb 00435EA2
:00435E9D E905000000              jmp 00435EA7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435E97(C)
|
:00435EA2 E99EFFFFFF              jmp 00435E45

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00435E53(C), :00435E9D(U)
|
:00435EA7 E903000000              jmp 00435EAF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435EC6(U)
|
:00435EAC FF45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435EA7(U)
|
:00435EAF 837DF440                cmp dword ptr [ebp-0C], 00000040
:00435EB3 0F8312000000            jnb 00435ECB
:00435EB9 8B45F4                  mov eax, dword ptr [ebp-0C]
:00435EBC 66C7044570524500FFFF    mov word ptr [2*eax+00455270], FFFF
:00435EC6 E9E1FFFFFF              jmp 00435EAC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435EB3(C)
|
:00435ECB E900000000              jmp 00435ED0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435ECB(U)
|
:00435ED0 5F                      pop edi
:00435ED1 5E                      pop esi
:00435ED2 5B                      pop ebx
:00435ED3 C9                      leave
:00435ED4 C3                      ret



* Referenced by a CALL at Address:
|:00436951   
|
:00435ED5 55                      push ebp
:00435ED6 8BEC                    mov ebp, esp
:00435ED8 83EC04                  sub esp, 00000004
:00435EDB 53                      push ebx
:00435EDC 56                      push esi
:00435EDD 57                      push edi
:00435EDE 8B450C                  mov eax, dword ptr [ebp+0C]
:00435EE1 33C9                    xor ecx, ecx
:00435EE3 668B0C4570524500        mov cx, word ptr [2*eax+00455270]
:00435EEB 894DFC                  mov dword ptr [ebp-04], ecx
:00435EEE 8B4508                  mov eax, dword ptr [ebp+08]
:00435EF1 33C9                    xor ecx, ecx
:00435EF3 8A8828CE4600            mov cl, byte ptr [eax+0046CE28]
:00435EF9 894D08                  mov dword ptr [ebp+08], ecx
:00435EFC 8B45FC                  mov eax, dword ptr [ebp-04]
:00435EFF 50                      push eax
:00435F00 8B4508                  mov eax, dword ptr [ebp+08]
:00435F03 50                      push eax
:00435F04 E86864FDFF              call 0040C371
:00435F09 83C408                  add esp, 00000008
:00435F0C 85C0                    test eax, eax
:00435F0E 0F840F000000            je 00435F23
:00435F14 B801000000              mov eax, 00000001
:00435F19 E953000000              jmp 00435F71
:00435F1E E94E000000              jmp 00435F71

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435F0E(C)
|
:00435F23 8B4508                  mov eax, dword ptr [ebp+08]
:00435F26 50                      push eax
:00435F27 E8E286FEFF              call 0041E60E
:00435F2C 83C404                  add esp, 00000004
:00435F2F 50                      push eax
:00435F30 8B45FC                  mov eax, dword ptr [ebp-04]
:00435F33 50                      push eax
:00435F34 E8AF5EFDFF              call 0040BDE8
:00435F39 83C404                  add esp, 00000004
:00435F3C 50                      push eax
:00435F3D 8B45FC                  mov eax, dword ptr [ebp-04]
:00435F40 8D0440                  lea eax, dword ptr [eax+2*eax]
:00435F43 03C0                    add eax, eax
:00435F45 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:00435F4C E87F33FDFF              call 004092D0
:00435F51 33C9                    xor ecx, ecx
:00435F53 8AC8                    mov cl, al
:00435F55 8B048DF82C4500          mov eax, dword ptr [4*ecx+00452CF8]
:00435F5C 50                      push eax

* Possible StringData Ref from Data Obj ->"%s%sװC6%sC7Ҫ"
                                  |
:00435F5D 688C294500              push 0045298C
:00435F62 6A01                    push 00000001
:00435F64 E8CC2F0000              call 00438F35
:00435F69 83C414                  add esp, 00000014
:00435F6C E900000000              jmp 00435F71

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00435F19(U), :00435F1E(U), :00435F6C(U)
|
:00435F71 5F                      pop edi
:00435F72 5E                      pop esi
:00435F73 5B                      pop ebx
:00435F74 C9                      leave
:00435F75 C3                      ret



* Referenced by a CALL at Address:
|:004363FD   
|
:00435F76 55                      push ebp
:00435F77 8BEC                    mov ebp, esp
:00435F79 83EC04                  sub esp, 00000004
:00435F7C 53                      push ebx
:00435F7D 56                      push esi
:00435F7E 57                      push edi
:00435F7F 68FFFF0000              push 0000FFFF
:00435F84 6A22                    push 00000022
:00435F86 68B0010000              push 000001B0
:00435F8B 688A010000              push 0000018A
:00435F90 6A18                    push 00000018
:00435F92 E87312FFFF              call 0042720A
:00435F97 83C414                  add esp, 00000014
:00435F9A 6A03                    push 00000003
:00435F9C B910BC4600              mov ecx, 0046BC10
:00435FA1 E8919CFEFF              call 0041FC37
:00435FA6 688A010000              push 0000018A
:00435FAB 6A03                    push 00000003
:00435FAD B910BC4600              mov ecx, 0046BC10
:00435FB2 E8509CFEFF              call 0041FC07
:00435FB7 8B4508                  mov eax, dword ptr [ebp+08]
:00435FBA 50                      push eax
:00435FBB E87A61FDFF              call 0040C13A
:00435FC0 83C404                  add esp, 00000004
:00435FC3 33C9                    xor ecx, ecx
:00435FC5 8AC8                    mov cl, al
:00435FC7 83F905                  cmp ecx, 00000005
:00435FCA 0F8511000000            jne 00435FE1
:00435FD0 6A18                    push 00000018
:00435FD2 B994A64600              mov ecx, 0046A694
:00435FD7 E84830FEFF              call 00419024
:00435FDC E90C000000              jmp 00435FED

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435FCA(C)
|
:00435FE1 6A00                    push 00000000
:00435FE3 B994A64600              mov ecx, 0046A694
:00435FE8 E83730FEFF              call 00419024

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435FDC(U)
|
:00435FED 8B4508                  mov eax, dword ptr [ebp+08]
:00435FF0 50                      push eax
:00435FF1 E85B62FDFF              call 0040C251
:00435FF6 83C404                  add esp, 00000004
:00435FF9 33C9                    xor ecx, ecx
:00435FFB 8AC8                    mov cl, al
:00435FFD 83F903                  cmp ecx, 00000003
:00436000 0F8556000000            jne 0043605C
:00436006 8B4508                  mov eax, dword ptr [ebp+08]
:00436009 50                      push eax
:0043600A E8FF85FEFF              call 0041E60E
:0043600F 83C404                  add esp, 00000004
:00436012 50                      push eax

* Possible StringData Ref from Data Obj ->"M4C6%s:"
                                  |
:00436013 68B4294500              push 004529B4
:00436018 6810BC4600              push 0046BC10
:0043601D E801ABFEFF              call 00420B23
:00436022 83C40C                  add esp, 0000000C
:00436025 8B4508                  mov eax, dword ptr [ebp+08]
:00436028 8BC8                    mov ecx, eax
:0043602A C1E004                  shl eax, 04
:0043602D 8D8C0818AA4600          lea ecx, dword ptr [eax+ecx+0046AA18]
:00436034 E8470F0000              call 00436F80
:00436039 33C9                    xor ecx, ecx
:0043603B 8AC8                    mov cl, al
:0043603D 8B048DE0FF4400          mov eax, dword ptr [4*ecx+0044FFE0]
:00436044 50                      push eax

* Possible StringData Ref from Data Obj ->"C7%sM0"
                                  |
:00436045 68C0294500              push 004529C0
:0043604A 6810BC4600              push 0046BC10
:0043604F E8CFAAFEFF              call 00420B23
:00436054 83C40C                  add esp, 0000000C
:00436057 E980000000              jmp 004360DC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436000(C)
|
:0043605C 8B4508                  mov eax, dword ptr [ebp+08]
:0043605F 8BC8                    mov ecx, eax
:00436061 C1E004                  shl eax, 04
:00436064 8D8C0818AA4600          lea ecx, dword ptr [eax+ecx+0046AA18]
:0043606B E89035FDFF              call 00409600
:00436070 8845FC                  mov byte ptr [ebp-04], al
:00436073 8B4508                  mov eax, dword ptr [ebp+08]
:00436076 50                      push eax
:00436077 E89285FEFF              call 0041E60E
:0043607C 83C404                  add esp, 00000004
:0043607F 50                      push eax

* Possible StringData Ref from Data Obj ->"M4C6%s"
                                  |
:00436080 68CC294500              push 004529CC
:00436085 6810BC4600              push 0046BC10
:0043608A E894AAFEFF              call 00420B23
:0043608F 83C40C                  add esp, 0000000C
:00436092 33C0                    xor eax, eax
:00436094 8A45FC                  mov al, byte ptr [ebp-04]
:00436097 50                      push eax

* Possible StringData Ref from Data Obj ->"(+%d)"
                                  |
:00436098 68D8294500              push 004529D8
:0043609D 6810BC4600              push 0046BC10
:004360A2 E87CAAFEFF              call 00420B23
:004360A7 83C40C                  add esp, 0000000C
:004360AA 8B4508                  mov eax, dword ptr [ebp+08]
:004360AD 8BC8                    mov ecx, eax
:004360AF C1E004                  shl eax, 04
:004360B2 8D8C0818AA4600          lea ecx, dword ptr [eax+ecx+0046AA18]
:004360B9 E8C20E0000              call 00436F80
:004360BE 33C9                    xor ecx, ecx
:004360C0 8AC8                    mov cl, al
:004360C2 8B048DE0FF4400          mov eax, dword ptr [4*ecx+0044FFE0]
:004360C9 50                      push eax

* Possible StringData Ref from Data Obj ->":C7%sM0"
                                  |
:004360CA 68E0294500              push 004529E0
:004360CF 6810BC4600              push 0046BC10
:004360D4 E84AAAFEFF              call 00420B23
:004360D9 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436057(U)
|
:004360DC E900000000              jmp 004360E1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004360DC(U)
|
:004360E1 5F                      pop edi
:004360E2 5E                      pop esi
:004360E3 5B                      pop ebx
:004360E4 C9                      leave
:004360E5 C3                      ret



* Referenced by a CALL at Address:
|:00436EA0   
|
:004360E6 55                      push ebp
:004360E7 8BEC                    mov ebp, esp
:004360E9 83EC1C                  sub esp, 0000001C
:004360EC 53                      push ebx
:004360ED 56                      push esi
:004360EE 57                      push edi
:004360EF C745F0FFFF0000          mov [ebp-10], 0000FFFF
:004360F6 6A01                    push 00000001
:004360F8 8B4508                  mov eax, dword ptr [ebp+08]
:004360FB 8B04C530244500          mov eax, dword ptr [8*eax+00452430]
:00436102 50                      push eax
:00436103 E881F1FFFF              call 00435289
:00436108 83C408                  add esp, 00000008
:0043610B 6A00                    push 00000000
:0043610D 8B4508                  mov eax, dword ptr [ebp+08]
:00436110 8B04C534244500          mov eax, dword ptr [8*eax+00452434]
:00436117 50                      push eax
:00436118 E86CF1FFFF              call 00435289
:0043611D 83C408                  add esp, 00000008
:00436120 837D0801                cmp dword ptr [ebp+08], 00000001
:00436124 0F8418000000            je 00436142
:0043612A 8B4508                  mov eax, dword ptr [ebp+08]
:0043612D 50                      push eax
:0043612E E87CF7FFFF              call 004358AF
:00436133 83C404                  add esp, 00000004
:00436136 8B4508                  mov eax, dword ptr [ebp+08]
:00436139 50                      push eax
:0043613A E873090000              call 00436AB2
:0043613F 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436124(C)
|
:00436142 E850E9FFFF              call 00434A97
:00436147 C645ECFF                mov [ebp-14], FF
:0043614B E878E5FFFF              call 004346C8

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004361E2(U), :00436237(U), :004363A0(U), :004363AF(U), :004363CF(U)
|:00436A9E(U)
|
:00436150 B988534500              mov ecx, 00455388
:00436155 E898BBFCFF              call 00401CF2
:0043615A B988534500              mov ecx, 00455388
:0043615F E872BDFCFF              call 00401ED6
:00436164 A27C534500              mov byte ptr [0045537C], al
:00436169 33C0                    xor eax, eax
:0043616B A07C534500              mov al, byte ptr [0045537C]
:00436170 8945F4                  mov dword ptr [ebp-0C], eax
:00436173 33C0                    xor eax, eax
:00436175 A07C534500              mov al, byte ptr [0045537C]
:0043617A 3B45F0                  cmp eax, dword ptr [ebp-10]
:0043617D 0F8420000000            je 004361A3
:00436183 8B4508                  mov eax, dword ptr [ebp+08]
:00436186 50                      push eax
:00436187 6A01                    push 00000001
:00436189 33C0                    xor eax, eax
:0043618B A07C534500              mov al, byte ptr [0045537C]
:00436190 50                      push eax
:00436191 E88CEBFFFF              call 00434D22
:00436196 83C40C                  add esp, 0000000C
:00436199 33C0                    xor eax, eax
:0043619B A07C534500              mov al, byte ptr [0045537C]
:004361A0 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043617D(C)
|
:004361A3 B988534500              mov ecx, 00455388
:004361A8 E80FBCFCFF              call 00401DBC
:004361AD A380534500              mov dword ptr [00455380], eax
:004361B2 33C0                    xor eax, eax
:004361B4 A07C534500              mov al, byte ptr [0045537C]
:004361B9 3DFE000000              cmp eax, 000000FE
:004361BE 0F8523000000            jne 004361E7
:004361C4 833D8053450001          cmp dword ptr [00455380], 00000001
:004361CB 0F8511000000            jne 004361E2
:004361D1 6A00                    push 00000000
:004361D3 B994A64600              mov ecx, 0046A694
:004361D8 E8472EFEFF              call 00419024
:004361DD E9C1080000              jmp 00436AA3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004361CB(C)
|
:004361E2 E969FFFFFF              jmp 00436150

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004361BE(C)
|
:004361E7 833D8053450001          cmp dword ptr [00455380], 00000001
:004361EE 0F8548000000            jne 0043623C
:004361F4 817DF4FF000000          cmp dword ptr [ebp-0C], 000000FF
:004361FB 0F843B000000            je 0043623C
:00436201 837DF455                cmp dword ptr [ebp-0C], 00000055
:00436205 0F8231000000            jb 0043623C
:0043620B 6A2A                    push 0000002A
:0043620D B994A64600              mov ecx, 0046A694
:00436212 E80D2EFEFF              call 00419024
:00436217 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043621A 83E855                  sub eax, 00000055
:0043621D 50                      push eax
:0043621E E8D7D5FFFF              call 004337FA
:00436223 83C404                  add esp, 00000004
:00436226 8B4508                  mov eax, dword ptr [ebp+08]
:00436229 50                      push eax
:0043622A E880F6FFFF              call 004358AF
:0043622F 83C404                  add esp, 00000004
:00436232 E8B0120000              call 004374E7
:00436237 E914FFFFFF              jmp 00436150

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004361EE(C), :004361FB(C), :00436205(C)
|
:0043623C 833D8053450001          cmp dword ptr [00455380], 00000001
:00436243 0F8584000000            jne 004362CD
:00436249 837DF452                cmp dword ptr [ebp-0C], 00000052
:0043624D 0F827A000000            jb 004362CD
:00436253 837DF454                cmp dword ptr [ebp-0C], 00000054
:00436257 0F8770000000            ja 004362CD
:0043625D 8B45F4                  mov eax, dword ptr [ebp-0C]
:00436260 83E852                  sub eax, 00000052
:00436263 3B4508                  cmp eax, dword ptr [ebp+08]
:00436266 0F8461000000            je 004362CD
:0043626C 6A00                    push 00000000
:0043626E B994A64600              mov ecx, 0046A694
:00436273 E8AC2DFEFF              call 00419024
:00436278 837D0801                cmp dword ptr [ebp+08], 00000001
:0043627C 0F8431000000            je 004362B3
:00436282 837DF453                cmp dword ptr [ebp-0C], 00000053
:00436286 0F8527000000            jne 004362B3
:0043628C 813D20CE4600FFFF0000    cmp dword ptr [0046CE20], 0000FFFF
:00436296 0F850D000000            jne 004362A9
:0043629C 33C0                    xor eax, eax
:0043629E 66A170524500            mov ax, word ptr [00455270]
:004362A4 A320CE4600              mov dword ptr [0046CE20], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436296(C)
|
:004362A9 6A01                    push 00000001
:004362AB E880090000              call 00436C30
:004362B0 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043627C(C), :00436286(C)
|
:004362B3 8B45F4                  mov eax, dword ptr [ebp-0C]
:004362B6 83E852                  sub eax, 00000052
:004362B9 50                      push eax
:004362BA E8EDE5FFFF              call 004348AC
:004362BF 83C404                  add esp, 00000004
:004362C2 8B45F4                  mov eax, dword ptr [ebp-0C]
:004362C5 83E852                  sub eax, 00000052
:004362C8 E9E0070000              jmp 00436AAD

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00436243(C), :0043624D(C), :00436257(C), :00436266(C)
|
:004362CD 33C0                    xor eax, eax
:004362CF A07C534500              mov al, byte ptr [0045537C]
:004362D4 3DFF000000              cmp eax, 000000FF
:004362D9 0F848A070000            je 00436A69
:004362DF 833D8053450001          cmp dword ptr [00455380], 00000001
:004362E6 0F857D070000            jne 00436A69
:004362EC 837DF440                cmp dword ptr [ebp-0C], 00000040
:004362F0 0F83AF000000            jnb 004363A5
:004362F6 837D0801                cmp dword ptr [ebp+08], 00000001
:004362FA 0F8552000000            jne 00436352
:00436300 8B45F4                  mov eax, dword ptr [ebp-0C]
:00436303 33C9                    xor ecx, ecx
:00436305 668B0C4570524500        mov cx, word ptr [2*eax+00455270]
:0043630D 81F9FFFF0000            cmp ecx, 0000FFFF
:00436313 0F8434000000            je 0043634D
:00436319 6A01                    push 00000001
:0043631B B994A64600              mov ecx, 0046A694
:00436320 E8FF2CFEFF              call 00419024
:00436325 8B45F4                  mov eax, dword ptr [ebp-0C]
:00436328 33C9                    xor ecx, ecx
:0043632A 668B0C4570524500        mov cx, word ptr [2*eax+00455270]
:00436332 890D20CE4600            mov dword ptr [0046CE20], ecx
:00436338 8B4508                  mov eax, dword ptr [ebp+08]
:0043633B 50                      push eax
:0043633C E8EF080000              call 00436C30
:00436341 83C404                  add esp, 00000004
:00436344 E89E110000              call 004374E7
:00436349 C645ECFF                mov [ebp-14], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436313(C)
|
:0043634D E94E000000              jmp 004363A0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004362FA(C)
|
:00436352 33C0                    xor eax, eax
:00436354 A07C534500              mov al, byte ptr [0045537C]
:00436359 33C9                    xor ecx, ecx
:0043635B 668B0C4570524500        mov cx, word ptr [2*eax+00455270]
:00436363 81F9FFFF0000            cmp ecx, 0000FFFF
:00436369 0F8431000000            je 004363A0
:0043636F 6A00                    push 00000000
:00436371 B994A64600              mov ecx, 0046A694
:00436376 E8A92CFEFF              call 00419024
:0043637B 6A01                    push 00000001
:0043637D 33C0                    xor eax, eax
:0043637F A07C534500              mov al, byte ptr [0045537C]
:00436384 33C9                    xor ecx, ecx
:00436386 668B0C4570524500        mov cx, word ptr [2*eax+00455270]
:0043638E 51                      push ecx
:0043638F E8458BFEFF              call 0041EED9
:00436394 83C404                  add esp, 00000004
:00436397 50                      push eax
:00436398 E8C78B0000              call 0043EF64
:0043639D 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043634D(U), :00436369(C)
|
:004363A0 E9ABFDFFFF              jmp 00436150

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004362F0(C)
|
:004363A5 837DF450                cmp dword ptr [ebp-0C], 00000050
:004363A9 0F8205000000            jb 004363B4
:004363AF E99CFDFFFF              jmp 00436150

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004363A9(C)
|
:004363B4 33C0                    xor eax, eax
:004363B6 A07C534500              mov al, byte ptr [0045537C]
:004363BB 33C9                    xor ecx, ecx
:004363BD 8A88E8CD4600            mov cl, byte ptr [eax+0046CDE8]
:004363C3 81F9FF000000            cmp ecx, 000000FF
:004363C9 0F850A000000            jne 004363D9
:004363CF E97CFDFFFF              jmp 00436150
:004363D4 E934000000              jmp 0043640D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004363C9(C)
|
:004363D9 33C0                    xor eax, eax
:004363DB A07C534500              mov al, byte ptr [0045537C]
:004363E0 33C9                    xor ecx, ecx
:004363E2 8A4DEC                  mov cl, byte ptr [ebp-14]
:004363E5 3BC1                    cmp eax, ecx
:004363E7 0F8420000000            je 0043640D
:004363ED 33C0                    xor eax, eax
:004363EF A07C534500              mov al, byte ptr [0045537C]
:004363F4 33C9                    xor ecx, ecx
:004363F6 8A88E8CD4600            mov cl, byte ptr [eax+0046CDE8]
:004363FC 51                      push ecx
:004363FD E874FBFFFF              call 00435F76
:00436402 83C404                  add esp, 00000004
:00436405 A07C534500              mov al, byte ptr [0045537C]
:0043640A 8845EC                  mov byte ptr [ebp-14], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004363D4(U), :004363E7(C)
|
:0043640D 6A04                    push 00000004
:0043640F 6A00                    push 00000000
:00436411 8B45F4                  mov eax, dword ptr [ebp-0C]
:00436414 33C9                    xor ecx, ecx
:00436416 8A88E8CD4600            mov cl, byte ptr [eax+0046CDE8]
:0043641C 51                      push ecx
:0043641D E8185DFDFF              call 0040C13A
:00436422 83C404                  add esp, 00000004
:00436425 33C9                    xor ecx, ecx
:00436427 8AC8                    mov cl, al
:00436429 8D0CC9                  lea ecx, dword ptr [ecx+8*ecx]
:0043642C C1E108                  shl ecx, 08
:0043642F 51                      push ecx
:00436430 B980E34600              mov ecx, 0046E380
:00436435 E8E6120100              call 00447720
:0043643A 8945FC                  mov dword ptr [ebp-04], eax
:0043643D 8B4508                  mov eax, dword ptr [ebp+08]
:00436440 50                      push eax
:00436441 6A00                    push 00000000
:00436443 8B45FC                  mov eax, dword ptr [ebp-04]
:00436446 50                      push eax
:00436447 E85BF6FFFF              call 00435AA7
:0043644C 83C40C                  add esp, 0000000C
:0043644F A27C534500              mov byte ptr [0045537C], al
:00436454 33C0                    xor eax, eax
:00436456 A07C534500              mov al, byte ptr [0045537C]
:0043645B 8945E8                  mov dword ptr [ebp-18], eax
:0043645E 8B45F4                  mov eax, dword ptr [ebp-0C]
:00436461 83E840                  sub eax, 00000040
:00436464 8945E4                  mov dword ptr [ebp-1C], eax
:00436467 837DE851                cmp dword ptr [ebp-18], 00000051
:0043646B 0F85BC000000            jne 0043652D
:00436471 837D0801                cmp dword ptr [ebp+08], 00000001
:00436475 0F85B2000000            jne 0043652D
:0043647B 8B45E4                  mov eax, dword ptr [ebp-1C]
:0043647E 33C9                    xor ecx, ecx
:00436480 8A8828CE4600            mov cl, byte ptr [eax+0046CE28]
:00436486 81F9FF000000            cmp ecx, 000000FF
:0043648C 0F849B000000            je 0043652D
:00436492 813D20CE4600FFFF0000    cmp dword ptr [0046CE20], 0000FFFF
:0043649C 0F848B000000            je 0043652D
:004364A2 8B45E4                  mov eax, dword ptr [ebp-1C]
:004364A5 33C9                    xor ecx, ecx
:004364A7 8A8828CE4600            mov cl, byte ptr [eax+0046CE28]
:004364AD 51                      push ecx
:004364AE E801E1FFFF              call 004345B4
:004364B3 83C404                  add esp, 00000004
:004364B6 8945F8                  mov dword ptr [ebp-08], eax
:004364B9 8B45F8                  mov eax, dword ptr [ebp-08]
:004364BC 50                      push eax
:004364BD 8B45E4                  mov eax, dword ptr [ebp-1C]
:004364C0 33C9                    xor ecx, ecx
:004364C2 8A8828CE4600            mov cl, byte ptr [eax+0046CE28]
:004364C8 51                      push ecx
:004364C9 E84081FEFF              call 0041E60E
:004364CE 83C404                  add esp, 00000004
:004364D1 50                      push eax
:004364D2 A120CE4600              mov eax, dword ptr [0046CE20]
:004364D7 50                      push eax
:004364D8 E80B59FDFF              call 0040BDE8
:004364DD 83C404                  add esp, 00000004
:004364E0 50                      push eax

* Possible StringData Ref from Data Obj ->"%sC6%sC7Խ%u"
                                  |
:004364E1 68EC294500              push 004529EC
:004364E6 6A01                    push 00000001
:004364E8 E8482A0000              call 00438F35
:004364ED 83C414                  add esp, 00000014
:004364F0 85C0                    test eax, eax
:004364F2 0F8430000000            je 00436528
:004364F8 8B45F8                  mov eax, dword ptr [ebp-08]
:004364FB 50                      push eax
:004364FC E83E8BFEFF              call 0041F03F
:00436501 83C404                  add esp, 00000004
:00436504 A120CE4600              mov eax, dword ptr [0046CE20]
:00436509 50                      push eax
:0043650A 8B45E4                  mov eax, dword ptr [ebp-1C]
:0043650D 33C9                    xor ecx, ecx
:0043650F 8A8828CE4600            mov cl, byte ptr [eax+0046CE28]
:00436515 51                      push ecx
:00436516 E82CE6FFFF              call 00434B47
:0043651B 83C408                  add esp, 00000008
:0043651E 8B45E4                  mov eax, dword ptr [ebp-1C]
:00436521 C68028CE4600FF          mov byte ptr [eax+0046CE28], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004364F2(C)
|
:00436528 E92B050000              jmp 00436A58

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043646B(C), :00436475(C), :0043648C(C), :0043649C(C)
|
:0043652D 837DE850                cmp dword ptr [ebp-18], 00000050
:00436531 0F8506010000            jne 0043663D
:00436537 837D0802                cmp dword ptr [ebp+08], 00000002
:0043653B 0F85FC000000            jne 0043663D
:00436541 8B45E4                  mov eax, dword ptr [ebp-1C]
:00436544 33C9                    xor ecx, ecx
:00436546 8A8828CE4600            mov cl, byte ptr [eax+0046CE28]
:0043654C 81F9FF000000            cmp ecx, 000000FF
:00436552 0F84E5000000            je 0043663D
:00436558 8B45E4                  mov eax, dword ptr [ebp-1C]
:0043655B 33C9                    xor ecx, ecx
:0043655D 8A8828CE4600            mov cl, byte ptr [eax+0046CE28]
:00436563 51                      push ecx
:00436564 E805E0FFFF              call 0043456E
:00436569 83C404                  add esp, 00000004
:0043656C 8BD8                    mov ebx, eax
:0043656E B9D0A64600              mov ecx, 0046A6D0
:00436573 E8C88EFEFF              call 0041F440
:00436578 3BD8                    cmp ebx, eax
:0043657A 0F8620000000            jbe 004365A0
:00436580 6A0A                    push 0000000A
:00436582 B994A64600              mov ecx, 0046A694
:00436587 E8982AFEFF              call 00419024

* Possible StringData Ref from Data Obj ->"ƽ"
                                  |
:0043658C 680C2A4500              push 00452A0C
:00436591 6A03                    push 00000003
:00436593 E89D290000              call 00438F35
:00436598 83C408                  add esp, 00000008
:0043659B E998000000              jmp 00436638

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043657A(C)
|
:004365A0 B9D0A64600              mov ecx, 0046A6D0
:004365A5 E84085FEFF              call 0041EAEA
:004365AA 33C9                    xor ecx, ecx
:004365AC 8AC8                    mov cl, al
:004365AE 83F90F                  cmp ecx, 0000000F
:004365B1 0F8C20000000            jl 004365D7
:004365B7 6A0A                    push 0000000A
:004365B9 B994A64600              mov ecx, 0046A694
:004365BE E8612AFEFF              call 00419024

* Possible StringData Ref from Data Obj ->"ٴˡ"
                                  |
:004365C3 68182A4500              push 00452A18
:004365C8 6A03                    push 00000003
:004365CA E866290000              call 00438F35
:004365CF 83C408                  add esp, 00000008
:004365D2 E961000000              jmp 00436638

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004365B1(C)
|
:004365D7 6A03                    push 00000003
:004365D9 B994A64600              mov ecx, 0046A694
:004365DE E8412AFEFF              call 00419024
:004365E3 8B45E4                  mov eax, dword ptr [ebp-1C]
:004365E6 33C9                    xor ecx, ecx
:004365E8 8A8828CE4600            mov cl, byte ptr [eax+0046CE28]
:004365EE 51                      push ecx
:004365EF E81A80FEFF              call 0041E60E
:004365F4 83C404                  add esp, 00000004
:004365F7 50                      push eax

* Possible StringData Ref from Data Obj ->"%sš"
                                  |
:004365F8 68282A4500              push 00452A28
:004365FD 6A03                    push 00000003
:004365FF E831290000              call 00438F35
:00436604 83C40C                  add esp, 0000000C
:00436607 8B45E4                  mov eax, dword ptr [ebp-1C]
:0043660A 33C9                    xor ecx, ecx
:0043660C 8A8828CE4600            mov cl, byte ptr [eax+0046CE28]
:00436612 51                      push ecx
:00436613 E856DFFFFF              call 0043456E
:00436618 83C404                  add esp, 00000004
:0043661B 50                      push eax
:0043661C E878F7FFFF              call 00435D99
:00436621 83C404                  add esp, 00000004
:00436624 8B45E4                  mov eax, dword ptr [ebp-1C]
:00436627 8A8028CE4600            mov al, byte ptr [eax+0046CE28]
:0043662D 50                      push eax
:0043662E B9D0A64600              mov ecx, 0046A6D0
:00436633 E80A85FEFF              call 0041EB42

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043659B(U), :004365D2(U)
|
:00436638 E91B040000              jmp 00436A58

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00436531(C), :0043653B(C), :00436552(C)
|
:0043663D 837DE851                cmp dword ptr [ebp-18], 00000051
:00436641 0F85A2000000            jne 004366E9
:00436647 837D0800                cmp dword ptr [ebp+08], 00000000
:0043664B 0F8598000000            jne 004366E9
:00436651 8B45E4                  mov eax, dword ptr [ebp-1C]
:00436654 33C9                    xor ecx, ecx
:00436656 8A8828CE4600            mov cl, byte ptr [eax+0046CE28]
:0043665C 81F9FF000000            cmp ecx, 000000FF
:00436662 0F8481000000            je 004366E9
:00436668 8B45E4                  mov eax, dword ptr [ebp-1C]
:0043666B 33C9                    xor ecx, ecx
:0043666D 8A8828CE4600            mov cl, byte ptr [eax+0046CE28]
:00436673 51                      push ecx
:00436674 E83BDFFFFF              call 004345B4
:00436679 83C404                  add esp, 00000004
:0043667C 8945F8                  mov dword ptr [ebp-08], eax
:0043667F 8B45F8                  mov eax, dword ptr [ebp-08]
:00436682 50                      push eax
:00436683 8B45E4                  mov eax, dword ptr [ebp-1C]
:00436686 33C9                    xor ecx, ecx
:00436688 8A8828CE4600            mov cl, byte ptr [eax+0046CE28]
:0043668E 51                      push ecx
:0043668F E87A7FFEFF              call 0041E60E
:00436694 83C404                  add esp, 00000004
:00436697 50                      push eax

* Possible StringData Ref from Data Obj ->"C6%sC7%w"
                                  |
:00436698 68342A4500              push 00452A34
:0043669D 6A01                    push 00000001
:0043669F E891280000              call 00438F35
:004366A4 83C410                  add esp, 00000010
:004366A7 85C0                    test eax, eax
:004366A9 0F8435000000            je 004366E4
:004366AF 6A04                    push 00000004
:004366B1 B994A64600              mov ecx, 0046A694
:004366B6 E86929FEFF              call 00419024
:004366BB 8B45F8                  mov eax, dword ptr [ebp-08]
:004366BE 50                      push eax
:004366BF E87B89FEFF              call 0041F03F
:004366C4 83C404                  add esp, 00000004
:004366C7 68FF000000              push 000000FF
:004366CC 8B45E4                  mov eax, dword ptr [ebp-1C]
:004366CF 50                      push eax
:004366D0 B9D0A64600              mov ecx, 0046A6D0
:004366D5 E8C6080000              call 00436FA0
:004366DA 8B45E4                  mov eax, dword ptr [ebp-1C]
:004366DD C68028CE4600FF          mov byte ptr [eax+0046CE28], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004366A9(C)
|
:004366E4 E96F030000              jmp 00436A58

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00436641(C), :0043664B(C), :00436662(C)
|
:004366E9 837DE850                cmp dword ptr [ebp-18], 00000050
:004366ED 0F85E4000000            jne 004367D7
:004366F3 837D0801                cmp dword ptr [ebp+08], 00000001
:004366F7 0F85DA000000            jne 004367D7
:004366FD 8B45E4                  mov eax, dword ptr [ebp-1C]
:00436700 33C9                    xor ecx, ecx
:00436702 8A8828CE4600            mov cl, byte ptr [eax+0046CE28]
:00436708 81F9FF000000            cmp ecx, 000000FF
:0043670E 0F84C3000000            je 004367D7
:00436714 813D20CE4600FFFF0000    cmp dword ptr [0046CE20], 0000FFFF
:0043671E 0F84B3000000            je 004367D7
:00436724 B9D0A64600              mov ecx, 0046A6D0
:00436729 E8BC83FEFF              call 0041EAEA
:0043672E 33C9                    xor ecx, ecx
:00436730 8AC8                    mov cl, al
:00436732 83F90F                  cmp ecx, 0000000F
:00436735 0F8C20000000            jl 0043675B
:0043673B 6A0A                    push 0000000A
:0043673D B994A64600              mov ecx, 0046A694
:00436742 E8DD28FEFF              call 00419024

* Possible StringData Ref from Data Obj ->"ٴˡ"
                                  |
:00436747 684C2A4500              push 00452A4C
:0043674C 6A00                    push 00000000
:0043674E E8E2270000              call 00438F35
:00436753 83C408                  add esp, 00000008
:00436756 E977000000              jmp 004367D2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436735(C)
|
:0043675B 6A03                    push 00000003
:0043675D B994A64600              mov ecx, 0046A694
:00436762 E8BD28FEFF              call 00419024
:00436767 8B45E4                  mov eax, dword ptr [ebp-1C]
:0043676A 33C9                    xor ecx, ecx
:0043676C 8A8828CE4600            mov cl, byte ptr [eax+0046CE28]
:00436772 51                      push ecx
:00436773 E8967EFEFF              call 0041E60E
:00436778 83C404                  add esp, 00000004
:0043677B 50                      push eax
:0043677C A120CE4600              mov eax, dword ptr [0046CE20]
:00436781 50                      push eax
:00436782 E86156FDFF              call 0040BDE8
:00436787 83C404                  add esp, 00000004
:0043678A 50                      push eax

* Possible StringData Ref from Data Obj ->"%s%s"
                                  |
:0043678B 685C2A4500              push 00452A5C
:00436790 6A00                    push 00000000
:00436792 E89E270000              call 00438F35
:00436797 83C410                  add esp, 00000010
:0043679A A120CE4600              mov eax, dword ptr [0046CE20]
:0043679F 50                      push eax
:004367A0 8B45E4                  mov eax, dword ptr [ebp-1C]
:004367A3 33C9                    xor ecx, ecx
:004367A5 8A8828CE4600            mov cl, byte ptr [eax+0046CE28]
:004367AB 51                      push ecx
:004367AC E896E3FFFF              call 00434B47
:004367B1 83C408                  add esp, 00000008
:004367B4 8B45E4                  mov eax, dword ptr [ebp-1C]
:004367B7 8A8028CE4600            mov al, byte ptr [eax+0046CE28]
:004367BD 50                      push eax
:004367BE B9D0A64600              mov ecx, 0046A6D0
:004367C3 E87A83FEFF              call 0041EB42
:004367C8 8B45E4                  mov eax, dword ptr [ebp-1C]
:004367CB C68028CE4600FF          mov byte ptr [eax+0046CE28], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436756(U)
|
:004367D2 E981020000              jmp 00436A58

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004366ED(C), :004366F7(C), :0043670E(C), :0043671E(C)
|
:004367D7 837DE840                cmp dword ptr [ebp-18], 00000040
:004367DB 0F8377020000            jnb 00436A58
:004367E1 8B45E4                  mov eax, dword ptr [ebp-1C]
:004367E4 33C9                    xor ecx, ecx
:004367E6 8A8828CE4600            mov cl, byte ptr [eax+0046CE28]
:004367EC 81F9FF000000            cmp ecx, 000000FF
:004367F2 0F8460020000            je 00436A58
:004367F8 8B45E8                  mov eax, dword ptr [ebp-18]
:004367FB 33C9                    xor ecx, ecx
:004367FD 668B0C4570524500        mov cx, word ptr [2*eax+00455270]
:00436805 81F9FFFF0000            cmp ecx, 0000FFFF
:0043680B 0F8447020000            je 00436A58
:00436811 837D0802                cmp dword ptr [ebp+08], 00000002
:00436815 0F8548000000            jne 00436863
:0043681B 8B45E4                  mov eax, dword ptr [ebp-1C]
:0043681E 33C9                    xor ecx, ecx
:00436820 8A8828CE4600            mov cl, byte ptr [eax+0046CE28]
:00436826 51                      push ecx
:00436827 E842DDFFFF              call 0043456E
:0043682C 83C404                  add esp, 00000004
:0043682F 8BD8                    mov ebx, eax
:00436831 B9D0A64600              mov ecx, 0046A6D0
:00436836 E8058CFEFF              call 0041F440
:0043683B 3BD8                    cmp ebx, eax
:0043683D 0F8620000000            jbe 00436863
:00436843 6A0A                    push 0000000A
:00436845 B994A64600              mov ecx, 0046A694
:0043684A E8D527FEFF              call 00419024

* Possible StringData Ref from Data Obj ->"ƽ㡣"
                                  |
:0043684F 686C2A4500              push 00452A6C
:00436854 6A00                    push 00000000
:00436856 E8DA260000              call 00438F35
:0043685B 83C408                  add esp, 00000008
:0043685E E9F5010000              jmp 00436A58

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00436815(C), :0043683D(C)
|
:00436863 837D0801                cmp dword ptr [ebp+08], 00000001
:00436867 0F859E000000            jne 0043690B
:0043686D 8B45E8                  mov eax, dword ptr [ebp-18]
:00436870 33C9                    xor ecx, ecx
:00436872 668B0C4570524500        mov cx, word ptr [2*eax+00455270]
:0043687A 3B0D20CE4600            cmp ecx, dword ptr [0046CE20]
:00436880 0F8585000000            jne 0043690B
:00436886 8B45E4                  mov eax, dword ptr [ebp-1C]
:00436889 33C9                    xor ecx, ecx
:0043688B 8A8828CE4600            mov cl, byte ptr [eax+0046CE28]
:00436891 51                      push ecx
:00436892 E8BA59FDFF              call 0040C251
:00436897 83C404                  add esp, 00000004
:0043689A 33C9                    xor ecx, ecx
:0043689C 8AC8                    mov cl, al
:0043689E 83F903                  cmp ecx, 00000003
:004368A1 0F8520000000            jne 004368C7
:004368A7 6A02                    push 00000002
:004368A9 B994A64600              mov ecx, 0046A694
:004368AE E87127FEFF              call 00419024

* Possible StringData Ref from Data Obj ->"ֻսʹá"
                                  |
:004368B3 68782A4500              push 00452A78
:004368B8 6A00                    push 00000000
:004368BA E876260000              call 00438F35
:004368BF 83C408                  add esp, 00000008
:004368C2 E93F000000              jmp 00436906

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004368A1(C)
|
:004368C7 6A20                    push 00000020
:004368C9 B994A64600              mov ecx, 0046A694
:004368CE E85127FEFF              call 00419024
:004368D3 8B45E4                  mov eax, dword ptr [ebp-1C]
:004368D6 33C9                    xor ecx, ecx
:004368D8 8A8828CE4600            mov cl, byte ptr [eax+0046CE28]
:004368DE 51                      push ecx
:004368DF E82A7DFEFF              call 0041E60E
:004368E4 83C404                  add esp, 00000004
:004368E7 50                      push eax
:004368E8 A120CE4600              mov eax, dword ptr [0046CE20]
:004368ED 50                      push eax
:004368EE E8F554FDFF              call 0040BDE8
:004368F3 83C404                  add esp, 00000004
:004368F6 50                      push eax

* Possible StringData Ref from Data Obj ->"%sõ%s"
                                  |
:004368F7 688C2A4500              push 00452A8C
:004368FC 6A00                    push 00000000
:004368FE E832260000              call 00438F35
:00436903 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004368C2(U)
|
:00436906 E94D010000              jmp 00436A58

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00436867(C), :00436880(C)
|
:0043690B 8B45E8                  mov eax, dword ptr [ebp-18]
:0043690E 33C9                    xor ecx, ecx
:00436910 668B0C4570524500        mov cx, word ptr [2*eax+00455270]
:00436918 51                      push ecx
:00436919 E8ABE2FFFF              call 00434BC9
:0043691E 83C404                  add esp, 00000004
:00436921 85C0                    test eax, eax
:00436923 0F8520000000            jne 00436949
:00436929 6A0A                    push 0000000A
:0043692B B994A64600              mov ecx, 0046A694
:00436930 E8EF26FEFF              call 00419024

* Possible StringData Ref from Data Obj ->"ٳˡ"
                                  |
:00436935 689C2A4500              push 00452A9C
:0043693A 6A00                    push 00000000
:0043693C E8F4250000              call 00438F35
:00436941 83C408                  add esp, 00000008
:00436944 E90F010000              jmp 00436A58

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436923(C)
|
:00436949 8B45E8                  mov eax, dword ptr [ebp-18]
:0043694C 50                      push eax
:0043694D 8B45E4                  mov eax, dword ptr [ebp-1C]
:00436950 50                      push eax
:00436951 E87FF5FFFF              call 00435ED5
:00436956 83C408                  add esp, 00000008
:00436959 85C0                    test eax, eax
:0043695B 0F84F7000000            je 00436A58
:00436961 6A04                    push 00000004
:00436963 B994A64600              mov ecx, 0046A694
:00436968 E8B726FEFF              call 00419024
:0043696D 8B45E8                  mov eax, dword ptr [ebp-18]
:00436970 33C9                    xor ecx, ecx
:00436972 668B0C4570524500        mov cx, word ptr [2*eax+00455270]
:0043697A 51                      push ecx
:0043697B E86854FDFF              call 0040BDE8
:00436980 83C404                  add esp, 00000004
:00436983 50                      push eax
:00436984 8B45E4                  mov eax, dword ptr [ebp-1C]
:00436987 33C9                    xor ecx, ecx
:00436989 8A8828CE4600            mov cl, byte ptr [eax+0046CE28]
:0043698F 51                      push ecx
:00436990 E8797CFEFF              call 0041E60E
:00436995 83C404                  add esp, 00000004
:00436998 50                      push eax

* Possible StringData Ref from Data Obj ->"%s%sˡ"
                                  |
:00436999 68AC2A4500              push 00452AAC
:0043699E 6A00                    push 00000000
:004369A0 E890250000              call 00438F35
:004369A5 83C410                  add esp, 00000010
:004369A8 8B45E8                  mov eax, dword ptr [ebp-18]
:004369AB 33C9                    xor ecx, ecx
:004369AD 668B0C4570524500        mov cx, word ptr [2*eax+00455270]
:004369B5 51                      push ecx
:004369B6 8B45E4                  mov eax, dword ptr [ebp-1C]
:004369B9 33C9                    xor ecx, ecx
:004369BB 8A8828CE4600            mov cl, byte ptr [eax+0046CE28]
:004369C1 51                      push ecx
:004369C2 E846E2FFFF              call 00434C0D
:004369C7 83C408                  add esp, 00000008
:004369CA 85C0                    test eax, eax
:004369CC 0F8486000000            je 00436A58
:004369D2 837D0802                cmp dword ptr [ebp+08], 00000002
:004369D6 0F851D000000            jne 004369F9
:004369DC 8B45E4                  mov eax, dword ptr [ebp-1C]
:004369DF 33C9                    xor ecx, ecx
:004369E1 8A8828CE4600            mov cl, byte ptr [eax+0046CE28]
:004369E7 51                      push ecx
:004369E8 E881DBFFFF              call 0043456E
:004369ED 83C404                  add esp, 00000004
:004369F0 50                      push eax
:004369F1 E8A3F3FFFF              call 00435D99
:004369F6 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004369D6(C)
|
:004369F9 837D0800                cmp dword ptr [ebp+08], 00000000
:004369FD 0F840A000000            je 00436A0D
:00436A03 837D0801                cmp dword ptr [ebp+08], 00000001
:00436A07 0F854B000000            jne 00436A58

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004369FD(C)
|
:00436A0D 837D0801                cmp dword ptr [ebp+08], 00000001
:00436A11 0F851A000000            jne 00436A31
:00436A17 A120CE4600              mov eax, dword ptr [0046CE20]
:00436A1C 50                      push eax
:00436A1D 8B45E4                  mov eax, dword ptr [ebp-1C]
:00436A20 33C9                    xor ecx, ecx
:00436A22 8A8828CE4600            mov cl, byte ptr [eax+0046CE28]
:00436A28 51                      push ecx
:00436A29 E819E1FFFF              call 00434B47
:00436A2E 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436A11(C)
|
:00436A31 837D0800                cmp dword ptr [ebp+08], 00000000
:00436A35 0F8513000000            jne 00436A4E
:00436A3B 68FF000000              push 000000FF
:00436A40 8B45E4                  mov eax, dword ptr [ebp-1C]
:00436A43 50                      push eax
:00436A44 B9D0A64600              mov ecx, 0046A6D0
:00436A49 E852050000              call 00436FA0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436A35(C)
|
:00436A4E 8B45E4                  mov eax, dword ptr [ebp-1C]
:00436A51 C68028CE4600FF          mov byte ptr [eax+0046CE28], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00436528(U), :00436638(U), :004366E4(U), :004367D2(U), :004367DB(C)
|:004367F2(C), :0043680B(C), :0043685E(U), :00436906(U), :00436944(U)
|:0043695B(C), :004369CC(C), :00436A07(C)
|
:00436A58 8B4508                  mov eax, dword ptr [ebp+08]
:00436A5B 50                      push eax
:00436A5C E851000000              call 00436AB2
:00436A61 83C404                  add esp, 00000004
:00436A64 E82EE0FFFF              call 00434A97

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004362D9(C), :004362E6(C)
|
:00436A69 833D8053450002          cmp dword ptr [00455380], 00000002
:00436A70 0F8528000000            jne 00436A9E
:00436A76 6A01                    push 00000001
:00436A78 B994A64600              mov ecx, 0046A694
:00436A7D E8A225FEFF              call 00419024

* Possible StringData Ref from Data Obj ->"𣿡"
                                  |
:00436A82 68BC2A4500              push 00452ABC
:00436A87 6A01                    push 00000001
:00436A89 E8A7240000              call 00438F35
:00436A8E 83C408                  add esp, 00000008
:00436A91 85C0                    test eax, eax
:00436A93 0F8405000000            je 00436A9E
:00436A99 E905000000              jmp 00436AA3

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00436A70(C), :00436A93(C)
|
:00436A9E E9ADF6FFFF              jmp 00436150

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004361DD(U), :00436A99(U)
|
:00436AA3 B8FFFF0000              mov eax, 0000FFFF
:00436AA8 E900000000              jmp 00436AAD

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004362C8(U), :00436AA8(U)
|
:00436AAD 5F                      pop edi
:00436AAE 5E                      pop esi
:00436AAF 5B                      pop ebx
:00436AB0 C9                      leave
:00436AB1 C3                      ret



* Referenced by a CALL at Addresses:
|:0043613A   , :00436A5C   , :00436CA6   
|
:00436AB2 55                      push ebp
:00436AB3 8BEC                    mov ebp, esp
:00436AB5 83EC10                  sub esp, 00000010
:00436AB8 53                      push ebx
:00436AB9 56                      push esi
:00436ABA 57                      push edi
:00436ABB E8D704FFFF              call 00426F97
:00436AC0 C745F800000000          mov [ebp-08], 00000000
:00436AC7 8B45F8                  mov eax, dword ptr [ebp-08]
:00436ACA 8945F4                  mov dword ptr [ebp-0C], eax
:00436ACD E903000000              jmp 00436AD5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436B1E(U)
|
:00436AD2 FF45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436ACD(U)
|
:00436AD5 837DF40F                cmp dword ptr [ebp-0C], 0000000F
:00436AD9 0F8344000000            jnb 00436B23
:00436ADF 8B45F4                  mov eax, dword ptr [ebp-0C]
:00436AE2 8A8028CE4600            mov al, byte ptr [eax+0046CE28]
:00436AE8 8845FC                  mov byte ptr [ebp-04], al
:00436AEB 33C0                    xor eax, eax
:00436AED 8A45FC                  mov al, byte ptr [ebp-04]
:00436AF0 3DFF000000              cmp eax, 000000FF
:00436AF5 0F8403000000            je 00436AFE
:00436AFB FF45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436AF5(C)
|
:00436AFE 8B4508                  mov eax, dword ptr [ebp+08]
:00436B01 83E802                  sub eax, 00000002
:00436B04 83F801                  cmp eax, 00000001
:00436B07 1BC0                    sbb eax, eax
:00436B09 F7D8                    neg eax
:00436B0B 50                      push eax
:00436B0C 8B45F4                  mov eax, dword ptr [ebp-0C]
:00436B0F 50                      push eax
:00436B10 33C0                    xor eax, eax
:00436B12 8A45FC                  mov al, byte ptr [ebp-04]
:00436B15 50                      push eax
:00436B16 E8E9DAFFFF              call 00434604
:00436B1B 83C40C                  add esp, 0000000C
:00436B1E E9AFFFFFFF              jmp 00436AD2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436AD9(C)
|
:00436B23 688A010000              push 0000018A
:00436B28 6A3C                    push 0000003C
:00436B2A B910BC4600              mov ecx, 0046BC10
:00436B2F E8D390FEFF              call 0041FC07
:00436B34 837D0801                cmp dword ptr [ebp+08], 00000001
:00436B38 0F8510000000            jne 00436B4E
:00436B3E 813D20CE4600FFFF0000    cmp dword ptr [0046CE20], 0000FFFF
:00436B48 0F841E000000            je 00436B6C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436B38(C)
|
:00436B4E 68FFFF0000              push 0000FFFF
:00436B53 6A10                    push 00000010
:00436B55 6890000000              push 00000090
:00436B5A 688A010000              push 0000018A
:00436B5F 68E0010000              push 000001E0
:00436B64 E8A106FFFF              call 0042720A
:00436B69 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436B48(C)
|
:00436B6C 8B4508                  mov eax, dword ptr [ebp+08]
:00436B6F 8945F0                  mov dword ptr [ebp-10], eax
:00436B72 E987000000              jmp 00436BFE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436C02(C)
|
:00436B77 8B45F8                  mov eax, dword ptr [ebp-08]
:00436B7A 50                      push eax

* Possible StringData Ref from Data Obj ->"M4Ʒ%3dM0"
                                  |
:00436B7B 68D02A4500              push 00452AD0
:00436B80 6810BC4600              push 0046BC10
:00436B85 E8999FFEFF              call 00420B23
:00436B8A 83C40C                  add esp, 0000000C
:00436B8D E98F000000              jmp 00436C21

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436C16(C)
|
:00436B92 8B45F8                  mov eax, dword ptr [ebp-08]
:00436B95 50                      push eax

* Possible StringData Ref from Data Obj ->"M4ԹƷ%3dM0"
                                  |
:00436B96 68E82A4500              push 00452AE8
:00436B9B 6810BC4600              push 0046BC10
:00436BA0 E87E9FFEFF              call 00420B23
:00436BA5 83C40C                  add esp, 0000000C
:00436BA8 E974000000              jmp 00436C21

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436C0C(C)
|
:00436BAD 813D20CE4600FFFF0000    cmp dword ptr [0046CE20], 0000FFFF
:00436BB7 0F8437000000            je 00436BF4
:00436BBD A120CE4600              mov eax, dword ptr [0046CE20]
:00436BC2 50                      push eax
:00436BC3 E82052FDFF              call 0040BDE8
:00436BC8 83C404                  add esp, 00000004
:00436BCB 50                      push eax

* Possible StringData Ref from Data Obj ->"M4%6sı"
                                  |
:00436BCC 68002B4500              push 00452B00
:00436BD1 6810BC4600              push 0046BC10
:00436BD6 E8489FFEFF              call 00420B23
:00436BDB 83C40C                  add esp, 0000000C
:00436BDE 8B45F8                  mov eax, dword ptr [ebp-08]
:00436BE1 50                      push eax

* Possible StringData Ref from Data Obj ->"%3dM0"
                                  |
:00436BE2 68102B4500              push 00452B10
:00436BE7 6810BC4600              push 0046BC10
:00436BEC E8329FFEFF              call 00420B23
:00436BF1 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436BB7(C)
|
:00436BF4 E928000000              jmp 00436C21
:00436BF9 E923000000              jmp 00436C21

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436B72(U)
|
:00436BFE 837DF000                cmp dword ptr [ebp-10], 00000000
:00436C02 0F846FFFFFFF            je 00436B77
:00436C08 837DF001                cmp dword ptr [ebp-10], 00000001
:00436C0C 0F849BFFFFFF            je 00436BAD
:00436C12 837DF002                cmp dword ptr [ebp-10], 00000002
:00436C16 0F8476FFFFFF            je 00436B92
:00436C1C E900000000              jmp 00436C21

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00436B8D(U), :00436BA8(U), :00436BF4(U), :00436BF9(U), :00436C1C(U)
|
:00436C21 E89103FFFF              call 00426FB7
:00436C26 E900000000              jmp 00436C2B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436C26(U)
|
:00436C2B 5F                      pop edi
:00436C2C 5E                      pop esi
:00436C2D 5B                      pop ebx
:00436C2E C9                      leave
:00436C2F C3                      ret



* Referenced by a CALL at Addresses:
|:004362AB   , :0043633C   
|
:00436C30 55                      push ebp
:00436C31 8BEC                    mov ebp, esp
:00436C33 83EC0C                  sub esp, 0000000C
:00436C36 53                      push ebx
:00436C37 56                      push esi
:00436C38 57                      push edi
:00436C39 C745F400000000          mov [ebp-0C], 00000000
:00436C40 C745F800000000          mov [ebp-08], 00000000
:00436C47 E903000000              jmp 00436C4F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436C9D(U)
|
:00436C4C FF45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436C47(U)
|
:00436C4F 837DF80F                cmp dword ptr [ebp-08], 0000000F
:00436C53 0F8349000000            jnb 00436CA2
:00436C59 8B45F8                  mov eax, dword ptr [ebp-08]
:00436C5C 50                      push eax
:00436C5D A120CE4600              mov eax, dword ptr [0046CE20]
:00436C62 50                      push eax
:00436C63 E88BDEFFFF              call 00434AF3
:00436C68 83C408                  add esp, 00000008
:00436C6B 33C9                    xor ecx, ecx
:00436C6D 8AC8                    mov cl, al
:00436C6F 894DFC                  mov dword ptr [ebp-04], ecx
:00436C72 817DFCFF000000          cmp dword ptr [ebp-04], 000000FF
:00436C79 0F8414000000            je 00436C93
:00436C7F 8A45FC                  mov al, byte ptr [ebp-04]
:00436C82 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00436C85 888128CE4600            mov byte ptr [ecx+0046CE28], al
:00436C8B FF45F4                  inc [ebp-0C]
:00436C8E E90A000000              jmp 00436C9D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436C79(C)
|
:00436C93 8B45F8                  mov eax, dword ptr [ebp-08]
:00436C96 C68028CE4600FF          mov byte ptr [eax+0046CE28], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436C8E(U)
|
:00436C9D E9AAFFFFFF              jmp 00436C4C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436C53(C)
|
:00436CA2 8B4508                  mov eax, dword ptr [ebp+08]
:00436CA5 50                      push eax
:00436CA6 E807FEFFFF              call 00436AB2
:00436CAB 83C404                  add esp, 00000004
:00436CAE 8B4508                  mov eax, dword ptr [ebp+08]
:00436CB1 50                      push eax
:00436CB2 E8F8EBFFFF              call 004358AF
:00436CB7 83C404                  add esp, 00000004
:00436CBA E900000000              jmp 00436CBF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436CBA(U)
|
:00436CBF 5F                      pop edi
:00436CC0 5E                      pop esi
:00436CC1 5B                      pop ebx
:00436CC2 C9                      leave
:00436CC3 C3                      ret



* Referenced by a CALL at Address:
|:00415CCC   
|
:00436CC4 55                      push ebp
:00436CC5 8BEC                    mov ebp, esp
:00436CC7 83EC1C                  sub esp, 0000001C
:00436CCA 53                      push ebx
:00436CCB 56                      push esi
:00436CCC 57                      push edi
:00436CCD C645FC00                mov [ebp-04], 00
:00436CD1 C70520CE4600FFFF0000    mov dword ptr [0046CE20], 0000FFFF
:00436CDB 6A07                    push 00000007
:00436CDD E8F3DF0000              call 00444CD5
:00436CE2 83C404                  add esp, 00000004
:00436CE5 68F6090000              push 000009F6
:00436CEA E852EDFEFF              call 00425A41
:00436CEF 83C404                  add esp, 00000004
:00436CF2 E829020000              call 00436F20
:00436CF7 85C0                    test eax, eax
:00436CF9 0F8545000000            jne 00436D44
:00436CFF B900AA4600              mov ecx, 0046AA00
:00436D04 E827ACFCFF              call 00401930
:00436D09 33C9                    xor ecx, ecx
:00436D0B 8AC8                    mov cl, al
:00436D0D 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:00436D10 8D0C89                  lea ecx, dword ptr [ecx+4*ecx]
:00436D13 81C1D0254500            add ecx, 004525D0
:00436D19 894DE4                  mov dword ptr [ebp-1C], ecx
:00436D1C 68FE030000              push 000003FE
:00436D21 E85182FEFF              call 0041EF77
:00436D26 83C404                  add esp, 00000004
:00436D29 8945F4                  mov dword ptr [ebp-0C], eax
:00436D2C 6A20                    push 00000020
:00436D2E 8B45F4                  mov eax, dword ptr [ebp-0C]
:00436D31 50                      push eax

* Possible StringData Ref from Data Obj ->"ǵϰ壬
ҪЩʲô"
                                  |
:00436D32 681C2B4500              push 00452B1C
:00436D37 E835A4FCFF              call 00401171
:00436D3C 83C40C                  add esp, 0000000C
:00436D3F E940000000              jmp 00436D84

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436CF9(C)
|
:00436D44 B900AA4600              mov ecx, 0046AA00
:00436D49 E8E2ABFCFF              call 00401930
:00436D4E 33C9                    xor ecx, ecx
:00436D50 8AC8                    mov cl, al
:00436D52 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:00436D55 8D0C89                  lea ecx, dword ptr [ecx+4*ecx]
:00436D58 81C148244500            add ecx, 00452448
:00436D5E 894DE4                  mov dword ptr [ebp-1C], ecx
:00436D61 68FD030000              push 000003FD
:00436D66 E80C82FEFF              call 0041EF77
:00436D6B 83C404                  add esp, 00000004
:00436D6E 8945F4                  mov dword ptr [ebp-0C], eax
:00436D71 6A20                    push 00000020
:00436D73 8B45F4                  mov eax, dword ptr [ebp-0C]
:00436D76 50                      push eax

* Possible StringData Ref from Data Obj ->"ϰ壬
ҪЩʲô"
                                  |
:00436D77 68402B4500              push 00452B40
:00436D7C E8F0A3FCFF              call 00401171
:00436D81 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436D3F(U)
|
:00436D84 E88DE3FFFF              call 00435116
:00436D89 E870FFFEFF              call 00426CFE
:00436D8E E846EEFEFF              call 00425BD9
:00436D93 6A02                    push 00000002
:00436D95 E8B7E3FFFF              call 00435151
:00436D9A 83C404                  add esp, 00000004
:00436D9D E86AF0FFFF              call 00435E0C
:00436DA2 E8D601FFFF              call 00426F7D
:00436DA7 C745E802000000          mov [ebp-18], 00000002
:00436DAE 8B45E8                  mov eax, dword ptr [ebp-18]
:00436DB1 8945EC                  mov dword ptr [ebp-14], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436EB2(C)
|
:00436DB4 837DE800                cmp dword ptr [ebp-18], 00000000
:00436DB8 0F8596000000            jne 00436E54
:00436DBE B9D0A64600              mov ecx, 0046A6D0
:00436DC3 E8227DFEFF              call 0041EAEA
:00436DC8 33C9                    xor ecx, ecx
:00436DCA 8AC8                    mov cl, al
:00436DCC 894DF0                  mov dword ptr [ebp-10], ecx
:00436DCF 837DF000                cmp dword ptr [ebp-10], 00000000
:00436DD3 0F8543000000            jne 00436E1C
:00436DD9 E809070000              call 004374E7
:00436DDE 6A02                    push 00000002
:00436DE0 B994A64600              mov ecx, 0046A694
:00436DE5 E83A22FEFF              call 00419024

* Possible StringData Ref from Data Obj ->"ûдŵƷ"
                                  |
:00436DEA 68642B4500              push 00452B64
:00436DEF 6A00                    push 00000000
:00436DF1 E83F210000              call 00438F35
:00436DF6 83C408                  add esp, 00000008
:00436DF9 E8E9060000              call 004374E7
:00436DFE 8B45EC                  mov eax, dword ptr [ebp-14]
:00436E01 8945E8                  mov dword ptr [ebp-18], eax
:00436E04 8B45E8                  mov eax, dword ptr [ebp-18]
:00436E07 50                      push eax
:00436E08 E89FDAFFFF              call 004348AC
:00436E0D 83C404                  add esp, 00000004
:00436E10 C6057C534500FF          mov byte ptr [0045537C], FF
:00436E17 E938000000              jmp 00436E54

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436DD3(C)
|
:00436E1C C645FC00                mov [ebp-04], 00
:00436E20 E903000000              jmp 00436E28

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436E4F(U)
|
:00436E25 FE45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436E20(U)
|
:00436E28 33C0                    xor eax, eax
:00436E2A 8A45FC                  mov al, byte ptr [ebp-04]
:00436E2D 83F80F                  cmp eax, 0000000F
:00436E30 0F8D1E000000            jnl 00436E54
:00436E36 8B45FC                  mov eax, dword ptr [ebp-04]
:00436E39 50                      push eax
:00436E3A B9D0A64600              mov ecx, 0046A6D0
:00436E3F E88C010000              call 00436FD0
:00436E44 33C9                    xor ecx, ecx
:00436E46 8A4DFC                  mov cl, byte ptr [ebp-04]
:00436E49 888128CE4600            mov byte ptr [ecx+0046CE28], al
:00436E4F E9D1FFFFFF              jmp 00436E25

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00436DB8(C), :00436E17(U), :00436E30(C)
|
:00436E54 837DE802                cmp dword ptr [ebp-18], 00000002
:00436E58 0F8538000000            jne 00436E96
:00436E5E 8B45E4                  mov eax, dword ptr [ebp-1C]
:00436E61 8945F8                  mov dword ptr [ebp-08], eax
:00436E64 C645FC00                mov [ebp-04], 00
:00436E68 E906000000              jmp 00436E73

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436E91(U)
|
:00436E6D FE45FC                  inc [ebp-04]
:00436E70 FF45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436E68(U)
|
:00436E73 33C0                    xor eax, eax
:00436E75 8A45FC                  mov al, byte ptr [ebp-04]
:00436E78 83F80F                  cmp eax, 0000000F
:00436E7B 0F8D15000000            jnl 00436E96
:00436E81 8B45F8                  mov eax, dword ptr [ebp-08]
:00436E84 8A00                    mov al, byte ptr [eax]
:00436E86 33C9                    xor ecx, ecx
:00436E88 8A4DFC                  mov cl, byte ptr [ebp-04]
:00436E8B 888128CE4600            mov byte ptr [ecx+0046CE28], al
:00436E91 E9D7FFFFFF              jmp 00436E6D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00436E58(C), :00436E7B(C)
|
:00436E96 8B45E8                  mov eax, dword ptr [ebp-18]
:00436E99 8945EC                  mov dword ptr [ebp-14], eax
:00436E9C 8B45E8                  mov eax, dword ptr [ebp-18]
:00436E9F 50                      push eax
:00436EA0 E841F2FFFF              call 004360E6
:00436EA5 83C404                  add esp, 00000004
:00436EA8 8945E8                  mov dword ptr [ebp-18], eax
:00436EAB 817DE8FFFF0000          cmp dword ptr [ebp-18], 0000FFFF
:00436EB2 0F85FCFEFFFF            jne 00436DB4
:00436EB8 E841FEFEFF              call 00426CFE
:00436EBD 6A00                    push 00000000
:00436EBF E807ECFEFF              call 00425ACB
:00436EC4 83C404                  add esp, 00000004
:00436EC7 E83ADDFDFF              call 00414C06
:00436ECC 6A01                    push 00000001
:00436ECE E849FDFEFF              call 00426C1C
:00436ED3 83C404                  add esp, 00000004
:00436ED6 E83CA3FCFF              call 00401217
:00436EDB E89D00FFFF              call 00426F7D
:00436EE0 6A20                    push 00000020
:00436EE2 8B45F4                  mov eax, dword ptr [ebp-0C]
:00436EE5 50                      push eax

* Possible StringData Ref from Data Obj ->"£뾡ܷԸ"
                                  |
:00436EE6 68782B4500              push 00452B78
:00436EEB E881A2FCFF              call 00401171
:00436EF0 83C40C                  add esp, 0000000C
:00436EF3 C70564F94600FFFFFFFF    mov dword ptr [0046F964], FFFFFFFF
:00436EFD C705982B4500FFFF0000    mov dword ptr [00452B98], 0000FFFF
:00436F07 681A090000              push 0000091A
:00436F0C E830EBFEFF              call 00425A41
:00436F11 83C404                  add esp, 00000004
:00436F14 33C0                    xor eax, eax
:00436F16 E900000000              jmp 00436F1B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436F16(U)
|
:00436F1B 5F                      pop edi
:00436F1C 5E                      pop esi
:00436F1D 5B                      pop ebx
:00436F1E C9                      leave
:00436F1F C3                      ret



* Referenced by a CALL at Address:
|:00436CF2   
|
:00436F20 55                      push ebp
:00436F21 8BEC                    mov ebp, esp
:00436F23 53                      push ebx
:00436F24 56                      push esi
:00436F25 57                      push edi
:00436F26 B900AA4600              mov ecx, 0046AA00
:00436F2B E8508EFDFF              call 0040FD80
:00436F30 33C9                    xor ecx, ecx
:00436F32 8AC8                    mov cl, al
:00436F34 83F903                  cmp ecx, 00000003
:00436F37 0F850A000000            jne 00436F47
:00436F3D B801000000              mov eax, 00000001
:00436F42 E902000000              jmp 00436F49

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436F37(C)
|
:00436F47 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436F42(U)
|
:00436F49 E900000000              jmp 00436F4E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436F49(U)
|
:00436F4E 5F                      pop edi
:00436F4F 5E                      pop esi
:00436F50 5B                      pop ebx
:00436F51 C9                      leave
:00436F52 C3                      ret


:00436F53 CC                      int 03
:00436F54 CC                      int 03
:00436F55 CC                      int 03
:00436F56 CC                      int 03
:00436F57 CC                      int 03
:00436F58 CC                      int 03
:00436F59 CC                      int 03
:00436F5A CC                      int 03
:00436F5B CC                      int 03
:00436F5C CC                      int 03
:00436F5D CC                      int 03
:00436F5E CC                      int 03
:00436F5F CC                      int 03

* Referenced by a CALL at Addresses:
|:00434597   , :004345E0   
|
:00436F60 55                      push ebp
:00436F61 8BEC                    mov ebp, esp
:00436F63 83EC04                  sub esp, 00000004
:00436F66 53                      push ebx
:00436F67 56                      push esi
:00436F68 57                      push edi
:00436F69 894DFC                  mov dword ptr [ebp-04], ecx
:00436F6C 8B45FC                  mov eax, dword ptr [ebp-04]
:00436F6F 8A400E                  mov al, byte ptr [eax+0E]
:00436F72 E900000000              jmp 00436F77

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436F72(U)
|
:00436F77 5F                      pop edi
:00436F78 5E                      pop esi
:00436F79 5B                      pop ebx
:00436F7A C9                      leave
:00436F7B C3                      ret


:00436F7C CC                      int 03
:00436F7D CC                      int 03
:00436F7E CC                      int 03
:00436F7F CC                      int 03

* Referenced by a CALL at Addresses:
|:00436034   , :004360B9   
|
:00436F80 55                      push ebp
:00436F81 8BEC                    mov ebp, esp
:00436F83 83EC04                  sub esp, 00000004
:00436F86 53                      push ebx
:00436F87 56                      push esi
:00436F88 57                      push edi
:00436F89 894DFC                  mov dword ptr [ebp-04], ecx
:00436F8C 8B45FC                  mov eax, dword ptr [ebp-04]
:00436F8F 8A4010                  mov al, byte ptr [eax+10]
:00436F92 E900000000              jmp 00436F97

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436F92(U)
|
:00436F97 5F                      pop edi
:00436F98 5E                      pop esi
:00436F99 5B                      pop ebx
:00436F9A C9                      leave
:00436F9B C3                      ret


:00436F9C CC                      int 03
:00436F9D CC                      int 03
:00436F9E CC                      int 03
:00436F9F CC                      int 03

* Referenced by a CALL at Addresses:
|:004366D5   , :00436A49   
|
:00436FA0 55                      push ebp
:00436FA1 8BEC                    mov ebp, esp
:00436FA3 83EC04                  sub esp, 00000004
:00436FA6 53                      push ebx
:00436FA7 56                      push esi
:00436FA8 57                      push edi
:00436FA9 894DFC                  mov dword ptr [ebp-04], ecx
:00436FAC 8A450C                  mov al, byte ptr [ebp+0C]
:00436FAF 8B4D08                  mov ecx, dword ptr [ebp+08]
:00436FB2 8B55FC                  mov edx, dword ptr [ebp-04]
:00436FB5 88441118                mov byte ptr [ecx+edx+18], al
:00436FB9 E900000000              jmp 00436FBE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436FB9(U)
|
:00436FBE 5F                      pop edi
:00436FBF 5E                      pop esi
:00436FC0 5B                      pop ebx
:00436FC1 C9                      leave
:00436FC2 C20800                  ret 0008


:00436FC5 CC                      int 03
:00436FC6 CC                      int 03
:00436FC7 CC                      int 03
:00436FC8 CC                      int 03
:00436FC9 CC                      int 03
:00436FCA CC                      int 03
:00436FCB CC                      int 03
:00436FCC CC                      int 03
:00436FCD CC                      int 03
:00436FCE CC                      int 03
:00436FCF CC                      int 03

* Referenced by a CALL at Address:
|:00436E3F   
|
:00436FD0 55                      push ebp
:00436FD1 8BEC                    mov ebp, esp
:00436FD3 83EC04                  sub esp, 00000004
:00436FD6 53                      push ebx
:00436FD7 56                      push esi
:00436FD8 57                      push edi
:00436FD9 894DFC                  mov dword ptr [ebp-04], ecx
:00436FDC 33C0                    xor eax, eax
:00436FDE 8A4508                  mov al, byte ptr [ebp+08]
:00436FE1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00436FE4 8A440818                mov al, byte ptr [eax+ecx+18]
:00436FE8 E900000000              jmp 00436FED

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436FE8(U)
|
:00436FED 5F                      pop edi
:00436FEE 5E                      pop esi
:00436FEF 5B                      pop ebx
:00436FF0 C9                      leave
:00436FF1 C20400                  ret 0004


:00436FF4 CC                      int 03
:00436FF5 CC                      int 03
:00436FF6 CC                      int 03
:00436FF7 CC                      int 03
:00436FF8 CC                      int 03
:00436FF9 CC                      int 03
:00436FFA CC                      int 03
:00436FFB CC                      int 03
:00436FFC CC                      int 03
:00436FFD CC                      int 03
:00436FFE CC                      int 03
:00436FFF CC                      int 03
:00437000 55                      push ebp
:00437001 8BEC                    mov ebp, esp
:00437003 53                      push ebx
:00437004 56                      push esi
:00437005 57                      push edi
:00437006 E80A000000              call 00437015
:0043700B E900000000              jmp 00437010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043700B(U)
|
:00437010 5F                      pop edi
:00437011 5E                      pop esi
:00437012 5B                      pop ebx
:00437013 C9                      leave
:00437014 C3                      ret



* Referenced by a CALL at Address:
|:00437006   
|
:00437015 55                      push ebp
:00437016 8BEC                    mov ebp, esp
:00437018 53                      push ebx
:00437019 56                      push esi
:0043701A 57                      push edi
:0043701B B980F94600              mov ecx, 0046F980
:00437020 E8ABBAFFFF              call 00432AD0
:00437025 E900000000              jmp 0043702A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437025(U)
|
:0043702A 5F                      pop edi
:0043702B 5E                      pop esi
:0043702C 5B                      pop ebx
:0043702D C9                      leave
:0043702E C3                      ret


:0043702F 55                      push ebp
:00437030 8BEC                    mov ebp, esp
:00437032 53                      push ebx
:00437033 56                      push esi
:00437034 57                      push edi
:00437035 E80A000000              call 00437044
:0043703A E900000000              jmp 0043703F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043703A(U)
|
:0043703F 5F                      pop edi
:00437040 5E                      pop esi
:00437041 5B                      pop ebx
:00437042 C9                      leave
:00437043 C3                      ret



* Referenced by a CALL at Address:
|:00437035   
|
:00437044 55                      push ebp
:00437045 8BEC                    mov ebp, esp
:00437047 53                      push ebx
:00437048 56                      push esi
:00437049 57                      push edi
:0043704A B9E8E44600              mov ecx, 0046E4E8
:0043704F E87CBAFFFF              call 00432AD0
:00437054 E900000000              jmp 00437059

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437054(U)
|
:00437059 5F                      pop edi
:0043705A 5E                      pop esi
:0043705B 5B                      pop ebx
:0043705C C9                      leave
:0043705D C3                      ret


:0043705E 55                      push ebp
:0043705F 8BEC                    mov ebp, esp
:00437061 53                      push ebx
:00437062 56                      push esi
:00437063 57                      push edi
:00437064 E80A000000              call 00437073
:00437069 E900000000              jmp 0043706E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437069(U)
|
:0043706E 5F                      pop edi
:0043706F 5E                      pop esi
:00437070 5B                      pop ebx
:00437071 C9                      leave
:00437072 C3                      ret



* Referenced by a CALL at Address:
|:00437064   
|
:00437073 55                      push ebp
:00437074 8BEC                    mov ebp, esp
:00437076 53                      push ebx
:00437077 56                      push esi
:00437078 57                      push edi
:00437079 B9D0E44600              mov ecx, 0046E4D0
:0043707E E84DBAFFFF              call 00432AD0
:00437083 E900000000              jmp 00437088

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437083(U)
|
:00437088 5F                      pop edi
:00437089 5E                      pop esi
:0043708A 5B                      pop ebx
:0043708B C9                      leave
:0043708C C3                      ret


:0043708D 55                      push ebp
:0043708E 8BEC                    mov ebp, esp
:00437090 53                      push ebx
:00437091 56                      push esi
:00437092 57                      push edi
:00437093 E80A000000              call 004370A2
:00437098 E900000000              jmp 0043709D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437098(U)
|
:0043709D 5F                      pop edi
:0043709E 5E                      pop esi
:0043709F 5B                      pop ebx
:004370A0 C9                      leave
:004370A1 C3                      ret



* Referenced by a CALL at Address:
|:00437093   
|
:004370A2 55                      push ebp
:004370A3 8BEC                    mov ebp, esp
:004370A5 53                      push ebx
:004370A6 56                      push esi
:004370A7 57                      push edi
:004370A8 B950F94600              mov ecx, 0046F950
:004370AD E81EBAFFFF              call 00432AD0
:004370B2 E900000000              jmp 004370B7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004370B2(U)
|
:004370B7 5F                      pop edi
:004370B8 5E                      pop esi
:004370B9 5B                      pop ebx
:004370BA C9                      leave
:004370BB C3                      ret


:004370BC 55                      push ebp
:004370BD 8BEC                    mov ebp, esp
:004370BF 53                      push ebx
:004370C0 56                      push esi
:004370C1 57                      push edi
:004370C2 E80A000000              call 004370D1
:004370C7 E900000000              jmp 004370CC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004370C7(U)
|
:004370CC 5F                      pop edi
:004370CD 5E                      pop esi
:004370CE 5B                      pop ebx
:004370CF C9                      leave
:004370D0 C3                      ret



* Referenced by a CALL at Address:
|:004370C2   
|
:004370D1 55                      push ebp
:004370D2 8BEC                    mov ebp, esp
:004370D4 53                      push ebx
:004370D5 56                      push esi
:004370D6 57                      push edi
:004370D7 B918E54600              mov ecx, 0046E518
:004370DC E8EFB9FFFF              call 00432AD0
:004370E1 E900000000              jmp 004370E6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004370E1(U)
|
:004370E6 5F                      pop edi
:004370E7 5E                      pop esi
:004370E8 5B                      pop ebx
:004370E9 C9                      leave
:004370EA C3                      ret


:004370EB 55                      push ebp
:004370EC 8BEC                    mov ebp, esp
:004370EE 53                      push ebx
:004370EF 56                      push esi
:004370F0 57                      push edi
:004370F1 E80A000000              call 00437100
:004370F6 E900000000              jmp 004370FB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004370F6(U)
|
:004370FB 5F                      pop edi
:004370FC 5E                      pop esi
:004370FD 5B                      pop ebx
:004370FE C9                      leave
:004370FF C3                      ret



* Referenced by a CALL at Address:
|:004370F1   
|
:00437100 55                      push ebp
:00437101 8BEC                    mov ebp, esp
:00437103 53                      push ebx
:00437104 56                      push esi
:00437105 57                      push edi
:00437106 B968F94600              mov ecx, 0046F968
:0043710B E8C0B9FFFF              call 00432AD0
:00437110 E900000000              jmp 00437115

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437110(U)
|
:00437115 5F                      pop edi
:00437116 5E                      pop esi
:00437117 5B                      pop ebx
:00437118 C9                      leave
:00437119 C3                      ret


:0043711A 55                      push ebp
:0043711B 8BEC                    mov ebp, esp
:0043711D 53                      push ebx
:0043711E 56                      push esi
:0043711F 57                      push edi
:00437120 E80A000000              call 0043712F
:00437125 E900000000              jmp 0043712A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437125(U)
|
:0043712A 5F                      pop edi
:0043712B 5E                      pop esi
:0043712C 5B                      pop ebx
:0043712D C9                      leave
:0043712E C3                      ret



* Referenced by a CALL at Address:
|:00437120   
|
:0043712F 55                      push ebp
:00437130 8BEC                    mov ebp, esp
:00437132 53                      push ebx
:00437133 56                      push esi
:00437134 57                      push edi
:00437135 B938F94600              mov ecx, 0046F938
:0043713A E891B9FFFF              call 00432AD0
:0043713F E900000000              jmp 00437144

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043713F(U)
|
:00437144 5F                      pop edi
:00437145 5E                      pop esi
:00437146 5B                      pop ebx
:00437147 C9                      leave
:00437148 C3                      ret


:00437149 55                      push ebp
:0043714A 8BEC                    mov ebp, esp
:0043714C 53                      push ebx
:0043714D 56                      push esi
:0043714E 57                      push edi
:0043714F E80A000000              call 0043715E
:00437154 E900000000              jmp 00437159

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437154(U)
|
:00437159 5F                      pop edi
:0043715A 5E                      pop esi
:0043715B 5B                      pop ebx
:0043715C C9                      leave
:0043715D C3                      ret



* Referenced by a CALL at Address:
|:0043714F   
|
:0043715E 55                      push ebp
:0043715F 8BEC                    mov ebp, esp
:00437161 53                      push ebx
:00437162 56                      push esi
:00437163 57                      push edi
:00437164 B9A0E44600              mov ecx, 0046E4A0
:00437169 E862B9FFFF              call 00432AD0
:0043716E E900000000              jmp 00437173

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043716E(U)
|
:00437173 5F                      pop edi
:00437174 5E                      pop esi
:00437175 5B                      pop ebx
:00437176 C9                      leave
:00437177 C3                      ret


:00437178 55                      push ebp
:00437179 8BEC                    mov ebp, esp
:0043717B 53                      push ebx
:0043717C 56                      push esi
:0043717D 57                      push edi
:0043717E E80A000000              call 0043718D
:00437183 E900000000              jmp 00437188

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437183(U)
|
:00437188 5F                      pop edi
:00437189 5E                      pop esi
:0043718A 5B                      pop ebx
:0043718B C9                      leave
:0043718C C3                      ret



* Referenced by a CALL at Address:
|:0043717E   
|
:0043718D 55                      push ebp
:0043718E 8BEC                    mov ebp, esp
:00437190 53                      push ebx
:00437191 56                      push esi
:00437192 57                      push edi
:00437193 B940CF4600              mov ecx, 0046CF40
:00437198 E833B9FFFF              call 00432AD0
:0043719D E900000000              jmp 004371A2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043719D(U)
|
:004371A2 5F                      pop edi
:004371A3 5E                      pop esi
:004371A4 5B                      pop ebx
:004371A5 C9                      leave
:004371A6 C3                      ret


:004371A7 55                      push ebp
:004371A8 8BEC                    mov ebp, esp
:004371AA 53                      push ebx
:004371AB 56                      push esi
:004371AC 57                      push edi
:004371AD E80A000000              call 004371BC
:004371B2 E900000000              jmp 004371B7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004371B2(U)
|
:004371B7 5F                      pop edi
:004371B8 5E                      pop esi
:004371B9 5B                      pop ebx
:004371BA C9                      leave
:004371BB C3                      ret



* Referenced by a CALL at Address:
|:004371AD   
|
:004371BC 55                      push ebp
:004371BD 8BEC                    mov ebp, esp
:004371BF 53                      push ebx
:004371C0 56                      push esi
:004371C1 57                      push edi
:004371C2 B900E54600              mov ecx, 0046E500
:004371C7 E804B9FFFF              call 00432AD0
:004371CC E900000000              jmp 004371D1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004371CC(U)
|
:004371D1 5F                      pop edi
:004371D2 5E                      pop esi
:004371D3 5B                      pop ebx
:004371D4 C9                      leave
:004371D5 C3                      ret


:004371D6 55                      push ebp
:004371D7 8BEC                    mov ebp, esp
:004371D9 53                      push ebx
:004371DA 56                      push esi
:004371DB 57                      push edi
:004371DC E80A000000              call 004371EB
:004371E1 E900000000              jmp 004371E6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004371E1(U)
|
:004371E6 5F                      pop edi
:004371E7 5E                      pop esi
:004371E8 5B                      pop ebx
:004371E9 C9                      leave
:004371EA C3                      ret



* Referenced by a CALL at Address:
|:004371DC   
|
:004371EB 55                      push ebp
:004371EC 8BEC                    mov ebp, esp
:004371EE 53                      push ebx
:004371EF 56                      push esi
:004371F0 57                      push edi
:004371F1 B9B8E44600              mov ecx, 0046E4B8
:004371F6 E8D5B8FFFF              call 00432AD0
:004371FB E900000000              jmp 00437200

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004371FB(U)
|
:00437200 5F                      pop edi
:00437201 5E                      pop esi
:00437202 5B                      pop ebx
:00437203 C9                      leave
:00437204 C3                      ret


:00437205 55                      push ebp
:00437206 8BEC                    mov ebp, esp
:00437208 53                      push ebx
:00437209 56                      push esi
:0043720A 57                      push edi
:0043720B E80A000000              call 0043721A
:00437210 E900000000              jmp 00437215

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437210(U)
|
:00437215 5F                      pop edi
:00437216 5E                      pop esi
:00437217 5B                      pop ebx
:00437218 C9                      leave
:00437219 C3                      ret



* Referenced by a CALL at Address:
|:0043720B   
|
:0043721A 55                      push ebp
:0043721B 8BEC                    mov ebp, esp
:0043721D 53                      push ebx
:0043721E 56                      push esi
:0043721F 57                      push edi
:00437220 B980E34600              mov ecx, 0046E380
:00437225 E8A6B8FFFF              call 00432AD0
:0043722A E900000000              jmp 0043722F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043722A(U)
|
:0043722F 5F                      pop edi
:00437230 5E                      pop esi
:00437231 5B                      pop ebx
:00437232 C9                      leave
:00437233 C3                      ret


:00437234 55                      push ebp
:00437235 8BEC                    mov ebp, esp
:00437237 53                      push ebx
:00437238 56                      push esi
:00437239 57                      push edi
:0043723A E80A000000              call 00437249
:0043723F E900000000              jmp 00437244

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043723F(U)
|
:00437244 5F                      pop edi
:00437245 5E                      pop esi
:00437246 5B                      pop ebx
:00437247 C9                      leave
:00437248 C3                      ret



* Referenced by a CALL at Address:
|:0043723A   
|
:00437249 55                      push ebp
:0043724A 8BEC                    mov ebp, esp
:0043724C 53                      push ebx
:0043724D 56                      push esi
:0043724E 57                      push edi
:0043724F B998F94600              mov ecx, 0046F998
:00437254 E877B8FFFF              call 00432AD0
:00437259 E900000000              jmp 0043725E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437259(U)
|
:0043725E 5F                      pop edi
:0043725F 5E                      pop esi
:00437260 5B                      pop ebx
:00437261 C9                      leave
:00437262 C3                      ret


:00437263 55                      push ebp
:00437264 8BEC                    mov ebp, esp
:00437266 53                      push ebx
:00437267 56                      push esi
:00437268 57                      push edi
:00437269 E80A000000              call 00437278
:0043726E E900000000              jmp 00437273

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043726E(U)
|
:00437273 5F                      pop edi
:00437274 5E                      pop esi
:00437275 5B                      pop ebx
:00437276 C9                      leave
:00437277 C3                      ret



* Referenced by a CALL at Address:
|:00437269   
|
:00437278 55                      push ebp
:00437279 8BEC                    mov ebp, esp
:0043727B 53                      push ebx
:0043727C 56                      push esi
:0043727D 57                      push edi
:0043727E B938CE4600              mov ecx, 0046CE38
:00437283 E8E823FDFF              call 00409670
:00437288 E900000000              jmp 0043728D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437288(U)
|
:0043728D 5F                      pop edi
:0043728E 5E                      pop esi
:0043728F 5B                      pop ebx
:00437290 C9                      leave
:00437291 C3                      ret


:00437292 55                      push ebp
:00437293 8BEC                    mov ebp, esp
:00437295 53                      push ebx
:00437296 56                      push esi
:00437297 57                      push edi
:00437298 E80A000000              call 004372A7
:0043729D E900000000              jmp 004372A2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043729D(U)
|
:004372A2 5F                      pop edi
:004372A3 5E                      pop esi
:004372A4 5B                      pop ebx
:004372A5 C9                      leave
:004372A6 C3                      ret



* Referenced by a CALL at Address:
|:00437298   
|
:004372A7 55                      push ebp
:004372A8 8BEC                    mov ebp, esp
:004372AA 53                      push ebx
:004372AB 56                      push esi
:004372AC 57                      push edi
:004372AD B998E34600              mov ecx, 0046E398
:004372B2 E8B923FDFF              call 00409670
:004372B7 E900000000              jmp 004372BC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004372B7(U)
|
:004372BC 5F                      pop edi
:004372BD 5E                      pop esi
:004372BE 5B                      pop ebx
:004372BF C9                      leave
:004372C0 C3                      ret


:004372C1 CC                      int 03
:004372C2 CC                      int 03
:004372C3 CC                      int 03
:004372C4 CC                      int 03
:004372C5 CC                      int 03
:004372C6 CC                      int 03
:004372C7 CC                      int 03
:004372C8 CC                      int 03
:004372C9 CC                      int 03
:004372CA CC                      int 03
:004372CB CC                      int 03
:004372CC CC                      int 03
:004372CD CC                      int 03
:004372CE CC                      int 03
:004372CF CC                      int 03
:004372D0 55                      push ebp
:004372D1 8BEC                    mov ebp, esp
:004372D3 53                      push ebx
:004372D4 56                      push esi
:004372D5 57                      push edi
:004372D6 E80A000000              call 004372E5
:004372DB E900000000              jmp 004372E0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004372DB(U)
|
:004372E0 5F                      pop edi
:004372E1 5E                      pop esi
:004372E2 5B                      pop ebx
:004372E3 C9                      leave
:004372E4 C3                      ret



* Referenced by a CALL at Address:
|:004372D6   
|
:004372E5 55                      push ebp
:004372E6 8BEC                    mov ebp, esp
:004372E8 53                      push ebx
:004372E9 56                      push esi
:004372EA 57                      push edi
:004372EB E900000000              jmp 004372F0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004372EB(U)
|
:004372F0 5F                      pop edi
:004372F1 5E                      pop esi
:004372F2 5B                      pop ebx
:004372F3 C9                      leave
:004372F4 C3                      ret



* Referenced by a CALL at Address:
|:004091C3   
|
:004372F5 55                      push ebp
:004372F6 8BEC                    mov ebp, esp
:004372F8 83EC04                  sub esp, 00000004
:004372FB 53                      push ebx
:004372FC 56                      push esi
:004372FD 57                      push edi
:004372FE 894DFC                  mov dword ptr [ebp-04], ecx
:00437301 E864F10000              call 0044646A
:00437306 8B4D08                  mov ecx, dword ptr [ebp+08]
:00437309 03C8                    add ecx, eax
:0043730B 8B45FC                  mov eax, dword ptr [ebp-04]
:0043730E 8908                    mov dword ptr [eax], ecx
:00437310 E900000000              jmp 00437315

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437310(U)
|
:00437315 5F                      pop edi
:00437316 5E                      pop esi
:00437317 5B                      pop ebx
:00437318 C9                      leave
:00437319 C20400                  ret 0004



* Referenced by a CALL at Address:
|:004186BF   
|
:0043731C 55                      push ebp
:0043731D 8BEC                    mov ebp, esp
:0043731F 83EC08                  sub esp, 00000008
:00437322 53                      push ebx
:00437323 56                      push esi
:00437324 57                      push edi
:00437325 894DF8                  mov dword ptr [ebp-08], ecx
:00437328 E83DF10000              call 0044646A
:0043732D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00437330 3B01                    cmp eax, dword ptr [ecx]
:00437332 0F8C0D000000            jl 00437345
:00437338 8B45F8                  mov eax, dword ptr [ebp-08]
:0043733B 8B00                    mov eax, dword ptr [eax]
:0043733D 8945FC                  mov dword ptr [ebp-04], eax
:00437340 E908000000              jmp 0043734D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437332(C)
|
:00437345 E820F10000              call 0044646A
:0043734A 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437340(U)
|
:0043734D 8B45F8                  mov eax, dword ptr [ebp-08]
:00437350 8B00                    mov eax, dword ptr [eax]
:00437352 2B45FC                  sub eax, dword ptr [ebp-04]
:00437355 E900000000              jmp 0043735A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437355(U)
|
:0043735A 5F                      pop edi
:0043735B 5E                      pop esi
:0043735C 5B                      pop ebx
:0043735D C9                      leave
:0043735E C3                      ret



* Referenced by a CALL at Addresses:
|:00435579   , :004356EB   , :0043573D   
|
:0043735F 55                      push ebp
:00437360 8BEC                    mov ebp, esp
:00437362 53                      push ebx
:00437363 56                      push esi
:00437364 57                      push edi
:00437365 E800F10000              call 0044646A
:0043736A 2B0540324500            sub eax, dword ptr [00453240]
:00437370 E900000000              jmp 00437375

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437370(U)
|
:00437375 5F                      pop edi
:00437376 5E                      pop esi
:00437377 5B                      pop ebx
:00437378 C9                      leave
:00437379 C3                      ret



* Referenced by a CALL at Address:
|:00435574   
|
:0043737A 55                      push ebp
:0043737B 8BEC                    mov ebp, esp
:0043737D 53                      push ebx
:0043737E 56                      push esi
:0043737F 57                      push edi
:00437380 E8E5F00000              call 0044646A
:00437385 A340324500              mov dword ptr [00453240], eax
:0043738A E900000000              jmp 0043738F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043738A(U)
|
:0043738F 5F                      pop edi
:00437390 5E                      pop esi
:00437391 5B                      pop ebx
:00437392 C9                      leave
:00437393 C3                      ret



* Referenced by a CALL at Addresses:
|:00425513   , :00437555   , :004375C9   
|
:00437394 55                      push ebp
:00437395 8BEC                    mov ebp, esp
:00437397 53                      push ebx
:00437398 56                      push esi
:00437399 57                      push edi
:0043739A 6A01                    push 00000001
:0043739C E85EEF0000              call 004462FF
:004373A1 83C404                  add esp, 00000004
:004373A4 E900000000              jmp 004373A9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004373A4(U)
|
:004373A9 5F                      pop edi
:004373AA 5E                      pop esi
:004373AB 5B                      pop ebx
:004373AC C9                      leave
:004373AD C3                      ret



* Referenced by a CALL at Addresses:
|:00426939   , :00427DB3   , :00437550   , :004375C4   , :004379FD   
|:00437E62   , :00438FA0   , :00439029   , :00439685   , :0043C76B   
|:00440A47   
|
:004373AE 55                      push ebp
:004373AF 8BEC                    mov ebp, esp
:004373B1 53                      push ebx
:004373B2 56                      push esi
:004373B3 57                      push edi
:004373B4 6A02                    push 00000002
:004373B6 E844EF0000              call 004462FF
:004373BB 83C404                  add esp, 00000004
:004373BE E900000000              jmp 004373C3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004373BE(U)
|
:004373C3 5F                      pop edi
:004373C4 5E                      pop esi
:004373C5 5B                      pop ebx
:004373C6 C9                      leave
:004373C7 C3                      ret



* Referenced by a CALL at Addresses:
|:004024EB   , :0040252C   , :00405169   , :004051A5   , :00408D62   
|:00408DA4   , :0042280E   , :0042295F   , :00422D48   , :00422EC9   
|:004234A8   , :00423E9B   , :00423EE9   , :004245AA   , :004247FF   
|:0042832E   , :0042D6D1   , :0042DA22   , :0042DD59   , :0043744B   
|:00439D50   , :00439DA6   , :0043B8EF   , :0043ECF4   
|
:004373C8 55                      push ebp
:004373C9 8BEC                    mov ebp, esp
:004373CB 53                      push ebx
:004373CC 56                      push esi
:004373CD 57                      push edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004373E0(U)
|
:004373CE B9B0FA4600              mov ecx, 0046FAB0
:004373D3 E8D812FEFF              call 004186B0
:004373D8 85C0                    test eax, eax
:004373DA 0F8505000000            jne 004373E5
:004373E0 E9E9FFFFFF              jmp 004373CE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004373DA(C)
|
:004373E5 E900000000              jmp 004373EA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004373E5(U)
|
:004373EA 5F                      pop edi
:004373EB 5E                      pop esi
:004373EC 5B                      pop ebx
:004373ED C9                      leave
:004373EE C3                      ret



* Referenced by a CALL at Addresses:
|:0042AAFB   , :0042AB73   
|
:004373EF 55                      push ebp
:004373F0 8BEC                    mov ebp, esp
:004373F2 53                      push ebx
:004373F3 56                      push esi
:004373F4 57                      push edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437419(U)
|
:004373F5 B9B0FA4600              mov ecx, 0046FAB0
:004373FA E8B112FEFF              call 004186B0
:004373FF 85C0                    test eax, eax
:00437401 0F8517000000            jne 0043741E
:00437407 B988534500              mov ecx, 00455388
:0043740C E8ABA9FCFF              call 00401DBC
:00437411 85C0                    test eax, eax
:00437413 0F8505000000            jne 0043741E
:00437419 E9D7FFFFFF              jmp 004373F5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00437401(C), :00437413(C)
|
:0043741E E900000000              jmp 00437423

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043741E(U)
|
:00437423 5F                      pop edi
:00437424 5E                      pop esi
:00437425 5B                      pop ebx
:00437426 C9                      leave
:00437427 C3                      ret



* Referenced by a CALL at Addresses:
|:0040ED70   , :0040EF60   , :0040EFC4   , :004374CE   
|
:00437428 55                      push ebp
:00437429 8BEC                    mov ebp, esp
:0043742B 53                      push ebx
:0043742C 56                      push esi
:0043742D 57                      push edi
:0043742E 837D0800                cmp dword ptr [ebp+08], 00000000
:00437432 0F8505000000            jne 0043743D
:00437438 E918000000              jmp 00437455

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437432(C)
|
:0043743D 8B4508                  mov eax, dword ptr [ebp+08]
:00437440 50                      push eax
:00437441 B9B0FA4600              mov ecx, 0046FAB0
:00437446 E8651DFDFF              call 004091B0
:0043744B E878FFFFFF              call 004373C8
:00437450 E900000000              jmp 00437455

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00437438(U), :00437450(U)
|
:00437455 5F                      pop edi
:00437456 5E                      pop esi
:00437457 5B                      pop ebx
:00437458 C9                      leave
:00437459 C3                      ret



* Referenced by a CALL at Addresses:
|:0041DA9B   , :0041DAF7   , :00422914   , :00424775   , :00428258   
|:0042AAF3   , :0042AB6B   , :004376EC   , :0043772D   , :0043AC9C   
|:0043ACE2   , :0043AD4E   , :0043ADC7   , :0043E42B   , :0043E486   
|:0043EC7C   , :00442CE7   , :00442D71   
|
:0043745A 55                      push ebp
:0043745B 8BEC                    mov ebp, esp
:0043745D 53                      push ebx
:0043745E 56                      push esi
:0043745F 57                      push edi
:00437460 8B4508                  mov eax, dword ptr [ebp+08]
:00437463 8D0440                  lea eax, dword ptr [eax+2*eax]
:00437466 03C0                    add eax, eax
:00437468 50                      push eax
:00437469 B9B0FA4600              mov ecx, 0046FAB0
:0043746E E83D1DFDFF              call 004091B0
:00437473 E900000000              jmp 00437478

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437473(U)
|
:00437478 5F                      pop edi
:00437479 5E                      pop esi
:0043747A 5B                      pop ebx
:0043747B C9                      leave
:0043747C C3                      ret



* Referenced by a CALL at Addresses:
|:0041600E   , :004374B2   , :004374ED   , :0043751E   , :00437583   
|:004375F7   , :004376F4   , :0043E433   , :0043EF48   , :0043FB91   
|
:0043747D 55                      push ebp
:0043747E 8BEC                    mov ebp, esp
:00437480 53                      push ebx
:00437481 56                      push esi
:00437482 57                      push edi
:00437483 B988534500              mov ecx, 00455388
:00437488 E82FA9FCFF              call 00401DBC
:0043748D E900000000              jmp 00437492

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043748D(U)
|
:00437492 5F                      pop edi
:00437493 5E                      pop esi
:00437494 5B                      pop ebx
:00437495 C9                      leave
:00437496 C3                      ret


:00437497 55                      push ebp
:00437498 8BEC                    mov ebp, esp
:0043749A 83EC04                  sub esp, 00000004
:0043749D 53                      push ebx
:0043749E 56                      push esi
:0043749F 57                      push edi
:004374A0 E903000000              jmp 004374A8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004374D6(U)
|
:004374A5 FF4D08                  dec [ebp+08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004374A0(U)
|
:004374A8 837D0800                cmp dword ptr [ebp+08], 00000000
:004374AC 0F8429000000            je 004374DB
:004374B2 E8C6FFFFFF              call 0043747D
:004374B7 8945FC                  mov dword ptr [ebp-04], eax
:004374BA 837DFC00                cmp dword ptr [ebp-04], 00000000
:004374BE 0F8408000000            je 004374CC
:004374C4 8B45FC                  mov eax, dword ptr [ebp-04]
:004374C7 E916000000              jmp 004374E2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004374BE(C)
|
:004374CC 6A01                    push 00000001
:004374CE E855FFFFFF              call 00437428
:004374D3 83C404                  add esp, 00000004
:004374D6 E9CAFFFFFF              jmp 004374A5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004374AC(C)
|
:004374DB 33C0                    xor eax, eax
:004374DD E900000000              jmp 004374E2

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004374C7(U), :004374DD(U)
|
:004374E2 5F                      pop edi
:004374E3 5E                      pop esi
:004374E4 5B                      pop ebx
:004374E5 C9                      leave
:004374E6 C3                      ret



* Referenced by a CALL at Addresses:
|:0040370E   , :00403FF7   , :0040401C   , :00404311   , :00404424   
|:00406ACA   , :0040B69D   , :0040B6EA   , :0040B755   , :0040CEDC   
|:0041DF6B   , :0041DF8D   , :0041E6CB   , :004211B4   , :0042121D   
|:004213B1   , :00421423   , :00421B6D   , :004250D5   , :00425897   
|:0042AB00   , :0042AB78   , :00435675   , :00436232   , :00436344   
|:00436DD9   , :00436DF9   , :00437519   , :00437535   , :00437590   
|:004376E5   , :0043773A   , :00438421   , :00438991   , :00438A25   
|:00438F9B   , :004394D4   , :00439676   , :0043AD47   , :0043AE17   
|:0043C5A6   , :0043C5D5   , :0043E3D1   , :0043E3DE   , :0043EFA7   
|:0043FBA8   , :00440136   , :00443FED   
|
:004374E7 55                      push ebp
:004374E8 8BEC                    mov ebp, esp
:004374EA 53                      push ebx
:004374EB 56                      push esi
:004374EC 57                      push edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004374FA(U)
|
:004374ED E88BFFFFFF              call 0043747D
:004374F2 85C0                    test eax, eax
:004374F4 0F8405000000            je 004374FF
:004374FA E9EEFFFFFF              jmp 004374ED

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004374F4(C)
|
:004374FF E900000000              jmp 00437504

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004374FF(U)
|
:00437504 5F                      pop edi
:00437505 5E                      pop esi
:00437506 5B                      pop ebx
:00437507 C9                      leave
:00437508 C3                      ret



* Referenced by a CALL at Addresses:
|:0041677D   , :004167A5   , :00424CDF   
|
:00437509 55                      push ebp
:0043750A 8BEC                    mov ebp, esp
:0043750C 83EC04                  sub esp, 00000004
:0043750F 53                      push ebx
:00437510 56                      push esi
:00437511 57                      push edi
:00437512 C745FCFFFF0000          mov [ebp-04], 0000FFFF
:00437519 E8C9FFFFFF              call 004374E7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437530(U)
|
:0043751E E85AFFFFFF              call 0043747D
:00437523 8945FC                  mov dword ptr [ebp-04], eax
:00437526 837DFC00                cmp dword ptr [ebp-04], 00000000
:0043752A 0F8505000000            jne 00437535
:00437530 E9E9FFFFFF              jmp 0043751E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043752A(C)
|
:00437535 E8ADFFFFFF              call 004374E7
:0043753A 8B45FC                  mov eax, dword ptr [ebp-04]
:0043753D E900000000              jmp 00437542

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043753D(U)
|
:00437542 5F                      pop edi
:00437543 5E                      pop esi
:00437544 5B                      pop ebx
:00437545 C9                      leave
:00437546 C3                      ret



* Referenced by a CALL at Address:
|:0043763C   
|
:00437547 55                      push ebp
:00437548 8BEC                    mov ebp, esp
:0043754A 83EC04                  sub esp, 00000004
:0043754D 53                      push ebx
:0043754E 56                      push esi
:0043754F 57                      push edi
:00437550 E859FEFFFF              call 004373AE
:00437555 E83AFEFFFF              call 00437394
:0043755A 8B4508                  mov eax, dword ptr [ebp+08]
:0043755D 8D0440                  lea eax, dword ptr [eax+2*eax]
:00437560 03C0                    add eax, eax
:00437562 8945FC                  mov dword ptr [ebp-04], eax
:00437565 E903000000              jmp 0043756D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004375AC(U)
|
:0043756A FF4DFC                  dec [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437565(U)
|
:0043756D 837DFC00                cmp dword ptr [ebp-04], 00000000
:00437571 0F843A000000            je 004375B1
:00437577 6A01                    push 00000001
:00437579 B9B0FA4600              mov ecx, 0046FAB0
:0043757E E82D1CFDFF              call 004091B0
:00437583 E8F5FEFFFF              call 0043747D
:00437588 85C0                    test eax, eax
:0043758A 0F8405000000            je 00437595
:00437590 E852FFFFFF              call 004374E7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043758A(C), :004375A7(U)
|
:00437595 B9B0FA4600              mov ecx, 0046FAB0
:0043759A E81111FEFF              call 004186B0
:0043759F 85C0                    test eax, eax
:004375A1 0F8505000000            jne 004375AC
:004375A7 E9E9FFFFFF              jmp 00437595

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004375A1(C)
|
:004375AC E9B9FFFFFF              jmp 0043756A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437571(C)
|
:004375B1 E900000000              jmp 004375B6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004375B1(U)
|
:004375B6 5F                      pop edi
:004375B7 5E                      pop esi
:004375B8 5B                      pop ebx
:004375B9 C9                      leave
:004375BA C3                      ret



* Referenced by a CALL at Addresses:
|:004024F2   , :00402533   , :00405170   , :004051AC   , :00408D69   
|:00408DAB   , :00419004   , :0041DAED   , :00422846   , :00422966   
|:00423EA2   , :00423EF0   , :0042CA00   , :0042CBBA   , :0042CBE2   
|:0043765B   , :00437D06   , :0043C763   , :0043EF22   
|
:004375BB 55                      push ebp
:004375BC 8BEC                    mov ebp, esp
:004375BE 83EC04                  sub esp, 00000004
:004375C1 53                      push ebx
:004375C2 56                      push esi
:004375C3 57                      push edi
:004375C4 E8E5FDFFFF              call 004373AE
:004375C9 E8C6FDFFFF              call 00437394
:004375CE 8B4508                  mov eax, dword ptr [ebp+08]
:004375D1 8D0440                  lea eax, dword ptr [eax+2*eax]
:004375D4 03C0                    add eax, eax
:004375D6 8945FC                  mov dword ptr [ebp-04], eax
:004375D9 E903000000              jmp 004375E1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437620(U)
|
:004375DE FF4DFC                  dec [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004375D9(U)
|
:004375E1 837DFC00                cmp dword ptr [ebp-04], 00000000
:004375E5 0F843A000000            je 00437625
:004375EB 6A01                    push 00000001
:004375ED B9B0FA4600              mov ecx, 0046FAB0
:004375F2 E8B91BFDFF              call 004091B0
:004375F7 E881FEFFFF              call 0043747D
:004375FC 85C0                    test eax, eax
:004375FE 0F8405000000            je 00437609
:00437604 E921000000              jmp 0043762A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004375FE(C), :0043761B(U)
|
:00437609 B9B0FA4600              mov ecx, 0046FAB0
:0043760E E89D10FEFF              call 004186B0
:00437613 85C0                    test eax, eax
:00437615 0F8505000000            jne 00437620
:0043761B E9E9FFFFFF              jmp 00437609

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437615(C)
|
:00437620 E9B9FFFFFF              jmp 004375DE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004375E5(C)
|
:00437625 E900000000              jmp 0043762A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00437604(U), :00437625(U)
|
:0043762A 5F                      pop edi
:0043762B 5E                      pop esi
:0043762C 5B                      pop ebx
:0043762D C9                      leave
:0043762E C3                      ret



* Referenced by a CALL at Addresses:
|:00425190   , :00425440   , :004254CE   
|
:0043762F 55                      push ebp
:00437630 8BEC                    mov ebp, esp
:00437632 53                      push ebx
:00437633 56                      push esi
:00437634 57                      push edi
:00437635 8B4508                  mov eax, dword ptr [ebp+08]
:00437638 C1E003                  shl eax, 03
:0043763B 50                      push eax
:0043763C E806FFFFFF              call 00437547
:00437641 83C404                  add esp, 00000004
:00437644 E900000000              jmp 00437649

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437644(U)
|
:00437649 5F                      pop edi
:0043764A 5E                      pop esi
:0043764B 5B                      pop ebx
:0043764C C9                      leave
:0043764D C3                      ret



* Referenced by a CALL at Addresses:
|:00408EA2   , :0041FFA8   , :004258B8   , :00438F19   , :004393CD   
|:004396A9   
|
:0043764E 55                      push ebp
:0043764F 8BEC                    mov ebp, esp
:00437651 53                      push ebx
:00437652 56                      push esi
:00437653 57                      push edi
:00437654 8B4508                  mov eax, dword ptr [ebp+08]
:00437657 C1E003                  shl eax, 03
:0043765A 50                      push eax
:0043765B E85BFFFFFF              call 004375BB
:00437660 83C404                  add esp, 00000004
:00437663 E900000000              jmp 00437668

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437663(U)
|
:00437668 5F                      pop edi
:00437669 5E                      pop esi
:0043766A 5B                      pop ebx
:0043766B C9                      leave
:0043766C C3                      ret



* Referenced by a CALL at Addresses:
|:00415B7C   , :004174F4   , :0042552E   , :00425A16   , :0042FD00   
|:0042FF4F   , :004308CD   , :00433B0C   , :00433D30   
|
:0043766D 55                      push ebp
:0043766E 8BEC                    mov ebp, esp
:00437670 53                      push ebx
:00437671 56                      push esi
:00437672 57                      push edi
:00437673 8B4508                  mov eax, dword ptr [ebp+08]
:00437676 50                      push eax
:00437677 B9D0A64600              mov ecx, 0046A6D0
:0043767C E8EE73FEFF              call 0041EA6F
:00437681 B900AA4600              mov ecx, 0046AA00
:00437686 E8C5A1FCFF              call 00401850
:0043768B 33C9                    xor ecx, ecx
:0043768D 8AC8                    mov cl, al
:0043768F 83F902                  cmp ecx, 00000002
:00437692 0F850C000000            jne 004376A4
:00437698 8B4508                  mov eax, dword ptr [ebp+08]
:0043769B 50                      push eax
:0043769C E843EAFDFF              call 004160E4
:004376A1 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437692(C)
|
:004376A4 33C0                    xor eax, eax
:004376A6 E900000000              jmp 004376AB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004376A6(U)
|
:004376AB 5F                      pop edi
:004376AC 5E                      pop esi
:004376AD 5B                      pop ebx
:004376AE C9                      leave
:004376AF C3                      ret



* Referenced by a CALL at Addresses:
|:0040F63E   , :0040F7B4   , :0040FAC0   , :0041585E   , :00415AD3   
|:00416825   , :004174E7   , :0042FEBD   , :00433AD0   
|
:004376B0 55                      push ebp
:004376B1 8BEC                    mov ebp, esp
:004376B3 53                      push ebx
:004376B4 56                      push esi
:004376B5 57                      push edi
:004376B6 B9D0A64600              mov ecx, 0046A6D0
:004376BB E88E73FEFF              call 0041EA4E
:004376C0 E900000000              jmp 004376C5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004376C0(U)
|
:004376C5 5F                      pop edi
:004376C6 5E                      pop esi
:004376C7 5B                      pop ebx
:004376C8 C9                      leave
:004376C9 C3                      ret



* Referenced by a CALL at Addresses:
|:00437CD0   , :00439424   
|
:004376CA 55                      push ebp
:004376CB 8BEC                    mov ebp, esp
:004376CD 83EC04                  sub esp, 00000004
:004376D0 53                      push ebx
:004376D1 56                      push esi
:004376D2 57                      push edi
:004376D3 C645FC0A                mov [ebp-04], 0A
:004376D7 33C0                    xor eax, eax
:004376D9 8A45FC                  mov al, byte ptr [ebp-04]
:004376DC 50                      push eax
:004376DD E8A6E7FEFF              call 00425E88
:004376E2 83C404                  add esp, 00000004
:004376E5 E8FDFDFFFF              call 004374E7
:004376EA 6A01                    push 00000001
:004376EC E869FDFFFF              call 0043745A
:004376F1 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437735(U)
|
:004376F4 E884FDFFFF              call 0043747D
:004376F9 85C0                    test eax, eax
:004376FB 0F8539000000            jne 0043773A
:00437701 B9B0FA4600              mov ecx, 0046FAB0
:00437706 E8A50FFEFF              call 004186B0
:0043770B 85C0                    test eax, eax
:0043770D 0F8422000000            je 00437735
:00437713 33C0                    xor eax, eax
:00437715 8A45FC                  mov al, byte ptr [ebp-04]
:00437718 3401                    xor al, 01
:0043771A 8845FC                  mov byte ptr [ebp-04], al
:0043771D 33C0                    xor eax, eax
:0043771F 8A45FC                  mov al, byte ptr [ebp-04]
:00437722 50                      push eax
:00437723 E860E7FEFF              call 00425E88
:00437728 83C404                  add esp, 00000004
:0043772B 6A01                    push 00000001
:0043772D E828FDFFFF              call 0043745A
:00437732 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043770D(C)
|
:00437735 E9BAFFFFFF              jmp 004376F4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004376FB(C)
|
:0043773A E8A8FDFFFF              call 004374E7
:0043773F 6A00                    push 00000000
:00437741 E842E7FEFF              call 00425E88
:00437746 83C404                  add esp, 00000004
:00437749 E900000000              jmp 0043774E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437749(U)
|
:0043774E 5F                      pop edi
:0043774F 5E                      pop esi
:00437750 5B                      pop ebx
:00437751 C9                      leave
:00437752 C3                      ret



* Referenced by a CALL at Addresses:
|:00437CA0   , :00443E34   
|
:00437753 55                      push ebp
:00437754 8BEC                    mov ebp, esp
:00437756 83EC70                  sub esp, 00000070
:00437759 53                      push ebx
:0043775A 56                      push esi
:0043775B 57                      push edi
:0043775C C7459800000000          mov [ebp-68], 00000000
:00437763 C645FC00                mov [ebp-04], 00
:00437767 8B4510                  mov eax, dword ptr [ebp+10]
:0043776A 894594                  mov dword ptr [ebp-6C], eax
:0043776D 8D459C                  lea eax, dword ptr [ebp-64]
:00437770 8945F8                  mov dword ptr [ebp-08], eax
:00437773 C745F001000000          mov [ebp-10], 00000001
:0043777A C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004378CF(U)
|
:00437781 8B4594                  mov eax, dword ptr [ebp-6C]
:00437784 33C9                    xor ecx, ecx
:00437786 8A08                    mov cl, byte ptr [eax]
:00437788 83F90A                  cmp ecx, 0000000A
:0043778B 0F8443010000            je 004378D4
:00437791 8B4594                  mov eax, dword ptr [ebp-6C]
:00437794 33C9                    xor ecx, ecx
:00437796 8A08                    mov cl, byte ptr [eax]
:00437798 85C9                    test ecx, ecx
:0043779A 0F8434010000            je 004378D4
:004377A0 8B4594                  mov eax, dword ptr [ebp-6C]
:004377A3 33C9                    xor ecx, ecx
:004377A5 8A08                    mov cl, byte ptr [eax]
:004377A7 81F981000000            cmp ecx, 00000081
:004377AD 0F8CCF000000            jl 00437882
:004377B3 8B4594                  mov eax, dword ptr [ebp-6C]
:004377B6 33C9                    xor ecx, ecx
:004377B8 8A08                    mov cl, byte ptr [eax]
:004377BA 81F9FE000000            cmp ecx, 000000FE
:004377C0 0F8FBC000000            jg 00437882
:004377C6 33C0                    xor eax, eax
:004377C8 8A45FC                  mov al, byte ptr [ebp-04]
:004377CB 33C9                    xor ecx, ecx
:004377CD 8A4D14                  mov cl, byte ptr [ebp+14]
:004377D0 03C1                    add eax, ecx
:004377D2 8B4D98                  mov ecx, dword ptr [ebp-68]
:004377D5 83C102                  add ecx, 00000002
:004377D8 3BC1                    cmp eax, ecx
:004377DA 0F8379000000            jnb 00437859
:004377E0 8B4594                  mov eax, dword ptr [ebp-6C]
:004377E3 33C9                    xor ecx, ecx
:004377E5 8A08                    mov cl, byte ptr [eax]
:004377E7 81F981000000            cmp ecx, 00000081
:004377ED 0F855C000000            jne 0043784F
:004377F3 8B4594                  mov eax, dword ptr [ebp-6C]
:004377F6 33C9                    xor ecx, ecx
:004377F8 8A4801                  mov cl, byte ptr [eax+01]
:004377FB 83F940                  cmp ecx, 00000040
:004377FE 0F8C4B000000            jl 0043784F
:00437804 8B4594                  mov eax, dword ptr [ebp-6C]
:00437807 33C9                    xor ecx, ecx
:00437809 8A4801                  mov cl, byte ptr [eax+01]
:0043780C 83F94B                  cmp ecx, 0000004B
:0043780F 0F8F3A000000            jg 0043784F
:00437815 8B4594                  mov eax, dword ptr [ebp-6C]
:00437818 33C9                    xor ecx, ecx
:0043781A 8A4801                  mov cl, byte ptr [eax+01]
:0043781D 83F948                  cmp ecx, 00000048
:00437820 0F8429000000            je 0043784F
:00437826 8B4594                  mov eax, dword ptr [ebp-6C]
:00437829 8A00                    mov al, byte ptr [eax]
:0043782B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043782E 8801                    mov byte ptr [ecx], al
:00437830 FF4594                  inc [ebp-6C]
:00437833 FF45F8                  inc [ebp-08]
:00437836 8B4594                  mov eax, dword ptr [ebp-6C]
:00437839 8A00                    mov al, byte ptr [eax]
:0043783B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043783E 8801                    mov byte ptr [ecx], al
:00437840 FF4594                  inc [ebp-6C]
:00437843 FF45F8                  inc [ebp-08]
:00437846 83459802                add dword ptr [ebp-68], 00000002
:0043784A E905000000              jmp 00437854

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004377ED(C), :004377FE(C), :0043780F(C), :00437820(C)
|
:0043784F E980000000              jmp 004378D4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043784A(U)
|
:00437854 E924000000              jmp 0043787D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004377DA(C)
|
:00437859 8B4594                  mov eax, dword ptr [ebp-6C]
:0043785C 8A00                    mov al, byte ptr [eax]
:0043785E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00437861 8801                    mov byte ptr [ecx], al
:00437863 FF4594                  inc [ebp-6C]
:00437866 FF45F8                  inc [ebp-08]
:00437869 8B4594                  mov eax, dword ptr [ebp-6C]
:0043786C 8A00                    mov al, byte ptr [eax]
:0043786E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00437871 8801                    mov byte ptr [ecx], al
:00437873 FF4594                  inc [ebp-6C]
:00437876 FF45F8                  inc [ebp-08]
:00437879 83459802                add dword ptr [ebp-68], 00000002

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437854(U)
|
:0043787D E94D000000              jmp 004378CF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004377AD(C), :004377C0(C)
|
:00437882 33C0                    xor eax, eax
:00437884 8A45FC                  mov al, byte ptr [ebp-04]
:00437887 33C9                    xor ecx, ecx
:00437889 8A4D14                  mov cl, byte ptr [ebp+14]
:0043788C 03C1                    add eax, ecx
:0043788E 3B4598                  cmp eax, dword ptr [ebp-68]
:00437891 0F870A000000            ja 004378A1
:00437897 E938000000              jmp 004378D4
:0043789C E92E000000              jmp 004378CF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437891(C)
|
:004378A1 8B4594                  mov eax, dword ptr [ebp-6C]
:004378A4 33C9                    xor ecx, ecx
:004378A6 8A08                    mov cl, byte ptr [eax]
:004378A8 83F91B                  cmp ecx, 0000001B
:004378AB 0F850B000000            jne 004378BC
:004378B1 33C0                    xor eax, eax
:004378B3 8A45FC                  mov al, byte ptr [ebp-04]
:004378B6 83C003                  add eax, 00000003
:004378B9 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004378AB(C)
|
:004378BC 8B4594                  mov eax, dword ptr [ebp-6C]
:004378BF 8A00                    mov al, byte ptr [eax]
:004378C1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004378C4 8801                    mov byte ptr [ecx], al
:004378C6 FF4594                  inc [ebp-6C]
:004378C9 FF45F8                  inc [ebp-08]
:004378CC FF4598                  inc [ebp-68]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043787D(U), :0043789C(U)
|
:004378CF E9ADFEFFFF              jmp 00437781

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043778B(C), :0043779A(C), :0043784F(U), :00437897(U)
|
:004378D4 8B45F8                  mov eax, dword ptr [ebp-08]
:004378D7 C60000                  mov byte ptr [eax], 00
:004378DA 8B4594                  mov eax, dword ptr [ebp-6C]
:004378DD 33C9                    xor ecx, ecx
:004378DF 8A08                    mov cl, byte ptr [eax]
:004378E1 83F90A                  cmp ecx, 0000000A
:004378E4 0F8503000000            jne 004378ED
:004378EA FF4598                  inc [ebp-68]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004378E4(C)
|
:004378ED 8B4594                  mov eax, dword ptr [ebp-6C]
:004378F0 33C9                    xor ecx, ecx
:004378F2 8A08                    mov cl, byte ptr [eax]
:004378F4 83F90D                  cmp ecx, 0000000D
:004378F7 0F8504000000            jne 00437901
:004378FD 83459802                add dword ptr [ebp-68], 00000002

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004378F7(C)
|
:00437901 837D1800                cmp dword ptr [ebp+18], 00000000
:00437905 0F8424000000            je 0043792F
:0043790B 8D459C                  lea eax, dword ptr [ebp-64]
:0043790E 50                      push eax
:0043790F E896FA0000              call 004473AA
:00437914 83C404                  add esp, 00000004
:00437917 884590                  mov byte ptr [ebp-70], al
:0043791A 33C0                    xor eax, eax
:0043791C 8A4514                  mov al, byte ptr [ebp+14]
:0043791F 33C9                    xor ecx, ecx
:00437921 8A4D90                  mov cl, byte ptr [ebp-70]
:00437924 2BC1                    sub eax, ecx
:00437926 99                      cdq
:00437927 2BC2                    sub eax, edx
:00437929 C1F801                  sar eax, 01
:0043792C 014508                  add dword ptr [ebp+08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437905(C)
|
:0043792F 6A07                    push 00000007
:00437931 B910BC4600              mov ecx, 0046BC10
:00437936 E89883FEFF              call 0041FCD3
:0043793B 8B450C                  mov eax, dword ptr [ebp+0C]
:0043793E 50                      push eax
:0043793F 8B4508                  mov eax, dword ptr [ebp+08]
:00437942 50                      push eax
:00437943 B910BC4600              mov ecx, 0046BC10
:00437948 E8BA82FEFF              call 0041FC07
:0043794D 8D459C                  lea eax, dword ptr [ebp-64]
:00437950 50                      push eax

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:00437951 6844324500              push 00453244
:00437956 6810BC4600              push 0046BC10
:0043795B E8C391FEFF              call 00420B23
:00437960 83C40C                  add esp, 0000000C
:00437963 8B4598                  mov eax, dword ptr [ebp-68]
:00437966 E900000000              jmp 0043796B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437966(U)
|
:0043796B 5F                      pop edi
:0043796C 5E                      pop esi
:0043796D 5B                      pop ebx
:0043796E C9                      leave
:0043796F C3                      ret



* Referenced by a CALL at Addresses:
|:00401159   , :00427E0B   
|
:00437970 55                      push ebp
:00437971 8BEC                    mov ebp, esp
:00437973 83EC48                  sub esp, 00000048
:00437976 53                      push ebx
:00437977 56                      push esi
:00437978 57                      push edi
:00437979 C645C8FF                mov [ebp-38], FF
:0043797D C645F408                mov [ebp-0C], 08
:00437981 33C0                    xor eax, eax
:00437983 8A4520                  mov al, byte ptr [ebp+20]
:00437986 25C0000000              and eax, 000000C0
:0043798B C1E806                  shr eax, 06
:0043798E 8845CC                  mov byte ptr [ebp-34], al
:00437991 33C0                    xor eax, eax
:00437993 8A4520                  mov al, byte ptr [ebp+20]
:00437996 A808                    test al, 08
:00437998 0F850C000000            jne 004379AA
:0043799E C745EC01000000          mov [ebp-14], 00000001
:004379A5 E907000000              jmp 004379B1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437998(C)
|
:004379AA C745EC00000000          mov [ebp-14], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004379A5(U)
|
:004379B1 33C0                    xor eax, eax
:004379B3 8A4520                  mov al, byte ptr [ebp+20]
:004379B6 83E020                  and eax, 00000020
:004379B9 8945F0                  mov dword ptr [ebp-10], eax
:004379BC 33C0                    xor eax, eax
:004379BE 8A4520                  mov al, byte ptr [ebp+20]
:004379C1 83E010                  and eax, 00000010
:004379C4 8945F8                  mov dword ptr [ebp-08], eax
:004379C7 C745D400000000          mov [ebp-2C], 00000000
:004379CE 8B4D14                  mov ecx, dword ptr [ebp+14]
:004379D1 33C0                    xor eax, eax
:004379D3 8A45F4                  mov al, byte ptr [ebp-0C]
:004379D6 03C0                    add eax, eax
:004379D8 2BC8                    sub ecx, eax
:004379DA 8B4514                  mov eax, dword ptr [ebp+14]
:004379DD 33D2                    xor edx, edx
:004379DF 8A55F4                  mov dl, byte ptr [ebp-0C]
:004379E2 03D2                    add edx, edx
:004379E4 2BC2                    sub eax, edx
:004379E6 BB14000000              mov ebx, 00000014
:004379EB 2BD2                    sub edx, edx
:004379ED F7F3                    div ebx
:004379EF C1E002                  shl eax, 02
:004379F2 8D0480                  lea eax, dword ptr [eax+4*eax]
:004379F5 2BC8                    sub ecx, eax
:004379F7 C1E901                  shr ecx, 01
:004379FA 894DC0                  mov dword ptr [ebp-40], ecx
:004379FD E8ACF9FFFF              call 004373AE
:00437A02 B9D0A64600              mov ecx, 0046A6D0
:00437A07 E8C43FFDFF              call 0040B9D0
:00437A0C 8845E4                  mov byte ptr [ebp-1C], al
:00437A0F E883F5FEFF              call 00426F97
:00437A14 6A04                    push 00000004
:00437A16 B910BC4600              mov ecx, 0046BC10
:00437A1B E86184FEFF              call 0041FE81
:00437A20 6A00                    push 00000000
:00437A22 B910BC4600              mov ecx, 0046BC10
:00437A27 E8A483FEFF              call 0041FDD0
:00437A2C 837DF000                cmp dword ptr [ebp-10], 00000000
:00437A30 0F842B000000            je 00437A61
:00437A36 837D1000                cmp dword ptr [ebp+10], 00000000
:00437A3A 0F8421000000            je 00437A61
:00437A40 6A06                    push 00000006
:00437A42 8B4514                  mov eax, dword ptr [ebp+14]
:00437A45 50                      push eax
:00437A46 8B4510                  mov eax, dword ptr [ebp+10]
:00437A49 50                      push eax
:00437A4A 8B450C                  mov eax, dword ptr [ebp+0C]
:00437A4D 50                      push eax
:00437A4E 8B4508                  mov eax, dword ptr [ebp+08]
:00437A51 50                      push eax
:00437A52 B958BC4600              mov ecx, 0046BC58
:00437A57 E80695FEFF              call 00420F62
:00437A5C E91E000000              jmp 00437A7F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00437A30(C), :00437A3A(C)
|
:00437A61 6A00                    push 00000000
:00437A63 6A06                    push 00000006
:00437A65 8B4514                  mov eax, dword ptr [ebp+14]
:00437A68 50                      push eax
:00437A69 8B4510                  mov eax, dword ptr [ebp+10]
:00437A6C 50                      push eax
:00437A6D 8B450C                  mov eax, dword ptr [ebp+0C]
:00437A70 50                      push eax
:00437A71 8B4508                  mov eax, dword ptr [ebp+08]
:00437A74 50                      push eax
:00437A75 B958BC4600              mov ecx, 0046BC58
:00437A7A E8EB92FEFF              call 00420D6A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437A5C(U)
|
:00437A7F 837D1C00                cmp dword ptr [ebp+1C], 00000000
:00437A83 0F84AB000000            je 00437B34
:00437A89 8B4D1C                  mov ecx, dword ptr [ebp+1C]
:00437A8C E8DFA0FCFF              call 00401B70
:00437A91 2500020000              and eax, 00000200
:00437A96 8945D4                  mov dword ptr [ebp-2C], eax
:00437A99 6A06                    push 00000006
:00437A9B B910BC4600              mov ecx, 0046BC10
:00437AA0 E82E82FEFF              call 0041FCD3
:00437AA5 33C0                    xor eax, eax
:00437AA7 8A45F4                  mov al, byte ptr [ebp-0C]
:00437AAA 0345C0                  add eax, dword ptr [ebp-40]
:00437AAD 03450C                  add eax, dword ptr [ebp+0C]
:00437AB0 50                      push eax
:00437AB1 837DD401                cmp dword ptr [ebp-2C], 00000001
:00437AB5 1BC0                    sbb eax, eax
:00437AB7 83E0F6                  and eax, FFFFFFF6
:00437ABA 83C00C                  add eax, 0000000C
:00437ABD 8B4D08                  mov ecx, dword ptr [ebp+08]
:00437AC0 C1E903                  shr ecx, 03
:00437AC3 03C1                    add eax, ecx
:00437AC5 50                      push eax
:00437AC6 B910BC4600              mov ecx, 0046BC10
:00437ACB E83781FEFF              call 0041FC07
:00437AD0 837DD400                cmp dword ptr [ebp-2C], 00000000
:00437AD4 0F8510000000            jne 00437AEA
:00437ADA 8B4D1C                  mov ecx, dword ptr [ebp+1C]
:00437ADD E83E00FEFF              call 00417B20
:00437AE2 8945FC                  mov dword ptr [ebp-04], eax
:00437AE5 E92F000000              jmp 00437B19

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437AD4(C)
|
:00437AEA 8B4D1C                  mov ecx, dword ptr [ebp+1C]
:00437AED E8AE1C0000              call 004397A0
:00437AF2 50                      push eax
:00437AF3 33C0                    xor eax, eax
:00437AF5 8A45F4                  mov al, byte ptr [ebp-0C]
:00437AF8 0345C0                  add eax, dword ptr [ebp-40]
:00437AFB 03450C                  add eax, dword ptr [ebp+0C]
:00437AFE 50                      push eax
:00437AFF 8B4508                  mov eax, dword ptr [ebp+08]
:00437B02 83C010                  add eax, 00000010
:00437B05 50                      push eax
:00437B06 E8D2F5FEFF              call 004270DD
:00437B0B 83C40C                  add esp, 0000000C
:00437B0E 8B4D1C                  mov ecx, dword ptr [ebp+1C]
:00437B11 E8CA19FDFF              call 004094E0
:00437B16 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437AE5(U)
|
:00437B19 8B45FC                  mov eax, dword ptr [ebp-04]
:00437B1C 50                      push eax

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:00437B1D 6848324500              push 00453248
:00437B22 6810BC4600              push 0046BC10
:00437B27 E8F78FFEFF              call 00420B23
:00437B2C 83C40C                  add esp, 0000000C
:00437B2F E907000000              jmp 00437B3B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437A83(C)
|
:00437B34 C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437B2F(U)
|
:00437B3B 8B4518                  mov eax, dword ptr [ebp+18]
:00437B3E 8945DC                  mov dword ptr [ebp-24], eax
:00437B41 C745C401000000          mov [ebp-3C], 00000001
:00437B48 8B4510                  mov eax, dword ptr [ebp+10]
:00437B4B C1E803                  shr eax, 03
:00437B4E 837DD401                cmp dword ptr [ebp-2C], 00000001
:00437B52 1BC9                    sbb ecx, ecx
:00437B54 83E1F6                  and ecx, FFFFFFF6
:00437B57 83C10E                  add ecx, 0000000E
:00437B5A 2BC1                    sub eax, ecx
:00437B5C 8945D0                  mov dword ptr [ebp-30], eax
:00437B5F 8B4514                  mov eax, dword ptr [ebp+14]
:00437B62 33C9                    xor ecx, ecx
:00437B64 8A4DF4                  mov cl, byte ptr [ebp-0C]
:00437B67 03C9                    add ecx, ecx
:00437B69 2BC1                    sub eax, ecx
:00437B6B B914000000              mov ecx, 00000014
:00437B70 2BD2                    sub edx, edx
:00437B72 F7F1                    div ecx
:00437B74 837D1C01                cmp dword ptr [ebp+1C], 00000001
:00437B78 1BC9                    sbb ecx, ecx
:00437B7A 41                      inc ecx
:00437B7B 2BC1                    sub eax, ecx
:00437B7D 8945D8                  mov dword ptr [ebp-28], eax
:00437B80 E832F4FEFF              call 00426FB7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437CDC(U)
|
:00437B85 8B45DC                  mov eax, dword ptr [ebp-24]
:00437B88 33C9                    xor ecx, ecx
:00437B8A 8A08                    mov cl, byte ptr [eax]
:00437B8C 85C9                    test ecx, ecx
:00437B8E 0F844D010000            je 00437CE1
:00437B94 E8FEF3FEFF              call 00426F97
:00437B99 837DD401                cmp dword ptr [ebp-2C], 00000001
:00437B9D 1BC0                    sbb eax, eax
:00437B9F 83E0F6                  and eax, FFFFFFF6
:00437BA2 83C00C                  add eax, 0000000C
:00437BA5 8B4D08                  mov ecx, dword ptr [ebp+08]
:00437BA8 C1E903                  shr ecx, 03
:00437BAB 03C1                    add eax, ecx
:00437BAD 8945E8                  mov dword ptr [ebp-18], eax
:00437BB0 837D1C01                cmp dword ptr [ebp+1C], 00000001
:00437BB4 B800000000              mov eax, 00000000
:00437BB9 83D0FF                  adc eax, FFFFFFFF
:00437BBC 83E014                  and eax, 00000014
:00437BBF 33C9                    xor ecx, ecx
:00437BC1 8A4DF4                  mov cl, byte ptr [ebp-0C]
:00437BC4 03C1                    add eax, ecx
:00437BC6 0345C0                  add eax, dword ptr [ebp-40]
:00437BC9 03450C                  add eax, dword ptr [ebp+0C]
:00437BCC 8945E0                  mov dword ptr [ebp-20], eax
:00437BCF 837DC400                cmp dword ptr [ebp-3C], 00000000
:00437BD3 0F858A000000            jne 00437C63
:00437BD9 68FFFF0000              push 0000FFFF
:00437BDE 8B4514                  mov eax, dword ptr [ebp+14]
:00437BE1 83E810                  sub eax, 00000010
:00437BE4 50                      push eax
:00437BE5 8B4510                  mov eax, dword ptr [ebp+10]
:00437BE8 83E810                  sub eax, 00000010
:00437BEB 837DD401                cmp dword ptr [ebp-2C], 00000001
:00437BEF B900000000              mov ecx, 00000000
:00437BF4 83D1FF                  adc ecx, FFFFFFFF
:00437BF7 83E148                  and ecx, 00000048
:00437BFA 2BC1                    sub eax, ecx
:00437BFC 50                      push eax
:00437BFD 8B450C                  mov eax, dword ptr [ebp+0C]
:00437C00 83C008                  add eax, 00000008
:00437C03 50                      push eax
:00437C04 837DD401                cmp dword ptr [ebp-2C], 00000001
:00437C08 B800000000              mov eax, 00000000
:00437C0D 83D0FF                  adc eax, FFFFFFFF
:00437C10 83E048                  and eax, 00000048
:00437C13 034508                  add eax, dword ptr [ebp+08]
:00437C16 83C008                  add eax, 00000008
:00437C19 50                      push eax
:00437C1A E8EBF5FEFF              call 0042720A
:00437C1F 83C414                  add esp, 00000014
:00437C22 837DFC00                cmp dword ptr [ebp-04], 00000000
:00437C26 0F8437000000            je 00437C63
:00437C2C 6A06                    push 00000006
:00437C2E B910BC4600              mov ecx, 0046BC10
:00437C33 E89B80FEFF              call 0041FCD3
:00437C38 8B45E0                  mov eax, dword ptr [ebp-20]
:00437C3B 83E814                  sub eax, 00000014
:00437C3E 50                      push eax
:00437C3F 8B45E8                  mov eax, dword ptr [ebp-18]
:00437C42 50                      push eax
:00437C43 B910BC4600              mov ecx, 0046BC10
:00437C48 E8BA7FFEFF              call 0041FC07
:00437C4D 8B45FC                  mov eax, dword ptr [ebp-04]
:00437C50 50                      push eax

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:00437C51 684C324500              push 0045324C
:00437C56 6810BC4600              push 0046BC10
:00437C5B E8C38EFEFF              call 00420B23
:00437C60 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00437BD3(C), :00437C26(C)
|
:00437C63 C645BC00                mov [ebp-44], 00
:00437C67 E903000000              jmp 00437C6F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437CAF(U)
|
:00437C6C FE45BC                  inc [ebp-44]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437C67(U)
|
:00437C6F 8B45DC                  mov eax, dword ptr [ebp-24]
:00437C72 33C9                    xor ecx, ecx
:00437C74 8A08                    mov cl, byte ptr [eax]
:00437C76 85C9                    test ecx, ecx
:00437C78 0F8436000000            je 00437CB4
:00437C7E 33C0                    xor eax, eax
:00437C80 8A45BC                  mov al, byte ptr [ebp-44]
:00437C83 3B45D8                  cmp eax, dword ptr [ebp-28]
:00437C86 0F8328000000            jnb 00437CB4
:00437C8C 8B45F8                  mov eax, dword ptr [ebp-08]
:00437C8F 50                      push eax
:00437C90 8B45D0                  mov eax, dword ptr [ebp-30]
:00437C93 50                      push eax
:00437C94 8B45DC                  mov eax, dword ptr [ebp-24]
:00437C97 50                      push eax
:00437C98 8B45E0                  mov eax, dword ptr [ebp-20]
:00437C9B 50                      push eax
:00437C9C 8B45E8                  mov eax, dword ptr [ebp-18]
:00437C9F 50                      push eax
:00437CA0 E8AEFAFFFF              call 00437753
:00437CA5 83C414                  add esp, 00000014
:00437CA8 0145DC                  add dword ptr [ebp-24], eax
:00437CAB 8345E014                add dword ptr [ebp-20], 00000014
:00437CAF E9B8FFFFFF              jmp 00437C6C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00437C78(C), :00437C86(C)
|
:00437CB4 B988534500              mov ecx, 00455388
:00437CB9 E8CA9FFCFF              call 00401C88
:00437CBE E8F4F2FEFF              call 00426FB7
:00437CC3 33C0                    xor eax, eax
:00437CC5 8A45CC                  mov al, byte ptr [ebp-34]
:00437CC8 85C0                    test eax, eax
:00437CCA 0F8505000000            jne 00437CD5
:00437CD0 E8F5F9FFFF              call 004376CA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437CCA(C)
|
:00437CD5 C745C400000000          mov [ebp-3C], 00000000
:00437CDC E9A4FEFFFF              jmp 00437B85

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437B8E(C)
|
:00437CE1 B988534500              mov ecx, 00455388
:00437CE6 E89D9FFCFF              call 00401C88
:00437CEB 33C0                    xor eax, eax
:00437CED 8A45CC                  mov al, byte ptr [ebp-34]
:00437CF0 8945B8                  mov dword ptr [ebp-48], eax
:00437CF3 E937000000              jmp 00437D2F
:00437CF8 E956000000              jmp 00437D53
:00437CFD 33C0                    xor eax, eax
:00437CFF 8A45E4                  mov al, byte ptr [ebp-1C]
:00437D02 8D0480                  lea eax, dword ptr [eax+4*eax]
:00437D05 50                      push eax
:00437D06 E8B0F8FFFF              call 004375BB
:00437D0B 83C404                  add esp, 00000004
:00437D0E E940000000              jmp 00437D53

* Possible StringData Ref from Data Obj ->""
                                  |
:00437D13 6850324500              push 00453250
:00437D18 6A06                    push 00000006
:00437D1A E816120000              call 00438F35
:00437D1F 83C408                  add esp, 00000008
:00437D22 8845C8                  mov byte ptr [ebp-38], al
:00437D25 E929000000              jmp 00437D53
:00437D2A E924000000              jmp 00437D53

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437CF3(U)
|
:00437D2F 837DB803                cmp dword ptr [ebp-48], 00000003
:00437D33 0F871A000000            ja 00437D53
:00437D39 8B45B8                  mov eax, dword ptr [ebp-48]
:00437D3C FF2485437D4300          jmp dword ptr [4*eax+00437D43]

:00437D43 F87C4300                DWORD 00437CF8
:00437D47 FD7C4300                DWORD 00437CFD
:00437D4B 137D4300                DWORD 00437D13
:00437D4F F87C4300                DWORD 00437CF8



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00437CF8(U), :00437D0E(U), :00437D25(U), :00437D2A(U), :00437D33(C)
|
:00437D53 837DEC00                cmp dword ptr [ebp-14], 00000000
:00437D57 0F8459000000            je 00437DB6
:00437D5D 837DF000                cmp dword ptr [ebp-10], 00000000
:00437D61 0F840F000000            je 00437D76
:00437D67 B958BC4600              mov ecx, 0046BC58
:00437D6C E86B92FEFF              call 00420FDC
:00437D71 E93B000000              jmp 00437DB1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437D61(C)
|
:00437D76 E8A392FCFF              call 0040101E
:00437D7B 33C9                    xor ecx, ecx
:00437D7D 8AC8                    mov cl, al
:00437D7F 83F903                  cmp ecx, 00000003
:00437D82 0F8529000000            jne 00437DB1
:00437D88 8B4514                  mov eax, dword ptr [ebp+14]
:00437D8B C1E804                  shr eax, 04
:00437D8E 50                      push eax
:00437D8F 8B4510                  mov eax, dword ptr [ebp+10]
:00437D92 C1E804                  shr eax, 04

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437D50(C)
|
:00437D95 50                      push eax
:00437D96 8B450C                  mov eax, dword ptr [ebp+0C]
:00437D99 C1E804                  shr eax, 04
:00437D9C 83E803                  sub eax, 00000003
:00437D9F 50                      push eax
:00437DA0 8B4508                  mov eax, dword ptr [ebp+08]
:00437DA3 C1E804                  shr eax, 04
:00437DA6 50                      push eax
:00437DA7 B900FB4600              mov ecx, 0046FB00
:00437DAC E87C2D0000              call 0043AB2D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00437D71(U), :00437D82(C)
|
:00437DB1 E90A000000              jmp 00437DC0
:00437DB6 B958BC4600              mov ecx, 0046BC58
:00437DBB E8F091FEFF              call 00420FB0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437DB1(U)
|
:00437DC0 33C0                    xor eax, eax
:00437DC2 8A45C8                  mov al, byte ptr [ebp-38]
:00437DC5 3DFF000000              cmp eax, 000000FF
:00437DCA 0F840E000000            je 00437DDE
:00437DD0 33C0                    xor eax, eax
:00437DD2 8A45C8                  mov al, byte ptr [ebp-38]
:00437DD5 83F801                  cmp eax, 00000001
:00437DD8 0F850A000000            jne 00437DE8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437DCA(C)
|
:00437DDE B801000000              mov eax, 00000001
:00437DE3 E902000000              jmp 00437DEA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437DD8(C)
|
:00437DE8 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437DE3(U)
|
:00437DEA E900000000              jmp 00437DEF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437DEA(U)
|
:00437DEF 5F                      pop edi
:00437DF0 5E                      pop esi
:00437DF1 5B                      pop ebx
:00437DF2 C9                      leave
:00437DF3 C3                      ret



* Referenced by a CALL at Addresses:
|:0040B2BF   , :0040B63D   , :0040B6C2   , :0040B8A4   , :0040FE95   
|:0040FF98   , :00410053   , :004100F8   , :0041018E   , :00410211   
|:00410419   , :0041059B   , :00410B53   , :00416601   , :00416B0C   
|:004314C1   , :0043CDED   , :0043E9A2   , :0043FCCF   , :0044122E   
|:00441669   , :00441842   , :004418FF   
|
:00437DF4 55                      push ebp
:00437DF5 8BEC                    mov ebp, esp
:00437DF7 6AFF                    push FFFFFFFF
:00437DF9 68D18A4300              push 00438AD1
:00437DFE 64A100000000            mov eax, dword ptr fs:[00000000]
:00437E04 50                      push eax
:00437E05 64892500000000          mov dword ptr fs:[00000000], esp
:00437E0C 81ECAC010000            sub esp, 000001AC
:00437E12 53                      push ebx
:00437E13 56                      push esi
:00437E14 57                      push edi
:00437E15 C685B0FEFFFF00          mov byte ptr [ebp+FFFFFEB0], 00
:00437E1C 33C0                    xor eax, eax
:00437E1E 8A4518                  mov al, byte ptr [ebp+18]
:00437E21 2480                    and al, 80
:00437E23 888580FEFFFF            mov byte ptr [ebp+FFFFFE80], al
:00437E29 33C0                    xor eax, eax
:00437E2B 8A4518                  mov al, byte ptr [ebp+18]
:00437E2E 2440                    and al, 40
:00437E30 8885BCFEFFFF            mov byte ptr [ebp+FFFFFEBC], al
:00437E36 C68574FEFFFF00          mov byte ptr [ebp+FFFFFE74], 00
:00437E3D C685C0FEFFFF14          mov byte ptr [ebp+FFFFFEC0], 14
:00437E44 C785B8FEFFFF00000000    mov dword ptr [ebp+FFFFFEB8], 00000000
:00437E4E C78594FEFFFF08000000    mov dword ptr [ebp+FFFFFE94], 00000008
:00437E58 C78570FEFFFF00000000    mov dword ptr [ebp+FFFFFE70], 00000000
:00437E62 E847F5FFFF              call 004373AE
:00437E67 837D2400                cmp dword ptr [ebp+24], 00000000
:00437E6B 0F841A000000            je 00437E8B
:00437E71 33C0                    xor eax, eax
:00437E73 8A4518                  mov al, byte ptr [ebp+18]
:00437E76 A820                    test al, 20
:00437E78 0F840D000000            je 00437E8B
:00437E7E 8B4524                  mov eax, dword ptr [ebp+24]
:00437E81 33C9                    xor ecx, ecx
:00437E83 8A08                    mov cl, byte ptr [eax]
:00437E85 898DB8FEFFFF            mov dword ptr [ebp+FFFFFEB8], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00437E6B(C), :00437E78(C)
|
:00437E8B C68590FEFFFF00          mov byte ptr [ebp+FFFFFE90], 00
:00437E92 E906000000              jmp 00437E9D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437F06(U)
|
:00437E97 FE8590FEFFFF            inc byte ptr [ebp+FFFFFE90]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437E92(U)
|
:00437E9D 33C0                    xor eax, eax
:00437E9F 8A8590FEFFFF            mov al, byte ptr [ebp+FFFFFE90]
:00437EA5 8B4D10                  mov ecx, dword ptr [ebp+10]
:00437EA8 833C8100                cmp dword ptr [ecx+4*eax], 00000000
:00437EAC 0F8459000000            je 00437F0B
:00437EB2 C68588FEFFFF00          mov byte ptr [ebp+FFFFFE88], 00
:00437EB9 E906000000              jmp 00437EC4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437EE7(U)
|
:00437EBE FE8588FEFFFF            inc byte ptr [ebp+FFFFFE88]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437EB9(U)
|
:00437EC4 33C0                    xor eax, eax
:00437EC6 8A8590FEFFFF            mov al, byte ptr [ebp+FFFFFE90]
:00437ECC 8B4D10                  mov ecx, dword ptr [ebp+10]
:00437ECF 8B0481                  mov eax, dword ptr [ecx+4*eax]
:00437ED2 33C9                    xor ecx, ecx
:00437ED4 8A8D88FEFFFF            mov cl, byte ptr [ebp+FFFFFE88]
:00437EDA 33D2                    xor edx, edx
:00437EDC 8A1408                  mov dl, byte ptr [eax+ecx]
:00437EDF 85D2                    test edx, edx
:00437EE1 0F8405000000            je 00437EEC
:00437EE7 E9D2FFFFFF              jmp 00437EBE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437EE1(C)
|
:00437EEC 33C0                    xor eax, eax
:00437EEE 8A8588FEFFFF            mov al, byte ptr [ebp+FFFFFE88]
:00437EF4 33C9                    xor ecx, ecx
:00437EF6 8A4D20                  mov cl, byte ptr [ebp+20]
:00437EF9 3BC1                    cmp eax, ecx
:00437EFB 0F8F02000000            jg 00437F03
:00437F01 8BC1                    mov eax, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437EFB(C)
|
:00437F03 884520                  mov byte ptr [ebp+20], al
:00437F06 E98CFFFFFF              jmp 00437E97

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437EAC(C)
|
:00437F0B 8A8590FEFFFF            mov al, byte ptr [ebp+FFFFFE90]
:00437F11 888574FEFFFF            mov byte ptr [ebp+FFFFFE74], al
:00437F17 33C0                    xor eax, eax
:00437F19 8A4520                  mov al, byte ptr [ebp+20]
:00437F1C 83F808                  cmp eax, 00000008
:00437F1F 0F8F05000000            jg 00437F2A
:00437F25 B808000000              mov eax, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437F1F(C)
|
:00437F2A 884520                  mov byte ptr [ebp+20], al
:00437F2D 33C0                    xor eax, eax
:00437F2F 8A8580FEFFFF            mov al, byte ptr [ebp+FFFFFE80]
:00437F35 85C0                    test eax, eax
:00437F37 0F8410000000            je 00437F4D
:00437F3D 33C0                    xor eax, eax
:00437F3F 8A4520                  mov al, byte ptr [ebp+20]
:00437F42 83C002                  add eax, 00000002
:00437F45 884520                  mov byte ptr [ebp+20], al
:00437F48 E900000000              jmp 00437F4D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00437F37(C), :00437F48(U)
|
:00437F4D 33C0                    xor eax, eax
:00437F4F 8A8580FEFFFF            mov al, byte ptr [ebp+FFFFFE80]
:00437F55 85C0                    test eax, eax
:00437F57 0F842F000000            je 00437F8C
:00437F5D 33C0                    xor eax, eax
:00437F5F 8A8574FEFFFF            mov al, byte ptr [ebp+FFFFFE74]
:00437F65 33C9                    xor ecx, ecx
:00437F67 8A4D14                  mov cl, byte ptr [ebp+14]
:00437F6A 3BC1                    cmp eax, ecx
:00437F6C 0F8E0C000000            jle 00437F7E
:00437F72 C685B0FEFFFF01          mov byte ptr [ebp+FFFFFEB0], 01
:00437F79 E909000000              jmp 00437F87

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437F6C(C)
|
:00437F7E 8A8574FEFFFF            mov al, byte ptr [ebp+FFFFFE74]
:00437F84 884514                  mov byte ptr [ebp+14], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437F79(U)
|
:00437F87 E91E000000              jmp 00437FAA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437F57(C)
|
:00437F8C 33C0                    xor eax, eax
:00437F8E 8A8574FEFFFF            mov al, byte ptr [ebp+FFFFFE74]
:00437F94 33C9                    xor ecx, ecx
:00437F96 8A4D14                  mov cl, byte ptr [ebp+14]
:00437F99 3BC1                    cmp eax, ecx
:00437F9B 0F8F09000000            jg 00437FAA
:00437FA1 8A8574FEFFFF            mov al, byte ptr [ebp+FFFFFE74]
:00437FA7 884514                  mov byte ptr [ebp+14], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00437F87(U), :00437F9B(C)
|
:00437FAA 8B4514                  mov eax, dword ptr [ebp+14]
:00437FAD 50                      push eax
:00437FAE 8B4520                  mov eax, dword ptr [ebp+20]
:00437FB1 50                      push eax
:00437FB2 8B451C                  mov eax, dword ptr [ebp+1C]
:00437FB5 50                      push eax
:00437FB6 8B4510                  mov eax, dword ptr [ebp+10]
:00437FB9 50                      push eax
:00437FBA 8D8DCCFEFFFF            lea ecx, dword ptr [ebp+FFFFFECC]
:00437FC0 E8BB180000              call 00439880
:00437FC5 C745FC00000000          mov [ebp-04], 00000000
:00437FCC 33C0                    xor eax, eax
:00437FCE 8A85C0FEFFFF            mov al, byte ptr [ebp+FFFFFEC0]
:00437FD4 33C9                    xor ecx, ecx
:00437FD6 8A4D14                  mov cl, byte ptr [ebp+14]
:00437FD9 0FAFC1                  imul eax, ecx
:00437FDC 8B8D94FEFFFF            mov ecx, dword ptr [ebp+FFFFFE94]
:00437FE2 8D0448                  lea eax, dword ptr [eax+2*ecx]
:00437FE5 83C00F                  add eax, 0000000F
:00437FE8 83E0F0                  and eax, FFFFFFF0
:00437FEB 8BC8                    mov ecx, eax
:00437FED 03C0                    add eax, eax
:00437FEF 2BC1                    sub eax, ecx
:00437FF1 89856CFEFFFF            mov dword ptr [ebp+FFFFFE6C], eax
:00437FF7 B9D0A64600              mov ecx, 0046A6D0
:00437FFC E81F3AFDFF              call 0040BA20
:00438001 F6C440                  test ah, 40
:00438004 0F84AB000000            je 004380B5
:0043800A B988534500              mov ecx, 00455388
:0043800F E8DE9CFCFF              call 00401CF2
:00438014 B988534500              mov ecx, 00455388
:00438019 E88214FDFF              call 004094A0
:0043801E 898568FEFFFF            mov dword ptr [ebp+FFFFFE68], eax
:00438024 B988534500              mov ecx, 00455388
:00438029 E89214FDFF              call 004094C0
:0043802E 898564FEFFFF            mov dword ptr [ebp+FFFFFE64], eax
:00438034 33C0                    xor eax, eax
:00438036 8A4520                  mov al, byte ptr [ebp+20]
:00438039 C1E003                  shl eax, 03
:0043803C 99                      cdq
:0043803D 2BC2                    sub eax, edx
:0043803F C1F801                  sar eax, 01
:00438042 8B8D68FEFFFF            mov ecx, dword ptr [ebp+FFFFFE68]
:00438048 83E1F8                  and ecx, FFFFFFF8
:0043804B 8BD1                    mov edx, ecx
:0043804D 03C9                    add ecx, ecx
:0043804F 2BCA                    sub ecx, edx
:00438051 3BC1                    cmp eax, ecx
:00438053 0F8727000000            ja 00438080
:00438059 8B8D68FEFFFF            mov ecx, dword ptr [ebp+FFFFFE68]
:0043805F 83E1F8                  and ecx, FFFFFFF8
:00438062 8BC1                    mov eax, ecx
:00438064 03C9                    add ecx, ecx
:00438066 2BC8                    sub ecx, eax
:00438068 33C0                    xor eax, eax
:0043806A 8A4520                  mov al, byte ptr [ebp+20]
:0043806D C1E003                  shl eax, 03
:00438070 99                      cdq
:00438071 2BC2                    sub eax, edx
:00438073 C1F801                  sar eax, 01
:00438076 2BC8                    sub ecx, eax
:00438078 894D08                  mov dword ptr [ebp+08], ecx
:0043807B E907000000              jmp 00438087

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438053(C)
|
:00438080 C7450810000000          mov [ebp+08], 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043807B(U)
|
:00438087 83BD64FEFFFF30          cmp dword ptr [ebp+FFFFFE64], 00000030
:0043808E 0F821A000000            jb 004380AE
:00438094 8B8564FEFFFF            mov eax, dword ptr [ebp+FFFFFE64]
:0043809A 83E0F8                  and eax, FFFFFFF8
:0043809D 8BC8                    mov ecx, eax
:0043809F 03C0                    add eax, eax
:004380A1 2BC1                    sub eax, ecx
:004380A3 83E80F                  sub eax, 0000000F
:004380A6 89450C                  mov dword ptr [ebp+0C], eax
:004380A9 E907000000              jmp 004380B5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043808E(C)
|
:004380AE C7450C30000000          mov [ebp+0C], 00000030

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00438004(C), :004380A9(U)
|
:004380B5 837D0810                cmp dword ptr [ebp+08], 00000010
:004380B9 0F8307000000            jnb 004380C6
:004380BF C7450810000000          mov [ebp+08], 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004380B9(C)
|
:004380C6 33C0                    xor eax, eax
:004380C8 8A4520                  mov al, byte ptr [ebp+20]
:004380CB 8D04C530000000          lea eax, dword ptr [8*eax+00000030]
:004380D2 034508                  add eax, dword ptr [ebp+08]
:004380D5 3D78020000              cmp eax, 00000278
:004380DA 0F8216000000            jb 004380F6
:004380E0 B878020000              mov eax, 00000278
:004380E5 33C9                    xor ecx, ecx
:004380E7 8A4D20                  mov cl, byte ptr [ebp+20]
:004380EA 8D0CCD30000000          lea ecx, dword ptr [8*ecx+00000030]
:004380F1 2BC1                    sub eax, ecx
:004380F3 894508                  mov dword ptr [ebp+08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004380DA(C)
|
:004380F6 837D0C30                cmp dword ptr [ebp+0C], 00000030
:004380FA 0F8307000000            jnb 00438107
:00438100 C7450C30000000          mov [ebp+0C], 00000030

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004380FA(C)
|
:00438107 8B856CFEFFFF            mov eax, dword ptr [ebp+FFFFFE6C]
:0043810D 03450C                  add eax, dword ptr [ebp+0C]
:00438110 3DA8010000              cmp eax, 000001A8
:00438115 0F820E000000            jb 00438129
:0043811B B8A8010000              mov eax, 000001A8
:00438120 2B856CFEFFFF            sub eax, dword ptr [ebp+FFFFFE6C]
:00438126 89450C                  mov dword ptr [ebp+0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438115(C)
|
:00438129 E8F08EFCFF              call 0040101E
:0043812E 33C9                    xor ecx, ecx
:00438130 8AC8                    mov cl, al
:00438132 83F903                  cmp ecx, 00000003
:00438135 0F850C000000            jne 00438147
:0043813B C68590FEFFFF05          mov byte ptr [ebp+FFFFFE90], 05
:00438142 E907000000              jmp 0043814E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438135(C)
|
:00438147 C68590FEFFFF02          mov byte ptr [ebp+FFFFFE90], 02

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438142(U)
|
:0043814E 6A00                    push 00000000
:00438150 E833DDFEFF              call 00425E88
:00438155 83C404                  add esp, 00000004
:00438158 33C0                    xor eax, eax
:0043815A 8A85B0FEFFFF            mov al, byte ptr [ebp+FFFFFEB0]
:00438160 48                      dec eax
:00438161 83F801                  cmp eax, 00000001
:00438164 1BC0                    sbb eax, eax
:00438166 83E010                  and eax, 00000010
:00438169 33C9                    xor ecx, ecx
:0043816B 8A4D20                  mov cl, byte ptr [ebp+20]
:0043816E 8D44C810                lea eax, dword ptr [eax+8*ecx+10]
:00438172 898578FEFFFF            mov dword ptr [ebp+FFFFFE78], eax
:00438178 33C0                    xor eax, eax
:0043817A 8A85BCFEFFFF            mov al, byte ptr [ebp+FFFFFEBC]
:00438180 85C0                    test eax, eax
:00438182 0F8433000000            je 004381BB
:00438188 6A00                    push 00000000
:0043818A 33C0                    xor eax, eax
:0043818C 8A8590FEFFFF            mov al, byte ptr [ebp+FFFFFE90]
:00438192 50                      push eax
:00438193 8B856CFEFFFF            mov eax, dword ptr [ebp+FFFFFE6C]
:00438199 50                      push eax
:0043819A 8B8578FEFFFF            mov eax, dword ptr [ebp+FFFFFE78]
:004381A0 83C010                  add eax, 00000010
:004381A3 50                      push eax
:004381A4 8B450C                  mov eax, dword ptr [ebp+0C]
:004381A7 50                      push eax
:004381A8 8B4508                  mov eax, dword ptr [ebp+08]
:004381AB 50                      push eax
:004381AC B958BC4600              mov ecx, 0046BC58
:004381B1 E8B48BFEFF              call 00420D6A
:004381B6 E92C000000              jmp 004381E7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438182(C)
|
:004381BB 33C0                    xor eax, eax
:004381BD 8A8590FEFFFF            mov al, byte ptr [ebp+FFFFFE90]
:004381C3 50                      push eax
:004381C4 8B856CFEFFFF            mov eax, dword ptr [ebp+FFFFFE6C]
:004381CA 50                      push eax
:004381CB 8B8578FEFFFF            mov eax, dword ptr [ebp+FFFFFE78]
:004381D1 83C010                  add eax, 00000010
:004381D4 50                      push eax
:004381D5 8B450C                  mov eax, dword ptr [ebp+0C]
:004381D8 50                      push eax
:004381D9 8B4508                  mov eax, dword ptr [ebp+08]
:004381DC 50                      push eax
:004381DD B958BC4600              mov ecx, 0046BC58
:004381E2 E87B8DFEFF              call 00420F62

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004381B6(U)
|
:004381E7 8B856CFEFFFF            mov eax, dword ptr [ebp+FFFFFE6C]
:004381ED 83E810                  sub eax, 00000010
:004381F0 33C9                    xor ecx, ecx
:004381F2 8A8DC0FEFFFF            mov cl, byte ptr [ebp+FFFFFEC0]
:004381F8 33D2                    xor edx, edx
:004381FA 8A5514                  mov dl, byte ptr [ebp+14]
:004381FD 0FAFCA                  imul ecx, edx
:00438200 2BC1                    sub eax, ecx
:00438202 C1E801                  shr eax, 01
:00438205 018594FEFFFF            add dword ptr [ebp+FFFFFE94], eax
:0043820B 33C0                    xor eax, eax
:0043820D 8A4520                  mov al, byte ptr [ebp+20]
:00438210 8D04C510000000          lea eax, dword ptr [8*eax+00000010]
:00438217 034508                  add eax, dword ptr [ebp+08]
:0043821A 8985C8FEFFFF            mov dword ptr [ebp+FFFFFEC8], eax
:00438220 33C0                    xor eax, eax
:00438222 8A8574FEFFFF            mov al, byte ptr [ebp+FFFFFE74]
:00438228 50                      push eax
:00438229 33C0                    xor eax, eax
:0043822B 8A4514                  mov al, byte ptr [ebp+14]
:0043822E 50                      push eax
:0043822F 33C0                    xor eax, eax
:00438231 8A85C0FEFFFF            mov al, byte ptr [ebp+FFFFFEC0]
:00438237 33C9                    xor ecx, ecx
:00438239 8A4D14                  mov cl, byte ptr [ebp+14]
:0043823C 0FAFC1                  imul eax, ecx
:0043823F 50                      push eax
:00438240 8B8594FEFFFF            mov eax, dword ptr [ebp+FFFFFE94]
:00438246 03450C                  add eax, dword ptr [ebp+0C]
:00438249 50                      push eax
:0043824A 8B85C8FEFFFF            mov eax, dword ptr [ebp+FFFFFEC8]
:00438250 C1E803                  shr eax, 03
:00438253 50                      push eax
:00438254 8D8D98FEFFFF            lea ecx, dword ptr [ebp+FFFFFE98]
:0043825A E861150000              call 004397C0
:0043825F C645FC01                mov [ebp-04], 01
:00438263 33C0                    xor eax, eax
:00438265 8A85B0FEFFFF            mov al, byte ptr [ebp+FFFFFEB0]
:0043826B 83F801                  cmp eax, 00000001
:0043826E 0F8534000000            jne 004382A8
:00438274 837D2400                cmp dword ptr [ebp+24], 00000000
:00438278 0F841F000000            je 0043829D
:0043827E 33C0                    xor eax, eax
:00438280 8A4518                  mov al, byte ptr [ebp+18]
:00438283 A820                    test al, 20
:00438285 0F8412000000            je 0043829D
:0043828B 8B85B8FEFFFF            mov eax, dword ptr [ebp+FFFFFEB8]
:00438291 50                      push eax
:00438292 8D8D98FEFFFF            lea ecx, dword ptr [ebp+FFFFFE98]
:00438298 E8EB91FEFF              call 00421488

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00438278(C), :00438285(C)
|
:0043829D 8D8D98FEFFFF            lea ecx, dword ptr [ebp+FFFFFE98]
:004382A3 E8F18DFEFF              call 00421099

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043826E(C)
|
:004382A8 33C0                    xor eax, eax
:004382AA 8A8580FEFFFF            mov al, byte ptr [ebp+FFFFFE80]
:004382B0 85C0                    test eax, eax
:004382B2 0F8434010000            je 004383EC
:004382B8 6A04                    push 00000004
:004382BA B910BC4600              mov ecx, 0046BC10
:004382BF E8BD7BFEFF              call 0041FE81
:004382C4 6A07                    push 00000007
:004382C6 B910BC4600              mov ecx, 0046BC10
:004382CB E8037AFEFF              call 0041FCD3
:004382D0 6A00                    push 00000000
:004382D2 B910BC4600              mov ecx, 0046BC10
:004382D7 E8F47AFEFF              call 0041FDD0
:004382DC C68590FEFFFF00          mov byte ptr [ebp+FFFFFE90], 00
:004382E3 E906000000              jmp 004382EE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004383D6(U)
|
:004382E8 FE8590FEFFFF            inc byte ptr [ebp+FFFFFE90]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004382E3(U)
|
:004382EE 33C0                    xor eax, eax
:004382F0 8A8590FEFFFF            mov al, byte ptr [ebp+FFFFFE90]
:004382F6 33C9                    xor ecx, ecx
:004382F8 8A4D14                  mov cl, byte ptr [ebp+14]
:004382FB 3BC1                    cmp eax, ecx
:004382FD 0F8DD8000000            jnl 004383DB
:00438303 33C0                    xor eax, eax
:00438305 8A8590FEFFFF            mov al, byte ptr [ebp+FFFFFE90]
:0043830B 0385B8FEFFFF            add eax, dword ptr [ebp+FFFFFEB8]
:00438311 8B4D10                  mov ecx, dword ptr [ebp+10]
:00438314 8B0481                  mov eax, dword ptr [ecx+4*eax]
:00438317 50                      push eax
:00438318 E88DF00000              call 004473AA
:0043831D 83C404                  add esp, 00000004
:00438320 8985B4FEFFFF            mov dword ptr [ebp+FFFFFEB4], eax
:00438326 33C9                    xor ecx, ecx
:00438328 8A8DC0FEFFFF            mov cl, byte ptr [ebp+FFFFFEC0]
:0043832E 33C0                    xor eax, eax
:00438330 8A8590FEFFFF            mov al, byte ptr [ebp+FFFFFE90]
:00438336 0FAFC8                  imul ecx, eax
:00438339 33C0                    xor eax, eax
:0043833B 8A85C0FEFFFF            mov al, byte ptr [ebp+FFFFFEC0]
:00438341 83E810                  sub eax, 00000010
:00438344 99                      cdq
:00438345 2BC2                    sub eax, edx
:00438347 C1F801                  sar eax, 01
:0043834A 03C8                    add ecx, eax
:0043834C 038D94FEFFFF            add ecx, dword ptr [ebp+FFFFFE94]
:00438352 034D0C                  add ecx, dword ptr [ebp+0C]
:00438355 51                      push ecx
:00438356 33C0                    xor eax, eax
:00438358 8A4520                  mov al, byte ptr [ebp+20]
:0043835B 2B85B4FEFFFF            sub eax, dword ptr [ebp+FFFFFEB4]
:00438361 C1E801                  shr eax, 01
:00438364 8B4D08                  mov ecx, dword ptr [ebp+08]
:00438367 C1E903                  shr ecx, 03
:0043836A 03C1                    add eax, ecx
:0043836C 40                      inc eax
:0043836D 50                      push eax
:0043836E B910BC4600              mov ecx, 0046BC10
:00438373 E88F78FEFF              call 0041FC07
:00438378 837D1C00                cmp dword ptr [ebp+1C], 00000000
:0043837C 0F842D000000            je 004383AF
:00438382 33C0                    xor eax, eax
:00438384 8A8590FEFFFF            mov al, byte ptr [ebp+FFFFFE90]
:0043838A 0385B8FEFFFF            add eax, dword ptr [ebp+FFFFFEB8]
:00438390 8B4D1C                  mov ecx, dword ptr [ebp+1C]
:00438393 33D2                    xor edx, edx
:00438395 8A1408                  mov dl, byte ptr [eax+ecx]
:00438398 4A                      dec edx
:00438399 83FA01                  cmp edx, 00000001
:0043839C 1BC0                    sbb eax, eax
:0043839E 83E0FD                  and eax, FFFFFFFD
:004383A1 83C007                  add eax, 00000007
:004383A4 50                      push eax
:004383A5 B910BC4600              mov ecx, 0046BC10
:004383AA E82479FEFF              call 0041FCD3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043837C(C)
|
:004383AF 33C0                    xor eax, eax
:004383B1 8A8590FEFFFF            mov al, byte ptr [ebp+FFFFFE90]
:004383B7 0385B8FEFFFF            add eax, dword ptr [ebp+FFFFFEB8]
:004383BD 8B4D10                  mov ecx, dword ptr [ebp+10]
:004383C0 8B0481                  mov eax, dword ptr [ecx+4*eax]
:004383C3 50                      push eax

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:004383C4 685C324500              push 0045325C
:004383C9 6810BC4600              push 0046BC10
:004383CE E85087FEFF              call 00420B23
:004383D3 83C40C                  add esp, 0000000C
:004383D6 E90DFFFFFF              jmp 004382E8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004382FD(C)
|
:004383DB 6A07                    push 00000007
:004383DD B910BC4600              mov ecx, 0046BC10
:004383E2 E8EC78FEFF              call 0041FCD3
:004383E7 E921000000              jmp 0043840D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004382B2(C)
|
:004383EC 6A00                    push 00000000
:004383EE 6A14                    push 00000014
:004383F0 8B8594FEFFFF            mov eax, dword ptr [ebp+FFFFFE94]
:004383F6 03450C                  add eax, dword ptr [ebp+0C]
:004383F9 50                      push eax
:004383FA 8B4508                  mov eax, dword ptr [ebp+08]
:004383FD C1E803                  shr eax, 03
:00438400 40                      inc eax
:00438401 50                      push eax
:00438402 8D8DCCFEFFFF            lea ecx, dword ptr [ebp+FFFFFECC]
:00438408 E80898FEFF              call 00421C15

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004383E7(U)
|
:0043840D B988534500              mov ecx, 00455388
:00438412 E87198FCFF              call 00401C88
:00438417 C78584FEFFFFFEFF0000    mov dword ptr [ebp+FFFFFE84], 0000FFFE
:00438421 E8C1F0FFFF              call 004374E7
:00438426 C7857CFEFFFF01000000    mov dword ptr [ebp+FFFFFE7C], 00000001
:00438430 C785C4FEFFFFFEFF0000    mov dword ptr [ebp+FFFFFEC4], 0000FFFE
:0043843A C7858CFEFFFF00000000    mov dword ptr [ebp+FFFFFE8C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438A20(U)
|
:00438444 83BD7CFEFFFF00          cmp dword ptr [ebp+FFFFFE7C], 00000000
:0043844B 0F84D4050000            je 00438A25
:00438451 33C0                    xor eax, eax
:00438453 8A8580FEFFFF            mov al, byte ptr [ebp+FFFFFE80]
:00438459 85C0                    test eax, eax
:0043845B 0F857A000000            jne 004384DB
:00438461 6A00                    push 00000000
:00438463 E820DAFEFF              call 00425E88
:00438468 83C404                  add esp, 00000004
:0043846B B988534500              mov ecx, 00455388
:00438470 E80799FCFF              call 00401D7C
:00438475 85C0                    test eax, eax
:00438477 0F8459000000            je 004384D6
:0043847D 8D8DCCFEFFFF            lea ecx, dword ptr [ebp+FFFFFECC]
:00438483 E88E98FEFF              call 00421D16
:00438488 33C9                    xor ecx, ecx
:0043848A 8AC8                    mov cl, al
:0043848C 898D84FEFFFF            mov dword ptr [ebp+FFFFFE84], ecx
:00438492 81BD84FEFFFFFF000000    cmp dword ptr [ebp+FFFFFE84], 000000FF
:0043849C 0F8405000000            je 004384A7
:004384A2 E97E050000              jmp 00438A25

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043849C(C)
|
:004384A7 8D8DCCFEFFFF            lea ecx, dword ptr [ebp+FFFFFECC]
:004384AD E8D198FEFF              call 00421D83
:004384B2 85C0                    test eax, eax
:004384B4 0F851C000000            jne 004384D6
:004384BA 33C0                    xor eax, eax
:004384BC 8A4518                  mov al, byte ptr [ebp+18]
:004384BF A801                    test al, 01
:004384C1 0F850F000000            jne 004384D6
:004384C7 C78584FEFFFFFEFF0000    mov dword ptr [ebp+FFFFFE84], 0000FFFE
:004384D1 E94F050000              jmp 00438A25

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00438477(C), :004384B4(C), :004384C1(C)
|
:004384D6 E90B050000              jmp 004389E6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043845B(C)
|
:004384DB B988534500              mov ecx, 00455388
:004384E0 E80D98FCFF              call 00401CF2
:004384E5 B988534500              mov ecx, 00455388
:004384EA E8B10FFDFF              call 004094A0
:004384EF 898560FEFFFF            mov dword ptr [ebp+FFFFFE60], eax
:004384F5 B988534500              mov ecx, 00455388
:004384FA E8C10FFDFF              call 004094C0
:004384FF 898558FEFFFF            mov dword ptr [ebp+FFFFFE58], eax
:00438505 C7855CFEFFFF00000000    mov dword ptr [ebp+FFFFFE5C], 00000000
:0043850F 8B4508                  mov eax, dword ptr [ebp+08]
:00438512 398560FEFFFF            cmp dword ptr [ebp+FFFFFE60], eax
:00438518 0F8272000000            jb 00438590
:0043851E 8B85C8FEFFFF            mov eax, dword ptr [ebp+FFFFFEC8]
:00438524 398560FEFFFF            cmp dword ptr [ebp+FFFFFE60], eax
:0043852A 0F8360000000            jnb 00438590
:00438530 8B8594FEFFFF            mov eax, dword ptr [ebp+FFFFFE94]
:00438536 03450C                  add eax, dword ptr [ebp+0C]
:00438539 3B8558FEFFFF            cmp eax, dword ptr [ebp+FFFFFE58]
:0043853F 0F874B000000            ja 00438590
:00438545 33C0                    xor eax, eax
:00438547 8A85C0FEFFFF            mov al, byte ptr [ebp+FFFFFEC0]
:0043854D 33C9                    xor ecx, ecx
:0043854F 8A4D14                  mov cl, byte ptr [ebp+14]
:00438552 0FAFC1                  imul eax, ecx
:00438555 038594FEFFFF            add eax, dword ptr [ebp+FFFFFE94]
:0043855B 03450C                  add eax, dword ptr [ebp+0C]
:0043855E 3B8558FEFFFF            cmp eax, dword ptr [ebp+FFFFFE58]
:00438564 0F8626000000            jbe 00438590
:0043856A 8B8558FEFFFF            mov eax, dword ptr [ebp+FFFFFE58]
:00438570 2B450C                  sub eax, dword ptr [ebp+0C]
:00438573 2B8594FEFFFF            sub eax, dword ptr [ebp+FFFFFE94]
:00438579 33C9                    xor ecx, ecx
:0043857B 8A8DC0FEFFFF            mov cl, byte ptr [ebp+FFFFFEC0]
:00438581 2BD2                    sub edx, edx
:00438583 F7F1                    div ecx
:00438585 898584FEFFFF            mov dword ptr [ebp+FFFFFE84], eax
:0043858B E975000000              jmp 00438605

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00438518(C), :0043852A(C), :0043853F(C), :00438564(C)
|
:00438590 C78584FEFFFFFEFF0000    mov dword ptr [ebp+FFFFFE84], 0000FFFE
:0043859A 8B85C8FEFFFF            mov eax, dword ptr [ebp+FFFFFEC8]
:004385A0 398560FEFFFF            cmp dword ptr [ebp+FFFFFE60], eax
:004385A6 0F8259000000            jb 00438605
:004385AC 8B85C8FEFFFF            mov eax, dword ptr [ebp+FFFFFEC8]
:004385B2 83C010                  add eax, 00000010
:004385B5 3B8560FEFFFF            cmp eax, dword ptr [ebp+FFFFFE60]
:004385BB 0F8644000000            jbe 00438605
:004385C1 8B8594FEFFFF            mov eax, dword ptr [ebp+FFFFFE94]
:004385C7 03450C                  add eax, dword ptr [ebp+0C]
:004385CA 3B8558FEFFFF            cmp eax, dword ptr [ebp+FFFFFE58]
:004385D0 0F872F000000            ja 00438605
:004385D6 33C0                    xor eax, eax
:004385D8 8A85C0FEFFFF            mov al, byte ptr [ebp+FFFFFEC0]
:004385DE 33C9                    xor ecx, ecx
:004385E0 8A4D14                  mov cl, byte ptr [ebp+14]
:004385E3 0FAFC1                  imul eax, ecx
:004385E6 038594FEFFFF            add eax, dword ptr [ebp+FFFFFE94]
:004385EC 03450C                  add eax, dword ptr [ebp+0C]
:004385EF 3B8558FEFFFF            cmp eax, dword ptr [ebp+FFFFFE58]
:004385F5 0F860A000000            jbe 00438605
:004385FB C7855CFEFFFF01000000    mov dword ptr [ebp+FFFFFE5C], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043858B(U), :004385A6(C), :004385BB(C), :004385D0(C), :004385F5(C)
|
:00438605 8B8584FEFFFF            mov eax, dword ptr [ebp+FFFFFE84]
:0043860B 3985C4FEFFFF            cmp dword ptr [ebp+FFFFFEC4], eax
:00438611 0F8408010000            je 0043871F
:00438617 81BDC4FEFFFFFEFF0000    cmp dword ptr [ebp+FFFFFEC4], 0000FFFE
:00438621 0F845A000000            je 00438681
:00438627 83BD8CFEFFFF01          cmp dword ptr [ebp+FFFFFE8C], 00000001
:0043862E 0F8443000000            je 00438677
:00438634 B9A0E44600              mov ecx, 0046E4A0
:00438639 E8A20AFDFF              call 004090E0
:0043863E 50                      push eax
:0043863F 6A14                    push 00000014
:00438641 33C0                    xor eax, eax
:00438643 8A4520                  mov al, byte ptr [ebp+20]
:00438646 C1E003                  shl eax, 03
:00438649 50                      push eax
:0043864A 33C0                    xor eax, eax
:0043864C 8A85C0FEFFFF            mov al, byte ptr [ebp+FFFFFEC0]
:00438652 0FAF85C4FEFFFF          imul eax, dword ptr [ebp+FFFFFEC4]
:00438659 038594FEFFFF            add eax, dword ptr [ebp+FFFFFE94]
:0043865F 03450C                  add eax, dword ptr [ebp+0C]
:00438662 50                      push eax
:00438663 8B4508                  mov eax, dword ptr [ebp+08]
:00438666 83C008                  add eax, 00000008
:00438669 50                      push eax
:0043866A E830D10000              call 0044579F
:0043866F 83C414                  add esp, 00000014
:00438672 E90A000000              jmp 00438681

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043862E(C)
|
:00438677 C7858CFEFFFF00000000    mov dword ptr [ebp+FFFFFE8C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00438621(C), :00438672(U)
|
:00438681 81BD84FEFFFFFEFF0000    cmp dword ptr [ebp+FFFFFE84], 0000FFFE
:0043868B 0F8478000000            je 00438709
:00438691 B9A0E44600              mov ecx, 0046E4A0
:00438696 E8450AFDFF              call 004090E0
:0043869B 50                      push eax
:0043869C 6A14                    push 00000014
:0043869E 33C0                    xor eax, eax
:004386A0 8A4520                  mov al, byte ptr [ebp+20]
:004386A3 C1E003                  shl eax, 03
:004386A6 50                      push eax
:004386A7 33C0                    xor eax, eax
:004386A9 8A85C0FEFFFF            mov al, byte ptr [ebp+FFFFFEC0]
:004386AF 0FAF8584FEFFFF          imul eax, dword ptr [ebp+FFFFFE84]
:004386B6 038594FEFFFF            add eax, dword ptr [ebp+FFFFFE94]
:004386BC 03450C                  add eax, dword ptr [ebp+0C]
:004386BF 50                      push eax
:004386C0 8B4508                  mov eax, dword ptr [ebp+08]
:004386C3 83C008                  add eax, 00000008
:004386C6 50                      push eax
:004386C7 E88FD20000              call 0044595B
:004386CC 83C414                  add esp, 00000014
:004386CF 6A07                    push 00000007
:004386D1 6A01                    push 00000001
:004386D3 6A14                    push 00000014
:004386D5 33C0                    xor eax, eax
:004386D7 8A4520                  mov al, byte ptr [ebp+20]
:004386DA C1E003                  shl eax, 03
:004386DD 83E808                  sub eax, 00000008
:004386E0 50                      push eax
:004386E1 33C0                    xor eax, eax
:004386E3 8A85C0FEFFFF            mov al, byte ptr [ebp+FFFFFEC0]
:004386E9 0FAF8584FEFFFF          imul eax, dword ptr [ebp+FFFFFE84]
:004386F0 038594FEFFFF            add eax, dword ptr [ebp+FFFFFE94]
:004386F6 03450C                  add eax, dword ptr [ebp+0C]
:004386F9 50                      push eax
:004386FA 8B4508                  mov eax, dword ptr [ebp+08]
:004386FD 83C00C                  add eax, 0000000C
:00438700 50                      push eax
:00438701 E871E9FEFF              call 00427077
:00438706 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043868B(C)
|
:00438709 B988534500              mov ecx, 00455388
:0043870E E87595FCFF              call 00401C88
:00438713 8B8584FEFFFF            mov eax, dword ptr [ebp+FFFFFE84]
:00438719 8985C4FEFFFF            mov dword ptr [ebp+FFFFFEC4], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438611(C)
|
:0043871F B988534500              mov ecx, 00455388
:00438724 E85396FCFF              call 00401D7C
:00438729 85C0                    test eax, eax
:0043872B 0F84B5020000            je 004389E6
:00438731 C7858CFEFFFF00000000    mov dword ptr [ebp+FFFFFE8C], 00000000
:0043873B 33C0                    xor eax, eax
:0043873D 8A85B0FEFFFF            mov al, byte ptr [ebp+FFFFFEB0]
:00438743 83F801                  cmp eax, 00000001
:00438746 0F8539000000            jne 00438785
:0043874C 8D8D98FEFFFF            lea ecx, dword ptr [ebp+FFFFFE98]
:00438752 E87E89FEFF              call 004210D5
:00438757 89854CFEFFFF            mov dword ptr [ebp+FFFFFE4C], eax
:0043875D 8B854CFEFFFF            mov eax, dword ptr [ebp+FFFFFE4C]
:00438763 3985B8FEFFFF            cmp dword ptr [ebp+FFFFFEB8], eax
:00438769 0F8416000000            je 00438785
:0043876F 8B854CFEFFFF            mov eax, dword ptr [ebp+FFFFFE4C]
:00438775 8985B8FEFFFF            mov dword ptr [ebp+FFFFFEB8], eax
:0043877B C78570FEFFFF01000000    mov dword ptr [ebp+FFFFFE70], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00438746(C), :00438769(C)
|
:00438785 B988534500              mov ecx, 00455388
:0043878A E86395FCFF              call 00401CF2
:0043878F B988534500              mov ecx, 00455388
:00438794 E8070DFDFF              call 004094A0
:00438799 898554FEFFFF            mov dword ptr [ebp+FFFFFE54], eax
:0043879F B988534500              mov ecx, 00455388
:004387A4 E8170DFDFF              call 004094C0
:004387A9 898550FEFFFF            mov dword ptr [ebp+FFFFFE50], eax
:004387AF 8B4508                  mov eax, dword ptr [ebp+08]
:004387B2 398554FEFFFF            cmp dword ptr [ebp+FFFFFE54], eax
:004387B8 0F8251000000            jb 0043880F
:004387BE 8B85C8FEFFFF            mov eax, dword ptr [ebp+FFFFFEC8]
:004387C4 398554FEFFFF            cmp dword ptr [ebp+FFFFFE54], eax
:004387CA 0F833F000000            jnb 0043880F
:004387D0 8B8594FEFFFF            mov eax, dword ptr [ebp+FFFFFE94]
:004387D6 03450C                  add eax, dword ptr [ebp+0C]
:004387D9 3B8550FEFFFF            cmp eax, dword ptr [ebp+FFFFFE50]
:004387DF 0F872A000000            ja 0043880F
:004387E5 33C0                    xor eax, eax
:004387E7 8A85C0FEFFFF            mov al, byte ptr [ebp+FFFFFEC0]
:004387ED 33C9                    xor ecx, ecx
:004387EF 8A4D14                  mov cl, byte ptr [ebp+14]
:004387F2 0FAFC1                  imul eax, ecx
:004387F5 038594FEFFFF            add eax, dword ptr [ebp+FFFFFE94]
:004387FB 03450C                  add eax, dword ptr [ebp+0C]
:004387FE 3B8550FEFFFF            cmp eax, dword ptr [ebp+FFFFFE50]
:00438804 0F8605000000            jbe 0043880F
:0043880A E90A000000              jmp 00438819

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004387B8(C), :004387CA(C), :004387DF(C), :00438804(C)
|
:0043880F C78584FEFFFFFF000000    mov dword ptr [ebp+FFFFFE84], 000000FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043880A(U)
|
:00438819 83BD70FEFFFF00          cmp dword ptr [ebp+FFFFFE70], 00000000
:00438820 0F8470010000            je 00438996
:00438826 C7858CFEFFFF01000000    mov dword ptr [ebp+FFFFFE8C], 00000001
:00438830 C785C4FEFFFFFF000000    mov dword ptr [ebp+FFFFFEC4], 000000FF
:0043883A 8B85C4FEFFFF            mov eax, dword ptr [ebp+FFFFFEC4]
:00438840 898584FEFFFF            mov dword ptr [ebp+FFFFFE84], eax
:00438846 68FFFF0000              push 0000FFFF
:0043884B 33C0                    xor eax, eax
:0043884D 8A85C0FEFFFF            mov al, byte ptr [ebp+FFFFFEC0]
:00438853 33C9                    xor ecx, ecx
:00438855 8A4D14                  mov cl, byte ptr [ebp+14]
:00438858 0FAFC1                  imul eax, ecx
:0043885B 50                      push eax
:0043885C 33C0                    xor eax, eax
:0043885E 8A4520                  mov al, byte ptr [ebp+20]
:00438861 C1E003                  shl eax, 03
:00438864 50                      push eax
:00438865 8B8594FEFFFF            mov eax, dword ptr [ebp+FFFFFE94]
:0043886B 03450C                  add eax, dword ptr [ebp+0C]
:0043886E 50                      push eax
:0043886F 8B4508                  mov eax, dword ptr [ebp+08]
:00438872 83C008                  add eax, 00000008
:00438875 50                      push eax
:00438876 E88FE9FEFF              call 0042720A
:0043887B 83C414                  add esp, 00000014
:0043887E C68590FEFFFF00          mov byte ptr [ebp+FFFFFE90], 00
:00438885 E906000000              jmp 00438890

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438978(U)
|
:0043888A FE8590FEFFFF            inc byte ptr [ebp+FFFFFE90]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438885(U)
|
:00438890 33C0                    xor eax, eax
:00438892 8A8590FEFFFF            mov al, byte ptr [ebp+FFFFFE90]
:00438898 33C9                    xor ecx, ecx
:0043889A 8A4D14                  mov cl, byte ptr [ebp+14]
:0043889D 3BC1                    cmp eax, ecx
:0043889F 0F8DD8000000            jnl 0043897D
:004388A5 33C0                    xor eax, eax
:004388A7 8A8590FEFFFF            mov al, byte ptr [ebp+FFFFFE90]
:004388AD 0385B8FEFFFF            add eax, dword ptr [ebp+FFFFFEB8]
:004388B3 8B4D10                  mov ecx, dword ptr [ebp+10]
:004388B6 8B0481                  mov eax, dword ptr [ecx+4*eax]
:004388B9 50                      push eax
:004388BA E8EBEA0000              call 004473AA
:004388BF 83C404                  add esp, 00000004
:004388C2 8985B4FEFFFF            mov dword ptr [ebp+FFFFFEB4], eax
:004388C8 33C9                    xor ecx, ecx
:004388CA 8A8DC0FEFFFF            mov cl, byte ptr [ebp+FFFFFEC0]
:004388D0 33C0                    xor eax, eax
:004388D2 8A8590FEFFFF            mov al, byte ptr [ebp+FFFFFE90]
:004388D8 0FAFC8                  imul ecx, eax
:004388DB 33C0                    xor eax, eax
:004388DD 8A85C0FEFFFF            mov al, byte ptr [ebp+FFFFFEC0]
:004388E3 83E810                  sub eax, 00000010
:004388E6 99                      cdq
:004388E7 2BC2                    sub eax, edx
:004388E9 C1F801                  sar eax, 01
:004388EC 03C8                    add ecx, eax
:004388EE 038D94FEFFFF            add ecx, dword ptr [ebp+FFFFFE94]
:004388F4 034D0C                  add ecx, dword ptr [ebp+0C]
:004388F7 51                      push ecx
:004388F8 33C0                    xor eax, eax
:004388FA 8A4520                  mov al, byte ptr [ebp+20]
:004388FD 2B85B4FEFFFF            sub eax, dword ptr [ebp+FFFFFEB4]
:00438903 C1E801                  shr eax, 01
:00438906 8B4D08                  mov ecx, dword ptr [ebp+08]
:00438909 C1E903                  shr ecx, 03
:0043890C 03C1                    add eax, ecx
:0043890E 40                      inc eax
:0043890F 50                      push eax
:00438910 B910BC4600              mov ecx, 0046BC10
:00438915 E8ED72FEFF              call 0041FC07
:0043891A 837D1C00                cmp dword ptr [ebp+1C], 00000000
:0043891E 0F842D000000            je 00438951
:00438924 33C0                    xor eax, eax
:00438926 8A8590FEFFFF            mov al, byte ptr [ebp+FFFFFE90]
:0043892C 0385B8FEFFFF            add eax, dword ptr [ebp+FFFFFEB8]
:00438932 8B4D1C                  mov ecx, dword ptr [ebp+1C]
:00438935 33D2                    xor edx, edx
:00438937 8A1408                  mov dl, byte ptr [eax+ecx]
:0043893A 4A                      dec edx
:0043893B 83FA01                  cmp edx, 00000001
:0043893E 1BC0                    sbb eax, eax
:00438940 83E0FD                  and eax, FFFFFFFD
:00438943 83C007                  add eax, 00000007
:00438946 50                      push eax
:00438947 B910BC4600              mov ecx, 0046BC10
:0043894C E88273FEFF              call 0041FCD3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043891E(C)
|
:00438951 33C0                    xor eax, eax
:00438953 8A8590FEFFFF            mov al, byte ptr [ebp+FFFFFE90]
:00438959 0385B8FEFFFF            add eax, dword ptr [ebp+FFFFFEB8]
:0043895F 8B4D10                  mov ecx, dword ptr [ebp+10]
:00438962 8B0481                  mov eax, dword ptr [ecx+4*eax]
:00438965 50                      push eax

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:00438966 6860324500              push 00453260
:0043896B 6810BC4600              push 0046BC10
:00438970 E8AE81FEFF              call 00420B23
:00438975 83C40C                  add esp, 0000000C
:00438978 E90DFFFFFF              jmp 0043888A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043889F(C)
|
:0043897D B988534500              mov ecx, 00455388
:00438982 E80193FCFF              call 00401C88
:00438987 C78570FEFFFF00000000    mov dword ptr [ebp+FFFFFE70], 00000000
:00438991 E851EBFFFF              call 004374E7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438820(C)
|
:00438996 81BD84FEFFFFFEFF0000    cmp dword ptr [ebp+FFFFFE84], 0000FFFE
:004389A0 0F842E000000            je 004389D4
:004389A6 81BD84FEFFFFFF000000    cmp dword ptr [ebp+FFFFFE84], 000000FF
:004389B0 0F841E000000            je 004389D4
:004389B6 6A00                    push 00000000
:004389B8 B994A64600              mov ecx, 0046A694
:004389BD E86206FEFF              call 00419024
:004389C2 83BD8CFEFFFF01          cmp dword ptr [ebp+FFFFFE8C], 00000001
:004389C9 0F8405000000            je 004389D4
:004389CF E951000000              jmp 00438A25

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004389A0(C), :004389B0(C), :004389C9(C)
|
:004389D4 83BD5CFEFFFF00          cmp dword ptr [ebp+FFFFFE5C], 00000000
:004389DB 0F8505000000            jne 004389E6
:004389E1 E93F000000              jmp 00438A25

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004384D6(U), :0043872B(C), :004389DB(C)
|
:004389E6 B988534500              mov ecx, 00455388
:004389EB E8AC93FCFF              call 00401D9C
:004389F0 85C0                    test eax, eax
:004389F2 0F8428000000            je 00438A20
:004389F8 33C0                    xor eax, eax
:004389FA 8A4518                  mov al, byte ptr [ebp+18]
:004389FD A801                    test al, 01
:004389FF 0F851B000000            jne 00438A20
:00438A05 6A01                    push 00000001
:00438A07 B994A64600              mov ecx, 0046A694
:00438A0C E81306FEFF              call 00419024
:00438A11 C78584FEFFFFFEFF0000    mov dword ptr [ebp+FFFFFE84], 0000FFFE
:00438A1B E905000000              jmp 00438A25

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004389F2(C), :004389FF(C)
|
:00438A20 E91FFAFFFF              jmp 00438444

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043844B(C), :004384A2(U), :004384D1(U), :004389CF(U), :004389E1(U)
|:00438A1B(U)
|
:00438A25 E8BDEAFFFF              call 004374E7
:00438A2A 33C0                    xor eax, eax
:00438A2C 8A85BCFEFFFF            mov al, byte ptr [ebp+FFFFFEBC]
:00438A32 85C0                    test eax, eax
:00438A34 0F8405000000            je 00438A3F
:00438A3A E90A000000              jmp 00438A49

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438A34(C)
|
:00438A3F B958BC4600              mov ecx, 0046BC58
:00438A44 E89385FEFF              call 00420FDC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438A3A(U)
|
:00438A49 837D2400                cmp dword ptr [ebp+24], 00000000
:00438A4D 0F8418000000            je 00438A6B
:00438A53 33C0                    xor eax, eax
:00438A55 8A4518                  mov al, byte ptr [ebp+18]
:00438A58 A820                    test al, 20
:00438A5A 0F840B000000            je 00438A6B
:00438A60 8A85B8FEFFFF            mov al, byte ptr [ebp+FFFFFEB8]
:00438A66 8B4D24                  mov ecx, dword ptr [ebp+24]
:00438A69 8801                    mov byte ptr [ecx], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00438A4D(C), :00438A5A(C)
|
:00438A6B 81BD84FEFFFFFEFF0000    cmp dword ptr [ebp+FFFFFE84], 0000FFFE
:00438A75 0F850C000000            jne 00438A87
:00438A7B C68548FEFFFFFF          mov byte ptr [ebp+FFFFFE48], FF
:00438A82 E912000000              jmp 00438A99

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438A75(C)
|
:00438A87 8B85B8FEFFFF            mov eax, dword ptr [ebp+FFFFFEB8]
:00438A8D 038584FEFFFF            add eax, dword ptr [ebp+FFFFFE84]
:00438A93 888548FEFFFF            mov byte ptr [ebp+FFFFFE48], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438A82(U)
|
:00438A99 C645FC00                mov [ebp-04], 00
:00438A9D E817000000              call 00438AB9
:00438AA2 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00438AA9 E817000000              call 00438AC5
:00438AAE 8A8548FEFFFF            mov al, byte ptr [ebp+FFFFFE48]
:00438AB4 E922000000              jmp 00438ADB

* Referenced by a CALL at Address:
|:00438A9D   
|
:00438AB9 8D8D98FEFFFF            lea ecx, dword ptr [ebp+FFFFFE98]
:00438ABF E83C0D0000              call 00439800
:00438AC4 C3                      ret



* Referenced by a CALL at Address:
|:00438AA9   
|
:00438AC5 8D8DCCFEFFFF            lea ecx, dword ptr [ebp+FFFFFECC]
:00438ACB E8400F0000              call 00439A10
:00438AD0 C3                      ret


:00438AD1 B810C24400              mov eax, 0044C210
:00438AD6 E9E5F50000              jmp 004480C0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438AB4(U)
|
:00438ADB 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00438ADE 64890D00000000          mov dword ptr fs:[00000000], ecx
:00438AE5 5F                      pop edi
:00438AE6 5E                      pop esi
:00438AE7 5B                      pop ebx
:00438AE8 C9                      leave
:00438AE9 C3                      ret



* Referenced by a CALL at Addresses:
|:00402A21   , :00429482   , :004294BC   , :00438B81   , :00438D26   
|
:00438AEA 55                      push ebp
:00438AEB 8BEC                    mov ebp, esp
:00438AED 83EC0C                  sub esp, 0000000C
:00438AF0 53                      push ebx
:00438AF1 56                      push esi
:00438AF2 57                      push edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438B05(U)
|
:00438AF3 8B4508                  mov eax, dword ptr [ebp+08]
:00438AF6 33C9                    xor ecx, ecx
:00438AF8 8A08                    mov cl, byte ptr [eax]
:00438AFA 85C9                    test ecx, ecx
:00438AFC 0F8408000000            je 00438B0A
:00438B02 FF4508                  inc [ebp+08]
:00438B05 E9E9FFFFFF              jmp 00438AF3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438AFC(C)
|
:00438B0A 8D45F4                  lea eax, dword ptr [ebp-0C]
:00438B0D 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438B3A(C)
|
:00438B10 B90A000000              mov ecx, 0000000A
:00438B15 8B450C                  mov eax, dword ptr [ebp+0C]
:00438B18 2BD2                    sub edx, edx
:00438B1A F7F1                    div ecx
:00438B1C 8D4230                  lea eax, dword ptr [edx+30]
:00438B1F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00438B22 8801                    mov byte ptr [ecx], al
:00438B24 FF45FC                  inc [ebp-04]
:00438B27 B90A000000              mov ecx, 0000000A
:00438B2C 8B450C                  mov eax, dword ptr [ebp+0C]
:00438B2F 2BD2                    sub edx, edx
:00438B31 F7F1                    div ecx
:00438B33 89450C                  mov dword ptr [ebp+0C], eax
:00438B36 837D0C00                cmp dword ptr [ebp+0C], 00000000
:00438B3A 0F85D0FFFFFF            jne 00438B10

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438B56(C)
|
:00438B40 FF4DFC                  dec [ebp-04]
:00438B43 8B45FC                  mov eax, dword ptr [ebp-04]
:00438B46 8A00                    mov al, byte ptr [eax]
:00438B48 8B4D08                  mov ecx, dword ptr [ebp+08]
:00438B4B 8801                    mov byte ptr [ecx], al
:00438B4D FF4508                  inc [ebp+08]
:00438B50 8D45F4                  lea eax, dword ptr [ebp-0C]
:00438B53 3945FC                  cmp dword ptr [ebp-04], eax
:00438B56 0F85E4FFFFFF            jne 00438B40
:00438B5C 8B4508                  mov eax, dword ptr [ebp+08]
:00438B5F C60000                  mov byte ptr [eax], 00
:00438B62 E900000000              jmp 00438B67

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438B62(U)
|
:00438B67 5F                      pop edi
:00438B68 5E                      pop esi
:00438B69 5B                      pop ebx
:00438B6A C9                      leave
:00438B6B C3                      ret



* Referenced by a CALL at Addresses:
|:00438D51   , :00439BC3   
|
:00438B6C 55                      push ebp
:00438B6D 8BEC                    mov ebp, esp
:00438B6F 83EC14                  sub esp, 00000014
:00438B72 53                      push ebx
:00438B73 56                      push esi
:00438B74 57                      push edi
:00438B75 C645EC00                mov [ebp-14], 00
:00438B79 8B450C                  mov eax, dword ptr [ebp+0C]
:00438B7C 50                      push eax
:00438B7D 8D45EC                  lea eax, dword ptr [ebp-14]
:00438B80 50                      push eax
:00438B81 E864FFFFFF              call 00438AEA
:00438B86 83C408                  add esp, 00000008
:00438B89 8B4508                  mov eax, dword ptr [ebp+08]
:00438B8C 8945FC                  mov dword ptr [ebp-04], eax
:00438B8F C645F800                mov [ebp-08], 00
:00438B93 E903000000              jmp 00438B9B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438BD0(U)
|
:00438B98 FE45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438B93(U)
|
:00438B9B 33C0                    xor eax, eax
:00438B9D 8A45F8                  mov al, byte ptr [ebp-08]
:00438BA0 33C9                    xor ecx, ecx
:00438BA2 8A4C05EC                mov cl, byte ptr [ebp+eax-14]
:00438BA6 85C9                    test ecx, ecx
:00438BA8 0F8427000000            je 00438BD5
:00438BAE 8B45FC                  mov eax, dword ptr [ebp-04]
:00438BB1 C600A3                  mov byte ptr [eax], A3
:00438BB4 FF45FC                  inc [ebp-04]
:00438BB7 33C0                    xor eax, eax
:00438BB9 8A45F8                  mov al, byte ptr [ebp-08]
:00438BBC 33C9                    xor ecx, ecx
:00438BBE 8A4C05EC                mov cl, byte ptr [ebp+eax-14]
:00438BC2 81C180000000            add ecx, 00000080
:00438BC8 8B45FC                  mov eax, dword ptr [ebp-04]
:00438BCB 8808                    mov byte ptr [eax], cl
:00438BCD FF45FC                  inc [ebp-04]
:00438BD0 E9C3FFFFFF              jmp 00438B98

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438BA8(C)
|
:00438BD5 8B45FC                  mov eax, dword ptr [ebp-04]
:00438BD8 C60000                  mov byte ptr [eax], 00
:00438BDB E900000000              jmp 00438BE0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438BDB(U)
|
:00438BE0 5F                      pop edi
:00438BE1 5E                      pop esi
:00438BE2 5B                      pop ebx
:00438BE3 C9                      leave
:00438BE4 C3                      ret



* Referenced by a CALL at Addresses:
|:00438E56   , :00438F8C   
|
:00438BE5 55                      push ebp
:00438BE6 8BEC                    mov ebp, esp
:00438BE8 83EC4C                  sub esp, 0000004C
:00438BEB 53                      push ebx
:00438BEC 56                      push esi
:00438BED 57                      push edi
:00438BEE C745F8B0F94600          mov [ebp-08], 0046F9B0
:00438BF5 8B4508                  mov eax, dword ptr [ebp+08]
:00438BF8 8B00                    mov eax, dword ptr [eax]
:00438BFA 8945C0                  mov dword ptr [ebp-40], eax
:00438BFD 8B4508                  mov eax, dword ptr [ebp+08]
:00438C00 83C004                  add eax, 00000004
:00438C03 8945EC                  mov dword ptr [ebp-14], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438E37(U)
|
:00438C06 8B45C0                  mov eax, dword ptr [ebp-40]
:00438C09 33C9                    xor ecx, ecx
:00438C0B 8A08                    mov cl, byte ptr [eax]
:00438C0D 85C9                    test ecx, ecx
:00438C0F 0F8427020000            je 00438E3C
:00438C15 8B45C0                  mov eax, dword ptr [ebp-40]
:00438C18 33C9                    xor ecx, ecx
:00438C1A 8A08                    mov cl, byte ptr [eax]
:00438C1C 81F980000000            cmp ecx, 00000080
:00438C22 0F8DEF010000            jnl 00438E17
:00438C28 8B45C0                  mov eax, dword ptr [ebp-40]
:00438C2B 33C9                    xor ecx, ecx
:00438C2D 8A08                    mov cl, byte ptr [eax]
:00438C2F 83F925                  cmp ecx, 00000025
:00438C32 0F85CA010000            jne 00438E02
:00438C38 FF45C0                  inc [ebp-40]
:00438C3B 8B45C0                  mov eax, dword ptr [ebp-40]
:00438C3E 33C9                    xor ecx, ecx
:00438C40 8A08                    mov cl, byte ptr [eax]
:00438C42 83F930                  cmp ecx, 00000030
:00438C45 0F8E25000000            jle 00438C70
:00438C4B 8B45C0                  mov eax, dword ptr [ebp-40]
:00438C4E 33C9                    xor ecx, ecx
:00438C50 8A08                    mov cl, byte ptr [eax]
:00438C52 83F939                  cmp ecx, 00000039
:00438C55 0F8D15000000            jnl 00438C70
:00438C5B 8B45C0                  mov eax, dword ptr [ebp-40]
:00438C5E 33C9                    xor ecx, ecx
:00438C60 8A08                    mov cl, byte ptr [eax]
:00438C62 83E930                  sub ecx, 00000030
:00438C65 894DFC                  mov dword ptr [ebp-04], ecx
:00438C68 FF45C0                  inc [ebp-40]
:00438C6B E907000000              jmp 00438C77

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00438C45(C), :00438C55(C)
|
:00438C70 C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438C6B(U)
|
:00438C77 8B45C0                  mov eax, dword ptr [ebp-40]
:00438C7A 8945B8                  mov dword ptr [ebp-48], eax
:00438C7D FF45C0                  inc [ebp-40]
:00438C80 8B45B8                  mov eax, dword ptr [ebp-48]
:00438C83 33C9                    xor ecx, ecx
:00438C85 8A08                    mov cl, byte ptr [eax]
:00438C87 894DB4                  mov dword ptr [ebp-4C], ecx
:00438C8A E94B010000              jmp 00438DDA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438DDE(C)
|
:00438C8F 8B45F8                  mov eax, dword ptr [ebp-08]
:00438C92 C60000                  mov byte ptr [eax], 00
:00438C95 8B45EC                  mov eax, dword ptr [ebp-14]
:00438C98 8B00                    mov eax, dword ptr [eax]
:00438C9A 50                      push eax
:00438C9B 8B45F8                  mov eax, dword ptr [ebp-08]
:00438C9E 50                      push eax
:00438C9F E84CE70000              call 004473F0
:00438CA4 83C408                  add esp, 00000008
:00438CA7 8B45EC                  mov eax, dword ptr [ebp-14]
:00438CAA 8B00                    mov eax, dword ptr [eax]
:00438CAC 50                      push eax
:00438CAD E8F8E60000              call 004473AA
:00438CB2 83C404                  add esp, 00000004
:00438CB5 8845F4                  mov byte ptr [ebp-0C], al
:00438CB8 33C0                    xor eax, eax
:00438CBA 8A45F4                  mov al, byte ptr [ebp-0C]
:00438CBD 0145F8                  add dword ptr [ebp-08], eax
:00438CC0 33C0                    xor eax, eax
:00438CC2 8A45F4                  mov al, byte ptr [ebp-0C]
:00438CC5 3B45FC                  cmp eax, dword ptr [ebp-04]
:00438CC8 0F8330000000            jnb 00438CFE
:00438CCE C745F000000000          mov [ebp-10], 00000000
:00438CD5 E903000000              jmp 00438CDD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438CF9(U)
|
:00438CDA FF45F0                  inc [ebp-10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438CD5(U)
|
:00438CDD 8B45FC                  mov eax, dword ptr [ebp-04]
:00438CE0 33C9                    xor ecx, ecx
:00438CE2 8A4DF4                  mov cl, byte ptr [ebp-0C]
:00438CE5 2BC1                    sub eax, ecx
:00438CE7 3B45F0                  cmp eax, dword ptr [ebp-10]
:00438CEA 0F860E000000            jbe 00438CFE
:00438CF0 8B45F8                  mov eax, dword ptr [ebp-08]
:00438CF3 C60020                  mov byte ptr [eax], 20
:00438CF6 FF45F8                  inc [ebp-08]
:00438CF9 E9DCFFFFFF              jmp 00438CDA

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00438CC8(C), :00438CEA(C)
|
:00438CFE 8345EC04                add dword ptr [ebp-14], 00000004
:00438D02 E9F6000000              jmp 00438DFD

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00438DE8(C), :00438DF2(C)
|
:00438D07 C645C400                mov [ebp-3C], 00
:00438D0B 8B45C0                  mov eax, dword ptr [ebp-40]
:00438D0E 33C9                    xor ecx, ecx
:00438D10 8A48FF                  mov cl, byte ptr [eax-01]
:00438D13 83F975                  cmp ecx, 00000075
:00438D16 0F8517000000            jne 00438D33
:00438D1C 8B45EC                  mov eax, dword ptr [ebp-14]
:00438D1F 8B00                    mov eax, dword ptr [eax]
:00438D21 50                      push eax
:00438D22 8D45C4                  lea eax, dword ptr [ebp-3C]
:00438D25 50                      push eax
:00438D26 E8BFFDFFFF              call 00438AEA
:00438D2B 83C408                  add esp, 00000008
:00438D2E E926000000              jmp 00438D59

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438D16(C)
|
:00438D33 C165FC01                shl dword ptr [ebp-04], 01
:00438D37 6A00                    push 00000000
:00438D39 6A14                    push 00000014
:00438D3B 8D45C4                  lea eax, dword ptr [ebp-3C]
:00438D3E 50                      push eax
:00438D3F E81FE70000              call 00447463
:00438D44 83C40C                  add esp, 0000000C
:00438D47 8B45EC                  mov eax, dword ptr [ebp-14]
:00438D4A 8B00                    mov eax, dword ptr [eax]
:00438D4C 50                      push eax
:00438D4D 8D45C4                  lea eax, dword ptr [ebp-3C]
:00438D50 50                      push eax
:00438D51 E816FEFFFF              call 00438B6C
:00438D56 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438D2E(U)
|
:00438D59 8D45C4                  lea eax, dword ptr [ebp-3C]
:00438D5C 50                      push eax
:00438D5D E848E60000              call 004473AA
:00438D62 83C404                  add esp, 00000004
:00438D65 8845F4                  mov byte ptr [ebp-0C], al
:00438D68 33C0                    xor eax, eax
:00438D6A 8A45F4                  mov al, byte ptr [ebp-0C]
:00438D6D 3B45FC                  cmp eax, dword ptr [ebp-04]
:00438D70 0F8331000000            jnb 00438DA7
:00438D76 C645BC00                mov [ebp-44], 00
:00438D7A E903000000              jmp 00438D82

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438DA2(U)
|
:00438D7F FE45BC                  inc [ebp-44]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438D7A(U)
|
:00438D82 8B45FC                  mov eax, dword ptr [ebp-04]
:00438D85 33C9                    xor ecx, ecx
:00438D87 8A4DF4                  mov cl, byte ptr [ebp-0C]
:00438D8A 2BC1                    sub eax, ecx
:00438D8C 33C9                    xor ecx, ecx
:00438D8E 8A4DBC                  mov cl, byte ptr [ebp-44]
:00438D91 3BC1                    cmp eax, ecx
:00438D93 0F860E000000            jbe 00438DA7
:00438D99 8B45F8                  mov eax, dword ptr [ebp-08]
:00438D9C C60020                  mov byte ptr [eax], 20
:00438D9F FF45F8                  inc [ebp-08]
:00438DA2 E9D8FFFFFF              jmp 00438D7F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00438D70(C), :00438D93(C)
|
:00438DA7 8B45F8                  mov eax, dword ptr [ebp-08]
:00438DAA C60000                  mov byte ptr [eax], 00
:00438DAD 8D45C4                  lea eax, dword ptr [ebp-3C]
:00438DB0 50                      push eax
:00438DB1 8B45F8                  mov eax, dword ptr [ebp-08]
:00438DB4 50                      push eax
:00438DB5 E813E60000              call 004473CD
:00438DBA 83C408                  add esp, 00000008
:00438DBD 8D45C4                  lea eax, dword ptr [ebp-3C]
:00438DC0 50                      push eax
:00438DC1 E8E4E50000              call 004473AA
:00438DC6 83C404                  add esp, 00000004
:00438DC9 0145F8                  add dword ptr [ebp-08], eax
:00438DCC 8345EC04                add dword ptr [ebp-14], 00000004
:00438DD0 E928000000              jmp 00438DFD
:00438DD5 E923000000              jmp 00438DFD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438C8A(U)
|
:00438DDA 837DB473                cmp dword ptr [ebp-4C], 00000073
:00438DDE 0F84ABFEFFFF            je 00438C8F
:00438DE4 837DB475                cmp dword ptr [ebp-4C], 00000075
:00438DE8 0F8419FFFFFF            je 00438D07
:00438DEE 837DB477                cmp dword ptr [ebp-4C], 00000077
:00438DF2 0F840FFFFFFF            je 00438D07
:00438DF8 E900000000              jmp 00438DFD

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00438D02(U), :00438DD0(U), :00438DD5(U), :00438DF8(U)
|
:00438DFD E910000000              jmp 00438E12

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438C32(C)
|
:00438E02 8B45C0                  mov eax, dword ptr [ebp-40]
:00438E05 8A00                    mov al, byte ptr [eax]
:00438E07 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00438E0A 8801                    mov byte ptr [ecx], al
:00438E0C FF45C0                  inc [ebp-40]
:00438E0F FF45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438DFD(U)
|
:00438E12 E920000000              jmp 00438E37

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438C22(C)
|
:00438E17 8B45C0                  mov eax, dword ptr [ebp-40]
:00438E1A 8A00                    mov al, byte ptr [eax]
:00438E1C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00438E1F 8801                    mov byte ptr [ecx], al
:00438E21 FF45C0                  inc [ebp-40]
:00438E24 FF45F8                  inc [ebp-08]
:00438E27 8B45C0                  mov eax, dword ptr [ebp-40]
:00438E2A 8A00                    mov al, byte ptr [eax]
:00438E2C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00438E2F 8801                    mov byte ptr [ecx], al
:00438E31 FF45C0                  inc [ebp-40]
:00438E34 FF45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438E12(U)
|
:00438E37 E9CAFDFFFF              jmp 00438C06

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438C0F(C)
|
:00438E3C 8B45F8                  mov eax, dword ptr [ebp-08]
:00438E3F C60000                  mov byte ptr [eax], 00
:00438E42 E900000000              jmp 00438E47

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438E42(U)
|
:00438E47 5F                      pop edi
:00438E48 5E                      pop esi
:00438E49 5B                      pop ebx
:00438E4A C9                      leave
:00438E4B C3                      ret



* Referenced by a CALL at Addresses:
|:0040B1FF   , :0040B218   , :0042C95F   , :00443F1E   
|
:00438E4C 55                      push ebp
:00438E4D 8BEC                    mov ebp, esp
:00438E4F 53                      push ebx
:00438E50 56                      push esi
:00438E51 57                      push edi
:00438E52 8D4508                  lea eax, dword ptr [ebp+08]
:00438E55 50                      push eax
:00438E56 E88AFDFFFF              call 00438BE5
:00438E5B 83C404                  add esp, 00000004
:00438E5E E900000000              jmp 00438E63

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438E5E(U)
|
:00438E63 5F                      pop edi
:00438E64 5E                      pop esi
:00438E65 5B                      pop ebx
:00438E66 C9                      leave
:00438E67 C3                      ret



* Referenced by a CALL at Address:
|:00438FB8   
|
:00438E68 55                      push ebp
:00438E69 8BEC                    mov ebp, esp
:00438E6B 83EC10                  sub esp, 00000010
:00438E6E 53                      push ebx
:00438E6F 56                      push esi
:00438E70 57                      push edi
:00438E71 E821E1FEFF              call 00426F97
:00438E76 8B4508                  mov eax, dword ptr [ebp+08]
:00438E79 50                      push eax
:00438E7A E82BE50000              call 004473AA
:00438E7F 83C404                  add esp, 00000004
:00438E82 8945F0                  mov dword ptr [ebp-10], eax
:00438E85 B828000000              mov eax, 00000028
:00438E8A 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00438E8D C1E901                  shr ecx, 01
:00438E90 2BC1                    sub eax, ecx
:00438E92 8945F8                  mov dword ptr [ebp-08], eax
:00438E95 C745F4C0000000          mov [ebp-0C], 000000C0
:00438E9C 8B45F0                  mov eax, dword ptr [ebp-10]
:00438E9F C1E003                  shl eax, 03
:00438EA2 83C020                  add eax, 00000020
:00438EA5 8945FC                  mov dword ptr [ebp-04], eax
:00438EA8 6A03                    push 00000003
:00438EAA 6A30                    push 00000030
:00438EAC 8B45FC                  mov eax, dword ptr [ebp-04]
:00438EAF 50                      push eax
:00438EB0 8B45F4                  mov eax, dword ptr [ebp-0C]
:00438EB3 83E810                  sub eax, 00000010
:00438EB6 50                      push eax
:00438EB7 8B45F8                  mov eax, dword ptr [ebp-08]
:00438EBA C1E003                  shl eax, 03
:00438EBD 83E810                  sub eax, 00000010
:00438EC0 50                      push eax
:00438EC1 B958BC4600              mov ecx, 0046BC58
:00438EC6 E89780FEFF              call 00420F62
:00438ECB 6A04                    push 00000004
:00438ECD B910BC4600              mov ecx, 0046BC10
:00438ED2 E8AA6FFEFF              call 0041FE81
:00438ED7 6A07                    push 00000007
:00438ED9 B910BC4600              mov ecx, 0046BC10
:00438EDE E8F06DFEFF              call 0041FCD3
:00438EE3 6A00                    push 00000000
:00438EE5 B910BC4600              mov ecx, 0046BC10
:00438EEA E8E16EFEFF              call 0041FDD0
:00438EEF 8B45F4                  mov eax, dword ptr [ebp-0C]
:00438EF2 50                      push eax
:00438EF3 8B45F8                  mov eax, dword ptr [ebp-08]
:00438EF6 50                      push eax
:00438EF7 B910BC4600              mov ecx, 0046BC10
:00438EFC E8066DFEFF              call 0041FC07
:00438F01 8B4508                  mov eax, dword ptr [ebp+08]
:00438F04 50                      push eax
:00438F05 6810BC4600              push 0046BC10
:00438F0A E8787BFEFF              call 00420A87
:00438F0F 83C408                  add esp, 00000008
:00438F12 E8A0E0FEFF              call 00426FB7
:00438F17 6A01                    push 00000001
:00438F19 E830E7FFFF              call 0043764E
:00438F1E 83C404                  add esp, 00000004
:00438F21 B958BC4600              mov ecx, 0046BC58
:00438F26 E8B180FEFF              call 00420FDC
:00438F2B E900000000              jmp 00438F30

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438F2B(U)
|
:00438F30 5F                      pop edi
:00438F31 5E                      pop esi
:00438F32 5B                      pop ebx
:00438F33 C9                      leave
:00438F34 C3                      ret



* Referenced by a CALL at Addresses:
|:0040180A   , :00402207   , :00402330   , :004028E8   , :00402C87   
|:00402CE1   , :004031B7   , :004036E2   , :00403706   , :00403742   
|:004037C4   , :004038D8   , :00403DDC   , :00403EAF   , :00403FA5   
|:00403FEF   , :00404014   , :004040BC   , :00404196   , :004041CA   
|:0040421A   , :004042C3   , :00404309   , :0040441C   , :0040446B   
|:0040454E   , :0040456D   , :00404F7C   , :00405012   , :00405097   
|:004055B9   , :00405657   , :004056EE   , :0040587E   , :00405995   
|:00405A33   , :00405AB8   , :00405C48   , :00405D5F   , :00405DFA   
|:00405E91   , :00406017   , :00406127   , :004061CE   , :00406277   
|:00406407   , :004064D9   , :00406556   , :004065FF   , :004066CC   
|:00406739   , :004067F2   , :00406901   , :00406AC2   , :00406B53   
|:00406BB7   , :00406C94   , :00406D32   , :00406D76   , :00406E04   
|:00406EA2   , :00406EEA   , :00406F78   , :00407016   , :0040705E   
|:004070EC   , :0040718A   , :004071D2   , :0040727E   , :00407332   
|:00407381   , :004074C7   , :004075CE   , :00407673   , :004076D1   
|:00407817   , :00407900   , :00407972   , :004079BE   , :00407A69   
|:00407ACB   , :00407B3E   , :00407B6B   , :00407C1E   , :00407C90   
|:00407D15   , :00407E92   , :00407EE2   , :00408332   , :004083BD   
|:00408427   , :00408475   , :004084DD   , :00408ECB   , :00408FE9   
|:00409009   , :00409057   , :0040A1A4   , :0040A24B   , :0040ACA4   
|:0040AEB3   , :0040AED4   , :0040B332   , :0040B364   , :0040B3DE   
|:0040B603   , :0040B734   , :0040CEA9   , :0040CED4   , :0040CF95   
|:0040D0F2   , :0040D131   , :0040D185   , :0040D19D   , :0040D1B5   
|:0040D2DF   , :0040D37D   , :0040D45C   , :0040F7D5   , :0040FB0D   
|:0040FB2E   , :00410614   , :0041064A   , :00410BE7   , :00416AE9   
|:0041DD30   , :0041DD5B   , :0041DD7B   , :0041DDBB   , :0041DE13   
|:0041DE7C   , :0041DED4   , :0041E688   , :0041E6C3   , :00423B53   
|:00423DDE   , :00423F52   , :004259F0   , :0042753C   , :0042759F   
|:00429AD8   , :00429AFD   , :00429B4F   , :00429B74   , :00429BA0   
|:00429C14   , :00429C6D   , :00429CCE   , :00429D27   , :00429D88   
|:00429DE1   , :00429E42   , :00429E9B   , :00429EFC   , :00429F55   
|:00429FB6   , :0042A00F   , :0042BE86   , :0042BEA3   , :0042CE6D   
|:00435104   , :00435504   , :00435783   , :00435F64   , :004364E8   
|:00436593   , :004365CA   , :004365FF   , :0043669F   , :0043674E   
|:00436792   , :00436856   , :004368BA   , :004368FE   , :0043693C   
|:004369A0   , :00436A89   , :00436DF1   , :00437D1A   , :0043CFC5   
|:0043CFE6   , :0043CFFA   , :0043D0FC   , :0043D142   , :0043D1B0   
|:0043D1F6   , :0043D234   , :0043D248   , :0043E0E6   , :0044125C   
|:0044127E   , :004412A0   , :004413CB   , :00441417   , :0044143A   
|:0044145C   , :004415CF   , :0044186D   , :004418AA   , :004418DC   
|:0044192E   , :00441B0E   , :00441C20   , :00441C74   , :00441CA0   
|:0044217D   , :004425C9   , :00442877   , :0044294D   , :00442C96   
|:00443238   , :0044357B   , :00443650   , :00443786   
|
:00438F35 55                      push ebp
:00438F36 8BEC                    mov ebp, esp
:00438F38 6AFF                    push FFFFFFFF
:00438F3A 6845954300              push 00439545
:00438F3F 64A100000000            mov eax, dword ptr fs:[00000000]
:00438F45 50                      push eax
:00438F46 64892500000000          mov dword ptr fs:[00000000], esp
:00438F4D 81ECA8010000            sub esp, 000001A8
:00438F53 53                      push ebx
:00438F54 56                      push esi
:00438F55 57                      push edi
:00438F56 C78578FEFFFF00000000    mov dword ptr [ebp+FFFFFE78], 00000000
:00438F60 C7459000000000          mov [ebp-70], 00000000
:00438F67 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00438F6A E80189FCFF              call 00401870
:00438F6F 8D4D98                  lea ecx, dword ptr [ebp-68]
:00438F72 E8F988FCFF              call 00401870
:00438F77 C64584FF                mov [ebp-7C], FF
:00438F7B C7458000000000          mov [ebp-80], 00000000
:00438F82 8B4580                  mov eax, dword ptr [ebp-80]
:00438F85 894588                  mov dword ptr [ebp-78], eax
:00438F88 8D450C                  lea eax, dword ptr [ebp+0C]
:00438F8B 50                      push eax
:00438F8C E854FCFFFF              call 00438BE5
:00438F91 83C404                  add esp, 00000004
:00438F94 C745DC01000000          mov [ebp-24], 00000001
:00438F9B E847E5FFFF              call 004374E7
:00438FA0 E809E4FFFF              call 004373AE
:00438FA5 8B4508                  mov eax, dword ptr [ebp+08]
:00438FA8 898550FEFFFF            mov dword ptr [ebp+FFFFFE50], eax
:00438FAE E94A000000              jmp 00438FFD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439004(C)
|
:00438FB3 68B0F94600              push 0046F9B0
:00438FB8 E8ABFEFFFF              call 00438E68
:00438FBD 83C404                  add esp, 00000004
:00438FC0 33C0                    xor eax, eax
:00438FC2 E988050000              jmp 0043954F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439011(C)
|
:00438FC7 68B0F94600              push 0046F9B0
:00438FCC E86752FDFF              call 0040E238
:00438FD1 83C404                  add esp, 00000004
:00438FD4 33C0                    xor eax, eax
:00438FD6 E974050000              jmp 0043954F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043901E(C)
|
:00438FDB 68B0F94600              push 0046F9B0
:00438FE0 E81452FDFF              call 0040E1F9
:00438FE5 83C404                  add esp, 00000004
:00438FE8 8945DC                  mov dword ptr [ebp-24], eax
:00438FEB 8B45DC                  mov eax, dword ptr [ebp-24]
:00438FEE E95C050000              jmp 0043954F
:00438FF3 E931000000              jmp 00439029
:00438FF8 E92C000000              jmp 00439029

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438FAE(U)
|
:00438FFD 83BD50FEFFFF03          cmp dword ptr [ebp+FFFFFE50], 00000003
:00439004 0F84A9FFFFFF            je 00438FB3
:0043900A 83BD50FEFFFF05          cmp dword ptr [ebp+FFFFFE50], 00000005
:00439011 0F84B0FFFFFF            je 00438FC7
:00439017 83BD50FEFFFF06          cmp dword ptr [ebp+FFFFFE50], 00000006
:0043901E 0F84B7FFFFFF            je 00438FDB
:00439024 E900000000              jmp 00439029

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00438FF3(U), :00438FF8(U), :00439024(U)
|
:00439029 E880E3FFFF              call 004373AE
:0043902E C745B400000000          mov [ebp-4C], 00000000
:00439035 C7459400000000          mov [ebp-6C], 00000000
:0043903C C68574FEFFFF00          mov byte ptr [ebp+FFFFFE74], 00
:00439043 E903000000              jmp 0043904B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004390B8(U)
|
:00439048 FF4594                  inc [ebp-6C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439043(U)
|
:0043904B 8B4594                  mov eax, dword ptr [ebp-6C]
:0043904E 33C9                    xor ecx, ecx
:00439050 8A88B0F94600            mov cl, byte ptr [eax+0046F9B0]
:00439056 85C9                    test ecx, ecx
:00439058 0F845F000000            je 004390BD
:0043905E 8B4594                  mov eax, dword ptr [ebp-6C]
:00439061 33C9                    xor ecx, ecx
:00439063 8A88B0F94600            mov cl, byte ptr [eax+0046F9B0]
:00439069 83F90A                  cmp ecx, 0000000A
:0043906C 0F8546000000            jne 004390B8
:00439072 8B4594                  mov eax, dword ptr [ebp-6C]
:00439075 33C9                    xor ecx, ecx
:00439077 8A8D74FEFFFF            mov cl, byte ptr [ebp+FFFFFE74]
:0043907D 2B448DB4                sub eax, dword ptr [ebp+4*ecx-4C]
:00439081 3B8578FEFFFF            cmp eax, dword ptr [ebp+FFFFFE78]
:00439087 0F8615000000            jbe 004390A2
:0043908D 8B4594                  mov eax, dword ptr [ebp-6C]
:00439090 33C9                    xor ecx, ecx
:00439092 8A8D74FEFFFF            mov cl, byte ptr [ebp+FFFFFE74]
:00439098 2B448DB4                sub eax, dword ptr [ebp+4*ecx-4C]
:0043909C 898578FEFFFF            mov dword ptr [ebp+FFFFFE78], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439087(C)
|
:004390A2 8B4594                  mov eax, dword ptr [ebp-6C]
:004390A5 40                      inc eax
:004390A6 33C9                    xor ecx, ecx
:004390A8 8A8D74FEFFFF            mov cl, byte ptr [ebp+FFFFFE74]
:004390AE 89448DB8                mov dword ptr [ebp+4*ecx-48], eax
:004390B2 FE8574FEFFFF            inc byte ptr [ebp+FFFFFE74]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043906C(C)
|
:004390B8 E98BFFFFFF              jmp 00439048

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439058(C)
|
:004390BD 8B4594                  mov eax, dword ptr [ebp-6C]
:004390C0 33C9                    xor ecx, ecx
:004390C2 8A8D74FEFFFF            mov cl, byte ptr [ebp+FFFFFE74]
:004390C8 89448DB8                mov dword ptr [ebp+4*ecx-48], eax
:004390CC 8B4594                  mov eax, dword ptr [ebp-6C]
:004390CF 33C9                    xor ecx, ecx
:004390D1 8A8D74FEFFFF            mov cl, byte ptr [ebp+FFFFFE74]
:004390D7 2B448DB4                sub eax, dword ptr [ebp+4*ecx-4C]
:004390DB 3B8578FEFFFF            cmp eax, dword ptr [ebp+FFFFFE78]
:004390E1 0F8615000000            jbe 004390FC
:004390E7 8B4594                  mov eax, dword ptr [ebp-6C]
:004390EA 33C9                    xor ecx, ecx
:004390EC 8A8D74FEFFFF            mov cl, byte ptr [ebp+FFFFFE74]
:004390F2 2B448DB4                sub eax, dword ptr [ebp+4*ecx-4C]
:004390F6 898578FEFFFF            mov dword ptr [ebp+FFFFFE78], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004390E1(C)
|
:004390FC F68578FEFFFF01          test byte ptr [ebp+FFFFFE78], 01
:00439103 0F8406000000            je 0043910F
:00439109 FF8578FEFFFF            inc dword ptr [ebp+FFFFFE78]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439103(C)
|
:0043910F F68578FEFFFF03          test byte ptr [ebp+FFFFFE78], 03
:00439116 0F840E000000            je 0043912A
:0043911C C7459001000000          mov [ebp-70], 00000001
:00439123 838578FEFFFF02          add dword ptr [ebp+FFFFFE78], 00000002

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439116(C)
|
:0043912A 6A00                    push 00000000
:0043912C E857CDFEFF              call 00425E88
:00439131 83C404                  add esp, 00000004
:00439134 C745E840010000          mov [ebp-18], 00000140
:0043913B C745E090000000          mov [ebp-20], 00000090
:00439142 8B8578FEFFFF            mov eax, dword ptr [ebp+FFFFFE78]
:00439148 C1E003                  shl eax, 03
:0043914B 83C020                  add eax, 00000020
:0043914E 8945EC                  mov dword ptr [ebp-14], eax
:00439151 33C0                    xor eax, eax
:00439153 8A8574FEFFFF            mov al, byte ptr [ebp+FFFFFE74]
:00439159 40                      inc eax
:0043915A C1E004                  shl eax, 04
:0043915D 83C020                  add eax, 00000020
:00439160 8945E4                  mov dword ptr [ebp-1C], eax
:00439163 B9D0A64600              mov ecx, 0046A6D0
:00439168 E8B328FDFF              call 0040BA20
:0043916D F6C440                  test ah, 40
:00439170 0F844F000000            je 004391C5
:00439176 B988534500              mov ecx, 00455388
:0043917B E8728BFCFF              call 00401CF2
:00439180 B988534500              mov ecx, 00455388
:00439185 E83603FDFF              call 004094C0
:0043918A 898558FEFFFF            mov dword ptr [ebp+FFFFFE58], eax
:00439190 8B45E4                  mov eax, dword ptr [ebp-1C]
:00439193 05A0000000              add eax, 000000A0
:00439198 3B8558FEFFFF            cmp eax, dword ptr [ebp+FFFFFE58]
:0043919E 0F8321000000            jnb 004391C5
:004391A4 8B8558FEFFFF            mov eax, dword ptr [ebp+FFFFFE58]
:004391AA 83C010                  add eax, 00000010
:004391AD 2B45E4                  sub eax, dword ptr [ebp-1C]
:004391B0 B990010000              mov ecx, 00000190
:004391B5 2B4DE4                  sub ecx, dword ptr [ebp-1C]
:004391B8 3BC1                    cmp eax, ecx
:004391BA 0F8202000000            jb 004391C2
:004391C0 8BC1                    mov eax, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004391BA(C)
|
:004391C2 8945E0                  mov dword ptr [ebp-20], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00439170(C), :0043919E(C)
|
:004391C5 837D0800                cmp dword ptr [ebp+08], 00000000
:004391C9 0F8442000000            je 00439211
:004391CF 837D0804                cmp dword ptr [ebp+08], 00000004
:004391D3 0F8404000000            je 004391DD
:004391D9 8345E420                add dword ptr [ebp-1C], 00000020

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004391D3(C)
|
:004391DD 8B45E8                  mov eax, dword ptr [ebp-18]
:004391E0 C1E803                  shr eax, 03
:004391E3 8B8D78FEFFFF            mov ecx, dword ptr [ebp+FFFFFE78]
:004391E9 C1E901                  shr ecx, 01
:004391EC 2BC1                    sub eax, ecx
:004391EE 038578FEFFFF            add eax, dword ptr [ebp+FFFFFE78]
:004391F4 83E808                  sub eax, 00000008
:004391F7 894588                  mov dword ptr [ebp-78], eax
:004391FA 33C0                    xor eax, eax
:004391FC 8A8574FEFFFF            mov al, byte ptr [ebp+FFFFFE74]
:00439202 83C002                  add eax, 00000002
:00439205 C1E004                  shl eax, 04
:00439208 83C008                  add eax, 00000008
:0043920B 0345E0                  add eax, dword ptr [ebp-20]
:0043920E 894580                  mov dword ptr [ebp-80], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004391C9(C)
|
:00439211 6A00                    push 00000000
:00439213 6A00                    push 00000000
:00439215 6A00                    push 00000000
:00439217 6A00                    push 00000000
:00439219 6A00                    push 00000000
:0043921B 6A00                    push 00000000
:0043921D 6A00                    push 00000000
:0043921F 8D4D9C                  lea ecx, dword ptr [ebp-64]
:00439222 E8F92AFDFF              call 0040BD20
:00439227 C745FC00000000          mov [ebp-04], 00000000
:0043922E 6A02                    push 00000002
:00439230 6A01                    push 00000001
:00439232 6A00                    push 00000000
:00439234 6A10                    push 00000010
:00439236 6A06                    push 00000006
:00439238 8B4580                  mov eax, dword ptr [ebp-80]
:0043923B 50                      push eax
:0043923C 8B4588                  mov eax, dword ptr [ebp-78]
:0043923F 83E807                  sub eax, 00000007
:00439242 50                      push eax
:00439243 8D4D9C                  lea ecx, dword ptr [ebp-64]
:00439246 E8E529FDFF              call 0040BC30
:0043924B 6A00                    push 00000000
:0043924D 6A00                    push 00000000
:0043924F 6A00                    push 00000000
:00439251 6A00                    push 00000000
:00439253 6A00                    push 00000000
:00439255 6A00                    push 00000000
:00439257 6A00                    push 00000000
:00439259 8D8D5CFEFFFF            lea ecx, dword ptr [ebp+FFFFFE5C]
:0043925F E8BC2AFDFF              call 0040BD20
:00439264 C645FC01                mov [ebp-04], 01
:00439268 6A03                    push 00000003
:0043926A 6A00                    push 00000000
:0043926C 6A00                    push 00000000
:0043926E 6A10                    push 00000010
:00439270 6A06                    push 00000006
:00439272 8B4580                  mov eax, dword ptr [ebp-80]
:00439275 50                      push eax
:00439276 8B4588                  mov eax, dword ptr [ebp-78]
:00439279 50                      push eax
:0043927A 8D8D5CFEFFFF            lea ecx, dword ptr [ebp+FFFFFE5C]
:00439280 E8AB29FDFF              call 0040BC30
:00439285 8B45E8                  mov eax, dword ptr [ebp-18]
:00439288 8B8D78FEFFFF            mov ecx, dword ptr [ebp+FFFFFE78]
:0043928E C1E102                  shl ecx, 02
:00439291 2BC1                    sub eax, ecx
:00439293 83E810                  sub eax, 00000010
:00439296 89857CFFFFFF            mov dword ptr [ebp+FFFFFF7C], eax
:0043929C 6A06                    push 00000006
:0043929E 8B45E4                  mov eax, dword ptr [ebp-1C]
:004392A1 50                      push eax
:004392A2 8B45EC                  mov eax, dword ptr [ebp-14]
:004392A5 50                      push eax
:004392A6 8B45E0                  mov eax, dword ptr [ebp-20]
:004392A9 50                      push eax
:004392AA 8B857CFFFFFF            mov eax, dword ptr [ebp+FFFFFF7C]
:004392B0 50                      push eax
:004392B1 B958BC4600              mov ecx, 0046BC58
:004392B6 E8A77CFEFF              call 00420F62
:004392BB 6A04                    push 00000004
:004392BD B910BC4600              mov ecx, 0046BC10
:004392C2 E8BA6BFEFF              call 0041FE81
:004392C7 6A07                    push 00000007
:004392C9 B910BC4600              mov ecx, 0046BC10
:004392CE E8006AFEFF              call 0041FCD3
:004392D3 6A00                    push 00000000
:004392D5 B910BC4600              mov ecx, 0046BC10
:004392DA E8F16AFEFF              call 0041FDD0
:004392DF C7459400000000          mov [ebp-6C], 00000000
:004392E6 E903000000              jmp 004392EE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004393AE(U)
|
:004392EB FF4594                  inc [ebp-6C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004392E6(U)
|
:004392EE 33C0                    xor eax, eax
:004392F0 8A8574FEFFFF            mov al, byte ptr [ebp+FFFFFE74]
:004392F6 3B4594                  cmp eax, dword ptr [ebp-6C]
:004392F9 0F82B4000000            jb 004393B3
:004392FF C7458C00000000          mov [ebp-74], 00000000
:00439306 E903000000              jmp 0043930E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043935B(U)
|
:0043930B FF458C                  inc [ebp-74]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439306(U)
|
:0043930E 8B4594                  mov eax, dword ptr [ebp-6C]
:00439311 8B4485B8                mov eax, dword ptr [ebp+4*eax-48]
:00439315 8B4D94                  mov ecx, dword ptr [ebp-6C]
:00439318 2B448DB4                sub eax, dword ptr [ebp+4*ecx-4C]
:0043931C 3B458C                  cmp eax, dword ptr [ebp-74]
:0043931F 0F863B000000            jbe 00439360
:00439325 8B4594                  mov eax, dword ptr [ebp-6C]
:00439328 8B4485B4                mov eax, dword ptr [ebp+4*eax-4C]
:0043932C 8B4D8C                  mov ecx, dword ptr [ebp-74]
:0043932F 33D2                    xor edx, edx
:00439331 8A9408B0F94600          mov dl, byte ptr [eax+ecx+0046F9B0]
:00439338 85D2                    test edx, edx
:0043933A 0F8420000000            je 00439360
:00439340 8B4594                  mov eax, dword ptr [ebp-6C]
:00439343 8B4485B4                mov eax, dword ptr [ebp+4*eax-4C]
:00439347 8B4D8C                  mov ecx, dword ptr [ebp-74]
:0043934A 8A8408B0F94600          mov al, byte ptr [eax+ecx+0046F9B0]
:00439351 8B4D8C                  mov ecx, dword ptr [ebp-74]
:00439354 88840D7CFEFFFF          mov byte ptr [ebp+ecx-00000184], al
:0043935B E9ABFFFFFF              jmp 0043930B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043931F(C), :0043933A(C)
|
:00439360 8B458C                  mov eax, dword ptr [ebp-74]
:00439363 C684057CFEFFFF00        mov byte ptr [ebp+eax-00000184], 00
:0043936B 8B4594                  mov eax, dword ptr [ebp-6C]
:0043936E 40                      inc eax
:0043936F C1E004                  shl eax, 04
:00439372 0345E0                  add eax, dword ptr [ebp-20]
:00439375 50                      push eax
:00439376 8B45E8                  mov eax, dword ptr [ebp-18]
:00439379 C1E803                  shr eax, 03
:0043937C 8B8D78FEFFFF            mov ecx, dword ptr [ebp+FFFFFE78]
:00439382 C1E901                  shr ecx, 01
:00439385 2BC1                    sub eax, ecx
:00439387 034590                  add eax, dword ptr [ebp-70]
:0043938A 50                      push eax
:0043938B B910BC4600              mov ecx, 0046BC10
:00439390 E87268FEFF              call 0041FC07
:00439395 8D857CFEFFFF            lea eax, dword ptr [ebp+FFFFFE7C]
:0043939B 50                      push eax

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:0043939C 6864324500              push 00453264
:004393A1 6810BC4600              push 0046BC10
:004393A6 E87877FEFF              call 00420B23
:004393AB 83C40C                  add esp, 0000000C
:004393AE E938FFFFFF              jmp 004392EB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004392F9(C)
|
:004393B3 B988534500              mov ecx, 00455388
:004393B8 E8CB88FCFF              call 00401C88
:004393BD 8B4508                  mov eax, dword ptr [ebp+08]
:004393C0 89854CFEFFFF            mov dword ptr [ebp+FFFFFE4C], eax
:004393C6 E9D1000000              jmp 0043949C
:004393CB 6A01                    push 00000001
:004393CD E87CE2FFFF              call 0043764E
:004393D2 83C404                  add esp, 00000004
:004393D5 E9F0000000              jmp 004394CA
:004393DA 8D4D9C                  lea ecx, dword ptr [ebp-64]
:004393DD E8A482FEFF              call 00421686
:004393E2 8D8D5CFEFFFF            lea ecx, dword ptr [ebp+FFFFFE5C]
:004393E8 E89982FEFF              call 00421686
:004393ED 83EC18                  sub esp, 00000018
:004393F0 8DB55CFEFFFF            lea esi, dword ptr [ebp+FFFFFE5C]
:004393F6 8BFC                    mov edi, esp
:004393F8 B905000000              mov ecx, 00000005
:004393FD F3                      repz
:004393FE A5                      movsd
:004393FF 66A5                    movsw
:00439401 A4                      movsb
:00439402 83EC18                  sub esp, 00000018
:00439405 8D759C                  lea esi, dword ptr [ebp-64]
:00439408 8BFC                    mov edi, esp
:0043940A B905000000              mov ecx, 00000005
:0043940F F3                      repz
:00439410 A5                      movsd
:00439411 66A5                    movsw
:00439413 A4                      movsb
:00439414 E845010000              call 0043955E
:00439419 83C430                  add esp, 00000030
:0043941C 884584                  mov byte ptr [ebp-7C], al
:0043941F E9A6000000              jmp 004394CA
:00439424 E8A1E2FFFF              call 004376CA
:00439429 E99C000000              jmp 004394CA
:0043942E 8D4D9C                  lea ecx, dword ptr [ebp-64]
:00439431 E85082FEFF              call 00421686
:00439436 8D8D5CFEFFFF            lea ecx, dword ptr [ebp+FFFFFE5C]
:0043943C E84582FEFF              call 00421686
:00439441 C64584FF                mov [ebp-7C], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439488(U)
|
:00439445 33C0                    xor eax, eax
:00439447 8A4584                  mov al, byte ptr [ebp-7C]
:0043944A 3DFF000000              cmp eax, 000000FF
:0043944F 0F8538000000            jne 0043948D
:00439455 6A00                    push 00000000
:00439457 E82CCAFEFF              call 00425E88
:0043945C 83C404                  add esp, 00000004
:0043945F 8D4D9C                  lea ecx, dword ptr [ebp-64]
:00439462 E85384FEFF              call 004218BA
:00439467 884584                  mov byte ptr [ebp-7C], al
:0043946A 33C0                    xor eax, eax
:0043946C 8A4584                  mov al, byte ptr [ebp-7C]
:0043946F 3DFF000000              cmp eax, 000000FF
:00439474 0F850E000000            jne 00439488
:0043947A 8D8D5CFEFFFF            lea ecx, dword ptr [ebp+FFFFFE5C]
:00439480 E83584FEFF              call 004218BA
:00439485 884584                  mov byte ptr [ebp-7C], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439474(C)
|
:00439488 E9B8FFFFFF              jmp 00439445

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043944F(C)
|
:0043948D E938000000              jmp 004394CA
:00439492 E933000000              jmp 004394CA
:00439497 E92E000000              jmp 004394CA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004393C6(U)
|
:0043949C 83BD4CFEFFFF04          cmp dword ptr [ebp+FFFFFE4C], 00000004
:004394A3 0F8721000000            ja 004394CA
:004394A9 8B854CFEFFFF            mov eax, dword ptr [ebp+FFFFFE4C]
:004394AF FF2485B6944300          jmp dword ptr [4*eax+004394B6]

:004394B6 CB934300                DWORD 004393CB
:004394BA DA934300                DWORD 004393DA
:004394BE 2E944300                DWORD 0043942E
:004394C2 CB934300                DWORD 004393CB
:004394C6 24944300                DWORD 00439424



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004393D5(U), :0043941F(U), :00439429(U), :0043948D(U), :00439492(U)
|:00439497(U), :004394A3(C)
|
:004394CA B958BC4600              mov ecx, 0046BC58
:004394CF E8087BFEFF              call 00420FDC
:004394D4 E80EE0FFFF              call 004374E7
:004394D9 33C0                    xor eax, eax
:004394DB 8A4584                  mov al, byte ptr [ebp-7C]
:004394DE 3DFF000000              cmp eax, 000000FF
:004394E3 0F840E000000            je 004394F7
:004394E9 33C0                    xor eax, eax
:004394EB 8A4584                  mov al, byte ptr [ebp-7C]
:004394EE 83F801                  cmp eax, 00000001
:004394F1 0F850F000000            jne 00439506

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004394E3(C)
|
:004394F7 C78554FEFFFF01000000    mov dword ptr [ebp+FFFFFE54], 00000001
:00439501 E90A000000              jmp 00439510

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004394F1(C)
|
:00439506 C78554FEFFFF00000000    mov dword ptr [ebp+FFFFFE54], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439501(U)
|
:00439510 C645FC00                mov [ebp-04], 00
:00439514 E817000000              call 00439530
:00439519 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00439520 E817000000              call 0043953C
:00439525 8B8554FEFFFF            mov eax, dword ptr [ebp+FFFFFE54]
:0043952B E91F000000              jmp 0043954F

* Referenced by a CALL at Address:
|:00439514   
|
:00439530 8D8D5CFEFFFF            lea ecx, dword ptr [ebp+FFFFFE5C]
:00439536 E83527FDFF              call 0040BC70
:0043953B C3                      ret



* Referenced by a CALL at Address:
|:00439520   
|
:0043953C 8D4D9C                  lea ecx, dword ptr [ebp-64]
:0043953F E82C27FDFF              call 0040BC70
:00439544 C3                      ret


:00439545 B840C24400              mov eax, 0044C240
:0043954A E971EB0000              jmp 004480C0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00438FC2(U), :00438FD6(U), :00438FEE(U), :0043952B(U)
|
:0043954F 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00439552 64890D00000000          mov dword ptr fs:[00000000], ecx
:00439559 5F                      pop edi
:0043955A 5E                      pop esi
:0043955B 5B                      pop ebx
:0043955C C9                      leave
:0043955D C3                      ret



* Referenced by a CALL at Address:
|:00439414   
|
:0043955E 55                      push ebp
:0043955F 8BEC                    mov ebp, esp
:00439561 6AFF                    push FFFFFFFF
:00439563 683C964300              push 0043963C
:00439568 64A100000000            mov eax, dword ptr fs:[00000000]
:0043956E 50                      push eax
:0043956F 64892500000000          mov dword ptr fs:[00000000], esp
:00439576 83EC08                  sub esp, 00000008
:00439579 53                      push ebx
:0043957A 56                      push esi
:0043957B 57                      push edi
:0043957C C745FC00000000          mov [ebp-04], 00000000
:00439583 C645FC01                mov [ebp-04], 01
:00439587 C645F0FF                mov [ebp-10], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439602(U)
|
:0043958B 33C0                    xor eax, eax
:0043958D 8A45F0                  mov al, byte ptr [ebp-10]
:00439590 3DFF000000              cmp eax, 000000FF
:00439595 0F856C000000            jne 00439607
:0043959B 6A00                    push 00000000
:0043959D E8E6C8FEFF              call 00425E88
:004395A2 83C404                  add esp, 00000004
:004395A5 8D4D08                  lea ecx, dword ptr [ebp+08]
:004395A8 E80D83FEFF              call 004218BA
:004395AD 8845F0                  mov byte ptr [ebp-10], al
:004395B0 33C0                    xor eax, eax
:004395B2 8A45F0                  mov al, byte ptr [ebp-10]
:004395B5 3DFF000000              cmp eax, 000000FF
:004395BA 0F850B000000            jne 004395CB
:004395C0 8D4D20                  lea ecx, dword ptr [ebp+20]
:004395C3 E8F282FEFF              call 004218BA
:004395C8 8845F0                  mov byte ptr [ebp-10], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004395BA(C)
|
:004395CB 33C0                    xor eax, eax
:004395CD 8A45F0                  mov al, byte ptr [ebp-10]
:004395D0 3DFF000000              cmp eax, 000000FF
:004395D5 0F8527000000            jne 00439602
:004395DB B988534500              mov ecx, 00455388
:004395E0 E8B787FCFF              call 00401D9C
:004395E5 85C0                    test eax, eax
:004395E7 0F8415000000            je 00439602
:004395ED C645F000                mov [ebp-10], 00
:004395F1 6A01                    push 00000001
:004395F3 B994A64600              mov ecx, 0046A694
:004395F8 E827FAFDFF              call 00419024
:004395FD E905000000              jmp 00439607

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004395D5(C), :004395E7(C)
|
:00439602 E984FFFFFF              jmp 0043958B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00439595(C), :004395FD(U)
|
:00439607 8A45F0                  mov al, byte ptr [ebp-10]
:0043960A 8845EC                  mov byte ptr [ebp-14], al
:0043960D C645FC00                mov [ebp-04], 00
:00439611 E814000000              call 0043962A
:00439616 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0043961D E811000000              call 00439633
:00439622 8A45EC                  mov al, byte ptr [ebp-14]
:00439625 E91C000000              jmp 00439646

* Referenced by a CALL at Address:
|:00439611   
|
:0043962A 8D4D08                  lea ecx, dword ptr [ebp+08]
:0043962D E83E26FDFF              call 0040BC70
:00439632 C3                      ret



* Referenced by a CALL at Address:
|:0043961D   
|
:00439633 8D4D20                  lea ecx, dword ptr [ebp+20]
:00439636 E83526FDFF              call 0040BC70
:0043963B C3                      ret


:0043963C B870C24400              mov eax, 0044C270
:00439641 E97AEA0000              jmp 004480C0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439625(U)
|
:00439646 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00439649 64890D00000000          mov dword ptr fs:[00000000], ecx
:00439650 5F                      pop edi
:00439651 5E                      pop esi
:00439652 5B                      pop ebx
:00439653 C9                      leave
:00439654 C3                      ret



* Referenced by a CALL at Address:
|:0043067B   
|
:00439655 55                      push ebp
:00439656 8BEC                    mov ebp, esp
:00439658 83EC08                  sub esp, 00000008
:0043965B 53                      push ebx
:0043965C 56                      push esi
:0043965D 57                      push edi
:0043965E C745FC00000000          mov [ebp-04], 00000000
:00439665 B9D0A64600              mov ecx, 0046A6D0
:0043966A E85125FDFF              call 0040BBC0
:0043966F 33C9                    xor ecx, ecx
:00439671 8AC8                    mov cl, al
:00439673 894DF8                  mov dword ptr [ebp-08], ecx
:00439676 E86CDEFFFF              call 004374E7
:0043967B B990A64600              mov ecx, 0046A690
:00439680 E86BF8FDFF              call 00418EF0
:00439685 E824DDFFFF              call 004373AE
:0043968A 837D083F                cmp dword ptr [ebp+08], 0000003F
:0043968E 0F831D000000            jnb 004396B1
:00439694 6A26                    push 00000026
:00439696 B994A64600              mov ecx, 0046A694
:0043969B E884F9FDFF              call 00419024
:004396A0 C745FC01000000          mov [ebp-04], 00000001
:004396A7 6A01                    push 00000001
:004396A9 E8A0DFFFFF              call 0043764E
:004396AE 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043968E(C)
|
:004396B1 6A04                    push 00000004
:004396B3 B910BC4600              mov ecx, 0046BC10
:004396B8 E8C467FEFF              call 0041FE81
:004396BD 6A07                    push 00000007
:004396BF B910BC4600              mov ecx, 0046BC10
:004396C4 E80A66FEFF              call 0041FCD3
:004396C9 E830D6FEFF              call 00426CFE
:004396CE 837D084A                cmp dword ptr [ebp+08], 0000004A
:004396D2 0F8314000000            jnb 004396EC
:004396D8 6A00                    push 00000000
:004396DA 8B45FC                  mov eax, dword ptr [ebp-04]
:004396DD 50                      push eax
:004396DE 6A00                    push 00000000
:004396E0 8B4508                  mov eax, dword ptr [ebp+08]
:004396E3 50                      push eax
:004396E4 E81DD2FEFF              call 00426906
:004396E9 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004396D2(C)
|
:004396EC 837D0C4A                cmp dword ptr [ebp+0C], 0000004A
:004396F0 0F8314000000            jnb 0043970A
:004396F6 6A00                    push 00000000
:004396F8 8B45FC                  mov eax, dword ptr [ebp-04]
:004396FB 50                      push eax
:004396FC 6A00                    push 00000000
:004396FE 8B450C                  mov eax, dword ptr [ebp+0C]
:00439701 50                      push eax
:00439702 E8FFD1FEFF              call 00426906
:00439707 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004396F0(C)
|
:0043970A 837D104A                cmp dword ptr [ebp+10], 0000004A
:0043970E 0F8314000000            jnb 00439728
:00439714 6A00                    push 00000000
:00439716 8B45FC                  mov eax, dword ptr [ebp-04]
:00439719 50                      push eax
:0043971A 6A00                    push 00000000
:0043971C 8B4510                  mov eax, dword ptr [ebp+10]
:0043971F 50                      push eax
:00439720 E8E1D1FEFF              call 00426906
:00439725 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043970E(C)
|
:00439728 E8D1D5FEFF              call 00426CFE

* Possible StringData Ref from Data Obj ->"C:PALET.E2"
                                  |
:0043972D 68A82B4500              push 00452BA8
:00439732 E8E1D5FEFF              call 00426D18
:00439737 83C404                  add esp, 00000004
:0043973A 837D083F                cmp dword ptr [ebp+08], 0000003F
:0043973E 0F8330000000            jnb 00439774
:00439744 6A02                    push 00000002
:00439746 E8D1D4FEFF              call 00426C1C
:0043974B 83C404                  add esp, 00000004
:0043974E B998FC4600              mov ecx, 0046FC98
:00439753 E8BBA40000              call 00443C13
:00439758 6A01                    push 00000001
:0043975A 6A06                    push 00000006
:0043975C 6890010000              push 00000190
:00439761 6880020000              push 00000280
:00439766 6A28                    push 00000028
:00439768 6A00                    push 00000000
:0043976A B958BC4600              mov ecx, 0046BC58
:0043976F E8F675FEFF              call 00420D6A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043973E(C)
|
:00439774 E804D8FEFF              call 00426F7D
:00439779 8B45F8                  mov eax, dword ptr [ebp-08]
:0043977C 50                      push eax
:0043977D B990A64600              mov ecx, 0046A690
:00439782 E843F7FDFF              call 00418ECA
:00439787 E900000000              jmp 0043978C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439787(U)
|
:0043978C 5F                      pop edi
:0043978D 5E                      pop esi
:0043978E 5B                      pop ebx
:0043978F C9                      leave
:00439790 C3                      ret


:00439791 CC                      int 03
:00439792 CC                      int 03
:00439793 CC                      int 03
:00439794 CC                      int 03
:00439795 CC                      int 03
:00439796 CC                      int 03
:00439797 CC                      int 03
:00439798 CC                      int 03
:00439799 CC                      int 03
:0043979A CC                      int 03
:0043979B CC                      int 03
:0043979C CC                      int 03
:0043979D CC                      int 03
:0043979E CC                      int 03
:0043979F CC                      int 03

* Referenced by a CALL at Addresses:
|:00437AED   , :0043F98E   
|
:004397A0 55                      push ebp
:004397A1 8BEC                    mov ebp, esp
:004397A3 83EC04                  sub esp, 00000004
:004397A6 53                      push ebx
:004397A7 56                      push esi
:004397A8 57                      push edi
:004397A9 894DFC                  mov dword ptr [ebp-04], ecx
:004397AC 8B45FC                  mov eax, dword ptr [ebp-04]
:004397AF 8B4016                  mov eax, dword ptr [eax+16]
:004397B2 E900000000              jmp 004397B7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004397B2(U)
|
:004397B7 5F                      pop edi
:004397B8 5E                      pop esi
:004397B9 5B                      pop ebx
:004397BA C9                      leave
:004397BB C3                      ret


:004397BC CC                      int 03
:004397BD CC                      int 03
:004397BE CC                      int 03
:004397BF CC                      int 03

* Referenced by a CALL at Addresses:
|:0043825A   , :00439B1D   
|
:004397C0 55                      push ebp
:004397C1 8BEC                    mov ebp, esp
:004397C3 83EC04                  sub esp, 00000004
:004397C6 53                      push ebx
:004397C7 56                      push esi
:004397C8 57                      push edi
:004397C9 894DFC                  mov dword ptr [ebp-04], ecx
:004397CC 8B4518                  mov eax, dword ptr [ebp+18]
:004397CF 50                      push eax
:004397D0 8B4514                  mov eax, dword ptr [ebp+14]
:004397D3 50                      push eax
:004397D4 8B4510                  mov eax, dword ptr [ebp+10]
:004397D7 50                      push eax
:004397D8 8B450C                  mov eax, dword ptr [ebp+0C]
:004397DB 50                      push eax
:004397DC 8B4508                  mov eax, dword ptr [ebp+08]
:004397DF 50                      push eax
:004397E0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004397E3 E838000000              call 00439820
:004397E8 E900000000              jmp 004397ED

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004397E8(U)
|
:004397ED 8B45FC                  mov eax, dword ptr [ebp-04]
:004397F0 5F                      pop edi
:004397F1 5E                      pop esi
:004397F2 5B                      pop ebx
:004397F3 C9                      leave
:004397F4 C21400                  ret 0014


:004397F7 CC                      int 03
:004397F8 CC                      int 03
:004397F9 CC                      int 03
:004397FA CC                      int 03
:004397FB CC                      int 03
:004397FC CC                      int 03
:004397FD CC                      int 03
:004397FE CC                      int 03
:004397FF CC                      int 03

* Referenced by a CALL at Addresses:
|:00438ABF   , :00439B54   
|
:00439800 55                      push ebp
:00439801 8BEC                    mov ebp, esp
:00439803 83EC04                  sub esp, 00000004
:00439806 53                      push ebx
:00439807 56                      push esi
:00439808 57                      push edi
:00439809 894DFC                  mov dword ptr [ebp-04], ecx
:0043980C E900000000              jmp 00439811

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043980C(U)
|
:00439811 5F                      pop edi
:00439812 5E                      pop esi
:00439813 5B                      pop ebx
:00439814 C9                      leave
:00439815 C3                      ret


:00439816 CC                      int 03
:00439817 CC                      int 03
:00439818 CC                      int 03
:00439819 CC                      int 03
:0043981A CC                      int 03
:0043981B CC                      int 03
:0043981C CC                      int 03
:0043981D CC                      int 03
:0043981E CC                      int 03
:0043981F CC                      int 03

* Referenced by a CALL at Addresses:
|:004397E3   , :0043C4DD   
|
:00439820 55                      push ebp
:00439821 8BEC                    mov ebp, esp
:00439823 83EC04                  sub esp, 00000004
:00439826 53                      push ebx
:00439827 56                      push esi
:00439828 57                      push edi
:00439829 894DFC                  mov dword ptr [ebp-04], ecx
:0043982C 8B4508                  mov eax, dword ptr [ebp+08]
:0043982F C1E003                  shl eax, 03
:00439832 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00439835 8901                    mov dword ptr [ecx], eax
:00439837 8B450C                  mov eax, dword ptr [ebp+0C]
:0043983A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043983D 894104                  mov dword ptr [ecx+04], eax
:00439840 8B4510                  mov eax, dword ptr [ebp+10]
:00439843 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00439846 894108                  mov dword ptr [ecx+08], eax
:00439849 8B4514                  mov eax, dword ptr [ebp+14]
:0043984C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043984F 89410C                  mov dword ptr [ecx+0C], eax
:00439852 8B4518                  mov eax, dword ptr [ebp+18]
:00439855 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00439858 894110                  mov dword ptr [ecx+10], eax
:0043985B 8B45FC                  mov eax, dword ptr [ebp-04]
:0043985E C7401400000000          mov [eax+14], 00000000
:00439865 E900000000              jmp 0043986A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439865(U)
|
:0043986A 5F                      pop edi
:0043986B 5E                      pop esi
:0043986C 5B                      pop ebx
:0043986D C9                      leave
:0043986E C21400                  ret 0014


:00439871 CC                      int 03
:00439872 CC                      int 03
:00439873 CC                      int 03
:00439874 CC                      int 03
:00439875 CC                      int 03
:00439876 CC                      int 03
:00439877 CC                      int 03
:00439878 CC                      int 03
:00439879 CC                      int 03
:0043987A CC                      int 03
:0043987B CC                      int 03
:0043987C CC                      int 03
:0043987D CC                      int 03
:0043987E CC                      int 03
:0043987F CC                      int 03

* Referenced by a CALL at Address:
|:00437FC0   
|
:00439880 55                      push ebp
:00439881 8BEC                    mov ebp, esp
:00439883 6AFF                    push FFFFFFFF
:00439885 68F3994300              push 004399F3
:0043988A 64A100000000            mov eax, dword ptr fs:[00000000]
:00439890 50                      push eax
:00439891 64892500000000          mov dword ptr fs:[00000000], esp
:00439898 83EC0C                  sub esp, 0000000C
:0043989B 53                      push ebx
:0043989C 56                      push esi
:0043989D 57                      push edi
:0043989E 894DE8                  mov dword ptr [ebp-18], ecx
:004398A1 6870BC4000              push 0040BC70
:004398A6 68F0BC4000              push 0040BCF0
:004398AB 6A0C                    push 0000000C
:004398AD 6A17                    push 00000017
:004398AF 8B45E8                  mov eax, dword ptr [ebp-18]
:004398B2 83C006                  add eax, 00000006
:004398B5 50                      push eax
:004398B6 E885E40000              call 00447D40
:004398BB C745FC00000000          mov [ebp-04], 00000000
:004398C2 8B4508                  mov eax, dword ptr [ebp+08]
:004398C5 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004398C8 894102                  mov dword ptr [ecx+02], eax
:004398CB C645F000                mov [ebp-10], 00
:004398CF E903000000              jmp 004398D7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439934(U)
|
:004398D4 FE45F0                  inc [ebp-10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004398CF(U)
|
:004398D7 33C0                    xor eax, eax
:004398D9 8A45F0                  mov al, byte ptr [ebp-10]
:004398DC 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004398DF 8B4902                  mov ecx, dword ptr [ecx+02]
:004398E2 833C8100                cmp dword ptr [ecx+4*eax], 00000000
:004398E6 0F844D000000            je 00439939
:004398EC C645EC00                mov [ebp-14], 00
:004398F0 E903000000              jmp 004398F8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439918(U)
|
:004398F5 FE45EC                  inc [ebp-14]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004398F0(U)
|
:004398F8 33C0                    xor eax, eax
:004398FA 8A45F0                  mov al, byte ptr [ebp-10]
:004398FD 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00439900 8B4902                  mov ecx, dword ptr [ecx+02]
:00439903 8B0481                  mov eax, dword ptr [ecx+4*eax]
:00439906 33C9                    xor ecx, ecx
:00439908 8A4DEC                  mov cl, byte ptr [ebp-14]
:0043990B 33D2                    xor edx, edx
:0043990D 8A1408                  mov dl, byte ptr [eax+ecx]
:00439910 85D2                    test edx, edx
:00439912 0F8405000000            je 0043991D
:00439918 E9D8FFFFFF              jmp 004398F5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439912(C)
|
:0043991D 33C0                    xor eax, eax
:0043991F 8A4510                  mov al, byte ptr [ebp+10]
:00439922 33C9                    xor ecx, ecx
:00439924 8A4DEC                  mov cl, byte ptr [ebp-14]
:00439927 3BC1                    cmp eax, ecx
:00439929 0F8F02000000            jg 00439931
:0043992F 8BC1                    mov eax, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439929(C)
|
:00439931 884510                  mov byte ptr [ebp+10], al
:00439934 E99BFFFFFF              jmp 004398D4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004398E6(C)
|
:00439939 33C0                    xor eax, eax
:0043993B 8A4514                  mov al, byte ptr [ebp+14]
:0043993E 33C9                    xor ecx, ecx
:00439940 8A4DF0                  mov cl, byte ptr [ebp-10]
:00439943 3BC1                    cmp eax, ecx
:00439945 0F8C02000000            jl 0043994D
:0043994B 8BC1                    mov eax, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439945(C)
|
:0043994D 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00439950 8801                    mov byte ptr [ecx], al
:00439952 33C0                    xor eax, eax
:00439954 8A4510                  mov al, byte ptr [ebp+10]
:00439957 83F808                  cmp eax, 00000008
:0043995A 0F8F05000000            jg 00439965
:00439960 B808000000              mov eax, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043995A(C)
|
:00439965 884510                  mov byte ptr [ebp+10], al
:00439968 8A4510                  mov al, byte ptr [ebp+10]
:0043996B 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043996E 884101                  mov byte ptr [ecx+01], al
:00439971 C645F000                mov [ebp-10], 00
:00439975 E903000000              jmp 0043997D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004399C4(U)
|
:0043997A FE45F0                  inc [ebp-10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439975(U)
|
:0043997D 33C0                    xor eax, eax
:0043997F 8A45F0                  mov al, byte ptr [ebp-10]
:00439982 83F80C                  cmp eax, 0000000C
:00439985 0F8D3E000000            jnl 004399C9
:0043998B 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0043998F 0F841F000000            je 004399B4
:00439995 33C0                    xor eax, eax
:00439997 8A45F0                  mov al, byte ptr [ebp-10]
:0043999A 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0043999D 8A0408                  mov al, byte ptr [eax+ecx]
:004399A0 33C9                    xor ecx, ecx
:004399A2 8A4DF0                  mov cl, byte ptr [ebp-10]
:004399A5 8B55E8                  mov edx, dword ptr [ebp-18]
:004399A8 8884111A010000          mov byte ptr [ecx+edx+0000011A], al
:004399AF E910000000              jmp 004399C4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043998F(C)
|
:004399B4 33C0                    xor eax, eax
:004399B6 8A45F0                  mov al, byte ptr [ebp-10]
:004399B9 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004399BC C684081A01000000        mov byte ptr [eax+ecx+0000011A], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004399AF(U)
|
:004399C4 E9B1FFFFFF              jmp 0043997A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439985(C)
|
:004399C9 E900000000              jmp 004399CE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004399C9(U)
|
:004399CE C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:004399D5 8B45E8                  mov eax, dword ptr [ebp-18]
:004399D8 E920000000              jmp 004399FD
:004399DD 6870BC4000              push 0040BC70
:004399E2 6A0C                    push 0000000C
:004399E4 6A0C                    push 0000000C
:004399E6 8B45E8                  mov eax, dword ptr [ebp-18]
:004399E9 83C006                  add eax, 00000006
:004399EC 50                      push eax
:004399ED E8DEE30000              call 00447DD0
:004399F2 C3                      ret


:004399F3 B8A0C24400              mov eax, 0044C2A0
:004399F8 E9C3E60000              jmp 004480C0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004399D8(U)
|
:004399FD 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00439A00 64890D00000000          mov dword ptr fs:[00000000], ecx
:00439A07 5F                      pop edi
:00439A08 5E                      pop esi
:00439A09 5B                      pop ebx
:00439A0A C9                      leave
:00439A0B C21000                  ret 0010


:00439A0E CC                      int 03
:00439A0F CC                      int 03

* Referenced by a CALL at Address:
|:00438ACB   
|
:00439A10 55                      push ebp
:00439A11 8BEC                    mov ebp, esp
:00439A13 6AFF                    push FFFFFFFF
:00439A15 68649A4300              push 00439A64
:00439A1A 64A100000000            mov eax, dword ptr fs:[00000000]
:00439A20 50                      push eax
:00439A21 64892500000000          mov dword ptr fs:[00000000], esp
:00439A28 83EC04                  sub esp, 00000004
:00439A2B 53                      push ebx
:00439A2C 56                      push esi
:00439A2D 57                      push edi
:00439A2E 894DF0                  mov dword ptr [ebp-10], ecx
:00439A31 C745FC00000000          mov [ebp-04], 00000000
:00439A38 E900000000              jmp 00439A3D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439A38(U)
|
:00439A3D C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00439A44 E805000000              call 00439A4E
:00439A49 E920000000              jmp 00439A6E

* Referenced by a CALL at Address:
|:00439A44   
|
:00439A4E 6870BC4000              push 0040BC70
:00439A53 6A0C                    push 0000000C
:00439A55 6A17                    push 00000017
:00439A57 8B45F0                  mov eax, dword ptr [ebp-10]
:00439A5A 83C006                  add eax, 00000006
:00439A5D 50                      push eax
:00439A5E E86DE30000              call 00447DD0
:00439A63 C3                      ret


:00439A64 B8C8C24400              mov eax, 0044C2C8
:00439A69 E952E60000              jmp 004480C0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439A49(U)
|
:00439A6E 8B45F4                  mov eax, dword ptr [ebp-0C]
:00439A71 64A300000000            mov dword ptr fs:[00000000], eax
:00439A77 5F                      pop edi
:00439A78 5E                      pop esi
:00439A79 5B                      pop ebx
:00439A7A C9                      leave
:00439A7B C3                      ret


:00439A7C CC                      int 03
:00439A7D CC                      int 03
:00439A7E CC                      int 03
:00439A7F CC                      int 03
:00439A80 55                      push ebp
:00439A81 8BEC                    mov ebp, esp
:00439A83 53                      push ebx
:00439A84 56                      push esi
:00439A85 57                      push edi
:00439A86 E80F000000              call 00439A9A
:00439A8B E824000000              call 00439AB4
:00439A90 E900000000              jmp 00439A95

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439A90(U)
|
:00439A95 5F                      pop edi
:00439A96 5E                      pop esi
:00439A97 5B                      pop ebx
:00439A98 C9                      leave
:00439A99 C3                      ret



* Referenced by a CALL at Address:
|:00439A86   
|
:00439A9A 55                      push ebp
:00439A9B 8BEC                    mov ebp, esp
:00439A9D 53                      push ebx
:00439A9E 56                      push esi
:00439A9F 57                      push edi
:00439AA0 B900FB4600              mov ecx, 0046FB00
:00439AA5 E8A6520000              call 0043ED50
:00439AAA E900000000              jmp 00439AAF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439AAA(U)
|
:00439AAF 5F                      pop edi
:00439AB0 5E                      pop esi
:00439AB1 5B                      pop ebx
:00439AB2 C9                      leave
:00439AB3 C3                      ret



* Referenced by a CALL at Address:
|:00439A8B   
|
:00439AB4 55                      push ebp
:00439AB5 8BEC                    mov ebp, esp
:00439AB7 53                      push ebx
:00439AB8 56                      push esi
:00439AB9 57                      push edi
:00439ABA 68D19A4300              push 00439AD1
:00439ABF E81CE20000              call 00447CE0
:00439AC4 83C404                  add esp, 00000004
:00439AC7 E900000000              jmp 00439ACC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439AC7(U)
|
:00439ACC 5F                      pop edi
:00439ACD 5E                      pop esi
:00439ACE 5B                      pop ebx
:00439ACF C9                      leave
:00439AD0 C3                      ret


:00439AD1 55                      push ebp
:00439AD2 8BEC                    mov ebp, esp
:00439AD4 53                      push ebx
:00439AD5 56                      push esi
:00439AD6 57                      push edi
:00439AD7 B900FB4600              mov ecx, 0046FB00
:00439ADC E8AF520000              call 0043ED90
:00439AE1 E900000000              jmp 00439AE6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439AE1(U)
|
:00439AE6 5F                      pop edi
:00439AE7 5E                      pop esi
:00439AE8 5B                      pop ebx
:00439AE9 C9                      leave
:00439AEA C3                      ret


:00439AEB 55                      push ebp
:00439AEC 8BEC                    mov ebp, esp
:00439AEE 53                      push ebx
:00439AEF 56                      push esi
:00439AF0 57                      push edi
:00439AF1 E80F000000              call 00439B05
:00439AF6 E831000000              call 00439B2C
:00439AFB E900000000              jmp 00439B00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439AFB(U)
|
:00439B00 5F                      pop edi
:00439B01 5E                      pop esi
:00439B02 5B                      pop ebx
:00439B03 C9                      leave
:00439B04 C3                      ret



* Referenced by a CALL at Address:
|:00439AF1   
|
:00439B05 55                      push ebp
:00439B06 8BEC                    mov ebp, esp
:00439B08 53                      push ebx
:00439B09 56                      push esi
:00439B0A 57                      push edi
:00439B0B 6A0F                    push 0000000F
:00439B0D 6A0A                    push 0000000A
:00439B0F 68F8000000              push 000000F8
:00439B14 6A58                    push 00000058
:00439B16 6A4C                    push 0000004C
:00439B18 B950FB4600              mov ecx, 0046FB50
:00439B1D E89EFCFFFF              call 004397C0
:00439B22 E900000000              jmp 00439B27

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439B22(U)
|
:00439B27 5F                      pop edi
:00439B28 5E                      pop esi
:00439B29 5B                      pop ebx
:00439B2A C9                      leave
:00439B2B C3                      ret



* Referenced by a CALL at Address:
|:00439AF6   
|
:00439B2C 55                      push ebp
:00439B2D 8BEC                    mov ebp, esp
:00439B2F 53                      push ebx
:00439B30 56                      push esi
:00439B31 57                      push edi
:00439B32 68499B4300              push 00439B49
:00439B37 E8A4E10000              call 00447CE0
:00439B3C 83C404                  add esp, 00000004
:00439B3F E900000000              jmp 00439B44

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439B3F(U)
|
:00439B44 5F                      pop edi
:00439B45 5E                      pop esi
:00439B46 5B                      pop ebx
:00439B47 C9                      leave
:00439B48 C3                      ret


:00439B49 55                      push ebp
:00439B4A 8BEC                    mov ebp, esp
:00439B4C 53                      push ebx
:00439B4D 56                      push esi
:00439B4E 57                      push edi
:00439B4F B950FB4600              mov ecx, 0046FB50
:00439B54 E8A7FCFFFF              call 00439800
:00439B59 E900000000              jmp 00439B5E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439B59(U)
|
:00439B5E 5F                      pop edi
:00439B5F 5E                      pop esi
:00439B60 5B                      pop ebx
:00439B61 C9                      leave
:00439B62 C3                      ret



* Referenced by a CALL at Addresses:
|:00402473   , :004050F1   , :00408CE1   , :00423E34   
|
:00439B63 55                      push ebp
:00439B64 8BEC                    mov ebp, esp
:00439B66 83EC2C                  sub esp, 0000002C
:00439B69 53                      push ebx
:00439B6A 56                      push esi
:00439B6B 57                      push edi
:00439B6C 33C0                    xor eax, eax
:00439B6E 8A4508                  mov al, byte ptr [ebp+08]
:00439B71 8BC8                    mov ecx, eax
:00439B73 8D0440                  lea eax, dword ptr [eax+2*eax]
:00439B76 C1E003                  shl eax, 03
:00439B79 2BC1                    sub eax, ecx
:00439B7B 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00439B81 E87AF6FCFF              call 00409200
:00439B86 668B00                  mov ax, word ptr [eax]
:00439B89 668945F0                mov word ptr [ebp-10], ax
:00439B8D 33DB                    xor ebx, ebx
:00439B8F 8A5DF0                  mov bl, byte ptr [ebp-10]
:00439B92 8D1C5B                  lea ebx, dword ptr [ebx+2*ebx]
:00439B95 B900FB4600              mov ecx, 0046FB00
:00439B9A E891AFFEFF              call 00424B30
:00439B9F 2BD8                    sub ebx, eax
:00439BA1 895DEC                  mov dword ptr [ebp-14], ebx
:00439BA4 33DB                    xor ebx, ebx
:00439BA6 8A5DF1                  mov bl, byte ptr [ebp-0F]
:00439BA9 8D1C5B                  lea ebx, dword ptr [ebx+2*ebx]
:00439BAC B900FB4600              mov ecx, 0046FB00
:00439BB1 E89AAFFEFF              call 00424B50
:00439BB6 2BD8                    sub ebx, eax
:00439BB8 895DD4                  mov dword ptr [ebp-2C], ebx
:00439BBB 8B450C                  mov eax, dword ptr [ebp+0C]
:00439BBE 50                      push eax
:00439BBF 8D45D8                  lea eax, dword ptr [ebp-28]
:00439BC2 50                      push eax
:00439BC3 E8A4EFFFFF              call 00438B6C
:00439BC8 83C408                  add esp, 00000008
:00439BCB 8D45D8                  lea eax, dword ptr [ebp-28]
:00439BCE 50                      push eax
:00439BCF E8D6D70000              call 004473AA
:00439BD4 83C404                  add esp, 00000004
:00439BD7 8845FC                  mov byte ptr [ebp-04], al
:00439BDA 837D0C00                cmp dword ptr [ebp+0C], 00000000
:00439BDE 0F8505000000            jne 00439BE9
:00439BE4 E9D3010000              jmp 00439DBC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439BDE(C)
|
:00439BE9 837DEC00                cmp dword ptr [ebp-14], 00000000
:00439BED 0F8C1E000000            jl 00439C11
:00439BF3 837DD400                cmp dword ptr [ebp-2C], 00000000
:00439BF7 0F8C14000000            jl 00439C11
:00439BFD 837DEC27                cmp dword ptr [ebp-14], 00000027
:00439C01 0F8D0A000000            jnl 00439C11
:00439C07 837DD418                cmp dword ptr [ebp-2C], 00000018
:00439C0B 0F8C05000000            jl 00439C16

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00439BED(C), :00439BF7(C), :00439C01(C)
|
:00439C11 E9A6010000              jmp 00439DBC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439C0B(C)
|
:00439C16 B900FB4600              mov ecx, 0046FB00
:00439C1B E810AFFEFF              call 00424B30
:00439C20 40                      inc eax
:00439C21 33C9                    xor ecx, ecx
:00439C23 8A4DF0                  mov cl, byte ptr [ebp-10]
:00439C26 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:00439C29 3BC1                    cmp eax, ecx
:00439C2B 0F8E0C000000            jle 00439C3D
:00439C31 C745EC00000000          mov [ebp-14], 00000000
:00439C38 E918000000              jmp 00439C55

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439C2B(C)
|
:00439C3D 33DB                    xor ebx, ebx
:00439C3F 8A5DF0                  mov bl, byte ptr [ebp-10]
:00439C42 8D1C5B                  lea ebx, dword ptr [ebx+2*ebx]
:00439C45 B900FB4600              mov ecx, 0046FB00
:00439C4A E8E1AEFEFF              call 00424B30
:00439C4F 2BD8                    sub ebx, eax
:00439C51 4B                      dec ebx
:00439C52 895DEC                  mov dword ptr [ebp-14], ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439C38(U)
|
:00439C55 6A04                    push 00000004
:00439C57 B910BC4600              mov ecx, 0046BC10
:00439C5C E82062FEFF              call 0041FE81
:00439C61 33C0                    xor eax, eax
:00439C63 8A4510                  mov al, byte ptr [ebp+10]
:00439C66 50                      push eax
:00439C67 B910BC4600              mov ecx, 0046BC10
:00439C6C E86260FEFF              call 0041FCD3
:00439C71 6A00                    push 00000000
:00439C73 B910BC4600              mov ecx, 0046BC10
:00439C78 E85361FEFF              call 0041FDD0
:00439C7D 6A01                    push 00000001
:00439C7F B910BC4600              mov ecx, 0046BC10
:00439C84 E8D761FEFF              call 0041FE60
:00439C89 6A00                    push 00000000
:00439C8B B910BC4600              mov ecx, 0046BC10
:00439C90 E89D61FEFF              call 0041FE32
:00439C95 B808000000              mov eax, 00000008
:00439C9A 33C9                    xor ecx, ecx
:00439C9C 8A4DFC                  mov cl, byte ptr [ebp-04]
:00439C9F 2BC1                    sub eax, ecx
:00439CA1 99                      cdq
:00439CA2 2BC2                    sub eax, edx
:00439CA4 C1F801                  sar eax, 01
:00439CA7 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00439CAA 8D0448                  lea eax, dword ptr [eax+2*ecx]
:00439CAD 40                      inc eax
:00439CAE 8945F8                  mov dword ptr [ebp-08], eax
:00439CB1 8B45D4                  mov eax, dword ptr [ebp-2C]
:00439CB4 83C003                  add eax, 00000003
:00439CB7 C1E004                  shl eax, 04
:00439CBA 8945F4                  mov dword ptr [ebp-0C], eax
:00439CBD 837DF802                cmp dword ptr [ebp-08], 00000002
:00439CC1 0F8307000000            jnb 00439CCE
:00439CC7 C745F800000000          mov [ebp-08], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439CC1(C)
|
:00439CCE 33C0                    xor eax, eax
:00439CD0 8A45FC                  mov al, byte ptr [ebp-04]
:00439CD3 0345F8                  add eax, dword ptr [ebp-08]
:00439CD6 83F84E                  cmp eax, 0000004E
:00439CD9 0F8212000000            jb 00439CF1
:00439CDF B84E000000              mov eax, 0000004E
:00439CE4 33C9                    xor ecx, ecx
:00439CE6 8A4DFC                  mov cl, byte ptr [ebp-04]
:00439CE9 2BC1                    sub eax, ecx
:00439CEB 8945F8                  mov dword ptr [ebp-08], eax
:00439CEE FF4DEC                  dec [ebp-14]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439CD9(C)
|
:00439CF1 33C0                    xor eax, eax
:00439CF3 A0BDFC4600              mov al, byte ptr [0046FCBD]
:00439CF8 83C004                  add eax, 00000004
:00439CFB 50                      push eax
:00439CFC B9B0FA4600              mov ecx, 0046FAB0
:00439D01 E8AAF4FCFF              call 004091B0
:00439D06 8B45F4                  mov eax, dword ptr [ebp-0C]
:00439D09 50                      push eax
:00439D0A 8B45F8                  mov eax, dword ptr [ebp-08]
:00439D0D 50                      push eax
:00439D0E B910BC4600              mov ecx, 0046BC10
:00439D13 E8EF5EFEFF              call 0041FC07
:00439D18 B968F94600              mov ecx, 0046F968
:00439D1D E8BEF3FCFF              call 004090E0
:00439D22 50                      push eax
:00439D23 6A10                    push 00000010
:00439D25 6A40                    push 00000040
:00439D27 8B45F4                  mov eax, dword ptr [ebp-0C]
:00439D2A 50                      push eax
:00439D2B 8B45F8                  mov eax, dword ptr [ebp-08]
:00439D2E C1E003                  shl eax, 03
:00439D31 50                      push eax
:00439D32 E8F4350000              call 0043D32B
:00439D37 83C414                  add esp, 00000014
:00439D3A 8D45D8                  lea eax, dword ptr [ebp-28]
:00439D3D 50                      push eax

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:00439D3E 68D8334500              push 004533D8
:00439D43 6810BC4600              push 0046BC10
:00439D48 E8D66DFEFF              call 00420B23
:00439D4D 83C40C                  add esp, 0000000C
:00439D50 E873D6FFFF              call 004373C8
:00439D55 33C0                    xor eax, eax
:00439D57 A0BDFC4600              mov al, byte ptr [0046FCBD]
:00439D5C 83C004                  add eax, 00000004
:00439D5F 50                      push eax
:00439D60 B9B0FA4600              mov ecx, 0046FAB0
:00439D65 E846F4FCFF              call 004091B0
:00439D6A 8B45EC                  mov eax, dword ptr [ebp-14]
:00439D6D 99                      cdq
:00439D6E 33C2                    xor eax, edx
:00439D70 2BC2                    sub eax, edx
:00439D72 83E001                  and eax, 00000001
:00439D75 33C2                    xor eax, edx
:00439D77 2BC2                    sub eax, edx
:00439D79 0F8403000000            je 00439D82
:00439D7F FF4DEC                  dec [ebp-14]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439D79(C)
|
:00439D82 6A00                    push 00000000
:00439D84 B968F94600              mov ecx, 0046F968
:00439D89 E852F3FCFF              call 004090E0
:00439D8E 50                      push eax
:00439D8F 6A10                    push 00000010
:00439D91 6A40                    push 00000040
:00439D93 8B45F4                  mov eax, dword ptr [ebp-0C]
:00439D96 50                      push eax
:00439D97 8B45F8                  mov eax, dword ptr [ebp-08]
:00439D9A C1E003                  shl eax, 03
:00439D9D 50                      push eax
:00439D9E E812350000              call 0043D2B5
:00439DA3 83C418                  add esp, 00000018
:00439DA6 E81DD6FFFF              call 004373C8
:00439DAB 6A00                    push 00000000
:00439DAD B910BC4600              mov ecx, 0046BC10
:00439DB2 E8A960FEFF              call 0041FE60
:00439DB7 E900000000              jmp 00439DBC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00439BE4(U), :00439C11(U), :00439DB7(U)
|
:00439DBC 5F                      pop edi
:00439DBD 5E                      pop esi
:00439DBE 5B                      pop ebx
:00439DBF C9                      leave
:00439DC0 C3                      ret



* Referenced by a CALL at Addresses:
|:0040248D   , :0040510B   , :00408CFE   , :004242A2   
|
:00439DC1 55                      push ebp
:00439DC2 8BEC                    mov ebp, esp
:00439DC4 83EC04                  sub esp, 00000004
:00439DC7 53                      push ebx
:00439DC8 56                      push esi
:00439DC9 57                      push edi
:00439DCA 33C0                    xor eax, eax
:00439DCC 8A450C                  mov al, byte ptr [ebp+0C]
:00439DCF 8BC8                    mov ecx, eax
:00439DD1 8D0440                  lea eax, dword ptr [eax+2*eax]
:00439DD4 C1E003                  shl eax, 03
:00439DD7 2BC1                    sub eax, ecx
:00439DD9 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00439DDF E81CF4FCFF              call 00409200
:00439DE4 668B00                  mov ax, word ptr [eax]
:00439DE7 50                      push eax
:00439DE8 8D45FC                  lea eax, dword ptr [ebp-04]
:00439DEB 50                      push eax
:00439DEC E833090000              call 0043A724
:00439DF1 83C408                  add esp, 00000008
:00439DF4 33C0                    xor eax, eax
:00439DF6 8A45FD                  mov al, byte ptr [ebp-03]
:00439DF9 83F80C                  cmp eax, 0000000C
:00439DFC 0F8D09000000            jnl 00439E0B
:00439E02 C645FD0F                mov [ebp-03], 0F
:00439E06 E904000000              jmp 00439E0F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439DFC(C)
|
:00439E0B C645FD03                mov [ebp-03], 03

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439E06(U)
|
:00439E0F 668B45FC                mov ax, word ptr [ebp-04]
:00439E13 8B4D08                  mov ecx, dword ptr [ebp+08]
:00439E16 668901                  mov word ptr [ecx], ax
:00439E19 8B4508                  mov eax, dword ptr [ebp+08]
:00439E1C E900000000              jmp 00439E21

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439E1C(U)
|
:00439E21 5F                      pop edi
:00439E22 5E                      pop esi
:00439E23 5B                      pop ebx
:00439E24 C9                      leave
:00439E25 C3                      ret



* Referenced by a CALL at Addresses:
|:004024E3   , :00405161   , :00408D5A   , :00423E74   , :00423E93   
|
:00439E26 55                      push ebp
:00439E27 8BEC                    mov ebp, esp
:00439E29 83EC14                  sub esp, 00000014
:00439E2C 53                      push ebx
:00439E2D 56                      push esi
:00439E2E 57                      push edi
:00439E2F 33C0                    xor eax, eax
:00439E31 8A450C                  mov al, byte ptr [ebp+0C]
:00439E34 8BC8                    mov ecx, eax
:00439E36 8D0440                  lea eax, dword ptr [eax+2*eax]
:00439E39 C1E003                  shl eax, 03
:00439E3C 2BC1                    sub eax, ecx
:00439E3E 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00439E44 E8E7F2FCFF              call 00409130
:00439E49 8D0440                  lea eax, dword ptr [eax+2*eax]
:00439E4C 03C0                    add eax, eax
:00439E4E 8D04C0                  lea eax, dword ptr [eax+8*eax]
:00439E51 05E8564500              add eax, 004556E8
:00439E56 8945EC                  mov dword ptr [ebp-14], eax
:00439E59 33C0                    xor eax, eax
:00439E5B 8A4508                  mov al, byte ptr [ebp+08]
:00439E5E 8945F8                  mov dword ptr [ebp-08], eax
:00439E61 33C0                    xor eax, eax
:00439E63 8A4509                  mov al, byte ptr [ebp+09]
:00439E66 83C003                  add eax, 00000003
:00439E69 C1E004                  shl eax, 04
:00439E6C 8945F4                  mov dword ptr [ebp-0C], eax
:00439E6F 33C0                    xor eax, eax
:00439E71 8A450C                  mov al, byte ptr [ebp+0C]
:00439E74 8BC8                    mov ecx, eax
:00439E76 8D0440                  lea eax, dword ptr [eax+2*eax]
:00439E79 C1E003                  shl eax, 03
:00439E7C 2BC1                    sub eax, ecx
:00439E7E 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00439E84 E897F3FCFF              call 00409220
:00439E89 85C0                    test eax, eax
:00439E8B 0F840C000000            je 00439E9D
:00439E91 C745F000000000          mov [ebp-10], 00000000
:00439E98 E907000000              jmp 00439EA4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439E8B(C)
|
:00439E9D C745F0C0180000          mov [ebp-10], 000018C0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439E98(U)
|
:00439EA4 E8EED0FEFF              call 00426F97
:00439EA9 6A60                    push 00000060
:00439EAB 68C0000000              push 000000C0
:00439EB0 8B45F4                  mov eax, dword ptr [ebp-0C]
:00439EB3 50                      push eax
:00439EB4 8B45F8                  mov eax, dword ptr [ebp-08]
:00439EB7 C1E003                  shl eax, 03
:00439EBA 50                      push eax
:00439EBB E8D2050000              call 0043A492
:00439EC0 83C410                  add esp, 00000010
:00439EC3 6A04                    push 00000004
:00439EC5 6A00                    push 00000000
:00439EC7 6870110100              push 00011170
:00439ECC B968F94600              mov ecx, 0046F968
:00439ED1 E84AD80000              call 00447720
:00439ED6 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00439ED9 03C8                    add ecx, eax
:00439EDB 51                      push ecx
:00439EDC 6A30                    push 00000030
:00439EDE 6884000000              push 00000084
:00439EE3 8B45F4                  mov eax, dword ptr [ebp-0C]
:00439EE6 83C020                  add eax, 00000020
:00439EE9 50                      push eax
:00439EEA 8B45F8                  mov eax, dword ptr [ebp-08]
:00439EED 8D04C528000000          lea eax, dword ptr [8*eax+00000028]
:00439EF4 50                      push eax
:00439EF5 E831340000              call 0043D32B
:00439EFA 83C414                  add esp, 00000014
:00439EFD 33C0                    xor eax, eax
:00439EFF 8A450C                  mov al, byte ptr [ebp+0C]
:00439F02 8BC8                    mov ecx, eax
:00439F04 8D0440                  lea eax, dword ptr [eax+2*eax]
:00439F07 C1E003                  shl eax, 03
:00439F0A 2BC1                    sub eax, ecx
:00439F0C 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00439F12 E809F3FCFF              call 00409220
:00439F17 85C0                    test eax, eax
:00439F19 0F8439000000            je 00439F58
:00439F1F 33C0                    xor eax, eax
:00439F21 8A450C                  mov al, byte ptr [ebp+0C]
:00439F24 8BC8                    mov ecx, eax
:00439F26 8D0440                  lea eax, dword ptr [eax+2*eax]
:00439F29 C1E003                  shl eax, 03
:00439F2C 2BC1                    sub eax, ecx
:00439F2E 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00439F34 E897F4FCFF              call 004093D0
:00439F39 33C9                    xor ecx, ecx
:00439F3B 8AC8                    mov cl, al
:00439F3D 83F907                  cmp ecx, 00000007
:00439F40 0F8509000000            jne 00439F4F
:00439F46 C645FC17                mov [ebp-04], 17
:00439F4A E904000000              jmp 00439F53

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439F40(C)
|
:00439F4F C645FC0D                mov [ebp-04], 0D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439F4A(U)
|
:00439F53 E904000000              jmp 00439F5C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439F19(C)
|
:00439F58 C645FC0F                mov [ebp-04], 0F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439F53(U)
|
:00439F5C 6A04                    push 00000004
:00439F5E B910BC4600              mov ecx, 0046BC10
:00439F63 E8195FFEFF              call 0041FE81
:00439F68 33C0                    xor eax, eax
:00439F6A 8A45FC                  mov al, byte ptr [ebp-04]
:00439F6D 50                      push eax
:00439F6E B910BC4600              mov ecx, 0046BC10
:00439F73 E85B5DFEFF              call 0041FCD3
:00439F78 8B45F4                  mov eax, dword ptr [ebp-0C]
:00439F7B 83C008                  add eax, 00000008
:00439F7E 50                      push eax
:00439F7F 8B45F8                  mov eax, dword ptr [ebp-08]
:00439F82 83C002                  add eax, 00000002
:00439F85 50                      push eax
:00439F86 B910BC4600              mov ecx, 0046BC10
:00439F8B E8775CFEFF              call 0041FC07
:00439F90 33C0                    xor eax, eax
:00439F92 8A450C                  mov al, byte ptr [ebp+0C]
:00439F95 8BC8                    mov ecx, eax
:00439F97 8D0440                  lea eax, dword ptr [eax+2*eax]
:00439F9A C1E003                  shl eax, 03
:00439F9D 2BC1                    sub eax, ecx
:00439F9F 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00439FA5 E8D6F5FCFF              call 00409580
:00439FAA 50                      push eax

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:00439FAB 68DC334500              push 004533DC
:00439FB0 6810BC4600              push 0046BC10
:00439FB5 E8696BFEFF              call 00420B23
:00439FBA 83C40C                  add esp, 0000000C
:00439FBD 6A17                    push 00000017
:00439FBF B910BC4600              mov ecx, 0046BC10
:00439FC4 E80A5DFEFF              call 0041FCD3
:00439FC9 8B45F4                  mov eax, dword ptr [ebp-0C]
:00439FCC 83C008                  add eax, 00000008
:00439FCF 50                      push eax
:00439FD0 8B45F8                  mov eax, dword ptr [ebp-08]
:00439FD3 83C00A                  add eax, 0000000A
:00439FD6 50                      push eax
:00439FD7 B910BC4600              mov ecx, 0046BC10
:00439FDC E8265CFEFF              call 0041FC07
:00439FE1 33C0                    xor eax, eax
:00439FE3 8A450C                  mov al, byte ptr [ebp+0C]
:00439FE6 8BC8                    mov ecx, eax
:00439FE8 8D0440                  lea eax, dword ptr [eax+2*eax]
:00439FEB C1E003                  shl eax, 03
:00439FEE 2BC1                    sub eax, ecx
:00439FF0 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00439FF6 E8A5F2FCFF              call 004092A0
:00439FFB 33C9                    xor ecx, ecx
:00439FFD 8AC8                    mov cl, al
:00439FFF 8B048DF82C4500          mov eax, dword ptr [4*ecx+00452CF8]
:0043A006 50                      push eax

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:0043A007 68E0334500              push 004533E0
:0043A00C 6810BC4600              push 0046BC10
:0043A011 E80D6BFEFF              call 00420B23
:0043A016 83C40C                  add esp, 0000000C
:0043A019 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043A01C 83C008                  add eax, 00000008
:0043A01F 50                      push eax
:0043A020 8B45F8                  mov eax, dword ptr [ebp-08]
:0043A023 83C012                  add eax, 00000012
:0043A026 50                      push eax
:0043A027 B910BC4600              mov ecx, 0046BC10
:0043A02C E8D65BFEFF              call 0041FC07
:0043A031 33C0                    xor eax, eax
:0043A033 8A450C                  mov al, byte ptr [ebp+0C]
:0043A036 8BC8                    mov ecx, eax
:0043A038 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043A03B C1E003                  shl eax, 03
:0043A03E 2BC1                    sub eax, ecx
:0043A040 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043A046 E8E5F0FCFF              call 00409130
:0043A04B 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043A04E 03C0                    add eax, eax
:0043A050 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:0043A057 E824F2FCFF              call 00409280
:0043A05C 33C9                    xor ecx, ecx
:0043A05E 8AC8                    mov cl, al
:0043A060 51                      push ecx

* Possible StringData Ref from Data Obj ->"Lv%d"
                                  |
:0043A061 68E4334500              push 004533E4
:0043A066 6810BC4600              push 0046BC10
:0043A06B E8B36AFEFF              call 00420B23
:0043A070 83C40C                  add esp, 0000000C
:0043A073 6880000000              push 00000080
:0043A078 33C0                    xor eax, eax
:0043A07A 8A450C                  mov al, byte ptr [ebp+0C]
:0043A07D 8BC8                    mov ecx, eax
:0043A07F 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043A082 C1E003                  shl eax, 03
:0043A085 2BC1                    sub eax, ecx
:0043A087 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043A08D E81EF7FCFF              call 004097B0
:0043A092 50                      push eax
:0043A093 8B45EC                  mov eax, dword ptr [ebp-14]
:0043A096 50                      push eax
:0043A097 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043A09A 83C020                  add eax, 00000020
:0043A09D 50                      push eax
:0043A09E 8B45F8                  mov eax, dword ptr [ebp-08]
:0043A0A1 8D04C528000000          lea eax, dword ptr [8*eax+00000028]
:0043A0A8 50                      push eax
:0043A0A9 6A0B                    push 0000000B
:0043A0AB E87C67FDFF              call 0041082C
:0043A0B0 83C418                  add esp, 00000018
:0043A0B3 6880000000              push 00000080
:0043A0B8 33C0                    xor eax, eax
:0043A0BA 8A450C                  mov al, byte ptr [ebp+0C]
:0043A0BD 8BC8                    mov ecx, eax
:0043A0BF 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043A0C2 C1E003                  shl eax, 03
:0043A0C5 2BC1                    sub eax, ecx
:0043A0C7 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043A0CD E88EF1FCFF              call 00409260
:0043A0D2 33C9                    xor ecx, ecx
:0043A0D4 8AC8                    mov cl, al
:0043A0D6 51                      push ecx
:0043A0D7 8B45EC                  mov eax, dword ptr [ebp-14]
:0043A0DA 50                      push eax
:0043A0DB 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043A0DE 83C038                  add eax, 00000038
:0043A0E1 50                      push eax
:0043A0E2 8B45F8                  mov eax, dword ptr [ebp-08]
:0043A0E5 8D04C528000000          lea eax, dword ptr [8*eax+00000028]
:0043A0EC 50                      push eax
:0043A0ED 6A0C                    push 0000000C
:0043A0EF E83867FDFF              call 0041082C
:0043A0F4 83C418                  add esp, 00000018
:0043A0F7 6A00                    push 00000000
:0043A0F9 6A04                    push 00000004
:0043A0FB 6A00                    push 00000000
:0043A0FD 68803E0300              push 00033E80
:0043A102 B9E8E44600              mov ecx, 0046E4E8
:0043A107 E814D60000              call 00447720
:0043A10C 50                      push eax
:0043A10D 6A18                    push 00000018
:0043A10F 6A18                    push 00000018
:0043A111 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043A114 83C020                  add eax, 00000020
:0043A117 50                      push eax
:0043A118 8B45F8                  mov eax, dword ptr [ebp-08]
:0043A11B 8D04C508000000          lea eax, dword ptr [8*eax+00000008]
:0043A122 50                      push eax
:0043A123 E88D310000              call 0043D2B5
:0043A128 83C418                  add esp, 00000018
:0043A12B 6A00                    push 00000000
:0043A12D 6A04                    push 00000004
:0043A12F 6A00                    push 00000000
:0043A131 68C0400300              push 000340C0
:0043A136 B9E8E44600              mov ecx, 0046E4E8
:0043A13B E8E0D50000              call 00447720
:0043A140 50                      push eax
:0043A141 6A18                    push 00000018
:0043A143 6A18                    push 00000018
:0043A145 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043A148 83C038                  add eax, 00000038
:0043A14B 50                      push eax
:0043A14C 8B45F8                  mov eax, dword ptr [ebp-08]
:0043A14F 8D04C508000000          lea eax, dword ptr [8*eax+00000008]
:0043A156 50                      push eax
:0043A157 E859310000              call 0043D2B5
:0043A15C 83C418                  add esp, 00000018
:0043A15F E853CEFEFF              call 00426FB7
:0043A164 E900000000              jmp 0043A169

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A164(U)
|
:0043A169 5F                      pop edi
:0043A16A 5E                      pop esi
:0043A16B 5B                      pop ebx
:0043A16C C9                      leave
:0043A16D C3                      ret



* Referenced by a CALL at Addresses:
|:00402524   , :0040519D   , :00408D9C   , :00423EE1   
|
:0043A16E 55                      push ebp
:0043A16F 8BEC                    mov ebp, esp
:0043A171 83EC18                  sub esp, 00000018
:0043A174 53                      push ebx
:0043A175 56                      push esi
:0043A176 57                      push edi
:0043A177 33C0                    xor eax, eax
:0043A179 8A450C                  mov al, byte ptr [ebp+0C]
:0043A17C 8BC8                    mov ecx, eax
:0043A17E 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043A181 C1E003                  shl eax, 03
:0043A184 2BC1                    sub eax, ecx
:0043A186 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043A18C E89FEFFCFF              call 00409130
:0043A191 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043A194 03C0                    add eax, eax
:0043A196 8D04C0                  lea eax, dword ptr [eax+8*eax]
:0043A199 05E8564500              add eax, 004556E8
:0043A19E 8945E8                  mov dword ptr [ebp-18], eax
:0043A1A1 33C0                    xor eax, eax
:0043A1A3 8A450C                  mov al, byte ptr [ebp+0C]
:0043A1A6 8BC8                    mov ecx, eax
:0043A1A8 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043A1AB C1E003                  shl eax, 03
:0043A1AE 2BC1                    sub eax, ecx
:0043A1B0 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043A1B6 E8F5F5FCFF              call 004097B0
:0043A1BB 8945F0                  mov dword ptr [ebp-10], eax
:0043A1BE 33C0                    xor eax, eax
:0043A1C0 8A450C                  mov al, byte ptr [ebp+0C]
:0043A1C3 8BC8                    mov ecx, eax
:0043A1C5 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043A1C8 C1E003                  shl eax, 03
:0043A1CB 2BC1                    sub eax, ecx
:0043A1CD 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043A1D3 E888F0FCFF              call 00409260
:0043A1D8 33C9                    xor ecx, ecx
:0043A1DA 8AC8                    mov cl, al
:0043A1DC 894DF8                  mov dword ptr [ebp-08], ecx
:0043A1DF 33C0                    xor eax, eax
:0043A1E1 8A4508                  mov al, byte ptr [ebp+08]
:0043A1E4 8945FC                  mov dword ptr [ebp-04], eax
:0043A1E7 33C0                    xor eax, eax
:0043A1E9 8A4509                  mov al, byte ptr [ebp+09]
:0043A1EC 83C003                  add eax, 00000003
:0043A1EF C1E004                  shl eax, 04
:0043A1F2 8945F4                  mov dword ptr [ebp-0C], eax
:0043A1F5 33C0                    xor eax, eax
:0043A1F7 8A450C                  mov al, byte ptr [ebp+0C]
:0043A1FA 8BC8                    mov ecx, eax
:0043A1FC 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043A1FF C1E003                  shl eax, 03
:0043A202 2BC1                    sub eax, ecx
:0043A204 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043A20A E811F0FCFF              call 00409220
:0043A20F 85C0                    test eax, eax
:0043A211 0F840C000000            je 0043A223
:0043A217 C745EC00000000          mov [ebp-14], 00000000
:0043A21E E907000000              jmp 0043A22A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A211(C)
|
:0043A223 C745ECC0180000          mov [ebp-14], 000018C0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A21E(U)
|
:0043A22A E868CDFEFF              call 00426F97
:0043A22F 6A00                    push 00000000
:0043A231 6A04                    push 00000004
:0043A233 6A00                    push 00000000
:0043A235 6870110100              push 00011170
:0043A23A B968F94600              mov ecx, 0046F968
:0043A23F E8DCD40000              call 00447720
:0043A244 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043A247 03C8                    add ecx, eax
:0043A249 51                      push ecx
:0043A24A 6A30                    push 00000030
:0043A24C 6884000000              push 00000084
:0043A251 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043A254 83C020                  add eax, 00000020
:0043A257 50                      push eax
:0043A258 8B45FC                  mov eax, dword ptr [ebp-04]
:0043A25B 8D04C528000000          lea eax, dword ptr [8*eax+00000028]
:0043A262 50                      push eax
:0043A263 E84D300000              call 0043D2B5
:0043A268 83C418                  add esp, 00000018
:0043A26B 33C0                    xor eax, eax
:0043A26D 8A4514                  mov al, byte ptr [ebp+14]
:0043A270 A801                    test al, 01
:0043A272 0F85D5000000            jne 0043A34D
:0043A278 33C0                    xor eax, eax
:0043A27A 8A4514                  mov al, byte ptr [ebp+14]
:0043A27D A880                    test al, 80
:0043A27F 0F8472000000            je 0043A2F7
:0043A285 6A21                    push 00000021
:0043A287 B994A64600              mov ecx, 0046A694
:0043A28C E893EDFDFF              call 00419024
:0043A291 33C0                    xor eax, eax
:0043A293 8A450C                  mov al, byte ptr [ebp+0C]
:0043A296 8BC8                    mov ecx, eax
:0043A298 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043A29B C1E003                  shl eax, 03
:0043A29E 2BC1                    sub eax, ecx
:0043A2A0 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043A2A6 E805F5FCFF              call 004097B0
:0043A2AB 8B5D10                  mov ebx, dword ptr [ebp+10]
:0043A2AE 03D8                    add ebx, eax
:0043A2B0 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043A2B3 E8D8F4FCFF              call 00409790
:0043A2B8 3BD8                    cmp ebx, eax
:0043A2BA 0F8C10000000            jl 0043A2D0
:0043A2C0 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043A2C3 E8C8F4FCFF              call 00409790
:0043A2C8 8945F0                  mov dword ptr [ebp-10], eax
:0043A2CB E922000000              jmp 0043A2F2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A2BA(C)
|
:0043A2D0 33C0                    xor eax, eax
:0043A2D2 8A450C                  mov al, byte ptr [ebp+0C]
:0043A2D5 8BC8                    mov ecx, eax
:0043A2D7 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043A2DA C1E003                  shl eax, 03
:0043A2DD 2BC1                    sub eax, ecx
:0043A2DF 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043A2E5 E8C6F4FCFF              call 004097B0
:0043A2EA 8B4D10                  mov ecx, dword ptr [ebp+10]
:0043A2ED 03C8                    add ecx, eax
:0043A2EF 894DF0                  mov dword ptr [ebp-10], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A2CB(U)
|
:0043A2F2 E951000000              jmp 0043A348

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A27F(C)
|
:0043A2F7 33C0                    xor eax, eax
:0043A2F9 8A450C                  mov al, byte ptr [ebp+0C]
:0043A2FC 8BC8                    mov ecx, eax
:0043A2FE 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043A301 C1E003                  shl eax, 03
:0043A304 2BC1                    sub eax, ecx
:0043A306 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043A30C E89FF4FCFF              call 004097B0
:0043A311 2B4510                  sub eax, dword ptr [ebp+10]
:0043A314 85C0                    test eax, eax
:0043A316 0F8E25000000            jle 0043A341
:0043A31C 33C0                    xor eax, eax
:0043A31E 8A450C                  mov al, byte ptr [ebp+0C]
:0043A321 8BC8                    mov ecx, eax
:0043A323 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043A326 C1E003                  shl eax, 03
:0043A329 2BC1                    sub eax, ecx
:0043A32B 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043A331 E87AF4FCFF              call 004097B0
:0043A336 2B4510                  sub eax, dword ptr [ebp+10]
:0043A339 8945F0                  mov dword ptr [ebp-10], eax
:0043A33C E907000000              jmp 0043A348

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A316(C)
|
:0043A341 C745F000000000          mov [ebp-10], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043A2F2(U), :0043A33C(U)
|
:0043A348 E9E4000000              jmp 0043A431

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A272(C)
|
:0043A34D 33C0                    xor eax, eax
:0043A34F 8A4514                  mov al, byte ptr [ebp+14]
:0043A352 A880                    test al, 80
:0043A354 0F847E000000            je 0043A3D8
:0043A35A 6A22                    push 00000022
:0043A35C B994A64600              mov ecx, 0046A694
:0043A361 E8BEECFDFF              call 00419024
:0043A366 33C0                    xor eax, eax
:0043A368 8A450C                  mov al, byte ptr [ebp+0C]
:0043A36B 8BC8                    mov ecx, eax
:0043A36D 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043A370 C1E003                  shl eax, 03
:0043A373 2BC1                    sub eax, ecx
:0043A375 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043A37B E8E0EEFCFF              call 00409260
:0043A380 33DB                    xor ebx, ebx
:0043A382 8AD8                    mov bl, al
:0043A384 035D10                  add ebx, dword ptr [ebp+10]
:0043A387 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043A38A E851EEFCFF              call 004091E0
:0043A38F 33C9                    xor ecx, ecx
:0043A391 8AC8                    mov cl, al
:0043A393 3BD9                    cmp ebx, ecx
:0043A395 0F8C14000000            jl 0043A3AF
:0043A39B 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043A39E E83DEEFCFF              call 004091E0
:0043A3A3 33C9                    xor ecx, ecx
:0043A3A5 8AC8                    mov cl, al
:0043A3A7 894DF8                  mov dword ptr [ebp-08], ecx
:0043A3AA E924000000              jmp 0043A3D3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A395(C)
|
:0043A3AF 33C0                    xor eax, eax
:0043A3B1 8A450C                  mov al, byte ptr [ebp+0C]
:0043A3B4 8BC8                    mov ecx, eax
:0043A3B6 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043A3B9 C1E003                  shl eax, 03
:0043A3BC 2BC1                    sub eax, ecx
:0043A3BE 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043A3C4 E897EEFCFF              call 00409260
:0043A3C9 33C9                    xor ecx, ecx
:0043A3CB 8AC8                    mov cl, al
:0043A3CD 034D10                  add ecx, dword ptr [ebp+10]
:0043A3D0 894DF8                  mov dword ptr [ebp-08], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A3AA(U)
|
:0043A3D3 E959000000              jmp 0043A431

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A354(C)
|
:0043A3D8 33C0                    xor eax, eax
:0043A3DA 8A450C                  mov al, byte ptr [ebp+0C]
:0043A3DD 8BC8                    mov ecx, eax
:0043A3DF 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043A3E2 C1E003                  shl eax, 03
:0043A3E5 2BC1                    sub eax, ecx
:0043A3E7 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043A3ED E86EEEFCFF              call 00409260
:0043A3F2 33C9                    xor ecx, ecx
:0043A3F4 8AC8                    mov cl, al
:0043A3F6 2B4D10                  sub ecx, dword ptr [ebp+10]
:0043A3F9 85C9                    test ecx, ecx
:0043A3FB 0F8E29000000            jle 0043A42A
:0043A401 33C0                    xor eax, eax
:0043A403 8A450C                  mov al, byte ptr [ebp+0C]
:0043A406 8BC8                    mov ecx, eax
:0043A408 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043A40B C1E003                  shl eax, 03
:0043A40E 2BC1                    sub eax, ecx
:0043A410 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043A416 E845EEFCFF              call 00409260
:0043A41B 33C9                    xor ecx, ecx
:0043A41D 8AC8                    mov cl, al
:0043A41F 2B4D10                  sub ecx, dword ptr [ebp+10]
:0043A422 894DF8                  mov dword ptr [ebp-08], ecx
:0043A425 E907000000              jmp 0043A431

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A3FB(C)
|
:0043A42A C745F800000000          mov [ebp-08], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043A348(U), :0043A3D3(U), :0043A425(U)
|
:0043A431 6880000000              push 00000080
:0043A436 8B45F0                  mov eax, dword ptr [ebp-10]
:0043A439 50                      push eax
:0043A43A 8B45E8                  mov eax, dword ptr [ebp-18]
:0043A43D 50                      push eax
:0043A43E 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043A441 83C020                  add eax, 00000020
:0043A444 50                      push eax
:0043A445 8B45FC                  mov eax, dword ptr [ebp-04]
:0043A448 8D04C528000000          lea eax, dword ptr [8*eax+00000028]
:0043A44F 50                      push eax
:0043A450 6A0B                    push 0000000B
:0043A452 E8D563FDFF              call 0041082C
:0043A457 83C418                  add esp, 00000018
:0043A45A 6880000000              push 00000080
:0043A45F 8B45F8                  mov eax, dword ptr [ebp-08]
:0043A462 50                      push eax
:0043A463 8B45E8                  mov eax, dword ptr [ebp-18]
:0043A466 50                      push eax
:0043A467 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043A46A 83C038                  add eax, 00000038
:0043A46D 50                      push eax
:0043A46E 8B45FC                  mov eax, dword ptr [ebp-04]
:0043A471 8D04C528000000          lea eax, dword ptr [8*eax+00000028]
:0043A478 50                      push eax
:0043A479 6A0C                    push 0000000C
:0043A47B E8AC63FDFF              call 0041082C
:0043A480 83C418                  add esp, 00000018
:0043A483 E82FCBFEFF              call 00426FB7
:0043A488 E900000000              jmp 0043A48D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A488(U)
|
:0043A48D 5F                      pop edi
:0043A48E 5E                      pop esi
:0043A48F 5B                      pop ebx
:0043A490 C9                      leave
:0043A491 C3                      ret



* Referenced by a CALL at Addresses:
|:004032B7   , :0042A9DD   , :00439EBB   , :0043BB73   , :0043E26C   
|
:0043A492 55                      push ebp
:0043A493 8BEC                    mov ebp, esp
:0043A495 81EC10010000            sub esp, 00000110
:0043A49B 53                      push ebx
:0043A49C 56                      push esi
:0043A49D 57                      push edi
:0043A49E 8D85F0FEFFFF            lea eax, dword ptr [ebp+FFFFFEF0]
:0043A4A4 8945FC                  mov dword ptr [ebp-04], eax
:0043A4A7 C745F400000000          mov [ebp-0C], 00000000
:0043A4AE E906000000              jmp 0043A4B9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A4E5(U)
|
:0043A4B3 FF45F4                  inc [ebp-0C]
:0043A4B6 FF45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A4AE(U)
|
:0043A4B9 817DF400010000          cmp dword ptr [ebp-0C], 00000100
:0043A4C0 0F8324000000            jnb 0043A4EA
:0043A4C6 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043A4C9 83E001                  and eax, 00000001
:0043A4CC 83F801                  cmp eax, 00000001
:0043A4CF 1BC0                    sbb eax, eax
:0043A4D1 25FF000000              and eax, 000000FF
:0043A4D6 50                      push eax
:0043A4D7 6A01                    push 00000001
:0043A4D9 8B45FC                  mov eax, dword ptr [ebp-04]
:0043A4DC 50                      push eax
:0043A4DD E881CF0000              call 00447463
:0043A4E2 83C40C                  add esp, 0000000C
:0043A4E5 E9C9FFFFFF              jmp 0043A4B3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A4C0(C)
|
:0043A4EA E8A8CAFEFF              call 00426F97
:0043A4EF 8B450C                  mov eax, dword ptr [ebp+0C]
:0043A4F2 8945F0                  mov dword ptr [ebp-10], eax
:0043A4F5 E904000000              jmp 0043A4FE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A54D(U)
|
:0043A4FA 8345F010                add dword ptr [ebp-10], 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A4F5(U)
|
:0043A4FE 8B4514                  mov eax, dword ptr [ebp+14]
:0043A501 03450C                  add eax, dword ptr [ebp+0C]
:0043A504 3B45F0                  cmp eax, dword ptr [ebp-10]
:0043A507 0F8645000000            jbe 0043A552
:0043A50D 8B4508                  mov eax, dword ptr [ebp+08]
:0043A510 8945F8                  mov dword ptr [ebp-08], eax
:0043A513 E904000000              jmp 0043A51C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A548(U)
|
:0043A518 8345F810                add dword ptr [ebp-08], 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A513(U)
|
:0043A51C 8B4510                  mov eax, dword ptr [ebp+10]
:0043A51F 034508                  add eax, dword ptr [ebp+08]
:0043A522 3B45F8                  cmp eax, dword ptr [ebp-08]
:0043A525 0F8622000000            jbe 0043A54D
:0043A52B 6A02                    push 00000002
:0043A52D 8D85F0FEFFFF            lea eax, dword ptr [ebp+FFFFFEF0]
:0043A533 50                      push eax
:0043A534 6A10                    push 00000010
:0043A536 6A10                    push 00000010
:0043A538 8B45F0                  mov eax, dword ptr [ebp-10]
:0043A53B 50                      push eax
:0043A53C 8B45F8                  mov eax, dword ptr [ebp-08]
:0043A53F 50                      push eax
:0043A540 E8702D0000              call 0043D2B5
:0043A545 83C418                  add esp, 00000018
:0043A548 E9CBFFFFFF              jmp 0043A518

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A525(C)
|
:0043A54D E9A8FFFFFF              jmp 0043A4FA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A507(C)
|
:0043A552 E860CAFEFF              call 00426FB7
:0043A557 E900000000              jmp 0043A55C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A557(U)
|
:0043A55C 5F                      pop edi
:0043A55D 5E                      pop esi
:0043A55E 5B                      pop ebx
:0043A55F C9                      leave
:0043A560 C3                      ret



* Referenced by a CALL at Address:
|:00440815   
|
:0043A561 55                      push ebp
:0043A562 8BEC                    mov ebp, esp
:0043A564 83EC04                  sub esp, 00000004
:0043A567 53                      push ebx
:0043A568 56                      push esi
:0043A569 57                      push edi
:0043A56A 894DFC                  mov dword ptr [ebp-04], ecx
:0043A56D 8B4508                  mov eax, dword ptr [ebp+08]
:0043A570 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043A573 8901                    mov dword ptr [ecx], eax
:0043A575 8B450C                  mov eax, dword ptr [ebp+0C]
:0043A578 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043A57B 894104                  mov dword ptr [ecx+04], eax
:0043A57E 8B4510                  mov eax, dword ptr [ebp+10]
:0043A581 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043A584 894108                  mov dword ptr [ecx+08], eax
:0043A587 8B4514                  mov eax, dword ptr [ebp+14]
:0043A58A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043A58D 89410C                  mov dword ptr [ecx+0C], eax
:0043A590 8B45FC                  mov eax, dword ptr [ebp-04]
:0043A593 C7401000000000          mov [eax+10], 00000000
:0043A59A 8B45FC                  mov eax, dword ptr [ebp-04]
:0043A59D C7401400000000          mov [eax+14], 00000000
:0043A5A4 8B45FC                  mov eax, dword ptr [ebp-04]
:0043A5A7 C7402D00000000          mov [eax+2D], 00000000
:0043A5AE 8B45FC                  mov eax, dword ptr [ebp-04]
:0043A5B1 C7403100000000          mov [eax+31], 00000000
:0043A5B8 8B45FC                  mov eax, dword ptr [ebp-04]
:0043A5BB C7402400000000          mov [eax+24], 00000000
:0043A5C2 8B45FC                  mov eax, dword ptr [ebp-04]
:0043A5C5 C6403EFF                mov [eax+3E], FF
:0043A5C9 8B45FC                  mov eax, dword ptr [ebp-04]
:0043A5CC C6403FFF                mov [eax+3F], FF
:0043A5D0 8B45FC                  mov eax, dword ptr [ebp-04]
:0043A5D3 C74040FFFF0000          mov [eax+40], 0000FFFF
:0043A5DA 8B45FC                  mov eax, dword ptr [ebp-04]
:0043A5DD C74044FFFF0000          mov [eax+44], 0000FFFF
:0043A5E4 8B45FC                  mov eax, dword ptr [ebp-04]
:0043A5E7 C6404800                mov [eax+48], 00
:0043A5EB 8B45FC                  mov eax, dword ptr [ebp-04]
:0043A5EE C6404900                mov [eax+49], 00
:0043A5F2 68FF000000              push 000000FF
:0043A5F7 68C0030000              push 000003C0
:0043A5FC 6A04                    push 00000004
:0043A5FE 6A00                    push 00000000
:0043A600 6840290000              push 00002940
:0043A605 B950F94600              mov ecx, 0046F950
:0043A60A E811D10000              call 00447720
:0043A60F 50                      push eax
:0043A610 E84ECE0000              call 00447463
:0043A615 83C40C                  add esp, 0000000C
:0043A618 68FF000000              push 000000FF
:0043A61D 68A8030000              push 000003A8
:0043A622 6A04                    push 00000004
:0043A624 6A00                    push 00000000
:0043A626 6868340000              push 00003468
:0043A62B B950F94600              mov ecx, 0046F950
:0043A630 E8EBD00000              call 00447720
:0043A635 50                      push eax
:0043A636 E828CE0000              call 00447463
:0043A63B 83C40C                  add esp, 0000000C
:0043A63E E900000000              jmp 0043A643

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A63E(U)
|
:0043A643 5F                      pop edi
:0043A644 5E                      pop esi
:0043A645 5B                      pop ebx
:0043A646 C9                      leave
:0043A647 C21000                  ret 0010



* Referenced by a CALL at Addresses:
|:0042C08C   , :0042C9C2   , :0043E24F   
|
:0043A64A 55                      push ebp
:0043A64B 8BEC                    mov ebp, esp
:0043A64D 83EC04                  sub esp, 00000004
:0043A650 53                      push ebx
:0043A651 56                      push esi
:0043A652 57                      push edi
:0043A653 894DFC                  mov dword ptr [ebp-04], ecx
:0043A656 8A4508                  mov al, byte ptr [ebp+08]
:0043A659 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043A65C 884120                  mov byte ptr [ecx+20], al
:0043A65F 8A450C                  mov al, byte ptr [ebp+0C]
:0043A662 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043A665 884121                  mov byte ptr [ecx+21], al
:0043A668 8A4510                  mov al, byte ptr [ebp+10]
:0043A66B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043A66E 884122                  mov byte ptr [ecx+22], al
:0043A671 8A4514                  mov al, byte ptr [ebp+14]
:0043A674 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043A677 884123                  mov byte ptr [ecx+23], al
:0043A67A E900000000              jmp 0043A67F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A67A(U)
|
:0043A67F 5F                      pop edi
:0043A680 5E                      pop esi
:0043A681 5B                      pop ebx
:0043A682 C9                      leave
:0043A683 C21000                  ret 0010



* Referenced by a CALL at Addresses:
|:004025D9   , :0042CA12   , :0043AD38   , :0043AE29   , :0043B8D8   
|:0043C773   , :0043CE6A   , :0043E3F0   , :00441C09   , :0044231B   
|:00442594   , :00442DDF   , :00442ECB   , :00443087   
|
:0043A686 55                      push ebp
:0043A687 8BEC                    mov ebp, esp
:0043A689 83EC04                  sub esp, 00000004
:0043A68C 53                      push ebx
:0043A68D 56                      push esi
:0043A68E 57                      push edi
:0043A68F 894DFC                  mov dword ptr [ebp-04], ecx
:0043A692 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043A695 E816470000              call 0043EDB0
:0043A69A 85C0                    test eax, eax
:0043A69C 0F8438000000            je 0043A6DA
:0043A6A2 E8F0C8FEFF              call 00426F97
:0043A6A7 6A00                    push 00000000
:0043A6A9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043A6AC E88F39FFFF              call 0042E040
:0043A6B1 8B45FC                  mov eax, dword ptr [ebp-04]
:0043A6B4 8A4023                  mov al, byte ptr [eax+23]
:0043A6B7 50                      push eax
:0043A6B8 8B45FC                  mov eax, dword ptr [ebp-04]
:0043A6BB 8A4022                  mov al, byte ptr [eax+22]
:0043A6BE 50                      push eax
:0043A6BF 8B45FC                  mov eax, dword ptr [ebp-04]
:0043A6C2 8A4021                  mov al, byte ptr [eax+21]
:0043A6C5 50                      push eax
:0043A6C6 8B45FC                  mov eax, dword ptr [ebp-04]
:0043A6C9 8A4020                  mov al, byte ptr [eax+20]
:0043A6CC 50                      push eax
:0043A6CD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043A6D0 E858040000              call 0043AB2D
:0043A6D5 E8DDC8FEFF              call 00426FB7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A69C(C)
|
:0043A6DA E900000000              jmp 0043A6DF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A6DA(U)
|
:0043A6DF 5F                      pop edi
:0043A6E0 5E                      pop esi
:0043A6E1 5B                      pop ebx
:0043A6E2 C9                      leave
:0043A6E3 C3                      ret



* Referenced by a CALL at Addresses:
|:0043AC7B   , :0043ACB9   , :0043AD9E   , :0043BEEE   , :0043C27F   
|:0043D6EF   , :0043E46D   , :00442D41   
|
:0043A6E4 55                      push ebp
:0043A6E5 8BEC                    mov ebp, esp
:0043A6E7 83EC04                  sub esp, 00000004
:0043A6EA 53                      push ebx
:0043A6EB 56                      push esi
:0043A6EC 57                      push edi
:0043A6ED 894DFC                  mov dword ptr [ebp-04], ecx
:0043A6F0 B988534500              mov ecx, 00455388
:0043A6F5 E8F875FCFF              call 00401CF2
:0043A6FA B988534500              mov ecx, 00455388
:0043A6FF E89CEDFCFF              call 004094A0
:0043A704 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043A707 894118                  mov dword ptr [ecx+18], eax
:0043A70A B988534500              mov ecx, 00455388
:0043A70F E8ACEDFCFF              call 004094C0
:0043A714 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043A717 89411C                  mov dword ptr [ecx+1C], eax
:0043A71A E900000000              jmp 0043A71F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A71A(U)
|
:0043A71F 5F                      pop edi
:0043A720 5E                      pop esi
:0043A721 5B                      pop ebx
:0043A722 C9                      leave
:0043A723 C3                      ret



* Referenced by a CALL at Addresses:
|:0040479C   , :0040488A   , :00422275   , :004225F8   , :00422F3D   
|:0042308F   , :00423265   , :00423372   , :00439DEC   
|
:0043A724 55                      push ebp
:0043A725 8BEC                    mov ebp, esp
:0043A727 83EC04                  sub esp, 00000004
:0043A72A 53                      push ebx
:0043A72B 56                      push esi
:0043A72C 57                      push edi
:0043A72D 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0043A730 E83B71FCFF              call 00401870
:0043A735 33DB                    xor ebx, ebx
:0043A737 8A5D0C                  mov bl, byte ptr [ebp+0C]
:0043A73A 8D1C5B                  lea ebx, dword ptr [ebx+2*ebx]
:0043A73D B900FB4600              mov ecx, 0046FB00
:0043A742 E8E9A3FEFF              call 00424B30
:0043A747 2BD8                    sub ebx, eax
:0043A749 885DFC                  mov byte ptr [ebp-04], bl
:0043A74C 33DB                    xor ebx, ebx
:0043A74E 8A5D0D                  mov bl, byte ptr [ebp+0D]
:0043A751 8D1C5B                  lea ebx, dword ptr [ebx+2*ebx]
:0043A754 B900FB4600              mov ecx, 0046FB00
:0043A759 E8F2A3FEFF              call 00424B50
:0043A75E 2BD8                    sub ebx, eax
:0043A760 885DFD                  mov byte ptr [ebp-03], bl
:0043A763 668B45FC                mov ax, word ptr [ebp-04]
:0043A767 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043A76A 668901                  mov word ptr [ecx], ax
:0043A76D 8B4508                  mov eax, dword ptr [ebp+08]
:0043A770 E900000000              jmp 0043A775

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A770(U)
|
:0043A775 5F                      pop edi
:0043A776 5E                      pop esi
:0043A777 5B                      pop ebx
:0043A778 C9                      leave
:0043A779 C3                      ret


:0043A77A 55                      push ebp
:0043A77B 8BEC                    mov ebp, esp
:0043A77D 83EC10                  sub esp, 00000010
:0043A780 53                      push ebx
:0043A781 56                      push esi
:0043A782 57                      push edi
:0043A783 894DF0                  mov dword ptr [ebp-10], ecx
:0043A786 33C0                    xor eax, eax
:0043A788 A0F8FA4600              mov al, byte ptr [0046FAF8]
:0043A78D A801                    test al, 01
:0043A78F 0F8525000000            jne 0043A7BA
:0043A795 33C0                    xor eax, eax
:0043A797 A0F8FA4600              mov al, byte ptr [0046FAF8]
:0043A79C 0C01                    or al, 01
:0043A79E A2F8FA4600              mov byte ptr [0046FAF8], al
:0043A7A3 B99CFB4600              mov ecx, 0046FB9C
:0043A7A8 E8C370FCFF              call 00401870
:0043A7AD 68B1A84300              push 0043A8B1
:0043A7B2 E829D50000              call 00447CE0
:0043A7B7 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A78F(C)
|
:0043A7BA 8B45F0                  mov eax, dword ptr [ebp-10]
:0043A7BD 8B4018                  mov eax, dword ptr [eax+18]
:0043A7C0 8945F8                  mov dword ptr [ebp-08], eax
:0043A7C3 8B45F0                  mov eax, dword ptr [ebp-10]
:0043A7C6 8B401C                  mov eax, dword ptr [eax+1C]
:0043A7C9 8945F4                  mov dword ptr [ebp-0C], eax
:0043A7CC 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0043A7CF E89C70FCFF              call 00401870
:0043A7D4 8B45F0                  mov eax, dword ptr [ebp-10]
:0043A7D7 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043A7DA 3908                    cmp dword ptr [eax], ecx
:0043A7DC 0F8F38000000            jg 0043A81A
:0043A7E2 8B45F0                  mov eax, dword ptr [ebp-10]
:0043A7E5 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043A7E8 394804                  cmp dword ptr [eax+04], ecx
:0043A7EB 0F8F29000000            jg 0043A81A
:0043A7F1 8B45F0                  mov eax, dword ptr [ebp-10]
:0043A7F4 8B4008                  mov eax, dword ptr [eax+08]
:0043A7F7 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043A7FA 0301                    add eax, dword ptr [ecx]
:0043A7FC 3B45F8                  cmp eax, dword ptr [ebp-08]
:0043A7FF 0F8E15000000            jle 0043A81A
:0043A805 8B45F0                  mov eax, dword ptr [ebp-10]
:0043A808 8B4004                  mov eax, dword ptr [eax+04]
:0043A80B 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043A80E 03410C                  add eax, dword ptr [ecx+0C]
:0043A811 3B45F4                  cmp eax, dword ptr [ebp-0C]
:0043A814 0F8F0D000000            jg 0043A827

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043A7DC(C), :0043A7EB(C), :0043A7FF(C)
|
:0043A81A C645FCFF                mov [ebp-04], FF
:0043A81E C645FDFF                mov [ebp-03], FF
:0043A822 E939000000              jmp 0043A860

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A814(C)
|
:0043A827 8B45F8                  mov eax, dword ptr [ebp-08]
:0043A82A 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043A82D 2B01                    sub eax, dword ptr [ecx]
:0043A82F 99                      cdq
:0043A830 83E20F                  and edx, 0000000F
:0043A833 03C2                    add eax, edx
:0043A835 C1F804                  sar eax, 04
:0043A838 B903000000              mov ecx, 00000003
:0043A83D 99                      cdq
:0043A83E F7F9                    idiv ecx
:0043A840 8845FC                  mov byte ptr [ebp-04], al
:0043A843 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043A846 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043A849 2B4104                  sub eax, dword ptr [ecx+04]
:0043A84C 99                      cdq
:0043A84D 83E20F                  and edx, 0000000F
:0043A850 03C2                    add eax, edx
:0043A852 C1F804                  sar eax, 04
:0043A855 B903000000              mov ecx, 00000003
:0043A85A 99                      cdq
:0043A85B F7F9                    idiv ecx
:0043A85D 8845FD                  mov byte ptr [ebp-03], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A822(U)
|
:0043A860 8B45F0                  mov eax, dword ptr [ebp-10]
:0043A863 33C9                    xor ecx, ecx
:0043A865 8A483E                  mov cl, byte ptr [eax+3E]
:0043A868 81F9FF000000            cmp ecx, 000000FF
:0043A86E 0F8507000000            jne 0043A87B
:0043A874 C6059CFB4600FF          mov byte ptr [0046FB9C], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A86E(C)
|
:0043A87B 8D45FC                  lea eax, dword ptr [ebp-04]
:0043A87E 50                      push eax
:0043A87F 689CFB4600              push 0046FB9C
:0043A884 E8F739FEFF              call 0041E280
:0043A889 83C408                  add esp, 00000008
:0043A88C 85C0                    test eax, eax
:0043A88E 0F850E000000            jne 0043A8A2
:0043A894 8D45FC                  lea eax, dword ptr [ebp-04]
:0043A897 50                      push eax
:0043A898 B99CFB4600              mov ecx, 0046FB9C
:0043A89D E8EE6FFCFF              call 00401890

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A88E(C)
|
:0043A8A2 B89CFB4600              mov eax, 0046FB9C
:0043A8A7 E900000000              jmp 0043A8AC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A8A7(U)
|
:0043A8AC 5F                      pop edi
:0043A8AD 5E                      pop esi
:0043A8AE 5B                      pop ebx
:0043A8AF C9                      leave
:0043A8B0 C3                      ret


:0043A8B1 55                      push ebp
:0043A8B2 8BEC                    mov ebp, esp
:0043A8B4 53                      push ebx
:0043A8B5 56                      push esi
:0043A8B6 57                      push edi
:0043A8B7 E900000000              jmp 0043A8BC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A8B7(U)
|
:0043A8BC 5F                      pop edi
:0043A8BD 5E                      pop esi
:0043A8BE 5B                      pop ebx
:0043A8BF C9                      leave
:0043A8C0 C3                      ret



* Referenced by a CALL at Addresses:
|:0043AC83   , :0043ACFF   , :0043ADEE   , :0043B411   , :00442D99   
|
:0043A8C1 55                      push ebp
:0043A8C2 8BEC                    mov ebp, esp
:0043A8C4 83EC10                  sub esp, 00000010
:0043A8C7 53                      push ebx
:0043A8C8 56                      push esi
:0043A8C9 57                      push edi
:0043A8CA 894DF0                  mov dword ptr [ebp-10], ecx
:0043A8CD 33C0                    xor eax, eax
:0043A8CF A088FB4600              mov al, byte ptr [0046FB88]
:0043A8D4 A801                    test al, 01
:0043A8D6 0F8525000000            jne 0043A901
:0043A8DC 33C0                    xor eax, eax
:0043A8DE A088FB4600              mov al, byte ptr [0046FB88]
:0043A8E3 0C01                    or al, 01
:0043A8E5 A288FB4600              mov byte ptr [0046FB88], al
:0043A8EA B9E8FA4600              mov ecx, 0046FAE8
:0043A8EF E87C6FFCFF              call 00401870
:0043A8F4 6835AA4300              push 0043AA35
:0043A8F9 E8E2D30000              call 00447CE0
:0043A8FE 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A8D6(C)
|
:0043A901 8B45F0                  mov eax, dword ptr [ebp-10]
:0043A904 8B4018                  mov eax, dword ptr [eax+18]
:0043A907 8945F8                  mov dword ptr [ebp-08], eax
:0043A90A 8B45F0                  mov eax, dword ptr [ebp-10]
:0043A90D 8B401C                  mov eax, dword ptr [eax+1C]
:0043A910 8945F4                  mov dword ptr [ebp-0C], eax
:0043A913 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0043A916 E8556FFCFF              call 00401870
:0043A91B 8B45F0                  mov eax, dword ptr [ebp-10]
:0043A91E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043A921 3908                    cmp dword ptr [eax], ecx
:0043A923 0F8F38000000            jg 0043A961
:0043A929 8B45F0                  mov eax, dword ptr [ebp-10]
:0043A92C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043A92F 394804                  cmp dword ptr [eax+04], ecx
:0043A932 0F8F29000000            jg 0043A961
:0043A938 8B45F0                  mov eax, dword ptr [ebp-10]
:0043A93B 8B4008                  mov eax, dword ptr [eax+08]
:0043A93E 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043A941 0301                    add eax, dword ptr [ecx]
:0043A943 3B45F8                  cmp eax, dword ptr [ebp-08]
:0043A946 0F8E15000000            jle 0043A961
:0043A94C 8B45F0                  mov eax, dword ptr [ebp-10]
:0043A94F 8B4004                  mov eax, dword ptr [eax+04]
:0043A952 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043A955 03410C                  add eax, dword ptr [ecx+0C]
:0043A958 3B45F4                  cmp eax, dword ptr [ebp-0C]
:0043A95B 0F8F0D000000            jg 0043A96E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043A923(C), :0043A932(C), :0043A946(C)
|
:0043A961 C645FCFF                mov [ebp-04], FF
:0043A965 C645FDFF                mov [ebp-03], FF
:0043A969 E945000000              jmp 0043A9B3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A95B(C)
|
:0043A96E 8B45F8                  mov eax, dword ptr [ebp-08]
:0043A971 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043A974 2B01                    sub eax, dword ptr [ecx]
:0043A976 99                      cdq
:0043A977 83E20F                  and edx, 0000000F
:0043A97A 03C2                    add eax, edx
:0043A97C C1F804                  sar eax, 04
:0043A97F 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043A982 034110                  add eax, dword ptr [ecx+10]
:0043A985 B903000000              mov ecx, 00000003
:0043A98A 99                      cdq
:0043A98B F7F9                    idiv ecx
:0043A98D 8845FC                  mov byte ptr [ebp-04], al
:0043A990 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043A993 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043A996 2B4104                  sub eax, dword ptr [ecx+04]
:0043A999 99                      cdq
:0043A99A 83E20F                  and edx, 0000000F
:0043A99D 03C2                    add eax, edx
:0043A99F C1F804                  sar eax, 04
:0043A9A2 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043A9A5 034114                  add eax, dword ptr [ecx+14]
:0043A9A8 B903000000              mov ecx, 00000003
:0043A9AD 99                      cdq
:0043A9AE F7F9                    idiv ecx
:0043A9B0 8845FD                  mov byte ptr [ebp-03], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A969(U)
|
:0043A9B3 8B45F0                  mov eax, dword ptr [ebp-10]
:0043A9B6 33C9                    xor ecx, ecx
:0043A9B8 8A483E                  mov cl, byte ptr [eax+3E]
:0043A9BB 81F9FF000000            cmp ecx, 000000FF
:0043A9C1 0F8507000000            jne 0043A9CE
:0043A9C7 C605E8FA4600FF          mov byte ptr [0046FAE8], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A9C1(C)
|
:0043A9CE 8D45FC                  lea eax, dword ptr [ebp-04]
:0043A9D1 50                      push eax
:0043A9D2 68E8FA4600              push 0046FAE8
:0043A9D7 E8A438FEFF              call 0041E280
:0043A9DC 83C408                  add esp, 00000008
:0043A9DF 85C0                    test eax, eax
:0043A9E1 0F853F000000            jne 0043AA26
:0043A9E7 33C0                    xor eax, eax
:0043A9E9 A0E8FA4600              mov al, byte ptr [0046FAE8]
:0043A9EE 3DFF000000              cmp eax, 000000FF
:0043A9F3 0F8408000000            je 0043AA01
:0043A9F9 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043A9FC E84E3B0000              call 0043E54F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A9F3(C)
|
:0043AA01 8D45FC                  lea eax, dword ptr [ebp-04]
:0043AA04 50                      push eax
:0043AA05 B9E8FA4600              mov ecx, 0046FAE8
:0043AA0A E8816EFCFF              call 00401890
:0043AA0F E883C5FEFF              call 00426F97
:0043AA14 68E8FA4600              push 0046FAE8
:0043AA19 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043AA1C E8823B0000              call 0043E5A3
:0043AA21 E891C5FEFF              call 00426FB7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A9E1(C)
|
:0043AA26 B8E8FA4600              mov eax, 0046FAE8
:0043AA2B E900000000              jmp 0043AA30

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043AA2B(U)
|
:0043AA30 5F                      pop edi
:0043AA31 5E                      pop esi
:0043AA32 5B                      pop ebx
:0043AA33 C9                      leave
:0043AA34 C3                      ret


:0043AA35 55                      push ebp
:0043AA36 8BEC                    mov ebp, esp
:0043AA38 53                      push ebx
:0043AA39 56                      push esi
:0043AA3A 57                      push edi
:0043AA3B E900000000              jmp 0043AA40

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043AA3B(U)
|
:0043AA40 5F                      pop edi
:0043AA41 5E                      pop esi
:0043AA42 5B                      pop ebx
:0043AA43 C9                      leave
:0043AA44 C3                      ret



* Referenced by a CALL at Addresses:
|:0040988C   , :0043AC08   
|
:0043AA45 55                      push ebp
:0043AA46 8BEC                    mov ebp, esp
:0043AA48 83EC1C                  sub esp, 0000001C
:0043AA4B 53                      push ebx
:0043AA4C 56                      push esi
:0043AA4D 57                      push edi
:0043AA4E 894DE4                  mov dword ptr [ebp-1C], ecx
:0043AA51 33C0                    xor eax, eax
:0043AA53 8A4508                  mov al, byte ptr [ebp+08]
:0043AA56 83F827                  cmp eax, 00000027
:0043AA59 0F8D0E000000            jnl 0043AA6D
:0043AA5F 33C0                    xor eax, eax
:0043AA61 8A450C                  mov al, byte ptr [ebp+0C]
:0043AA64 83F818                  cmp eax, 00000018
:0043AA67 0F8C05000000            jl 0043AA72

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043AA59(C)
|
:0043AA6D E9B4000000              jmp 0043AB26

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043AA67(C)
|
:0043AA72 33C0                    xor eax, eax
:0043AA74 8A4510                  mov al, byte ptr [ebp+10]
:0043AA77 33C9                    xor ecx, ecx
:0043AA79 8A4D08                  mov cl, byte ptr [ebp+08]
:0043AA7C 03C1                    add eax, ecx
:0043AA7E 83F827                  cmp eax, 00000027
:0043AA81 0F8205000000            jb 0043AA8C
:0043AA87 B827000000              mov eax, 00000027

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043AA81(C)
|
:0043AA8C 8945FC                  mov dword ptr [ebp-04], eax
:0043AA8F 33C0                    xor eax, eax
:0043AA91 8A4514                  mov al, byte ptr [ebp+14]
:0043AA94 33C9                    xor ecx, ecx
:0043AA96 8A4D0C                  mov cl, byte ptr [ebp+0C]
:0043AA99 03C1                    add eax, ecx
:0043AA9B 83F818                  cmp eax, 00000018
:0043AA9E 0F8205000000            jb 0043AAA9
:0043AAA4 B818000000              mov eax, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043AA9E(C)
|
:0043AAA9 8945F8                  mov dword ptr [ebp-08], eax
:0043AAAC 33C0                    xor eax, eax
:0043AAAE 8A450C                  mov al, byte ptr [ebp+0C]
:0043AAB1 8945EC                  mov dword ptr [ebp-14], eax
:0043AAB4 E903000000              jmp 0043AABC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043AB1C(U)
|
:0043AAB9 FF45EC                  inc [ebp-14]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043AAB4(U)
|
:0043AABC 8B45F8                  mov eax, dword ptr [ebp-08]
:0043AABF 3945EC                  cmp dword ptr [ebp-14], eax
:0043AAC2 0F8359000000            jnb 0043AB21
:0043AAC8 8B45E4                  mov eax, dword ptr [ebp-1C]
:0043AACB 8B4008                  mov eax, dword ptr [eax+08]
:0043AACE 0FAF45EC                imul eax, dword ptr [ebp-14]
:0043AAD2 C1E804                  shr eax, 04
:0043AAD5 8945F0                  mov dword ptr [ebp-10], eax
:0043AAD8 33C0                    xor eax, eax
:0043AADA 8A4508                  mov al, byte ptr [ebp+08]
:0043AADD 8945F4                  mov dword ptr [ebp-0C], eax
:0043AAE0 E903000000              jmp 0043AAE8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043AB17(U)
|
:0043AAE5 FF45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043AAE0(U)
|
:0043AAE8 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043AAEB 3945FC                  cmp dword ptr [ebp-04], eax
:0043AAEE 0F8628000000            jbe 0043AB1C
:0043AAF4 6A04                    push 00000004
:0043AAF6 6A00                    push 00000000
:0043AAF8 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043AAFB 0345F0                  add eax, dword ptr [ebp-10]
:0043AAFE 0540290000              add eax, 00002940
:0043AB03 50                      push eax
:0043AB04 B950F94600              mov ecx, 0046F950
:0043AB09 E812CC0000              call 00447720
:0043AB0E 8945E8                  mov dword ptr [ebp-18], eax
:0043AB11 8B45E8                  mov eax, dword ptr [ebp-18]
:0043AB14 C600FF                  mov byte ptr [eax], FF
:0043AB17 E9C9FFFFFF              jmp 0043AAE5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043AAEE(C)
|
:0043AB1C E998FFFFFF              jmp 0043AAB9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043AAC2(C)
|
:0043AB21 E900000000              jmp 0043AB26

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043AA6D(U), :0043AB21(U)
|
:0043AB26 5F                      pop edi
:0043AB27 5E                      pop esi
:0043AB28 5B                      pop ebx
:0043AB29 C9                      leave
:0043AB2A C21000                  ret 0010



* Referenced by a CALL at Addresses:
|:0040254A   , :00402DB0   , :00403245   , :00403842   , :00403F6B   
|:00404436   , :004049FF   , :00404B6F   , :00404D9E   , :004051C3   
|:00407EA7   , :00408DC2   , :00408F00   , :00423F09   , :0042AB8A   
|:0042CBB3   , :0042CBDB   , :00437DAC   , :0043A6D0   , :0043BD51   
|:0043C71C   , :0043E58F   , :0043E62F   , :0043EA31   , :004419F9   
|:0044401F   
|
:0043AB2D 55                      push ebp
:0043AB2E 8BEC                    mov ebp, esp
:0043AB30 83EC0C                  sub esp, 0000000C
:0043AB33 53                      push ebx
:0043AB34 56                      push esi
:0043AB35 57                      push edi
:0043AB36 894DF4                  mov dword ptr [ebp-0C], ecx
:0043AB39 33C0                    xor eax, eax
:0043AB3B 8A4508                  mov al, byte ptr [ebp+08]
:0043AB3E B903000000              mov ecx, 00000003
:0043AB43 99                      cdq
:0043AB44 F7F9                    idiv ecx
:0043AB46 8855FC                  mov byte ptr [ebp-04], dl
:0043AB49 33C0                    xor eax, eax
:0043AB4B 8A450C                  mov al, byte ptr [ebp+0C]
:0043AB4E B903000000              mov ecx, 00000003
:0043AB53 99                      cdq
:0043AB54 F7F9                    idiv ecx
:0043AB56 8855F8                  mov byte ptr [ebp-08], dl
:0043AB59 33C0                    xor eax, eax
:0043AB5B 8A4508                  mov al, byte ptr [ebp+08]
:0043AB5E 33C9                    xor ecx, ecx
:0043AB60 8A4DFC                  mov cl, byte ptr [ebp-04]
:0043AB63 2BC1                    sub eax, ecx
:0043AB65 884508                  mov byte ptr [ebp+08], al
:0043AB68 33C0                    xor eax, eax
:0043AB6A 8A450C                  mov al, byte ptr [ebp+0C]
:0043AB6D 33C9                    xor ecx, ecx
:0043AB6F 8A4DF8                  mov cl, byte ptr [ebp-08]
:0043AB72 2BC1                    sub eax, ecx
:0043AB74 88450C                  mov byte ptr [ebp+0C], al
:0043AB77 33C0                    xor eax, eax
:0043AB79 8A45FC                  mov al, byte ptr [ebp-04]
:0043AB7C 33C9                    xor ecx, ecx
:0043AB7E 8A4D10                  mov cl, byte ptr [ebp+10]
:0043AB81 03C1                    add eax, ecx
:0043AB83 884510                  mov byte ptr [ebp+10], al
:0043AB86 33C0                    xor eax, eax
:0043AB88 8A45F8                  mov al, byte ptr [ebp-08]
:0043AB8B 33C9                    xor ecx, ecx
:0043AB8D 8A4D14                  mov cl, byte ptr [ebp+14]
:0043AB90 03C1                    add eax, ecx
:0043AB92 884514                  mov byte ptr [ebp+14], al
:0043AB95 33C0                    xor eax, eax
:0043AB97 8A45FC                  mov al, byte ptr [ebp-04]
:0043AB9A 85C0                    test eax, eax
:0043AB9C 0F8505000000            jne 0043ABA7
:0043ABA2 E91E000000              jmp 0043ABC5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043AB9C(C)
|
:0043ABA7 B903000000              mov ecx, 00000003
:0043ABAC 33C0                    xor eax, eax
:0043ABAE 8A4510                  mov al, byte ptr [ebp+10]
:0043ABB1 BB03000000              mov ebx, 00000003
:0043ABB6 99                      cdq
:0043ABB7 F7FB                    idiv ebx
:0043ABB9 2BCA                    sub ecx, edx
:0043ABBB 33C0                    xor eax, eax
:0043ABBD 8A4510                  mov al, byte ptr [ebp+10]
:0043ABC0 03C8                    add ecx, eax
:0043ABC2 884D10                  mov byte ptr [ebp+10], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043ABA2(U)
|
:0043ABC5 33C0                    xor eax, eax
:0043ABC7 8A45F8                  mov al, byte ptr [ebp-08]
:0043ABCA 85C0                    test eax, eax
:0043ABCC 0F8505000000            jne 0043ABD7
:0043ABD2 E91E000000              jmp 0043ABF5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043ABCC(C)
|
:0043ABD7 B903000000              mov ecx, 00000003
:0043ABDC 33C0                    xor eax, eax
:0043ABDE 8A4514                  mov al, byte ptr [ebp+14]
:0043ABE1 BB03000000              mov ebx, 00000003
:0043ABE6 99                      cdq
:0043ABE7 F7FB                    idiv ebx
:0043ABE9 2BCA                    sub ecx, edx
:0043ABEB 33C0                    xor eax, eax
:0043ABED 8A4514                  mov al, byte ptr [ebp+14]
:0043ABF0 03C8                    add ecx, eax
:0043ABF2 884D14                  mov byte ptr [ebp+14], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043ABD2(U)
|
:0043ABF5 8B4514                  mov eax, dword ptr [ebp+14]
:0043ABF8 50                      push eax
:0043ABF9 8B4510                  mov eax, dword ptr [ebp+10]
:0043ABFC 50                      push eax
:0043ABFD 8B450C                  mov eax, dword ptr [ebp+0C]
:0043AC00 50                      push eax
:0043AC01 8B4508                  mov eax, dword ptr [ebp+08]
:0043AC04 50                      push eax
:0043AC05 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043AC08 E838FEFFFF              call 0043AA45
:0043AC0D 8B4514                  mov eax, dword ptr [ebp+14]
:0043AC10 50                      push eax
:0043AC11 8B4510                  mov eax, dword ptr [ebp+10]
:0043AC14 50                      push eax
:0043AC15 8B450C                  mov eax, dword ptr [ebp+0C]
:0043AC18 50                      push eax
:0043AC19 8B4508                  mov eax, dword ptr [ebp+08]
:0043AC1C 50                      push eax
:0043AC1D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043AC20 E8E9270000              call 0043D40E
:0043AC25 E900000000              jmp 0043AC2A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043AC25(U)
|
:0043AC2A 5F                      pop edi
:0043AC2B 5E                      pop esi
:0043AC2C 5B                      pop ebx
:0043AC2D C9                      leave
:0043AC2E C21000                  ret 0010



* Referenced by a CALL at Addresses:
|:0041DC4B   , :0043D016   
|
:0043AC31 55                      push ebp
:0043AC32 8BEC                    mov ebp, esp
:0043AC34 83EC0C                  sub esp, 0000000C
:0043AC37 53                      push ebx
:0043AC38 56                      push esi
:0043AC39 57                      push edi
:0043AC3A 894DF4                  mov dword ptr [ebp-0C], ecx
:0043AC3D 33C0                    xor eax, eax
:0043AC3F A094FB4600              mov al, byte ptr [0046FB94]
:0043AC44 A801                    test al, 01
:0043AC46 0F8525000000            jne 0043AC71
:0043AC4C 33C0                    xor eax, eax
:0043AC4E A094FB4600              mov al, byte ptr [0046FB94]
:0043AC53 0C01                    or al, 01
:0043AC55 A294FB4600              mov byte ptr [0046FB94], al
:0043AC5A B998FB4600              mov ecx, 0046FB98
:0043AC5F E80C6CFCFF              call 00401870
:0043AC64 684EAE4300              push 0043AE4E
:0043AC69 E872D00000              call 00447CE0
:0043AC6E 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043AC46(C)
|
:0043AC71 C745F801000000          mov [ebp-08], 00000001
:0043AC78 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043AC7B E864FAFFFF              call 0043A6E4
:0043AC80 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043AC83 E839FCFFFF              call 0043A8C1
:0043AC88 50                      push eax
:0043AC89 B998FB4600              mov ecx, 0046FB98
:0043AC8E E8FD6BFCFF              call 00401890
:0043AC93 668B00                  mov ax, word ptr [eax]
:0043AC96 668945FC                mov word ptr [ebp-04], ax
:0043AC9A 6A01                    push 00000001
:0043AC9C E8B9C7FFFF              call 0043745A
:0043ACA1 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043AD17(U)
|
:0043ACA4 B988534500              mov ecx, 00455388
:0043ACA9 E8CE70FCFF              call 00401D7C
:0043ACAE 85C0                    test eax, eax
:0043ACB0 0F8466000000            je 0043AD1C
:0043ACB6 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043ACB9 E826FAFFFF              call 0043A6E4
:0043ACBE 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043ACC1 E809070000              call 0043B3CF
:0043ACC6 85C0                    test eax, eax
:0043ACC8 0F852E000000            jne 0043ACFC
:0043ACCE B9B0FA4600              mov ecx, 0046FAB0
:0043ACD3 E8D8D9FDFF              call 004186B0
:0043ACD8 85C0                    test eax, eax
:0043ACDA 0F841C000000            je 0043ACFC
:0043ACE0 6A02                    push 00000002
:0043ACE2 E873C7FFFF              call 0043745A
:0043ACE7 83C404                  add esp, 00000004
:0043ACEA B998FC4600              mov ecx, 0046FC98
:0043ACEF E82C36FEFF              call 0041E320
:0043ACF4 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043ACF7 E8A4EBFCFF              call 004098A0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043ACC8(C), :0043ACDA(C)
|
:0043ACFC 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043ACFF E8BDFBFFFF              call 0043A8C1
:0043AD04 50                      push eax
:0043AD05 B998FB4600              mov ecx, 0046FB98
:0043AD0A E8816BFCFF              call 00401890
:0043AD0F 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043AD12 E8B8060000              call 0043B3CF
:0043AD17 E988FFFFFF              jmp 0043ACA4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043ACB0(C)
|
:0043AD1C 8D45FC                  lea eax, dword ptr [ebp-04]
:0043AD1F 50                      push eax
:0043AD20 6898FB4600              push 0046FB98
:0043AD25 E85635FEFF              call 0041E280
:0043AD2A 83C408                  add esp, 00000008
:0043AD2D 85C0                    test eax, eax
:0043AD2F 0F8512000000            jne 0043AD47
:0043AD35 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043AD38 E849F9FFFF              call 0043A686
:0043AD3D B898FB4600              mov eax, 0046FB98
:0043AD42 E902010000              jmp 0043AE49

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043AD2F(C)
|
:0043AD47 E89BC7FFFF              call 004374E7
:0043AD4C 6A01                    push 00000001
:0043AD4E E807C7FFFF              call 0043745A
:0043AD53 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043AE21(U)
|
:0043AD56 B988534500              mov ecx, 00455388
:0043AD5B E81C70FCFF              call 00401D7C
:0043AD60 85C0                    test eax, eax
:0043AD62 0F8433000000            je 0043AD9B
:0043AD68 B988534500              mov ecx, 00455388
:0043AD6D E80A70FCFF              call 00401D7C
:0043AD72 85C0                    test eax, eax
:0043AD74 0F8421000000            je 0043AD9B
:0043AD7A 33C0                    xor eax, eax
:0043AD7C A0AC354500              mov al, byte ptr [004535AC]
:0043AD81 85C0                    test eax, eax
:0043AD83 0F8512000000            jne 0043AD9B
:0043AD89 33C0                    xor eax, eax
:0043AD8B A098FB4600              mov al, byte ptr [0046FB98]
:0043AD90 3DFF000000              cmp eax, 000000FF
:0043AD95 0F858B000000            jne 0043AE26

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043AD62(C), :0043AD74(C), :0043AD83(C)
|
:0043AD9B 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043AD9E E841F9FFFF              call 0043A6E4
:0043ADA3 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043ADA6 E824060000              call 0043B3CF
:0043ADAB 85C0                    test eax, eax
:0043ADAD 0F8538000000            jne 0043ADEB
:0043ADB3 B9B0FA4600              mov ecx, 0046FAB0
:0043ADB8 E8F3D8FDFF              call 004186B0
:0043ADBD 85C0                    test eax, eax
:0043ADBF 0F8426000000            je 0043ADEB
:0043ADC5 6A01                    push 00000001
:0043ADC7 E88EC6FFFF              call 0043745A
:0043ADCC 83C404                  add esp, 00000004
:0043ADCF E8C3C1FEFF              call 00426F97
:0043ADD4 B998FC4600              mov ecx, 0046FC98
:0043ADD9 E84235FEFF              call 0041E320
:0043ADDE 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043ADE1 E8BAEAFCFF              call 004098A0
:0043ADE6 E8CCC1FEFF              call 00426FB7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043ADAD(C), :0043ADBF(C)
|
:0043ADEB 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043ADEE E8CEFAFFFF              call 0043A8C1
:0043ADF3 50                      push eax
:0043ADF4 B998FB4600              mov ecx, 0046FB98
:0043ADF9 E8926AFCFF              call 00401890
:0043ADFE B988534500              mov ecx, 00455388
:0043AE03 E8946FFCFF              call 00401D9C
:0043AE08 85C0                    test eax, eax
:0043AE0A 0F8411000000            je 0043AE21
:0043AE10 C745F800000000          mov [ebp-08], 00000000
:0043AE17 E8CBC6FFFF              call 004374E7
:0043AE1C E905000000              jmp 0043AE26

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043AE0A(C)
|
:0043AE21 E930FFFFFF              jmp 0043AD56

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043AD95(C), :0043AE1C(U)
|
:0043AE26 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043AE29 E858F8FFFF              call 0043A686
:0043AE2E 837DF800                cmp dword ptr [ebp-08], 00000000
:0043AE32 0F8507000000            jne 0043AE3F
:0043AE38 C60598FB4600FF          mov byte ptr [0046FB98], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043AE32(C)
|
:0043AE3F B898FB4600              mov eax, 0046FB98
:0043AE44 E900000000              jmp 0043AE49

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043AD42(U), :0043AE44(U)
|
:0043AE49 5F                      pop edi
:0043AE4A 5E                      pop esi
:0043AE4B 5B                      pop ebx
:0043AE4C C9                      leave
:0043AE4D C3                      ret


:0043AE4E 55                      push ebp
:0043AE4F 8BEC                    mov ebp, esp
:0043AE51 53                      push ebx
:0043AE52 56                      push esi
:0043AE53 57                      push edi
:0043AE54 E900000000              jmp 0043AE59

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043AE54(U)
|
:0043AE59 5F                      pop edi
:0043AE5A 5E                      pop esi
:0043AE5B 5B                      pop ebx
:0043AE5C C9                      leave
:0043AE5D C3                      ret



* Referenced by a CALL at Addresses:
|:0042CA23   , :0043BE10   , :0043E670   
|
:0043AE5E 55                      push ebp
:0043AE5F 8BEC                    mov ebp, esp
:0043AE61 83EC08                  sub esp, 00000008
:0043AE64 53                      push ebx
:0043AE65 56                      push esi
:0043AE66 57                      push edi
:0043AE67 894DF8                  mov dword ptr [ebp-08], ecx
:0043AE6A 33C0                    xor eax, eax
:0043AE6C 8A4508                  mov al, byte ptr [ebp+08]
:0043AE6F 3DFF000000              cmp eax, 000000FF
:0043AE74 0F84A5000000            je 0043AF1F
:0043AE7A 33C0                    xor eax, eax
:0043AE7C 8A4508                  mov al, byte ptr [ebp+08]
:0043AE7F 83F82D                  cmp eax, 0000002D
:0043AE82 0F8D97000000            jnl 0043AF1F
:0043AE88 33C0                    xor eax, eax
:0043AE8A 8A4508                  mov al, byte ptr [ebp+08]
:0043AE8D 8BC8                    mov ecx, eax
:0043AE8F 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043AE92 C1E003                  shl eax, 03
:0043AE95 2BC1                    sub eax, ecx
:0043AE97 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043AE9D E8E42FFFFF              call 0042DE86
:0043AEA2 85C0                    test eax, eax
:0043AEA4 0F8475000000            je 0043AF1F
:0043AEAA 33C0                    xor eax, eax
:0043AEAC 8A4508                  mov al, byte ptr [ebp+08]
:0043AEAF 8BC8                    mov ecx, eax
:0043AEB1 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043AEB4 C1E003                  shl eax, 03
:0043AEB7 2BC1                    sub eax, ecx
:0043AEB9 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043AEBF E8BCE6FCFF              call 00409580
:0043AEC4 8945FC                  mov dword ptr [ebp-04], eax
:0043AEC7 E85E68FCFF              call 0040172A
:0043AECC 6A0C                    push 0000000C
:0043AECE BB06000000              mov ebx, 00000006
:0043AED3 8B45FC                  mov eax, dword ptr [ebp-04]
:0043AED6 50                      push eax
:0043AED7 E8CEC40000              call 004473AA
:0043AEDC 83C404                  add esp, 00000004
:0043AEDF 2BD8                    sub ebx, eax
:0043AEE1 C1EB01                  shr ebx, 01
:0043AEE4 83C33D                  add ebx, 0000003D
:0043AEE7 53                      push ebx
:0043AEE8 B910BC4600              mov ecx, 0046BC10
:0043AEED E8154DFEFF              call 0041FC07
:0043AEF2 33C0                    xor eax, eax
:0043AEF4 8A4508                  mov al, byte ptr [ebp+08]
:0043AEF7 8BC8                    mov ecx, eax
:0043AEF9 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043AEFC C1E003                  shl eax, 03
:0043AEFF 2BC1                    sub eax, ecx
:0043AF01 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043AF07 E874E6FCFF              call 00409580
:0043AF0C 50                      push eax

* Possible StringData Ref from Data Obj ->"M4C7%s"
                                  |
:0043AF0D 68EC334500              push 004533EC
:0043AF12 6810BC4600              push 0046BC10
:0043AF17 E8075CFEFF              call 00420B23
:0043AF1C 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043AE74(C), :0043AE82(C), :0043AEA4(C)
|
:0043AF1F E900000000              jmp 0043AF24

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043AF1F(U)
|
:0043AF24 5F                      pop edi
:0043AF25 5E                      pop esi
:0043AF26 5B                      pop ebx
:0043AF27 C9                      leave
:0043AF28 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0042A9BA   , :0043B1D2   , :0043B8EA   , :00440A05   
|
:0043AF2B 55                      push ebp
:0043AF2C 8BEC                    mov ebp, esp
:0043AF2E 83EC14                  sub esp, 00000014
:0043AF31 53                      push ebx
:0043AF32 56                      push esi
:0043AF33 57                      push edi
:0043AF34 894DEC                  mov dword ptr [ebp-14], ecx
:0043AF37 8B4508                  mov eax, dword ptr [ebp+08]
:0043AF3A 8945F4                  mov dword ptr [ebp-0C], eax
:0043AF3D 8B450C                  mov eax, dword ptr [ebp+0C]
:0043AF40 8945F0                  mov dword ptr [ebp-10], eax
:0043AF43 33C0                    xor eax, eax
:0043AF45 8A4510                  mov al, byte ptr [ebp+10]
:0043AF48 83F801                  cmp eax, 00000001
:0043AF4B 0F85EC000000            jne 0043B03D
:0043AF51 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043AF54 8B45EC                  mov eax, dword ptr [ebp-14]
:0043AF57 BB30000000              mov ebx, 00000030
:0043AF5C 8B4008                  mov eax, dword ptr [eax+08]
:0043AF5F 99                      cdq
:0043AF60 F7FB                    idiv ebx
:0043AF62 2BC8                    sub ecx, eax
:0043AF64 894DF4                  mov dword ptr [ebp-0C], ecx
:0043AF67 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0043AF6A 8B45EC                  mov eax, dword ptr [ebp-14]
:0043AF6D BB30000000              mov ebx, 00000030
:0043AF72 8B400C                  mov eax, dword ptr [eax+0C]
:0043AF75 99                      cdq
:0043AF76 F7FB                    idiv ebx
:0043AF78 2BC8                    sub ecx, eax
:0043AF7A 894DF0                  mov dword ptr [ebp-10], ecx
:0043AF7D 837DF400                cmp dword ptr [ebp-0C], 00000000
:0043AF81 0F8D07000000            jnl 0043AF8E
:0043AF87 C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043AF81(C)
|
:0043AF8E 837DF000                cmp dword ptr [ebp-10], 00000000
:0043AF92 0F8D07000000            jnl 0043AF9F
:0043AF98 C745F000000000          mov [ebp-10], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043AF92(C)
|
:0043AF9F 8B45EC                  mov eax, dword ptr [ebp-14]
:0043AFA2 8B4008                  mov eax, dword ptr [eax+08]
:0043AFA5 99                      cdq
:0043AFA6 83E20F                  and edx, 0000000F
:0043AFA9 03C2                    add eax, edx
:0043AFAB C1F804                  sar eax, 04
:0043AFAE 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043AFB1 03C8                    add ecx, eax
:0043AFB3 33C0                    xor eax, eax
:0043AFB5 A0C8FC4600              mov al, byte ptr [0046FCC8]
:0043AFBA 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043AFBD 3BC8                    cmp ecx, eax
:0043AFBF 0F8E29000000            jle 0043AFEE
:0043AFC5 33C9                    xor ecx, ecx
:0043AFC7 8B45EC                  mov eax, dword ptr [ebp-14]
:0043AFCA 8B4008                  mov eax, dword ptr [eax+08]
:0043AFCD 99                      cdq
:0043AFCE 83E20F                  and edx, 0000000F
:0043AFD1 03C2                    add eax, edx
:0043AFD3 C1F804                  sar eax, 04
:0043AFD6 8B55F4                  mov edx, dword ptr [ebp-0C]
:0043AFD9 03D0                    add edx, eax
:0043AFDB 33C0                    xor eax, eax
:0043AFDD A0C8FC4600              mov al, byte ptr [0046FCC8]
:0043AFE2 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043AFE5 2BD0                    sub edx, eax
:0043AFE7 2BCA                    sub ecx, edx
:0043AFE9 F7D9                    neg ecx
:0043AFEB 294DF4                  sub dword ptr [ebp-0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043AFBF(C)
|
:0043AFEE 8B45EC                  mov eax, dword ptr [ebp-14]
:0043AFF1 8B400C                  mov eax, dword ptr [eax+0C]
:0043AFF4 99                      cdq
:0043AFF5 83E20F                  and edx, 0000000F
:0043AFF8 03C2                    add eax, edx
:0043AFFA C1F804                  sar eax, 04
:0043AFFD 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043B000 03C8                    add ecx, eax
:0043B002 33C0                    xor eax, eax
:0043B004 A0C9FC4600              mov al, byte ptr [0046FCC9]
:0043B009 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043B00C 3BC8                    cmp ecx, eax
:0043B00E 0F8E29000000            jle 0043B03D
:0043B014 33C9                    xor ecx, ecx
:0043B016 8B45EC                  mov eax, dword ptr [ebp-14]
:0043B019 8B400C                  mov eax, dword ptr [eax+0C]
:0043B01C 99                      cdq
:0043B01D 83E20F                  and edx, 0000000F
:0043B020 03C2                    add eax, edx
:0043B022 C1F804                  sar eax, 04
:0043B025 8B55F0                  mov edx, dword ptr [ebp-10]
:0043B028 03D0                    add edx, eax
:0043B02A 33C0                    xor eax, eax
:0043B02C A0C9FC4600              mov al, byte ptr [0046FCC9]
:0043B031 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043B034 2BD0                    sub edx, eax
:0043B036 2BCA                    sub ecx, edx
:0043B038 F7D9                    neg ecx
:0043B03A 294DF0                  sub dword ptr [ebp-10], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043AF4B(C), :0043B00E(C)
|
:0043B03D B903000000              mov ecx, 00000003
:0043B042 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043B045 99                      cdq
:0043B046 F7F9                    idiv ecx
:0043B048 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043B04B 8945FC                  mov dword ptr [ebp-04], eax
:0043B04E B903000000              mov ecx, 00000003
:0043B053 8B45F0                  mov eax, dword ptr [ebp-10]
:0043B056 99                      cdq
:0043B057 F7F9                    idiv ecx
:0043B059 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043B05C 8945F8                  mov dword ptr [ebp-08], eax
:0043B05F 8B45EC                  mov eax, dword ptr [ebp-14]
:0043B062 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043B065 394810                  cmp dword ptr [eax+10], ecx
:0043B068 0F850F000000            jne 0043B07D
:0043B06E 8B45EC                  mov eax, dword ptr [ebp-14]
:0043B071 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043B074 394814                  cmp dword ptr [eax+14], ecx
:0043B077 0F8424000000            je 0043B0A1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B068(C)
|
:0043B07D E815BFFEFF              call 00426F97
:0043B082 8B45FC                  mov eax, dword ptr [ebp-04]
:0043B085 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B088 894110                  mov dword ptr [ecx+10], eax
:0043B08B 8B45F8                  mov eax, dword ptr [ebp-08]
:0043B08E 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B091 894114                  mov dword ptr [ecx+14], eax
:0043B094 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B097 E804E8FCFF              call 004098A0
:0043B09C E816BFFEFF              call 00426FB7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B077(C)
|
:0043B0A1 E900000000              jmp 0043B0A6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B0A1(U)
|
:0043B0A6 5F                      pop edi
:0043B0A7 5E                      pop esi
:0043B0A8 5B                      pop ebx
:0043B0A9 C9                      leave
:0043B0AA C20C00                  ret 000C



* Referenced by a CALL at Addresses:
|:0043B3BE   , :0043BD6F   
|
:0043B0AD 55                      push ebp
:0043B0AE 8BEC                    mov ebp, esp
:0043B0B0 83EC14                  sub esp, 00000014
:0043B0B3 53                      push ebx
:0043B0B4 56                      push esi
:0043B0B5 57                      push edi
:0043B0B6 894DEC                  mov dword ptr [ebp-14], ecx
:0043B0B9 33C0                    xor eax, eax
:0043B0BB 8A4508                  mov al, byte ptr [ebp+08]
:0043B0BE B903000000              mov ecx, 00000003
:0043B0C3 99                      cdq
:0043B0C4 F7F9                    idiv ecx
:0043B0C6 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043B0C9 884508                  mov byte ptr [ebp+08], al
:0043B0CC 33C0                    xor eax, eax
:0043B0CE 8A450C                  mov al, byte ptr [ebp+0C]
:0043B0D1 B903000000              mov ecx, 00000003
:0043B0D6 99                      cdq
:0043B0D7 F7F9                    idiv ecx
:0043B0D9 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043B0DC 88450C                  mov byte ptr [ebp+0C], al
:0043B0DF 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B0E2 E8499AFEFF              call 00424B30
:0043B0E7 8945F4                  mov dword ptr [ebp-0C], eax
:0043B0EA 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B0ED E85E9AFEFF              call 00424B50
:0043B0F2 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B1D7(U)
|
:0043B0F5 33C0                    xor eax, eax
:0043B0F7 8A4508                  mov al, byte ptr [ebp+08]
:0043B0FA 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B0FD 3B4110                  cmp eax, dword ptr [ecx+10]
:0043B100 0F8511000000            jne 0043B117
:0043B106 8B45EC                  mov eax, dword ptr [ebp-14]
:0043B109 33C9                    xor ecx, ecx
:0043B10B 8A4D0C                  mov cl, byte ptr [ebp+0C]
:0043B10E 394814                  cmp dword ptr [eax+14], ecx
:0043B111 0F84C5000000            je 0043B1DC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B100(C)
|
:0043B117 33C0                    xor eax, eax
:0043B119 8A4508                  mov al, byte ptr [ebp+08]
:0043B11C 2B45F4                  sub eax, dword ptr [ebp-0C]
:0043B11F 8945FC                  mov dword ptr [ebp-04], eax
:0043B122 33C0                    xor eax, eax
:0043B124 8A450C                  mov al, byte ptr [ebp+0C]
:0043B127 2B45F0                  sub eax, dword ptr [ebp-10]
:0043B12A 8945F8                  mov dword ptr [ebp-08], eax
:0043B12D 837DFC00                cmp dword ptr [ebp-04], 00000000
:0043B131 0F8505000000            jne 0043B13C
:0043B137 E93D000000              jmp 0043B179

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B131(C)
|
:0043B13C 837DFC0C                cmp dword ptr [ebp-04], 0000000C
:0043B140 0F8C09000000            jl 0043B14F
:0043B146 8345F409                add dword ptr [ebp-0C], 00000009
:0043B14A E92A000000              jmp 0043B179

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B140(C)
|
:0043B14F 837DFCF4                cmp dword ptr [ebp-04], FFFFFFF4
:0043B153 0F8E1C000000            jle 0043B175
:0043B159 837DFC00                cmp dword ptr [ebp-04], 00000000
:0043B15D 0F8E09000000            jle 0043B16C
:0043B163 8345F403                add dword ptr [ebp-0C], 00000003
:0043B167 E904000000              jmp 0043B170

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B15D(C)
|
:0043B16C 836DF403                sub dword ptr [ebp-0C], 00000003

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B167(U)
|
:0043B170 E904000000              jmp 0043B179

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B153(C)
|
:0043B175 836DF409                sub dword ptr [ebp-0C], 00000009

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043B137(U), :0043B14A(U), :0043B170(U)
|
:0043B179 837DF800                cmp dword ptr [ebp-08], 00000000
:0043B17D 0F8505000000            jne 0043B188
:0043B183 E93D000000              jmp 0043B1C5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B17D(C)
|
:0043B188 837DF80C                cmp dword ptr [ebp-08], 0000000C
:0043B18C 0F8C09000000            jl 0043B19B
:0043B192 8345F009                add dword ptr [ebp-10], 00000009
:0043B196 E92A000000              jmp 0043B1C5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B18C(C)
|
:0043B19B 837DF8F4                cmp dword ptr [ebp-08], FFFFFFF4
:0043B19F 0F8E1C000000            jle 0043B1C1
:0043B1A5 837DF800                cmp dword ptr [ebp-08], 00000000
:0043B1A9 0F8E09000000            jle 0043B1B8
:0043B1AF 8345F003                add dword ptr [ebp-10], 00000003
:0043B1B3 E904000000              jmp 0043B1BC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B1A9(C)
|
:0043B1B8 836DF003                sub dword ptr [ebp-10], 00000003

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B1B3(U)
|
:0043B1BC E904000000              jmp 0043B1C5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B19F(C)
|
:0043B1C1 836DF009                sub dword ptr [ebp-10], 00000009

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043B183(U), :0043B196(U), :0043B1BC(U)
|
:0043B1C5 6A00                    push 00000000
:0043B1C7 8B45F0                  mov eax, dword ptr [ebp-10]
:0043B1CA 50                      push eax
:0043B1CB 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043B1CE 50                      push eax
:0043B1CF 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B1D2 E854FDFFFF              call 0043AF2B
:0043B1D7 E919FFFFFF              jmp 0043B0F5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B111(C)
|
:0043B1DC E900000000              jmp 0043B1E1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B1DC(U)
|
:0043B1E1 5F                      pop edi
:0043B1E2 5E                      pop esi
:0043B1E3 5B                      pop ebx
:0043B1E4 C9                      leave
:0043B1E5 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:004045D0   , :00405680   , :00405A5C   , :00405E23   , :004061F7   
|:0040697B   , :0040734C   , :0040769C   , :00424531   , :00427A09   
|:00427D97   , :00428011   , :0042C8D1   , :0043E518   , :00442C54   
|:00444289   
|
:0043B1E8 55                      push ebp
:0043B1E9 8BEC                    mov ebp, esp
:0043B1EB 83EC28                  sub esp, 00000028
:0043B1EE 53                      push ebx
:0043B1EF 56                      push esi
:0043B1F0 57                      push edi
:0043B1F1 894DD8                  mov dword ptr [ebp-28], ecx
:0043B1F4 33C0                    xor eax, eax
:0043B1F6 8A4508                  mov al, byte ptr [ebp+08]
:0043B1F9 8945E8                  mov dword ptr [ebp-18], eax
:0043B1FC 33C0                    xor eax, eax
:0043B1FE 8A450C                  mov al, byte ptr [ebp+0C]
:0043B201 8945DC                  mov dword ptr [ebp-24], eax
:0043B204 C745EC00000000          mov [ebp-14], 00000000
:0043B20B C745E000000000          mov [ebp-20], 00000000
:0043B212 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043B215 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:0043B218 8B45D8                  mov eax, dword ptr [ebp-28]
:0043B21B BB30000000              mov ebx, 00000030
:0043B220 8B4008                  mov eax, dword ptr [eax+08]
:0043B223 99                      cdq
:0043B224 F7FB                    idiv ebx
:0043B226 2BC8                    sub ecx, eax
:0043B228 894DFC                  mov dword ptr [ebp-04], ecx
:0043B22B 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043B22E 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:0043B231 8B45D8                  mov eax, dword ptr [ebp-28]
:0043B234 BB30000000              mov ebx, 00000030
:0043B239 8B400C                  mov eax, dword ptr [eax+0C]
:0043B23C 99                      cdq
:0043B23D F7FB                    idiv ebx
:0043B23F 2BC8                    sub ecx, eax
:0043B241 894DF8                  mov dword ptr [ebp-08], ecx
:0043B244 8B45D8                  mov eax, dword ptr [ebp-28]
:0043B247 8B4010                  mov eax, dword ptr [eax+10]
:0043B24A 2B45FC                  sub eax, dword ptr [ebp-04]
:0043B24D 8945F0                  mov dword ptr [ebp-10], eax
:0043B250 8B45D8                  mov eax, dword ptr [ebp-28]
:0043B253 8B4014                  mov eax, dword ptr [eax+14]
:0043B256 2B45F8                  sub eax, dword ptr [ebp-08]
:0043B259 8945E4                  mov dword ptr [ebp-1C], eax
:0043B25C C745F409000000          mov [ebp-0C], 00000009
:0043B263 8B45F0                  mov eax, dword ptr [ebp-10]
:0043B266 3945F4                  cmp dword ptr [ebp-0C], eax
:0043B269 0F8E30000000            jle 0043B29F
:0043B26F 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043B272 83E803                  sub eax, 00000003
:0043B275 3B45E4                  cmp eax, dword ptr [ebp-1C]
:0043B278 0F8E21000000            jle 0043B29F
:0043B27E 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043B281 F7D8                    neg eax
:0043B283 3B45F0                  cmp eax, dword ptr [ebp-10]
:0043B286 0F8D13000000            jnl 0043B29F
:0043B28C 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043B28F F7D8                    neg eax
:0043B291 3B45E4                  cmp eax, dword ptr [ebp-1C]
:0043B294 0F8D05000000            jnl 0043B29F
:0043B29A E929010000              jmp 0043B3C8

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043B269(C), :0043B278(C), :0043B286(C), :0043B294(C)
|
:0043B29F 837DFC00                cmp dword ptr [ebp-04], 00000000
:0043B2A3 0F8C0F000000            jl 0043B2B8
:0043B2A9 8B45E8                  mov eax, dword ptr [ebp-18]
:0043B2AC 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043B2AF 3B45F4                  cmp eax, dword ptr [ebp-0C]
:0043B2B2 0F8D07000000            jnl 0043B2BF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B2A3(C)
|
:0043B2B8 C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B2B2(C)
|
:0043B2BF 837DF800                cmp dword ptr [ebp-08], 00000000
:0043B2C3 0F8C0F000000            jl 0043B2D8
:0043B2C9 8B45DC                  mov eax, dword ptr [ebp-24]
:0043B2CC 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043B2CF 3B45F4                  cmp eax, dword ptr [ebp-0C]
:0043B2D2 0F8D07000000            jnl 0043B2DF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B2C3(C)
|
:0043B2D8 C745F800000000          mov [ebp-08], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B2D2(C)
|
:0043B2DF 8B45D8                  mov eax, dword ptr [ebp-28]
:0043B2E2 8B4008                  mov eax, dword ptr [eax+08]
:0043B2E5 99                      cdq
:0043B2E6 83E20F                  and edx, 0000000F
:0043B2E9 03C2                    add eax, edx
:0043B2EB C1F804                  sar eax, 04
:0043B2EE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043B2F1 03C8                    add ecx, eax
:0043B2F3 33C0                    xor eax, eax
:0043B2F5 A0C8FC4600              mov al, byte ptr [0046FCC8]
:0043B2FA 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043B2FD 3BC8                    cmp ecx, eax
:0043B2FF 0F8F25000000            jg 0043B32A
:0043B305 33C9                    xor ecx, ecx
:0043B307 8A0DC8FC4600            mov cl, byte ptr [0046FCC8]
:0043B30D 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:0043B310 8B45D8                  mov eax, dword ptr [ebp-28]
:0043B313 8B4008                  mov eax, dword ptr [eax+08]
:0043B316 99                      cdq
:0043B317 83E20F                  and edx, 0000000F
:0043B31A 03C2                    add eax, edx
:0043B31C C1F804                  sar eax, 04
:0043B31F 2BC8                    sub ecx, eax
:0043B321 3B4DFC                  cmp ecx, dword ptr [ebp-04]
:0043B324 0F8D1F000000            jnl 0043B349

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B2FF(C)
|
:0043B32A 33C9                    xor ecx, ecx
:0043B32C 8A0DC8FC4600            mov cl, byte ptr [0046FCC8]
:0043B332 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:0043B335 8B45D8                  mov eax, dword ptr [ebp-28]
:0043B338 8B4008                  mov eax, dword ptr [eax+08]
:0043B33B 99                      cdq
:0043B33C 83E20F                  and edx, 0000000F
:0043B33F 03C2                    add eax, edx
:0043B341 C1F804                  sar eax, 04
:0043B344 2BC8                    sub ecx, eax
:0043B346 894DFC                  mov dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B324(C)
|
:0043B349 8B45D8                  mov eax, dword ptr [ebp-28]
:0043B34C 8B400C                  mov eax, dword ptr [eax+0C]
:0043B34F 99                      cdq
:0043B350 83E20F                  and edx, 0000000F
:0043B353 03C2                    add eax, edx
:0043B355 C1F804                  sar eax, 04
:0043B358 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043B35B 03C8                    add ecx, eax
:0043B35D 33C0                    xor eax, eax
:0043B35F A0C9FC4600              mov al, byte ptr [0046FCC9]
:0043B364 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043B367 3BC8                    cmp ecx, eax
:0043B369 0F8F25000000            jg 0043B394
:0043B36F 33C9                    xor ecx, ecx
:0043B371 8A0DC9FC4600            mov cl, byte ptr [0046FCC9]
:0043B377 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:0043B37A 8B45D8                  mov eax, dword ptr [ebp-28]
:0043B37D 8B400C                  mov eax, dword ptr [eax+0C]
:0043B380 99                      cdq
:0043B381 83E20F                  and edx, 0000000F
:0043B384 03C2                    add eax, edx
:0043B386 C1F804                  sar eax, 04
:0043B389 2BC8                    sub ecx, eax
:0043B38B 3B4DF8                  cmp ecx, dword ptr [ebp-08]
:0043B38E 0F8D1F000000            jnl 0043B3B3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B369(C)
|
:0043B394 33C9                    xor ecx, ecx
:0043B396 8A0DC9FC4600            mov cl, byte ptr [0046FCC9]
:0043B39C 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:0043B39F 8B45D8                  mov eax, dword ptr [ebp-28]
:0043B3A2 8B400C                  mov eax, dword ptr [eax+0C]
:0043B3A5 99                      cdq
:0043B3A6 83E20F                  and edx, 0000000F
:0043B3A9 03C2                    add eax, edx
:0043B3AB C1F804                  sar eax, 04
:0043B3AE 2BC8                    sub ecx, eax
:0043B3B0 894DF8                  mov dword ptr [ebp-08], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B38E(C)
|
:0043B3B3 8B45F8                  mov eax, dword ptr [ebp-08]
:0043B3B6 50                      push eax
:0043B3B7 8B45FC                  mov eax, dword ptr [ebp-04]
:0043B3BA 50                      push eax
:0043B3BB 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0043B3BE E8EAFCFFFF              call 0043B0AD
:0043B3C3 E900000000              jmp 0043B3C8

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043B29A(U), :0043B3C3(U)
|
:0043B3C8 5F                      pop edi
:0043B3C9 5E                      pop esi
:0043B3CA 5B                      pop ebx
:0043B3CB C9                      leave
:0043B3CC C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0043ACC1   , :0043AD12   , :0043ADA6   , :00442D4B   
|
:0043B3CF 55                      push ebp
:0043B3D0 8BEC                    mov ebp, esp
:0043B3D2 83EC34                  sub esp, 00000034
:0043B3D5 53                      push ebx
:0043B3D6 56                      push esi
:0043B3D7 57                      push edi
:0043B3D8 894DCC                  mov dword ptr [ebp-34], ecx
:0043B3DB 8B45CC                  mov eax, dword ptr [ebp-34]
:0043B3DE 8B4018                  mov eax, dword ptr [eax+18]
:0043B3E1 8945E8                  mov dword ptr [ebp-18], eax
:0043B3E4 8B45CC                  mov eax, dword ptr [ebp-34]
:0043B3E7 8B401C                  mov eax, dword ptr [eax+1C]
:0043B3EA 8945E0                  mov dword ptr [ebp-20], eax
:0043B3ED C745EC00000000          mov [ebp-14], 00000000
:0043B3F4 C745E400000000          mov [ebp-1C], 00000000
:0043B3FB C745DC00000000          mov [ebp-24], 00000000
:0043B402 C645F800                mov [ebp-08], 00
:0043B406 C645F400                mov [ebp-0C], 00
:0043B40A C645F000                mov [ebp-10], 00
:0043B40E 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0043B411 E8ABF4FFFF              call 0043A8C1
:0043B416 668B00                  mov ax, word ptr [eax]
:0043B419 668945FC                mov word ptr [ebp-04], ax
:0043B41D 837DE808                cmp dword ptr [ebp-18], 00000008
:0043B421 0F8235000000            jb 0043B45C
:0043B427 817DE810010000          cmp dword ptr [ebp-18], 00000110
:0043B42E 0F8328000000            jnb 0043B45C
:0043B434 837DE008                cmp dword ptr [ebp-20], 00000008
:0043B438 0F821E000000            jb 0043B45C
:0043B43E 837DE020                cmp dword ptr [ebp-20], 00000020
:0043B442 0F8314000000            jnb 0043B45C
:0043B448 6A01                    push 00000001
:0043B44A E839AAFEFF              call 00425E88
:0043B44F 83C404                  add esp, 00000004
:0043B452 B801000000              mov eax, 00000001
:0043B457 E9A0040000              jmp 0043B8FC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043B421(C), :0043B42E(C), :0043B438(C), :0043B442(C)
|
:0043B45C 8B45CC                  mov eax, dword ptr [ebp-34]
:0043B45F 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043B462 3908                    cmp dword ptr [eax], ecx
:0043B464 0F874F000000            ja 0043B4B9
:0043B46A 8B45CC                  mov eax, dword ptr [ebp-34]
:0043B46D 8B00                    mov eax, dword ptr [eax]
:0043B46F 83C030                  add eax, 00000030
:0043B472 3B45E8                  cmp eax, dword ptr [ebp-18]
:0043B475 0F863E000000            jbe 0043B4B9
:0043B47B 8B45CC                  mov eax, dword ptr [ebp-34]
:0043B47E 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0043B481 394804                  cmp dword ptr [eax+04], ecx
:0043B484 0F872F000000            ja 0043B4B9
:0043B48A 8B45CC                  mov eax, dword ptr [ebp-34]
:0043B48D 8B4004                  mov eax, dword ptr [eax+04]
:0043B490 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0043B493 03410C                  add eax, dword ptr [ecx+0C]
:0043B496 3B45E0                  cmp eax, dword ptr [ebp-20]
:0043B499 0F861A000000            jbe 0043B4B9
:0043B49F 8B45CC                  mov eax, dword ptr [ebp-34]
:0043B4A2 B903000000              mov ecx, 00000003
:0043B4A7 8B4010                  mov eax, dword ptr [eax+10]
:0043B4AA 99                      cdq
:0043B4AB F7F9                    idiv ecx
:0043B4AD 85C0                    test eax, eax
:0043B4AF 0F8404000000            je 0043B4B9
:0043B4B5 C645F406                mov [ebp-0C], 06

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043B464(C), :0043B475(C), :0043B484(C), :0043B499(C), :0043B4AF(C)
|
:0043B4B9 8B45CC                  mov eax, dword ptr [ebp-34]
:0043B4BC 8B4008                  mov eax, dword ptr [eax+08]
:0043B4BF 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0043B4C2 0301                    add eax, dword ptr [ecx]
:0043B4C4 83E830                  sub eax, 00000030
:0043B4C7 3B45E8                  cmp eax, dword ptr [ebp-18]
:0043B4CA 0F8773000000            ja 0043B543
:0043B4D0 8B45CC                  mov eax, dword ptr [ebp-34]
:0043B4D3 8B4008                  mov eax, dword ptr [eax+08]
:0043B4D6 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0043B4D9 0301                    add eax, dword ptr [ecx]
:0043B4DB 3B45E8                  cmp eax, dword ptr [ebp-18]
:0043B4DE 0F865F000000            jbe 0043B543
:0043B4E4 8B45CC                  mov eax, dword ptr [ebp-34]
:0043B4E7 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0043B4EA 394804                  cmp dword ptr [eax+04], ecx
:0043B4ED 0F8750000000            ja 0043B543
:0043B4F3 8B45CC                  mov eax, dword ptr [ebp-34]
:0043B4F6 8B4004                  mov eax, dword ptr [eax+04]
:0043B4F9 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0043B4FC 03410C                  add eax, dword ptr [ecx+0C]
:0043B4FF 3B45E0                  cmp eax, dword ptr [ebp-20]
:0043B502 0F863B000000            jbe 0043B543
:0043B508 33C9                    xor ecx, ecx
:0043B50A 8A0DC8FC4600            mov cl, byte ptr [0046FCC8]
:0043B510 8B45CC                  mov eax, dword ptr [ebp-34]
:0043B513 8B4008                  mov eax, dword ptr [eax+08]
:0043B516 99                      cdq
:0043B517 83E20F                  and edx, 0000000F
:0043B51A 03C2                    add eax, edx
:0043B51C C1F804                  sar eax, 04
:0043B51F BB03000000              mov ebx, 00000003
:0043B524 99                      cdq
:0043B525 F7FB                    idiv ebx
:0043B527 2BC8                    sub ecx, eax
:0043B529 8B45CC                  mov eax, dword ptr [ebp-34]
:0043B52C BB03000000              mov ebx, 00000003
:0043B531 8B4010                  mov eax, dword ptr [eax+10]
:0043B534 99                      cdq
:0043B535 F7FB                    idiv ebx
:0043B537 3BC8                    cmp ecx, eax
:0043B539 0F8404000000            je 0043B543
:0043B53F C645F402                mov [ebp-0C], 02

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043B4CA(C), :0043B4DE(C), :0043B4ED(C), :0043B502(C), :0043B539(C)
|
:0043B543 8B45CC                  mov eax, dword ptr [ebp-34]
:0043B546 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0043B549 394804                  cmp dword ptr [eax+04], ecx
:0043B54C 0F874E000000            ja 0043B5A0
:0043B552 8B45CC                  mov eax, dword ptr [ebp-34]
:0043B555 8B4004                  mov eax, dword ptr [eax+04]
:0043B558 83C030                  add eax, 00000030
:0043B55B 3B45E0                  cmp eax, dword ptr [ebp-20]
:0043B55E 0F863C000000            jbe 0043B5A0
:0043B564 8B45CC                  mov eax, dword ptr [ebp-34]
:0043B567 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043B56A 3908                    cmp dword ptr [eax], ecx
:0043B56C 0F872E000000            ja 0043B5A0
:0043B572 8B45CC                  mov eax, dword ptr [ebp-34]
:0043B575 8B4008                  mov eax, dword ptr [eax+08]
:0043B578 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0043B57B 0301                    add eax, dword ptr [ecx]
:0043B57D 3B45E8                  cmp eax, dword ptr [ebp-18]
:0043B580 0F861A000000            jbe 0043B5A0
:0043B586 8B45CC                  mov eax, dword ptr [ebp-34]
:0043B589 B903000000              mov ecx, 00000003
:0043B58E 8B4014                  mov eax, dword ptr [eax+14]
:0043B591 99                      cdq
:0043B592 F7F9                    idiv ecx
:0043B594 85C0                    test eax, eax
:0043B596 0F8404000000            je 0043B5A0
:0043B59C C645F004                mov [ebp-10], 04

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043B54C(C), :0043B55E(C), :0043B56C(C), :0043B580(C), :0043B596(C)
|
:0043B5A0 8B45CC                  mov eax, dword ptr [ebp-34]
:0043B5A3 8B4004                  mov eax, dword ptr [eax+04]
:0043B5A6 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0043B5A9 03410C                  add eax, dword ptr [ecx+0C]
:0043B5AC 83E830                  sub eax, 00000030
:0043B5AF 3B45E0                  cmp eax, dword ptr [ebp-20]
:0043B5B2 0F8772000000            ja 0043B62A
:0043B5B8 8B45CC                  mov eax, dword ptr [ebp-34]
:0043B5BB 8B4004                  mov eax, dword ptr [eax+04]
:0043B5BE 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0043B5C1 03410C                  add eax, dword ptr [ecx+0C]
:0043B5C4 3B45E0                  cmp eax, dword ptr [ebp-20]
:0043B5C7 0F865D000000            jbe 0043B62A
:0043B5CD 8B45CC                  mov eax, dword ptr [ebp-34]
:0043B5D0 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043B5D3 3908                    cmp dword ptr [eax], ecx
:0043B5D5 0F874F000000            ja 0043B62A
:0043B5DB 8B45CC                  mov eax, dword ptr [ebp-34]
:0043B5DE 8B4008                  mov eax, dword ptr [eax+08]
:0043B5E1 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0043B5E4 0301                    add eax, dword ptr [ecx]
:0043B5E6 3B45E8                  cmp eax, dword ptr [ebp-18]
:0043B5E9 0F863B000000            jbe 0043B62A
:0043B5EF 33C9                    xor ecx, ecx
:0043B5F1 8A0DC9FC4600            mov cl, byte ptr [0046FCC9]
:0043B5F7 8B45CC                  mov eax, dword ptr [ebp-34]
:0043B5FA 8B400C                  mov eax, dword ptr [eax+0C]
:0043B5FD 99                      cdq
:0043B5FE 83E20F                  and edx, 0000000F
:0043B601 03C2                    add eax, edx
:0043B603 C1F804                  sar eax, 04
:0043B606 BB03000000              mov ebx, 00000003
:0043B60B 99                      cdq
:0043B60C F7FB                    idiv ebx
:0043B60E 2BC8                    sub ecx, eax
:0043B610 8B45CC                  mov eax, dword ptr [ebp-34]
:0043B613 BB03000000              mov ebx, 00000003
:0043B618 8B4014                  mov eax, dword ptr [eax+14]
:0043B61B 99                      cdq
:0043B61C F7FB                    idiv ebx
:0043B61E 3BC8                    cmp ecx, eax
:0043B620 0F8404000000            je 0043B62A
:0043B626 C645F008                mov [ebp-10], 08

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043B5B2(C), :0043B5C7(C), :0043B5D5(C), :0043B5E9(C), :0043B620(C)
|
:0043B62A 33C0                    xor eax, eax
:0043B62C 8A45F4                  mov al, byte ptr [ebp-0C]
:0043B62F 85C0                    test eax, eax
:0043B631 0F850B000000            jne 0043B642
:0043B637 8A45F0                  mov al, byte ptr [ebp-10]
:0043B63A 8845F8                  mov byte ptr [ebp-08], al
:0043B63D E952000000              jmp 0043B694

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B631(C)
|
:0043B642 33C0                    xor eax, eax
:0043B644 8A45F0                  mov al, byte ptr [ebp-10]
:0043B647 85C0                    test eax, eax
:0043B649 0F850B000000            jne 0043B65A
:0043B64F 8A45F4                  mov al, byte ptr [ebp-0C]
:0043B652 8845F8                  mov byte ptr [ebp-08], al
:0043B655 E93A000000              jmp 0043B694

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B649(C)
|
:0043B65A 33C0                    xor eax, eax
:0043B65C 8A45F0                  mov al, byte ptr [ebp-10]
:0043B65F 83F808                  cmp eax, 00000008
:0043B662 0F8517000000            jne 0043B67F
:0043B668 33C0                    xor eax, eax
:0043B66A 8A45F4                  mov al, byte ptr [ebp-0C]
:0043B66D 83F802                  cmp eax, 00000002
:0043B670 0F8509000000            jne 0043B67F
:0043B676 C645F809                mov [ebp-08], 09
:0043B67A E915000000              jmp 0043B694

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043B662(C), :0043B670(C)
|
:0043B67F 33C0                    xor eax, eax
:0043B681 8A45F0                  mov al, byte ptr [ebp-10]
:0043B684 33C9                    xor ecx, ecx
:0043B686 8A4DF4                  mov cl, byte ptr [ebp-0C]
:0043B689 03C1                    add eax, ecx
:0043B68B 99                      cdq
:0043B68C 2BC2                    sub eax, edx
:0043B68E C1F801                  sar eax, 01
:0043B691 8845F8                  mov byte ptr [ebp-08], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043B63D(U), :0043B655(U), :0043B67A(U)
|
:0043B694 8B45CC                  mov eax, dword ptr [ebp-34]
:0043B697 33C9                    xor ecx, ecx
:0043B699 8A4849                  mov cl, byte ptr [eax+49]
:0043B69C 85C9                    test ecx, ecx
:0043B69E 0F8494000000            je 0043B738
:0043B6A4 8D45FC                  lea eax, dword ptr [ebp-04]
:0043B6A7 50                      push eax
:0043B6A8 E890DEFDFF              call 0041953D
:0043B6AD 83C404                  add esp, 00000004
:0043B6B0 33C9                    xor ecx, ecx
:0043B6B2 8AC8                    mov cl, al
:0043B6B4 81F9FF000000            cmp ecx, 000000FF
:0043B6BA 0F8478000000            je 0043B738
:0043B6C0 8B45FC                  mov eax, dword ptr [ebp-04]
:0043B6C3 50                      push eax
:0043B6C4 E838020000              call 0043B901
:0043B6C9 83C404                  add esp, 00000004
:0043B6CC 33C9                    xor ecx, ecx
:0043B6CE 8AC8                    mov cl, al
:0043B6D0 85C9                    test ecx, ecx
:0043B6D2 0F8460000000            je 0043B738
:0043B6D8 33C0                    xor eax, eax
:0043B6DA 8A45F8                  mov al, byte ptr [ebp-08]
:0043B6DD 83F802                  cmp eax, 00000002
:0043B6E0 0F8C0E000000            jl 0043B6F4
:0043B6E6 33C0                    xor eax, eax
:0043B6E8 8A45F8                  mov al, byte ptr [ebp-08]
:0043B6EB 83F809                  cmp eax, 00000009
:0043B6EE 0F8E44000000            jle 0043B738

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B6E0(C)
|
:0043B6F4 8D45FC                  lea eax, dword ptr [ebp-04]
:0043B6F7 50                      push eax
:0043B6F8 E840DEFDFF              call 0041953D
:0043B6FD 83C404                  add esp, 00000004
:0043B700 33C9                    xor ecx, ecx
:0043B702 8AC8                    mov cl, al
:0043B704 8BC1                    mov eax, ecx
:0043B706 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:0043B709 C1E103                  shl ecx, 03
:0043B70C 2BC8                    sub ecx, eax
:0043B70E 8D8998C04600            lea ecx, dword ptr [ecx+0046C098]
:0043B714 E807DBFCFF              call 00409220
:0043B719 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0043B71C 3B414A                  cmp eax, dword ptr [ecx+4A]
:0043B71F 0F8513000000            jne 0043B738
:0043B725 8B45FC                  mov eax, dword ptr [ebp-04]
:0043B728 50                      push eax
:0043B729 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0043B72C E8AB2F0000              call 0043E6DC
:0043B731 33C0                    xor eax, eax
:0043B733 E9C4010000              jmp 0043B8FC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043B69E(C), :0043B6BA(C), :0043B6D2(C), :0043B6EE(C), :0043B71F(C)
|
:0043B738 33C0                    xor eax, eax
:0043B73A 8A45F8                  mov al, byte ptr [ebp-08]
:0043B73D 50                      push eax
:0043B73E E845A7FEFF              call 00425E88
:0043B743 83C404                  add esp, 00000004
:0043B746 8A45F8                  mov al, byte ptr [ebp-08]
:0043B749 A2AC354500              mov byte ptr [004535AC], al
:0043B74E B9D0A64600              mov ecx, 0046A6D0
:0043B753 E878360000              call 0043EDD0
:0043B758 8845D8                  mov byte ptr [ebp-28], al
:0043B75B 33C0                    xor eax, eax
:0043B75D 8A45D8                  mov al, byte ptr [ebp-28]
:0043B760 3DFF000000              cmp eax, 000000FF
:0043B765 0F8489010000            je 0043B8F4
:0043B76B B988534500              mov ecx, 00455388
:0043B770 E80766FCFF              call 00401D7C
:0043B775 85C0                    test eax, eax
:0043B777 0F8477010000            je 0043B8F4
:0043B77D 8B45CC                  mov eax, dword ptr [ebp-34]
:0043B780 8B4010                  mov eax, dword ptr [eax+10]
:0043B783 8945D4                  mov dword ptr [ebp-2C], eax
:0043B786 8B45CC                  mov eax, dword ptr [ebp-34]
:0043B789 8B4014                  mov eax, dword ptr [eax+14]
:0043B78C 8945D0                  mov dword ptr [ebp-30], eax
:0043B78F 33C0                    xor eax, eax
:0043B791 8A45F8                  mov al, byte ptr [ebp-08]
:0043B794 85C0                    test eax, eax
:0043B796 0F8423010000            je 0043B8BF
:0043B79C 33C0                    xor eax, eax
:0043B79E 8A45F4                  mov al, byte ptr [ebp-0C]
:0043B7A1 83F802                  cmp eax, 00000002
:0043B7A4 0F8554000000            jne 0043B7FE
:0043B7AA 33C0                    xor eax, eax
:0043B7AC 8A45D8                  mov al, byte ptr [ebp-28]
:0043B7AF 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043B7B2 0145D4                  add dword ptr [ebp-2C], eax
:0043B7B5 33C9                    xor ecx, ecx
:0043B7B7 8A0DC8FC4600            mov cl, byte ptr [0046FCC8]
:0043B7BD 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:0043B7C0 8B45CC                  mov eax, dword ptr [ebp-34]
:0043B7C3 8B4008                  mov eax, dword ptr [eax+08]
:0043B7C6 99                      cdq
:0043B7C7 83E20F                  and edx, 0000000F
:0043B7CA 03C2                    add eax, edx
:0043B7CC C1F804                  sar eax, 04
:0043B7CF 2BC8                    sub ecx, eax
:0043B7D1 3B4DD4                  cmp ecx, dword ptr [ebp-2C]
:0043B7D4 0F8D1F000000            jnl 0043B7F9
:0043B7DA 33C9                    xor ecx, ecx
:0043B7DC 8A0DC8FC4600            mov cl, byte ptr [0046FCC8]
:0043B7E2 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:0043B7E5 8B45CC                  mov eax, dword ptr [ebp-34]
:0043B7E8 8B4008                  mov eax, dword ptr [eax+08]
:0043B7EB 99                      cdq
:0043B7EC 83E20F                  and edx, 0000000F
:0043B7EF 03C2                    add eax, edx
:0043B7F1 C1F804                  sar eax, 04
:0043B7F4 2BC8                    sub ecx, eax
:0043B7F6 894DD4                  mov dword ptr [ebp-2C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B7D4(C)
|
:0043B7F9 E92C000000              jmp 0043B82A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B7A4(C)
|
:0043B7FE 33C0                    xor eax, eax
:0043B800 8A45F4                  mov al, byte ptr [ebp-0C]
:0043B803 83F806                  cmp eax, 00000006
:0043B806 0F851E000000            jne 0043B82A
:0043B80C 33C0                    xor eax, eax
:0043B80E 33C9                    xor ecx, ecx
:0043B810 8A4DD8                  mov cl, byte ptr [ebp-28]
:0043B813 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:0043B816 2BC1                    sub eax, ecx
:0043B818 F7D8                    neg eax
:0043B81A 2945D4                  sub dword ptr [ebp-2C], eax
:0043B81D 0F8907000000            jns 0043B82A
:0043B823 C745D400000000          mov [ebp-2C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043B7F9(U), :0043B806(C), :0043B81D(C)
|
:0043B82A 33C0                    xor eax, eax
:0043B82C 8A45F0                  mov al, byte ptr [ebp-10]
:0043B82F 83F808                  cmp eax, 00000008
:0043B832 0F8554000000            jne 0043B88C
:0043B838 33C0                    xor eax, eax
:0043B83A 8A45D8                  mov al, byte ptr [ebp-28]
:0043B83D 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043B840 0145D0                  add dword ptr [ebp-30], eax
:0043B843 33C9                    xor ecx, ecx
:0043B845 8A0DC9FC4600            mov cl, byte ptr [0046FCC9]
:0043B84B 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:0043B84E 8B45CC                  mov eax, dword ptr [ebp-34]
:0043B851 8B400C                  mov eax, dword ptr [eax+0C]
:0043B854 99                      cdq
:0043B855 83E20F                  and edx, 0000000F
:0043B858 03C2                    add eax, edx
:0043B85A C1F804                  sar eax, 04
:0043B85D 2BC8                    sub ecx, eax
:0043B85F 3B4DD0                  cmp ecx, dword ptr [ebp-30]
:0043B862 0F8D1F000000            jnl 0043B887
:0043B868 33C9                    xor ecx, ecx
:0043B86A 8A0DC9FC4600            mov cl, byte ptr [0046FCC9]
:0043B870 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:0043B873 8B45CC                  mov eax, dword ptr [ebp-34]
:0043B876 8B400C                  mov eax, dword ptr [eax+0C]
:0043B879 99                      cdq
:0043B87A 83E20F                  and edx, 0000000F
:0043B87D 03C2                    add eax, edx
:0043B87F C1F804                  sar eax, 04
:0043B882 2BC8                    sub ecx, eax
:0043B884 894DD0                  mov dword ptr [ebp-30], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B862(C)
|
:0043B887 E92C000000              jmp 0043B8B8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B832(C)
|
:0043B88C 33C0                    xor eax, eax
:0043B88E 8A45F0                  mov al, byte ptr [ebp-10]
:0043B891 83F804                  cmp eax, 00000004
:0043B894 0F851E000000            jne 0043B8B8
:0043B89A 33C0                    xor eax, eax
:0043B89C 33C9                    xor ecx, ecx
:0043B89E 8A4DD8                  mov cl, byte ptr [ebp-28]
:0043B8A1 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:0043B8A4 2BC1                    sub eax, ecx
:0043B8A6 F7D8                    neg eax
:0043B8A8 2945D0                  sub dword ptr [ebp-30], eax
:0043B8AB 0F8907000000            jns 0043B8B8
:0043B8B1 C745D000000000          mov [ebp-30], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043B887(U), :0043B894(C), :0043B8AB(C)
|
:0043B8B8 C745DC01000000          mov [ebp-24], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B796(C)
|
:0043B8BF 837DDC00                cmp dword ptr [ebp-24], 00000000
:0043B8C3 0F842B000000            je 0043B8F4
:0043B8C9 6A02                    push 00000002
:0043B8CB B9B0FA4600              mov ecx, 0046FAB0
:0043B8D0 E8DBD8FCFF              call 004091B0
:0043B8D5 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0043B8D8 E8A9EDFFFF              call 0043A686
:0043B8DD 6A00                    push 00000000
:0043B8DF 8B45D0                  mov eax, dword ptr [ebp-30]
:0043B8E2 50                      push eax
:0043B8E3 8B45D4                  mov eax, dword ptr [ebp-2C]
:0043B8E6 50                      push eax
:0043B8E7 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0043B8EA E83CF6FFFF              call 0043AF2B
:0043B8EF E8D4BAFFFF              call 004373C8

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043B765(C), :0043B777(C), :0043B8C3(C)
|
:0043B8F4 8B45DC                  mov eax, dword ptr [ebp-24]
:0043B8F7 E900000000              jmp 0043B8FC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043B457(U), :0043B733(U), :0043B8F7(U)
|
:0043B8FC 5F                      pop edi
:0043B8FD 5E                      pop esi
:0043B8FE 5B                      pop ebx
:0043B8FF C9                      leave
:0043B900 C3                      ret



* Referenced by a CALL at Address:
|:0043B6C4   
|
:0043B901 55                      push ebp
:0043B902 8BEC                    mov ebp, esp
:0043B904 83EC04                  sub esp, 00000004
:0043B907 53                      push ebx
:0043B908 56                      push esi
:0043B909 57                      push edi
:0043B90A C645FC00                mov [ebp-04], 00
:0043B90E 33DB                    xor ebx, ebx
:0043B910 8A5D09                  mov bl, byte ptr [ebp+09]
:0043B913 33C0                    xor eax, eax
:0043B915 A0C8FC4600              mov al, byte ptr [0046FCC8]
:0043B91A 0FAFD8                  imul ebx, eax
:0043B91D 33C0                    xor eax, eax
:0043B91F 8A4508                  mov al, byte ptr [ebp+08]
:0043B922 03D8                    add ebx, eax
:0043B924 6A04                    push 00000004
:0043B926 6A00                    push 00000000
:0043B928 68E82C0000              push 00002CE8
:0043B92D B950F94600              mov ecx, 0046F950
:0043B932 E8E9BD0000              call 00447720
:0043B937 33C9                    xor ecx, ecx
:0043B939 8A0C03                  mov cl, byte ptr [ebx+eax]
:0043B93C 81F9FF000000            cmp ecx, 000000FF
:0043B942 0F8404000000            je 0043B94C
:0043B948 C645FC01                mov [ebp-04], 01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B942(C)
|
:0043B94C 8A45FC                  mov al, byte ptr [ebp-04]
:0043B94F E900000000              jmp 0043B954

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B94F(U)
|
:0043B954 5F                      pop edi
:0043B955 5E                      pop esi
:0043B956 5B                      pop ebx
:0043B957 C9                      leave
:0043B958 C3                      ret


:0043B959 55                      push ebp
:0043B95A 8BEC                    mov ebp, esp
:0043B95C 83EC10                  sub esp, 00000010
:0043B95F 53                      push ebx
:0043B960 56                      push esi
:0043B961 57                      push edi
:0043B962 E830B6FEFF              call 00426F97
:0043B967 6A00                    push 00000000
:0043B969 6A00                    push 00000000
:0043B96B 6A00                    push 00000000
:0043B96D E88D930000              call 00444CFF
:0043B972 83C40C                  add esp, 0000000C
:0043B975 C745F400000000          mov [ebp-0C], 00000000
:0043B97C E903000000              jmp 0043B984

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B9FE(U)
|
:0043B981 FF45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B97C(U)
|
:0043B984 8B4514                  mov eax, dword ptr [ebp+14]
:0043B987 3945F4                  cmp dword ptr [ebp-0C], eax
:0043B98A 0F8373000000            jnb 0043BA03
:0043B990 C745F000000000          mov [ebp-10], 00000000
:0043B997 E903000000              jmp 0043B99F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B9F9(U)
|
:0043B99C FF45F0                  inc [ebp-10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B997(U)
|
:0043B99F 8B4510                  mov eax, dword ptr [ebp+10]
:0043B9A2 3945F0                  cmp dword ptr [ebp-10], eax
:0043B9A5 0F8353000000            jnb 0043B9FE
:0043B9AB 8B4518                  mov eax, dword ptr [ebp+18]
:0043B9AE 33C9                    xor ecx, ecx
:0043B9B0 8A08                    mov cl, byte ptr [eax]
:0043B9B2 894DFC                  mov dword ptr [ebp-04], ecx
:0043B9B5 FF4518                  inc [ebp+18]
:0043B9B8 6A04                    push 00000004
:0043B9BA 6A00                    push 00000000
:0043B9BC 6A00                    push 00000000
:0043B9BE B9E8E44600              mov ecx, 0046E4E8
:0043B9C3 E858BD0000              call 00447720
:0043B9C8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043B9CB C1E108                  shl ecx, 08
:0043B9CE 03C1                    add eax, ecx
:0043B9D0 8945F8                  mov dword ptr [ebp-08], eax
:0043B9D3 6A00                    push 00000000
:0043B9D5 8B45F8                  mov eax, dword ptr [ebp-08]
:0043B9D8 50                      push eax
:0043B9D9 6A04                    push 00000004
:0043B9DB 6A04                    push 00000004
:0043B9DD 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043B9E0 C1E002                  shl eax, 02
:0043B9E3 03450C                  add eax, dword ptr [ebp+0C]
:0043B9E6 50                      push eax
:0043B9E7 8B45F0                  mov eax, dword ptr [ebp-10]
:0043B9EA C1E002                  shl eax, 02
:0043B9ED 034508                  add eax, dword ptr [ebp+08]
:0043B9F0 50                      push eax
:0043B9F1 E8BF180000              call 0043D2B5
:0043B9F6 83C418                  add esp, 00000018
:0043B9F9 E99EFFFFFF              jmp 0043B99C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B9A5(C)
|
:0043B9FE E97EFFFFFF              jmp 0043B981

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B98A(C)
|
:0043BA03 E8AFB5FEFF              call 00426FB7
:0043BA08 E900000000              jmp 0043BA0D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043BA08(U)
|
:0043BA0D 5F                      pop edi
:0043BA0E 5E                      pop esi
:0043BA0F 5B                      pop ebx
:0043BA10 C9                      leave
:0043BA11 C3                      ret



* Referenced by a CALL at Address:
|:0043BC20   
|
:0043BA12 55                      push ebp
:0043BA13 8BEC                    mov ebp, esp
:0043BA15 83EC18                  sub esp, 00000018
:0043BA18 53                      push ebx
:0043BA19 56                      push esi
:0043BA1A 57                      push edi
:0043BA1B 894DE8                  mov dword ptr [ebp-18], ecx
:0043BA1E C745FC00000000          mov [ebp-04], 00000000
:0043BA25 E903000000              jmp 0043BA2D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043BAD3(U)
|
:0043BA2A FF45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043BA25(U)
|
:0043BA2D 837DFC2D                cmp dword ptr [ebp-04], 0000002D
:0043BA31 0F83A1000000            jnb 0043BAD8
:0043BA37 8B45FC                  mov eax, dword ptr [ebp-04]
:0043BA3A 8BC8                    mov ecx, eax
:0043BA3C 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043BA3F C1E003                  shl eax, 03
:0043BA42 2BC1                    sub eax, ecx
:0043BA44 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043BA4A E8E1DDFCFF              call 00409830
:0043BA4F 33C9                    xor ecx, ecx
:0043BA51 8AC8                    mov cl, al
:0043BA53 83F902                  cmp ecx, 00000002
:0043BA56 0F8577000000            jne 0043BAD3
:0043BA5C 8B45FC                  mov eax, dword ptr [ebp-04]
:0043BA5F 8BC8                    mov ecx, eax
:0043BA61 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043BA64 C1E003                  shl eax, 03
:0043BA67 2BC1                    sub eax, ecx
:0043BA69 0598C04600              add eax, 0046C098
:0043BA6E 8945EC                  mov dword ptr [ebp-14], eax
:0043BA71 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043BA74 E887D7FCFF              call 00409200
:0043BA79 668B00                  mov ax, word ptr [eax]
:0043BA7C 668945F8                mov word ptr [ebp-08], ax
:0043BA80 33C0                    xor eax, eax
:0043BA82 8A45F8                  mov al, byte ptr [ebp-08]
:0043BA85 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043BA88 C1E002                  shl eax, 02
:0043BA8B 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043BA8E 034135                  add eax, dword ptr [ecx+35]
:0043BA91 40                      inc eax
:0043BA92 8945F4                  mov dword ptr [ebp-0C], eax
:0043BA95 33C0                    xor eax, eax
:0043BA97 8A45F9                  mov al, byte ptr [ebp-07]
:0043BA9A 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043BA9D C1E002                  shl eax, 02
:0043BAA0 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043BAA3 034139                  add eax, dword ptr [ecx+39]
:0043BAA6 83C002                  add eax, 00000002
:0043BAA9 8945F0                  mov dword ptr [ebp-10], eax
:0043BAAC 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043BAAF E86CD7FCFF              call 00409220
:0043BAB4 83F801                  cmp eax, 00000001
:0043BAB7 1BC0                    sbb eax, eax
:0043BAB9 83C00C                  add eax, 0000000C
:0043BABC 50                      push eax
:0043BABD 6A00                    push 00000000
:0043BABF 6A08                    push 00000008
:0043BAC1 6A0A                    push 0000000A
:0043BAC3 8B45F0                  mov eax, dword ptr [ebp-10]
:0043BAC6 50                      push eax
:0043BAC7 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043BACA 50                      push eax
:0043BACB E8A7B5FEFF              call 00427077
:0043BAD0 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043BA56(C)
|
:0043BAD3 E952FFFFFF              jmp 0043BA2A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043BA31(C)
|
:0043BAD8 E900000000              jmp 0043BADD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043BAD8(U)
|
:0043BADD 5F                      pop edi
:0043BADE 5E                      pop esi
:0043BADF 5B                      pop ebx
:0043BAE0 C9                      leave
:0043BAE1 C3                      ret



* Referenced by a CALL at Address:
|:00442287   
|
:0043BAE2 55                      push ebp
:0043BAE3 8BEC                    mov ebp, esp
:0043BAE5 83EC34                  sub esp, 00000034
:0043BAE8 53                      push ebx
:0043BAE9 56                      push esi
:0043BAEA 57                      push edi
:0043BAEB 894DCC                  mov dword ptr [ebp-34], ecx
:0043BAEE 6A72                    push 00000072
:0043BAF0 E893A3FEFF              call 00425E88
:0043BAF5 83C404                  add esp, 00000004
:0043BAF8 E89AB4FEFF              call 00426F97
:0043BAFD 33C0                    xor eax, eax
:0043BAFF A0C8FC4600              mov al, byte ptr [0046FCC8]
:0043BB04 8945E8                  mov dword ptr [ebp-18], eax
:0043BB07 33C0                    xor eax, eax
:0043BB09 A0C9FC4600              mov al, byte ptr [0046FCC9]
:0043BB0E 8945E0                  mov dword ptr [ebp-20], eax
:0043BB11 8B45E8                  mov eax, dword ptr [ebp-18]
:0043BB14 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043BB17 C1E002                  shl eax, 02
:0043BB1A 8945F8                  mov dword ptr [ebp-08], eax
:0043BB1D 8B45E0                  mov eax, dword ptr [ebp-20]
:0043BB20 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043BB23 C1E002                  shl eax, 02
:0043BB26 8945F0                  mov dword ptr [ebp-10], eax
:0043BB29 B880020000              mov eax, 00000280
:0043BB2E 2B45F8                  sub eax, dword ptr [ebp-08]
:0043BB31 C1E801                  shr eax, 01
:0043BB34 8945FC                  mov dword ptr [ebp-04], eax
:0043BB37 B890010000              mov eax, 00000190
:0043BB3C 2B45F0                  sub eax, dword ptr [ebp-10]
:0043BB3F C1E801                  shr eax, 01
:0043BB42 83C028                  add eax, 00000028
:0043BB45 8945F4                  mov dword ptr [ebp-0C], eax
:0043BB48 8B45F8                  mov eax, dword ptr [ebp-08]
:0043BB4B 83C020                  add eax, 00000020
:0043BB4E 83E0F0                  and eax, FFFFFFF0
:0043BB51 8BC8                    mov ecx, eax
:0043BB53 03C0                    add eax, eax
:0043BB55 2BC1                    sub eax, ecx
:0043BB57 8945EC                  mov dword ptr [ebp-14], eax
:0043BB5A 8B45F0                  mov eax, dword ptr [ebp-10]
:0043BB5D 83C030                  add eax, 00000030
:0043BB60 50                      push eax
:0043BB61 8B45EC                  mov eax, dword ptr [ebp-14]
:0043BB64 50                      push eax
:0043BB65 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043BB68 83E828                  sub eax, 00000028
:0043BB6B 50                      push eax
:0043BB6C 8B45FC                  mov eax, dword ptr [ebp-04]
:0043BB6F 83E810                  sub eax, 00000010
:0043BB72 50                      push eax
:0043BB73 E81AE9FFFF              call 0043A492
:0043BB78 83C410                  add esp, 00000010
:0043BB7B 8B45EC                  mov eax, dword ptr [ebp-14]
:0043BB7E 2B45F8                  sub eax, dword ptr [ebp-08]
:0043BB81 C1E801                  shr eax, 01
:0043BB84 83E810                  sub eax, 00000010
:0043BB87 0145FC                  add dword ptr [ebp-04], eax
:0043BB8A 8B45FC                  mov eax, dword ptr [ebp-04]
:0043BB8D 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0043BB90 894135                  mov dword ptr [ecx+35], eax
:0043BB93 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043BB96 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0043BB99 894139                  mov dword ptr [ecx+39], eax
:0043BB9C 6A17                    push 00000017
:0043BB9E 6A01                    push 00000001
:0043BBA0 8B45F0                  mov eax, dword ptr [ebp-10]
:0043BBA3 83C002                  add eax, 00000002
:0043BBA6 50                      push eax
:0043BBA7 8B45F8                  mov eax, dword ptr [ebp-08]
:0043BBAA 83C002                  add eax, 00000002
:0043BBAD 50                      push eax
:0043BBAE 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043BBB1 48                      dec eax
:0043BBB2 50                      push eax
:0043BBB3 8B45FC                  mov eax, dword ptr [ebp-04]
:0043BBB6 48                      dec eax
:0043BBB7 50                      push eax
:0043BBB8 E8BAB4FEFF              call 00427077
:0043BBBD 83C418                  add esp, 00000018
:0043BBC0 6A04                    push 00000004
:0043BBC2 B910BC4600              mov ecx, 0046BC10
:0043BBC7 E8B542FEFF              call 0041FE81
:0043BBCC 6A07                    push 00000007
:0043BBCE B910BC4600              mov ecx, 0046BC10
:0043BBD3 E85A42FEFF              call 0041FE32
:0043BBD8 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043BBDB 83E81C                  sub eax, 0000001C
:0043BBDE 50                      push eax
:0043BBDF 6A24                    push 00000024
:0043BBE1 B910BC4600              mov ecx, 0046BC10
:0043BBE6 E81C40FEFF              call 0041FC07

* Possible StringData Ref from Data Obj ->"սС"
                                  |
:0043BBEB 68F8334500              push 004533F8
:0043BBF0 6810BC4600              push 0046BC10
:0043BBF5 E8294FFEFF              call 00420B23
:0043BBFA 83C408                  add esp, 00000008
:0043BBFD 8B45E0                  mov eax, dword ptr [ebp-20]
:0043BC00 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043BC03 50                      push eax
:0043BC04 8B45E8                  mov eax, dword ptr [ebp-18]
:0043BC07 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043BC0A 50                      push eax
:0043BC0B 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043BC0E 50                      push eax
:0043BC0F 8B45FC                  mov eax, dword ptr [ebp-04]
:0043BC12 50                      push eax
:0043BC13 B998FC4600              mov ecx, 0046FC98
:0043BC18 E8D7460000              call 004402F4
:0043BC1D 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0043BC20 E8EDFDFFFF              call 0043BA12
:0043BC25 8B45CC                  mov eax, dword ptr [ebp-34]
:0043BC28 8B4010                  mov eax, dword ptr [eax+10]
:0043BC2B C1E002                  shl eax, 02
:0043BC2E 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0043BC31 034135                  add eax, dword ptr [ecx+35]
:0043BC34 8945E4                  mov dword ptr [ebp-1C], eax
:0043BC37 8B45CC                  mov eax, dword ptr [ebp-34]
:0043BC3A 8B4014                  mov eax, dword ptr [eax+14]
:0043BC3D C1E002                  shl eax, 02
:0043BC40 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0043BC43 034139                  add eax, dword ptr [ecx+39]
:0043BC46 8945DC                  mov dword ptr [ebp-24], eax

* Possible Reference to Dialog: DialogID_009C 
                                  |
:0043BC49 C745D49C000000          mov [ebp-2C], 0000009C
:0043BC50 C745D060000000          mov [ebp-30], 00000060
:0043BC57 6A0F                    push 0000000F
:0043BC59 6A01                    push 00000001
:0043BC5B 8B45D0                  mov eax, dword ptr [ebp-30]
:0043BC5E 50                      push eax
:0043BC5F 8B45D4                  mov eax, dword ptr [ebp-2C]
:0043BC62 50                      push eax
:0043BC63 8B45DC                  mov eax, dword ptr [ebp-24]
:0043BC66 50                      push eax
:0043BC67 8B45E4                  mov eax, dword ptr [ebp-1C]
:0043BC6A 50                      push eax
:0043BC6B E807B4FEFF              call 00427077
:0043BC70 83C418                  add esp, 00000018
:0043BC73 6A0F                    push 0000000F
:0043BC75 6A01                    push 00000001
:0043BC77 8B45D0                  mov eax, dword ptr [ebp-30]
:0043BC7A 83E802                  sub eax, 00000002
:0043BC7D 50                      push eax
:0043BC7E 8B45D4                  mov eax, dword ptr [ebp-2C]
:0043BC81 83E802                  sub eax, 00000002
:0043BC84 50                      push eax
:0043BC85 8B45DC                  mov eax, dword ptr [ebp-24]
:0043BC88 40                      inc eax
:0043BC89 50                      push eax
:0043BC8A 8B45E4                  mov eax, dword ptr [ebp-1C]
:0043BC8D 40                      inc eax
:0043BC8E 50                      push eax
:0043BC8F E8E3B3FEFF              call 00427077
:0043BC94 83C418                  add esp, 00000018
:0043BC97 B968F94600              mov ecx, 0046F968
:0043BC9C E83FD4FCFF              call 004090E0
:0043BCA1 50                      push eax
:0043BCA2 6A60                    push 00000060

* Possible Reference to Dialog: DialogID_009C 
                                  |
:0043BCA4 689C000000              push 0000009C
:0043BCA9 8B45CC                  mov eax, dword ptr [ebp-34]
:0043BCAC 8B4039                  mov eax, dword ptr [eax+39]
:0043BCAF 8B0D00334500            mov ecx, dword ptr [00453300]
:0043BCB5 8D0488                  lea eax, dword ptr [eax+4*ecx]
:0043BCB8 50                      push eax
:0043BCB9 8B45CC                  mov eax, dword ptr [ebp-34]
:0043BCBC 8B4035                  mov eax, dword ptr [eax+35]
:0043BCBF 8B0DFC324500            mov ecx, dword ptr [004532FC]
:0043BCC5 8D0488                  lea eax, dword ptr [eax+4*ecx]
:0043BCC8 50                      push eax
:0043BCC9 E85D160000              call 0043D32B
:0043BCCE 83C414                  add esp, 00000014
:0043BCD1 E8E1B2FEFF              call 00426FB7
:0043BCD6 6A00                    push 00000000
:0043BCD8 E8ABA1FEFF              call 00425E88
:0043BCDD 83C404                  add esp, 00000004
:0043BCE0 C745D800000000          mov [ebp-28], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043BD3C(U)
|
:0043BCE7 B988534500              mov ecx, 00455388
:0043BCEC E8AB60FCFF              call 00401D9C
:0043BCF1 85C0                    test eax, eax
:0043BCF3 0F8411000000            je 0043BD0A
:0043BCF9 6A01                    push 00000001
:0043BCFB B994A64600              mov ecx, 0046A694
:0043BD00 E81FD3FDFF              call 00419024
:0043BD05 E937000000              jmp 0043BD41

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043BCF3(C)
|
:0043BD0A 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0043BD0D E8CD010000              call 0043BEDF
:0043BD12 B988534500              mov ecx, 00455388
:0043BD17 E86060FCFF              call 00401D7C
:0043BD1C 85C0                    test eax, eax
:0043BD1E 0F8418000000            je 0043BD3C
:0043BD24 C745D801000000          mov [ebp-28], 00000001
:0043BD2B 6A00                    push 00000000
:0043BD2D B994A64600              mov ecx, 0046A694
:0043BD32 E8EDD2FDFF              call 00419024
:0043BD37 E905000000              jmp 0043BD41

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043BD1E(C)
|
:0043BD3C E9A6FFFFFF              jmp 0043BCE7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043BD05(U), :0043BD37(U)
|
:0043BD41 E8E459FCFF              call 0040172A
:0043BD46 6A18                    push 00000018
:0043BD48 6A27                    push 00000027
:0043BD4A 6A00                    push 00000000
:0043BD4C 6A00                    push 00000000
:0043BD4E 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0043BD51 E8D7EDFFFF              call 0043AB2D
:0043BD56 837DD800                cmp dword ptr [ebp-28], 00000000
:0043BD5A 0F8414000000            je 0043BD74
:0043BD60 A190FB4600              mov eax, dword ptr [0046FB90]
:0043BD65 50                      push eax
:0043BD66 A18CFB4600              mov eax, dword ptr [0046FB8C]
:0043BD6B 50                      push eax
:0043BD6C 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0043BD6F E839F3FFFF              call 0043B0AD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043BD5A(C)
|
:0043BD74 C7050033450000000000    mov dword ptr [00453300], 00000000
:0043BD7E A100334500              mov eax, dword ptr [00453300]
:0043BD83 A3FC324500              mov dword ptr [004532FC], eax
:0043BD88 E900000000              jmp 0043BD8D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043BD88(U)
|
:0043BD8D 5F                      pop edi
:0043BD8E 5E                      pop esi
:0043BD8F 5B                      pop ebx
:0043BD90 C9                      leave
:0043BD91 C3                      ret



* Referenced by a CALL at Address:
|:0043BF58   
|
:0043BD92 55                      push ebp
:0043BD93 8BEC                    mov ebp, esp
:0043BD95 83EC0C                  sub esp, 0000000C
:0043BD98 53                      push ebx
:0043BD99 56                      push esi
:0043BD9A 57                      push edi
:0043BD9B 894DF4                  mov dword ptr [ebp-0C], ecx
:0043BD9E 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0043BDA1 E8CA5AFCFF              call 00401870
:0043BDA6 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043BDA9 8B4018                  mov eax, dword ptr [eax+18]
:0043BDAC 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043BDAF 2B4135                  sub eax, dword ptr [ecx+35]
:0043BDB2 99                      cdq
:0043BDB3 83E203                  and edx, 00000003
:0043BDB6 03C2                    add eax, edx
:0043BDB8 C1F802                  sar eax, 02
:0043BDBB B903000000              mov ecx, 00000003
:0043BDC0 99                      cdq
:0043BDC1 F7F9                    idiv ecx
:0043BDC3 8845FC                  mov byte ptr [ebp-04], al
:0043BDC6 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043BDC9 8B401C                  mov eax, dword ptr [eax+1C]
:0043BDCC 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043BDCF 2B4139                  sub eax, dword ptr [ecx+39]
:0043BDD2 99                      cdq
:0043BDD3 83E203                  and edx, 00000003
:0043BDD6 03C2                    add eax, edx
:0043BDD8 C1F802                  sar eax, 02
:0043BDDB B903000000              mov ecx, 00000003
:0043BDE0 99                      cdq
:0043BDE1 F7F9                    idiv ecx
:0043BDE3 8845FD                  mov byte ptr [ebp-03], al
:0043BDE6 8D45FC                  lea eax, dword ptr [ebp-04]
:0043BDE9 50                      push eax
:0043BDEA E84ED7FDFF              call 0041953D
:0043BDEF 83C404                  add esp, 00000004
:0043BDF2 8845F8                  mov byte ptr [ebp-08], al
:0043BDF5 33C0                    xor eax, eax
:0043BDF7 A004334500              mov al, byte ptr [00453304]
:0043BDFC 33C9                    xor ecx, ecx
:0043BDFE 8A4DF8                  mov cl, byte ptr [ebp-08]
:0043BE01 3BC1                    cmp eax, ecx
:0043BE03 0F8419000000            je 0043BE22
:0043BE09 8B45F8                  mov eax, dword ptr [ebp-08]
:0043BE0C 50                      push eax
:0043BE0D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043BE10 E849F0FFFF              call 0043AE5E
:0043BE15 8A45F8                  mov al, byte ptr [ebp-08]
:0043BE18 A204334500              mov byte ptr [00453304], al
:0043BE1D E915000000              jmp 0043BE37

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043BE03(C)
|
:0043BE22 33C0                    xor eax, eax
:0043BE24 8A45F8                  mov al, byte ptr [ebp-08]
:0043BE27 3DFF000000              cmp eax, 000000FF
:0043BE2C 0F8505000000            jne 0043BE37
:0043BE32 E8F358FCFF              call 0040172A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043BE1D(U), :0043BE2C(C)
|
:0043BE37 33C0                    xor eax, eax
:0043BE39 8A45FC                  mov al, byte ptr [ebp-04]
:0043BE3C 8D4440EE                lea eax, dword ptr [eax+2*eax-12]
:0043BE40 A38CFB4600              mov dword ptr [0046FB8C], eax
:0043BE45 33C0                    xor eax, eax
:0043BE47 8A45FD                  mov al, byte ptr [ebp-03]
:0043BE4A 8D4440F4                lea eax, dword ptr [eax+2*eax-0C]
:0043BE4E A390FB4600              mov dword ptr [0046FB90], eax
:0043BE53 33C0                    xor eax, eax
:0043BE55 8A45FC                  mov al, byte ptr [ebp-04]
:0043BE58 83F806                  cmp eax, 00000006
:0043BE5B 0F8D0A000000            jnl 0043BE6B
:0043BE61 C7058CFB460000000000    mov dword ptr [0046FB8C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043BE5B(C)
|
:0043BE6B 33C0                    xor eax, eax
:0043BE6D A0C8FC4600              mov al, byte ptr [0046FCC8]
:0043BE72 83E807                  sub eax, 00000007
:0043BE75 33C9                    xor ecx, ecx
:0043BE77 8A4DFC                  mov cl, byte ptr [ebp-04]
:0043BE7A 3BC1                    cmp eax, ecx
:0043BE7C 0F8D12000000            jnl 0043BE94
:0043BE82 33C0                    xor eax, eax
:0043BE84 A0C8FC4600              mov al, byte ptr [0046FCC8]
:0043BE89 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043BE8C 83E827                  sub eax, 00000027
:0043BE8F A38CFB4600              mov dword ptr [0046FB8C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043BE7C(C)
|
:0043BE94 33C0                    xor eax, eax
:0043BE96 8A45FD                  mov al, byte ptr [ebp-03]
:0043BE99 83F804                  cmp eax, 00000004
:0043BE9C 0F8D0A000000            jnl 0043BEAC
:0043BEA2 C70590FB460000000000    mov dword ptr [0046FB90], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043BE9C(C)
|
:0043BEAC 33C0                    xor eax, eax
:0043BEAE A0C9FC4600              mov al, byte ptr [0046FCC9]
:0043BEB3 83E804                  sub eax, 00000004
:0043BEB6 33C9                    xor ecx, ecx
:0043BEB8 8A4DFD                  mov cl, byte ptr [ebp-03]
:0043BEBB 3BC1                    cmp eax, ecx
:0043BEBD 0F8D12000000            jnl 0043BED5
:0043BEC3 33C0                    xor eax, eax
:0043BEC5 A0C9FC4600              mov al, byte ptr [0046FCC9]
:0043BECA 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043BECD 83E818                  sub eax, 00000018
:0043BED0 A390FB4600              mov dword ptr [0046FB90], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043BEBD(C)
|
:0043BED5 E900000000              jmp 0043BEDA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043BED5(U)
|
:0043BEDA 5F                      pop edi
:0043BEDB 5E                      pop esi
:0043BEDC 5B                      pop ebx
:0043BEDD C9                      leave
:0043BEDE C3                      ret



* Referenced by a CALL at Address:
|:0043BD0D   
|
:0043BEDF 55                      push ebp
:0043BEE0 8BEC                    mov ebp, esp
:0043BEE2 83EC0C                  sub esp, 0000000C
:0043BEE5 53                      push ebx
:0043BEE6 56                      push esi
:0043BEE7 57                      push edi
:0043BEE8 894DF4                  mov dword ptr [ebp-0C], ecx
:0043BEEB 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043BEEE E8F1E7FFFF              call 0043A6E4
:0043BEF3 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043BEF6 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043BEF9 8B4918                  mov ecx, dword ptr [ecx+18]
:0043BEFC 394835                  cmp dword ptr [eax+35], ecx
:0043BEFF 0F8F5E010000            jg 0043C063
:0043BF05 33C0                    xor eax, eax
:0043BF07 A0C8FC4600              mov al, byte ptr [0046FCC8]
:0043BF0C 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043BF0F C1E002                  shl eax, 02
:0043BF12 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043BF15 034135                  add eax, dword ptr [ecx+35]
:0043BF18 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043BF1B 3B4118                  cmp eax, dword ptr [ecx+18]
:0043BF1E 0F8E3F010000            jle 0043C063
:0043BF24 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043BF27 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043BF2A 8B491C                  mov ecx, dword ptr [ecx+1C]
:0043BF2D 394839                  cmp dword ptr [eax+39], ecx
:0043BF30 0F8F2D010000            jg 0043C063
:0043BF36 33C0                    xor eax, eax
:0043BF38 A0C9FC4600              mov al, byte ptr [0046FCC9]
:0043BF3D 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043BF40 C1E002                  shl eax, 02
:0043BF43 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043BF46 034139                  add eax, dword ptr [ecx+39]
:0043BF49 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043BF4C 3B411C                  cmp eax, dword ptr [ecx+1C]
:0043BF4F 0F8E0E010000            jle 0043C063
:0043BF55 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043BF58 E835FEFFFF              call 0043BD92
:0043BF5D A18CFB4600              mov eax, dword ptr [0046FB8C]
:0043BF62 3905FC324500            cmp dword ptr [004532FC], eax
:0043BF68 0F8511000000            jne 0043BF7F
:0043BF6E A190FB4600              mov eax, dword ptr [0046FB90]
:0043BF73 390500334500            cmp dword ptr [00453300], eax
:0043BF79 0F84E4000000            je 0043C063

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043BF68(C)
|
:0043BF7F E813B0FEFF              call 00426F97
:0043BF84 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043BF87 8B4035                  mov eax, dword ptr [eax+35]
:0043BF8A 8B0DFC324500            mov ecx, dword ptr [004532FC]
:0043BF90 8D0488                  lea eax, dword ptr [eax+4*ecx]
:0043BF93 8945FC                  mov dword ptr [ebp-04], eax
:0043BF96 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043BF99 8B4039                  mov eax, dword ptr [eax+39]
:0043BF9C 8B0D00334500            mov ecx, dword ptr [00453300]
:0043BFA2 8D0488                  lea eax, dword ptr [eax+4*ecx]
:0043BFA5 8945F8                  mov dword ptr [ebp-08], eax
:0043BFA8 6A00                    push 00000000
:0043BFAA B968F94600              mov ecx, 0046F968
:0043BFAF E82CD1FCFF              call 004090E0
:0043BFB4 50                      push eax
:0043BFB5 6A60                    push 00000060

* Possible Reference to Dialog: DialogID_009C 
                                  |
:0043BFB7 689C000000              push 0000009C
:0043BFBC 8B45F8                  mov eax, dword ptr [ebp-08]
:0043BFBF 50                      push eax
:0043BFC0 8B45FC                  mov eax, dword ptr [ebp-04]
:0043BFC3 50                      push eax
:0043BFC4 E8EC120000              call 0043D2B5
:0043BFC9 83C418                  add esp, 00000018
:0043BFCC 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043BFCF 8B4035                  mov eax, dword ptr [eax+35]
:0043BFD2 8B0D8CFB4600            mov ecx, dword ptr [0046FB8C]
:0043BFD8 8D0488                  lea eax, dword ptr [eax+4*ecx]
:0043BFDB 8945FC                  mov dword ptr [ebp-04], eax
:0043BFDE 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043BFE1 8B4039                  mov eax, dword ptr [eax+39]
:0043BFE4 8B0D90FB4600            mov ecx, dword ptr [0046FB90]
:0043BFEA 8D0488                  lea eax, dword ptr [eax+4*ecx]
:0043BFED 8945F8                  mov dword ptr [ebp-08], eax
:0043BFF0 B968F94600              mov ecx, 0046F968
:0043BFF5 E8E6D0FCFF              call 004090E0
:0043BFFA 50                      push eax
:0043BFFB 6A60                    push 00000060

* Possible Reference to Dialog: DialogID_009C 
                                  |
:0043BFFD 689C000000              push 0000009C
:0043C002 8B45F8                  mov eax, dword ptr [ebp-08]
:0043C005 50                      push eax
:0043C006 8B45FC                  mov eax, dword ptr [ebp-04]
:0043C009 50                      push eax
:0043C00A E81C130000              call 0043D32B
:0043C00F 83C414                  add esp, 00000014
:0043C012 6A0E                    push 0000000E
:0043C014 6A01                    push 00000001
:0043C016 6A5F                    push 0000005F

* Possible Reference to Dialog: DialogID_009C 
                                  |
:0043C018 689C000000              push 0000009C
:0043C01D 8B45F8                  mov eax, dword ptr [ebp-08]
:0043C020 50                      push eax
:0043C021 8B45FC                  mov eax, dword ptr [ebp-04]
:0043C024 50                      push eax
:0043C025 E84DB0FEFF              call 00427077
:0043C02A 83C418                  add esp, 00000018
:0043C02D 6A0E                    push 0000000E
:0043C02F 6A01                    push 00000001
:0043C031 6A5D                    push 0000005D
:0043C033 689A000000              push 0000009A
:0043C038 8B45F8                  mov eax, dword ptr [ebp-08]
:0043C03B 40                      inc eax
:0043C03C 50                      push eax
:0043C03D 8B45FC                  mov eax, dword ptr [ebp-04]
:0043C040 40                      inc eax
:0043C041 50                      push eax
:0043C042 E830B0FEFF              call 00427077
:0043C047 83C418                  add esp, 00000018
:0043C04A A18CFB4600              mov eax, dword ptr [0046FB8C]
:0043C04F A3FC324500              mov dword ptr [004532FC], eax
:0043C054 A190FB4600              mov eax, dword ptr [0046FB90]
:0043C059 A300334500              mov dword ptr [00453300], eax
:0043C05E E854AFFEFF              call 00426FB7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043BEFF(C), :0043BF1E(C), :0043BF30(C), :0043BF4F(C), :0043BF79(C)
|
:0043C063 E900000000              jmp 0043C068

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C063(U)
|
:0043C068 5F                      pop edi
:0043C069 5E                      pop esi
:0043C06A 5B                      pop ebx
:0043C06B C9                      leave
:0043C06C C3                      ret



* Referenced by a CALL at Addresses:
|:0043C420   , :0043CA9A   , :0044224F   , :0044226C   
|
:0043C06D 55                      push ebp
:0043C06E 8BEC                    mov ebp, esp
:0043C070 83EC14                  sub esp, 00000014
:0043C073 53                      push ebx
:0043C074 56                      push esi
:0043C075 57                      push edi
:0043C076 894DEC                  mov dword ptr [ebp-14], ecx
:0043C079 33C0                    xor eax, eax
:0043C07B 8A4508                  mov al, byte ptr [ebp+08]
:0043C07E 85C0                    test eax, eax
:0043C080 0F8509000000            jne 0043C08F
:0043C086 C645F800                mov [ebp-08], 00
:0043C08A E904000000              jmp 0043C093

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C080(C)
|
:0043C08F C645F80F                mov [ebp-08], 0F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C08A(U)
|
:0043C093 33C0                    xor eax, eax
:0043C095 8A4508                  mov al, byte ptr [ebp+08]
:0043C098 85C0                    test eax, eax
:0043C09A 0F8509000000            jne 0043C0A9
:0043C0A0 C645FC0F                mov [ebp-04], 0F
:0043C0A4 E904000000              jmp 0043C0AD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C09A(C)
|
:0043C0A9 C645FC2D                mov [ebp-04], 2D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C0A4(U)
|
:0043C0AD 33C0                    xor eax, eax
:0043C0AF 8A45F8                  mov al, byte ptr [ebp-08]
:0043C0B2 8945F0                  mov dword ptr [ebp-10], eax
:0043C0B5 E903000000              jmp 0043C0BD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C0D1(U)
|
:0043C0BA FF45F0                  inc [ebp-10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C0B5(U)
|
:0043C0BD 837DF02D                cmp dword ptr [ebp-10], 0000002D
:0043C0C1 0F830F000000            jnb 0043C0D6
:0043C0C7 8B45F0                  mov eax, dword ptr [ebp-10]
:0043C0CA C680B8FA4600FF          mov byte ptr [eax+0046FAB8], FF
:0043C0D1 E9E4FFFFFF              jmp 0043C0BA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C0C1(C)
|
:0043C0D6 33C0                    xor eax, eax
:0043C0D8 8A45F8                  mov al, byte ptr [ebp-08]
:0043C0DB 05B8FA4600              add eax, 0046FAB8
:0043C0E0 8945F4                  mov dword ptr [ebp-0C], eax
:0043C0E3 33C0                    xor eax, eax
:0043C0E5 8A4508                  mov al, byte ptr [ebp+08]
:0043C0E8 85C0                    test eax, eax
:0043C0EA 0F8573000000            jne 0043C163
:0043C0F0 33C0                    xor eax, eax
:0043C0F2 8A45F8                  mov al, byte ptr [ebp-08]
:0043C0F5 8945F0                  mov dword ptr [ebp-10], eax
:0043C0F8 E903000000              jmp 0043C100

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C15E(U)
|
:0043C0FD FF45F0                  inc [ebp-10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C0F8(U)
|
:0043C100 33C0                    xor eax, eax
:0043C102 8A45FC                  mov al, byte ptr [ebp-04]
:0043C105 3B45F0                  cmp eax, dword ptr [ebp-10]
:0043C108 0F8655000000            jbe 0043C163
:0043C10E 8B45F0                  mov eax, dword ptr [ebp-10]
:0043C111 8BC8                    mov ecx, eax
:0043C113 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043C116 C1E003                  shl eax, 03
:0043C119 2BC1                    sub eax, ecx
:0043C11B 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043C121 E80AD7FCFF              call 00409830
:0043C126 33C9                    xor ecx, ecx
:0043C128 8AC8                    mov cl, al
:0043C12A 83F902                  cmp ecx, 00000002
:0043C12D 0F852B000000            jne 0043C15E
:0043C133 8B45F0                  mov eax, dword ptr [ebp-10]
:0043C136 8BC8                    mov ecx, eax
:0043C138 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043C13B C1E003                  shl eax, 03
:0043C13E 2BC1                    sub eax, ecx
:0043C140 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043C146 E8D5D0FCFF              call 00409220
:0043C14B 85C0                    test eax, eax
:0043C14D 0F840B000000            je 0043C15E
:0043C153 8A45F0                  mov al, byte ptr [ebp-10]
:0043C156 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043C159 8801                    mov byte ptr [ecx], al
:0043C15B FF45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043C12D(C), :0043C14D(C)
|
:0043C15E E99AFFFFFF              jmp 0043C0FD

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043C0EA(C), :0043C108(C)
|
:0043C163 33C0                    xor eax, eax
:0043C165 8A4508                  mov al, byte ptr [ebp+08]
:0043C168 83F801                  cmp eax, 00000001
:0043C16B 0F8573000000            jne 0043C1E4
:0043C171 33C0                    xor eax, eax
:0043C173 8A45F8                  mov al, byte ptr [ebp-08]
:0043C176 8945F0                  mov dword ptr [ebp-10], eax
:0043C179 E903000000              jmp 0043C181

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C1DF(U)
|
:0043C17E FF45F0                  inc [ebp-10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C179(U)
|
:0043C181 33C0                    xor eax, eax
:0043C183 8A45FC                  mov al, byte ptr [ebp-04]
:0043C186 3B45F0                  cmp eax, dword ptr [ebp-10]
:0043C189 0F8655000000            jbe 0043C1E4
:0043C18F 8B45F0                  mov eax, dword ptr [ebp-10]
:0043C192 8BC8                    mov ecx, eax
:0043C194 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043C197 C1E003                  shl eax, 03
:0043C19A 2BC1                    sub eax, ecx
:0043C19C 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043C1A2 E889D6FCFF              call 00409830
:0043C1A7 33C9                    xor ecx, ecx
:0043C1A9 8AC8                    mov cl, al
:0043C1AB 83F902                  cmp ecx, 00000002
:0043C1AE 0F852B000000            jne 0043C1DF
:0043C1B4 8B45F0                  mov eax, dword ptr [ebp-10]
:0043C1B7 8BC8                    mov ecx, eax
:0043C1B9 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043C1BC C1E003                  shl eax, 03
:0043C1BF 2BC1                    sub eax, ecx
:0043C1C1 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043C1C7 E86808FFFF              call 0042CA34
:0043C1CC 85C0                    test eax, eax
:0043C1CE 0F840B000000            je 0043C1DF
:0043C1D4 8A45F0                  mov al, byte ptr [ebp-10]
:0043C1D7 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043C1DA 8801                    mov byte ptr [ecx], al
:0043C1DC FF45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043C1AE(C), :0043C1CE(C)
|
:0043C1DF E99AFFFFFF              jmp 0043C17E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043C16B(C), :0043C189(C)
|
:0043C1E4 33C0                    xor eax, eax
:0043C1E6 8A45F8                  mov al, byte ptr [ebp-08]
:0043C1E9 8945F0                  mov dword ptr [ebp-10], eax
:0043C1EC E903000000              jmp 0043C1F4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C232(U)
|
:0043C1F1 FF45F0                  inc [ebp-10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C1EC(U)
|
:0043C1F4 33C0                    xor eax, eax
:0043C1F6 8A45FC                  mov al, byte ptr [ebp-04]
:0043C1F9 3B45F0                  cmp eax, dword ptr [ebp-10]
:0043C1FC 0F8635000000            jbe 0043C237
:0043C202 8B45F0                  mov eax, dword ptr [ebp-10]
:0043C205 8BC8                    mov ecx, eax
:0043C207 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043C20A C1E003                  shl eax, 03
:0043C20D 2BC1                    sub eax, ecx
:0043C20F 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043C215 E816D6FCFF              call 00409830
:0043C21A 33C9                    xor ecx, ecx
:0043C21C 8AC8                    mov cl, al
:0043C21E 83F903                  cmp ecx, 00000003
:0043C221 0F8C0B000000            jl 0043C232
:0043C227 8A45F0                  mov al, byte ptr [ebp-10]
:0043C22A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043C22D 8801                    mov byte ptr [ecx], al
:0043C22F FF45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C221(C)
|
:0043C232 E9BAFFFFFF              jmp 0043C1F1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C1FC(C)
|
:0043C237 E900000000              jmp 0043C23C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C237(U)
|
:0043C23C 5F                      pop edi
:0043C23D 5E                      pop esi
:0043C23E 5B                      pop ebx
:0043C23F C9                      leave
:0043C240 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0043C5F8   
|
:0043C243 55                      push ebp
:0043C244 8BEC                    mov ebp, esp
:0043C246 83EC10                  sub esp, 00000010
:0043C249 53                      push ebx
:0043C24A 56                      push esi
:0043C24B 57                      push edi
:0043C24C 894DF0                  mov dword ptr [ebp-10], ecx
:0043C24F C645F4FF                mov [ebp-0C], FF
:0043C253 B900FB4600              mov ecx, 0046FB00
:0043C258 E8932B0000              call 0043EDF0
:0043C25D 33C9                    xor ecx, ecx
:0043C25F 8AC8                    mov cl, al
:0043C261 85C9                    test ecx, ecx
:0043C263 0F840C000000            je 0043C275
:0043C269 C745FC0F000000          mov [ebp-04], 0000000F
:0043C270 E907000000              jmp 0043C27C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C263(C)
|
:0043C275 C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C270(U)
|
:0043C27C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043C27F E860E4FFFF              call 0043A6E4
:0043C284 C645F800                mov [ebp-08], 00
:0043C288 E903000000              jmp 0043C290

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C374(U)
|
:0043C28D FE45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C288(U)
|
:0043C290 33C0                    xor eax, eax
:0043C292 8A45F8                  mov al, byte ptr [ebp-08]
:0043C295 83F80A                  cmp eax, 0000000A
:0043C298 0F8DDB000000            jnl 0043C379
:0043C29E 8B45F0                  mov eax, dword ptr [ebp-10]
:0043C2A1 817818D8000000          cmp dword ptr [eax+18], 000000D8
:0043C2A8 0F82C6000000            jb 0043C374
:0043C2AE 8B45F0                  mov eax, dword ptr [ebp-10]
:0043C2B1 81781890010000          cmp dword ptr [eax+18], 00000190
:0043C2B8 0F83B6000000            jnb 0043C374
:0043C2BE 33C0                    xor eax, eax
:0043C2C0 8A45F8                  mov al, byte ptr [ebp-08]
:0043C2C3 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043C2C6 C1E003                  shl eax, 03
:0043C2C9 0588000000              add eax, 00000088
:0043C2CE 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043C2D1 3B411C                  cmp eax, dword ptr [ecx+1C]
:0043C2D4 0F839A000000            jnb 0043C374
:0043C2DA 33C0                    xor eax, eax
:0043C2DC 8A45F8                  mov al, byte ptr [ebp-08]
:0043C2DF 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043C2E2 C1E003                  shl eax, 03
:0043C2E5 0598000000              add eax, 00000098
:0043C2EA 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043C2ED 3B411C                  cmp eax, dword ptr [ecx+1C]
:0043C2F0 0F827E000000            jb 0043C374
:0043C2F6 8B45F0                  mov eax, dword ptr [ebp-10]
:0043C2F9 33C9                    xor ecx, ecx
:0043C2FB 8A483D                  mov cl, byte ptr [eax+3D]
:0043C2FE 33C0                    xor eax, eax
:0043C300 8A45F8                  mov al, byte ptr [ebp-08]
:0043C303 03C8                    add ecx, eax
:0043C305 8B45FC                  mov eax, dword ptr [ebp-04]
:0043C308 8A8401B8FA4600          mov al, byte ptr [ecx+eax+0046FAB8]
:0043C30F 8845F4                  mov byte ptr [ebp-0C], al
:0043C312 33C0                    xor eax, eax
:0043C314 8A45F4                  mov al, byte ptr [ebp-0C]
:0043C317 3DFF000000              cmp eax, 000000FF
:0043C31C 0F8449000000            je 0043C36B
:0043C322 33C0                    xor eax, eax
:0043C324 8A45F4                  mov al, byte ptr [ebp-0C]
:0043C327 8BC8                    mov ecx, eax
:0043C329 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043C32C C1E003                  shl eax, 03
:0043C32F 2BC1                    sub eax, ecx
:0043C331 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043C337 E84A1BFFFF              call 0042DE86
:0043C33C 85C0                    test eax, eax
:0043C33E 0F8427000000            je 0043C36B
:0043C344 33C0                    xor eax, eax
:0043C346 8A45F4                  mov al, byte ptr [ebp-0C]
:0043C349 8BC8                    mov ecx, eax
:0043C34B 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043C34E C1E003                  shl eax, 03
:0043C351 2BC1                    sub eax, ecx
:0043C353 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043C359 E8D2D4FCFF              call 00409830
:0043C35E 33C9                    xor ecx, ecx
:0043C360 8AC8                    mov cl, al
:0043C362 83F902                  cmp ecx, 00000002
:0043C365 0F8404000000            je 0043C36F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043C31C(C), :0043C33E(C)
|
:0043C36B C645F4FF                mov [ebp-0C], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C365(C)
|
:0043C36F E905000000              jmp 0043C379

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043C2A8(C), :0043C2B8(C), :0043C2D4(C), :0043C2F0(C)
|
:0043C374 E914FFFFFF              jmp 0043C28D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043C298(C), :0043C36F(U)
|
:0043C379 33C0                    xor eax, eax
:0043C37B 8A45F4                  mov al, byte ptr [ebp-0C]
:0043C37E 3DFF000000              cmp eax, 000000FF
:0043C383 0F8504000000            jne 0043C38D
:0043C389 C645F8FF                mov [ebp-08], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C383(C)
|
:0043C38D 8A45F8                  mov al, byte ptr [ebp-08]
:0043C390 E900000000              jmp 0043C395

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C390(U)
|
:0043C395 5F                      pop edi
:0043C396 5E                      pop esi
:0043C397 5B                      pop ebx
:0043C398 C9                      leave
:0043C399 C3                      ret



* Referenced by a CALL at Addresses:
|:00442223   , :0044223E   
|
:0043C39A 55                      push ebp
:0043C39B 8BEC                    mov ebp, esp
:0043C39D 83EC3C                  sub esp, 0000003C
:0043C3A0 53                      push ebx
:0043C3A1 56                      push esi
:0043C3A2 57                      push edi
:0043C3A3 894DC4                  mov dword ptr [ebp-3C], ecx
:0043C3A6 33C0                    xor eax, eax
:0043C3A8 A084FB4600              mov al, byte ptr [0046FB84]
:0043C3AD A801                    test al, 01
:0043C3AF 0F8533000000            jne 0043C3E8
:0043C3B5 33C0                    xor eax, eax
:0043C3B7 A084FB4600              mov al, byte ptr [0046FB84]
:0043C3BC 0C01                    or al, 01
:0043C3BE A284FB4600              mov byte ptr [0046FB84], al
:0043C3C3 6A00                    push 00000000
:0043C3C5 6A00                    push 00000000
:0043C3C7 6A00                    push 00000000
:0043C3C9 6A00                    push 00000000
:0043C3CB 6A00                    push 00000000
:0043C3CD 6A00                    push 00000000
:0043C3CF 6A00                    push 00000000
:0043C3D1 B968FB4600              mov ecx, 0046FB68
:0043C3D6 E845F9FCFF              call 0040BD20
:0043C3DB 6868CA4300              push 0043CA68
:0043C3E0 E8FBB80000              call 00447CE0
:0043C3E5 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C3AF(C)
|
:0043C3E8 C645CC00                mov [ebp-34], 00
:0043C3EC C645D400                mov [ebp-2C], 00
:0043C3F0 6A04                    push 00000004
:0043C3F2 B910BC4600              mov ecx, 0046BC10
:0043C3F7 E8853AFEFF              call 0041FE81
:0043C3FC 6A00                    push 00000000
:0043C3FE B910BC4600              mov ecx, 0046BC10
:0043C403 E8C839FEFF              call 0041FDD0
:0043C408 6A07                    push 00000007
:0043C40A B910BC4600              mov ecx, 0046BC10
:0043C40F E8BF38FEFF              call 0041FCD3
:0043C414 8B45C4                  mov eax, dword ptr [ebp-3C]
:0043C417 8A402C                  mov al, byte ptr [eax+2C]
:0043C41A 50                      push eax
:0043C41B B900FB4600              mov ecx, 0046FB00
:0043C420 E848FCFFFF              call 0043C06D
:0043C425 8B45C4                  mov eax, dword ptr [ebp-3C]
:0043C428 33C9                    xor ecx, ecx
:0043C42A 8A482C                  mov cl, byte ptr [eax+2C]
:0043C42D 85C9                    test ecx, ecx
:0043C42F 0F8509000000            jne 0043C43E
:0043C435 C645D000                mov [ebp-30], 00
:0043C439 E904000000              jmp 0043C442

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C42F(C)
|
:0043C43E C645D00F                mov [ebp-30], 0F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C439(U)
|
:0043C442 8B45C4                  mov eax, dword ptr [ebp-3C]
:0043C445 33C9                    xor ecx, ecx
:0043C447 8A482C                  mov cl, byte ptr [eax+2C]
:0043C44A 85C9                    test ecx, ecx
:0043C44C 0F8509000000            jne 0043C45B
:0043C452 C645E80F                mov [ebp-18], 0F
:0043C456 E904000000              jmp 0043C45F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C44C(C)
|
:0043C45B C645E81E                mov [ebp-18], 1E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C456(U)
|
:0043C45F C645F000                mov [ebp-10], 00
:0043C463 E906000000              jmp 0043C46E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C4A4(U)
|
:0043C468 FE45F0                  inc [ebp-10]
:0043C46B FE45CC                  inc [ebp-34]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C463(U)
|
:0043C46E 33C0                    xor eax, eax
:0043C470 8A45F0                  mov al, byte ptr [ebp-10]
:0043C473 33C9                    xor ecx, ecx
:0043C475 8A4DE8                  mov cl, byte ptr [ebp-18]
:0043C478 3BC1                    cmp eax, ecx
:0043C47A 0F8D29000000            jnl 0043C4A9
:0043C480 33C0                    xor eax, eax
:0043C482 8A45F0                  mov al, byte ptr [ebp-10]
:0043C485 33C9                    xor ecx, ecx
:0043C487 8A4DD0                  mov cl, byte ptr [ebp-30]
:0043C48A 33D2                    xor edx, edx
:0043C48C 8A9408B8FA4600          mov dl, byte ptr [eax+ecx+0046FAB8]
:0043C493 81FAFF000000            cmp edx, 000000FF
:0043C499 0F8505000000            jne 0043C4A4
:0043C49F E905000000              jmp 0043C4A9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C499(C)
|
:0043C4A4 E9BFFFFFFF              jmp 0043C468

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043C47A(C), :0043C49F(U)
|
:0043C4A9 6A00                    push 00000000
:0043C4AB 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->"ȷ"
                                  |
:0043C4AD 6804344500              push 00453404
:0043C4B2 6A0A                    push 0000000A
:0043C4B4 6A06                    push 00000006
:0043C4B6 6A70                    push 00000070
:0043C4B8 6A2E                    push 0000002E
:0043C4BA B968FB4600              mov ecx, 0046FB68
:0043C4BF E86CF7FCFF              call 0040BC30
:0043C4C4 33C0                    xor eax, eax
:0043C4C6 8A45CC                  mov al, byte ptr [ebp-34]
:0043C4C9 50                      push eax
:0043C4CA 6A0A                    push 0000000A
:0043C4CC 68F0000000              push 000000F0
:0043C4D1 6888000000              push 00000088
:0043C4D6 6A32                    push 00000032
:0043C4D8 B950FB4600              mov ecx, 0046FB50
:0043C4DD E83ED3FFFF              call 00439820
:0043C4E2 C645EC00                mov [ebp-14], 00
:0043C4E6 C745F400000000          mov [ebp-0C], 00000000
:0043C4ED C70508334500FF000000    mov dword ptr [00453308], 000000FF
:0043C4F7 E89BAAFEFF              call 00426F97
:0043C4FC B968F94600              mov ecx, 0046F968
:0043C501 E8DACBFCFF              call 004090E0
:0043C506 50                      push eax
:0043C507 6A18                    push 00000018
:0043C509 68B8000000              push 000000B8
:0043C50E 6884000000              push 00000084
:0043C513 68D8000000              push 000000D8
:0043C518 E80E0E0000              call 0043D32B
:0043C51D 83C414                  add esp, 00000014
:0043C520 6A00                    push 00000000
:0043C522 6A04                    push 00000004
:0043C524 6A00                    push 00000000
:0043C526 6800EF0100              push 0001EF00
:0043C52B B9E8E44600              mov ecx, 0046E4E8
:0043C530 E8EBB10000              call 00447720
:0043C535 50                      push eax
:0043C536 6828010000              push 00000128
:0043C53B 68E0000000              push 000000E0
:0043C540 6A60                    push 00000060
:0043C542 68D0000000              push 000000D0
:0043C547 E8690D0000              call 0043D2B5
:0043C54C 83C418                  add esp, 00000018
:0043C54F B968FB4600              mov ecx, 0046FB68
:0043C554 E82D51FEFF              call 00421686
:0043C559 E859AAFEFF              call 00426FB7
:0043C55E 6A00                    push 00000000
:0043C560 B950FB4600              mov ecx, 0046FB50
:0043C565 E81E4FFEFF              call 00421488

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C70A(U)
|
:0043C56A B968FB4600              mov ecx, 0046FB68
:0043C56F E84653FEFF              call 004218BA
:0043C574 33C9                    xor ecx, ecx
:0043C576 8AC8                    mov cl, al
:0043C578 81F9FF000000            cmp ecx, 000000FF
:0043C57E 0F858B010000            jne 0043C70F
:0043C584 B988534500              mov ecx, 00455388
:0043C589 E8EE57FCFF              call 00401D7C
:0043C58E 85C0                    test eax, eax
:0043C590 0F842D000000            je 0043C5C3
:0043C596 33C0                    xor eax, eax
:0043C598 8A45EC                  mov al, byte ptr [ebp-14]
:0043C59B 3DFF000000              cmp eax, 000000FF
:0043C5A0 0F841D000000            je 0043C5C3
:0043C5A6 E83CAFFFFF              call 004374E7
:0043C5AB C745F401000000          mov [ebp-0C], 00000001
:0043C5B2 6A00                    push 00000000
:0043C5B4 B994A64600              mov ecx, 0046A694
:0043C5B9 E866CAFDFF              call 00419024
:0043C5BE E94C010000              jmp 0043C70F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043C590(C), :0043C5A0(C)
|
:0043C5C3 B988534500              mov ecx, 00455388
:0043C5C8 E8CF57FCFF              call 00401D9C
:0043C5CD 85C0                    test eax, eax
:0043C5CF 0F8416000000            je 0043C5EB
:0043C5D5 E80DAFFFFF              call 004374E7
:0043C5DA 6A01                    push 00000001
:0043C5DC B994A64600              mov ecx, 0046A694
:0043C5E1 E83ECAFDFF              call 00419024
:0043C5E6 E924010000              jmp 0043C70F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C5CF(C)
|
:0043C5EB 6A00                    push 00000000
:0043C5ED E89698FEFF              call 00425E88
:0043C5F2 83C404                  add esp, 00000004
:0043C5F5 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:0043C5F8 E846FCFFFF              call 0043C243
:0043C5FD 8845EC                  mov byte ptr [ebp-14], al
:0043C600 E892A9FEFF              call 00426F97
:0043C605 8B45EC                  mov eax, dword ptr [ebp-14]
:0043C608 50                      push eax
:0043C609 E8A7010000              call 0043C7B5
:0043C60E 83C404                  add esp, 00000004
:0043C611 C645F81B                mov [ebp-08], 1B
:0043C615 C645F000                mov [ebp-10], 00
:0043C619 E903000000              jmp 0043C621

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C688(U)
|
:0043C61E FE45F0                  inc [ebp-10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C619(U)
|
:0043C621 33C0                    xor eax, eax
:0043C623 8A45F0                  mov al, byte ptr [ebp-10]
:0043C626 83F80A                  cmp eax, 0000000A
:0043C629 0F8D5E000000            jnl 0043C68D
:0043C62F 8B45C4                  mov eax, dword ptr [ebp-3C]
:0043C632 33C9                    xor ecx, ecx
:0043C634 8A482C                  mov cl, byte ptr [eax+2C]
:0043C637 85C9                    test ecx, ecx
:0043C639 0F851C000000            jne 0043C65B
:0043C63F 8B45F0                  mov eax, dword ptr [ebp-10]
:0043C642 50                      push eax
:0043C643 8B45C4                  mov eax, dword ptr [ebp-3C]
:0043C646 8A403D                  mov al, byte ptr [eax+3D]
:0043C649 50                      push eax
:0043C64A 8B45F8                  mov eax, dword ptr [ebp-08]
:0043C64D 50                      push eax
:0043C64E E8CC020000              call 0043C91F
:0043C653 83C40C                  add esp, 0000000C
:0043C656 E92D000000              jmp 0043C688

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C639(C)
|
:0043C65B 8B45C4                  mov eax, dword ptr [ebp-3C]
:0043C65E 33C9                    xor ecx, ecx
:0043C660 8A482C                  mov cl, byte ptr [eax+2C]
:0043C663 83F901                  cmp ecx, 00000001
:0043C666 0F851C000000            jne 0043C688
:0043C66C 8B45F0                  mov eax, dword ptr [ebp-10]
:0043C66F 50                      push eax
:0043C670 8B45C4                  mov eax, dword ptr [ebp-3C]
:0043C673 33C9                    xor ecx, ecx
:0043C675 8A483D                  mov cl, byte ptr [eax+3D]
:0043C678 83C10F                  add ecx, 0000000F
:0043C67B 51                      push ecx
:0043C67C 8B45F8                  mov eax, dword ptr [ebp-08]
:0043C67F 50                      push eax
:0043C680 E89A020000              call 0043C91F
:0043C685 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043C656(U), :0043C666(C)
|
:0043C688 E991FFFFFF              jmp 0043C61E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C629(C)
|
:0043C68D 33C0                    xor eax, eax
:0043C68F 8A45CC                  mov al, byte ptr [ebp-34]
:0043C692 83F80A                  cmp eax, 0000000A
:0043C695 0F8E6A000000            jle 0043C705
:0043C69B B950FB4600              mov ecx, 0046FB50
:0043C6A0 E8F449FEFF              call 00421099
:0043C6A5 B950FB4600              mov ecx, 0046FB50
:0043C6AA E8264AFEFF              call 004210D5
:0043C6AF 8945FC                  mov dword ptr [ebp-04], eax
:0043C6B2 8B45C4                  mov eax, dword ptr [ebp-3C]
:0043C6B5 33C9                    xor ecx, ecx
:0043C6B7 8A483D                  mov cl, byte ptr [eax+3D]
:0043C6BA 3B4DFC                  cmp ecx, dword ptr [ebp-04]
:0043C6BD 0F8442000000            je 0043C705
:0043C6C3 8A45FC                  mov al, byte ptr [ebp-04]
:0043C6C6 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:0043C6C9 88413D                  mov byte ptr [ecx+3D], al
:0043C6CC 6A00                    push 00000000
:0043C6CE 6A04                    push 00000004
:0043C6D0 6A00                    push 00000000
:0043C6D2 6800EF0100              push 0001EF00
:0043C6D7 B9E8E44600              mov ecx, 0046E4E8
:0043C6DC E83FB00000              call 00447720
:0043C6E1 50                      push eax
:0043C6E2 6828010000              push 00000128
:0043C6E7 68E0000000              push 000000E0
:0043C6EC 6A60                    push 00000060
:0043C6EE 68D0000000              push 000000D0
:0043C6F3 E8BD0B0000              call 0043D2B5
:0043C6F8 83C418                  add esp, 00000018
:0043C6FB B968FB4600              mov ecx, 0046FB68
:0043C700 E8814FFEFF              call 00421686

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043C695(C), :0043C6BD(C)
|
:0043C705 E8ADA8FEFF              call 00426FB7
:0043C70A E95BFEFFFF              jmp 0043C56A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043C57E(C), :0043C5BE(U), :0043C5E6(U)
|
:0043C70F 6A18                    push 00000018
:0043C711 6A27                    push 00000027
:0043C713 6A00                    push 00000000
:0043C715 6A00                    push 00000000
:0043C717 B900FB4600              mov ecx, 0046FB00
:0043C71C E80CE4FFFF              call 0043AB2D
:0043C721 837DF400                cmp dword ptr [ebp-0C], 00000000
:0043C725 0F8479000000            je 0043C7A4
:0043C72B 8B45C4                  mov eax, dword ptr [ebp-3C]
:0043C72E 33C9                    xor ecx, ecx
:0043C730 8A482C                  mov cl, byte ptr [eax+2C]
:0043C733 8D0449                  lea eax, dword ptr [ecx+2*ecx]
:0043C736 8D0480                  lea eax, dword ptr [eax+4*eax]
:0043C739 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:0043C73C 33D2                    xor edx, edx
:0043C73E 8A513D                  mov dl, byte ptr [ecx+3D]
:0043C741 03C2                    add eax, edx
:0043C743 33C9                    xor ecx, ecx
:0043C745 8A4DEC                  mov cl, byte ptr [ebp-14]
:0043C748 03C1                    add eax, ecx
:0043C74A 8845C8                  mov byte ptr [ebp-38], al
:0043C74D 33C0                    xor eax, eax
:0043C74F 8A45C8                  mov al, byte ptr [ebp-38]
:0043C752 8A80B8FA4600            mov al, byte ptr [eax+0046FAB8]
:0043C758 50                      push eax
:0043C759 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:0043C75C E8501D0000              call 0043E4B1
:0043C761 6A03                    push 00000003
:0043C763 E853AEFFFF              call 004375BB
:0043C768 83C404                  add esp, 00000004
:0043C76B E83EACFFFF              call 004373AE
:0043C770 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:0043C773 E80EDFFFFF              call 0043A686
:0043C778 C705BEFC460000000000    mov dword ptr [0046FCBE], 00000000
:0043C782 33C0                    xor eax, eax
:0043C784 8A45C8                  mov al, byte ptr [ebp-38]
:0043C787 33C9                    xor ecx, ecx
:0043C789 8A88B8FA4600            mov cl, byte ptr [eax+0046FAB8]
:0043C78F 8BC1                    mov eax, ecx
:0043C791 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:0043C794 C1E103                  shl ecx, 03
:0043C797 2BC8                    sub ecx, eax
:0043C799 8D8998C04600            lea ecx, dword ptr [ecx+0046C098]
:0043C79F E81BF7FEFF              call 0042BEBF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C725(C)
|
:0043C7A4 8B45C4                  mov eax, dword ptr [ebp-3C]
:0043C7A7 C6403D00                mov [eax+3D], 00
:0043C7AB E900000000              jmp 0043C7B0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C7AB(U)
|
:0043C7B0 5F                      pop edi
:0043C7B1 5E                      pop esi
:0043C7B2 5B                      pop ebx
:0043C7B3 C9                      leave
:0043C7B4 C3                      ret



* Referenced by a CALL at Address:
|:0043C609   
|
:0043C7B5 55                      push ebp
:0043C7B6 8BEC                    mov ebp, esp
:0043C7B8 83EC08                  sub esp, 00000008
:0043C7BB 53                      push ebx
:0043C7BC 56                      push esi
:0043C7BD 57                      push edi
:0043C7BE 33C0                    xor eax, eax
:0043C7C0 8A4508                  mov al, byte ptr [ebp+08]
:0043C7C3 3B0508334500            cmp eax, dword ptr [00453308]
:0043C7C9 0F84D4000000            je 0043C8A3
:0043C7CF 33C0                    xor eax, eax
:0043C7D1 8A4508                  mov al, byte ptr [ebp+08]
:0043C7D4 3DFF000000              cmp eax, 000000FF
:0043C7D9 0F84C4000000            je 0043C8A3
:0043C7DF E8B3A7FEFF              call 00426F97
:0043C7E4 C745FCD8000000          mov [ebp-04], 000000D8
:0043C7EB A108334500              mov eax, dword ptr [00453308]
:0043C7F0 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043C7F3 C1E003                  shl eax, 03
:0043C7F6 0584000000              add eax, 00000084
:0043C7FB 8945F8                  mov dword ptr [ebp-08], eax
:0043C7FE 6A00                    push 00000000
:0043C800 B968F94600              mov ecx, 0046F968
:0043C805 E8D6C8FCFF              call 004090E0
:0043C80A 50                      push eax
:0043C80B 6A18                    push 00000018
:0043C80D 68B8000000              push 000000B8
:0043C812 8B45F8                  mov eax, dword ptr [ebp-08]
:0043C815 50                      push eax
:0043C816 8B45FC                  mov eax, dword ptr [ebp-04]
:0043C819 50                      push eax
:0043C81A E8960A0000              call 0043D2B5
:0043C81F 83C418                  add esp, 00000018
:0043C822 33C0                    xor eax, eax
:0043C824 8A4508                  mov al, byte ptr [ebp+08]
:0043C827 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043C82A C1E003                  shl eax, 03
:0043C82D 0584000000              add eax, 00000084
:0043C832 8945F8                  mov dword ptr [ebp-08], eax
:0043C835 B968F94600              mov ecx, 0046F968
:0043C83A E8A1C8FCFF              call 004090E0
:0043C83F 50                      push eax
:0043C840 6A18                    push 00000018
:0043C842 68B8000000              push 000000B8
:0043C847 8B45F8                  mov eax, dword ptr [ebp-08]
:0043C84A 50                      push eax
:0043C84B 8B45FC                  mov eax, dword ptr [ebp-04]
:0043C84E 50                      push eax
:0043C84F E8D70A0000              call 0043D32B
:0043C854 83C414                  add esp, 00000014
:0043C857 6A0C                    push 0000000C
:0043C859 6A01                    push 00000001
:0043C85B 6A18                    push 00000018
:0043C85D 68B8000000              push 000000B8
:0043C862 8B45F8                  mov eax, dword ptr [ebp-08]
:0043C865 50                      push eax
:0043C866 8B45FC                  mov eax, dword ptr [ebp-04]
:0043C869 50                      push eax
:0043C86A E808A8FEFF              call 00427077
:0043C86F 83C418                  add esp, 00000018
:0043C872 6A0C                    push 0000000C
:0043C874 6A01                    push 00000001
:0043C876 6A16                    push 00000016
:0043C878 68B6000000              push 000000B6
:0043C87D 8B45F8                  mov eax, dword ptr [ebp-08]
:0043C880 40                      inc eax
:0043C881 50                      push eax
:0043C882 8B45FC                  mov eax, dword ptr [ebp-04]
:0043C885 40                      inc eax
:0043C886 50                      push eax
:0043C887 E8EBA7FEFF              call 00427077
:0043C88C 83C418                  add esp, 00000018
:0043C88F 33C0                    xor eax, eax
:0043C891 8A4508                  mov al, byte ptr [ebp+08]
:0043C894 A308334500              mov dword ptr [00453308], eax
:0043C899 E819A7FEFF              call 00426FB7
:0043C89E E972000000              jmp 0043C915

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043C7C9(C), :0043C7D9(C)
|
:0043C8A3 33C0                    xor eax, eax
:0043C8A5 8A4508                  mov al, byte ptr [ebp+08]
:0043C8A8 3DFF000000              cmp eax, 000000FF
:0043C8AD 0F8562000000            jne 0043C915
:0043C8B3 813D08334500FF000000    cmp dword ptr [00453308], 000000FF
:0043C8BD 0F8452000000            je 0043C915
:0043C8C3 E8CFA6FEFF              call 00426F97
:0043C8C8 C745FCD8000000          mov [ebp-04], 000000D8
:0043C8CF A108334500              mov eax, dword ptr [00453308]
:0043C8D4 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043C8D7 C1E003                  shl eax, 03
:0043C8DA 0584000000              add eax, 00000084
:0043C8DF 8945F8                  mov dword ptr [ebp-08], eax
:0043C8E2 6A00                    push 00000000
:0043C8E4 B968F94600              mov ecx, 0046F968
:0043C8E9 E8F2C7FCFF              call 004090E0
:0043C8EE 50                      push eax
:0043C8EF 6A18                    push 00000018
:0043C8F1 68B8000000              push 000000B8
:0043C8F6 8B45F8                  mov eax, dword ptr [ebp-08]
:0043C8F9 50                      push eax
:0043C8FA 8B45FC                  mov eax, dword ptr [ebp-04]
:0043C8FD 50                      push eax
:0043C8FE E8B2090000              call 0043D2B5
:0043C903 83C418                  add esp, 00000018
:0043C906 C70508334500FF000000    mov dword ptr [00453308], 000000FF
:0043C910 E8A2A6FEFF              call 00426FB7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043C89E(U), :0043C8AD(C), :0043C8BD(C)
|
:0043C915 E900000000              jmp 0043C91A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C915(U)
|
:0043C91A 5F                      pop edi
:0043C91B 5E                      pop esi
:0043C91C 5B                      pop ebx
:0043C91D C9                      leave
:0043C91E C3                      ret



* Referenced by a CALL at Addresses:
|:0043C64E   , :0043C680   
|
:0043C91F 55                      push ebp
:0043C920 8BEC                    mov ebp, esp
:0043C922 83EC0C                  sub esp, 0000000C
:0043C925 53                      push ebx
:0043C926 56                      push esi
:0043C927 57                      push edi
:0043C928 33C0                    xor eax, eax
:0043C92A 8A4510                  mov al, byte ptr [ebp+10]
:0043C92D 33C9                    xor ecx, ecx
:0043C92F 8A4D0C                  mov cl, byte ptr [ebp+0C]
:0043C932 33D2                    xor edx, edx
:0043C934 8A9408B8FA4600          mov dl, byte ptr [eax+ecx+0046FAB8]
:0043C93B 81FAFF000000            cmp edx, 000000FF
:0043C941 0F8417010000            je 0043CA5E
:0043C947 E84BA6FEFF              call 00426F97
:0043C94C 33C0                    xor eax, eax
:0043C94E 8A4510                  mov al, byte ptr [ebp+10]
:0043C951 33C9                    xor ecx, ecx
:0043C953 8A4D0C                  mov cl, byte ptr [ebp+0C]
:0043C956 33D2                    xor edx, edx
:0043C958 8A9408B8FA4600          mov dl, byte ptr [eax+ecx+0046FAB8]
:0043C95F 8BC2                    mov eax, edx
:0043C961 8D0C52                  lea ecx, dword ptr [edx+2*edx]
:0043C964 C1E103                  shl ecx, 03
:0043C967 2BC8                    sub ecx, eax
:0043C969 81C198C04600            add ecx, 0046C098
:0043C96F 894DF4                  mov dword ptr [ebp-0C], ecx
:0043C972 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043C975 E8B6C7FCFF              call 00409130
:0043C97A 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043C97D 03C0                    add eax, eax
:0043C97F 8D04C0                  lea eax, dword ptr [eax+8*eax]
:0043C982 05E8564500              add eax, 004556E8
:0043C987 8945FC                  mov dword ptr [ebp-04], eax
:0043C98A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043C98D E89ECEFCFF              call 00409830
:0043C992 8845F8                  mov byte ptr [ebp-08], al
:0043C995 33C0                    xor eax, eax
:0043C997 8A4510                  mov al, byte ptr [ebp+10]
:0043C99A 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043C99D C1E003                  shl eax, 03
:0043C9A0 058A000000              add eax, 0000008A
:0043C9A5 50                      push eax
:0043C9A6 33C0                    xor eax, eax
:0043C9A8 8A4508                  mov al, byte ptr [ebp+08]
:0043C9AB 40                      inc eax
:0043C9AC 50                      push eax
:0043C9AD B910BC4600              mov ecx, 0046BC10
:0043C9B2 E85032FEFF              call 0041FC07
:0043C9B7 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043C9BA E83A02FFFF              call 0042CBF9
:0043C9BF 33C0                    xor eax, eax
:0043C9C1 8A4510                  mov al, byte ptr [ebp+10]
:0043C9C4 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043C9C7 C1E003                  shl eax, 03
:0043C9CA 058A000000              add eax, 0000008A
:0043C9CF 50                      push eax
:0043C9D0 33C0                    xor eax, eax
:0043C9D2 8A4508                  mov al, byte ptr [ebp+08]
:0043C9D5 83C009                  add eax, 00000009
:0043C9D8 50                      push eax
:0043C9D9 B910BC4600              mov ecx, 0046BC10
:0043C9DE E82432FEFF              call 0041FC07
:0043C9E3 33C0                    xor eax, eax
:0043C9E5 8A45F8                  mov al, byte ptr [ebp-08]
:0043C9E8 83F802                  cmp eax, 00000002
:0043C9EB 0F8423000000            je 0043CA14
:0043C9F1 6A17                    push 00000017
:0043C9F3 B910BC4600              mov ecx, 0046BC10
:0043C9F8 E8D632FEFF              call 0041FCD3

* Possible StringData Ref from Data Obj ->"-ս-"
                                  |
:0043C9FD 680C344500              push 0045340C
:0043CA02 6810BC4600              push 0046BC10
:0043CA07 E81741FEFF              call 00420B23
:0043CA0C 83C408                  add esp, 00000008
:0043CA0F E945000000              jmp 0043CA59

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C9EB(C)
|
:0043CA14 33C0                    xor eax, eax
:0043CA16 8A45F8                  mov al, byte ptr [ebp-08]
:0043CA19 83F801                  cmp eax, 00000001
:0043CA1C 0F8437000000            je 0043CA59
:0043CA22 6A70                    push 00000070
:0043CA24 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043CA27 E884CDFCFF              call 004097B0
:0043CA2C 50                      push eax
:0043CA2D 8B45FC                  mov eax, dword ptr [ebp-04]
:0043CA30 50                      push eax
:0043CA31 33C0                    xor eax, eax
:0043CA33 8A4510                  mov al, byte ptr [ebp+10]
:0043CA36 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043CA39 C1E003                  shl eax, 03
:0043CA3C 0588000000              add eax, 00000088
:0043CA41 50                      push eax
:0043CA42 33C0                    xor eax, eax
:0043CA44 8A4508                  mov al, byte ptr [ebp+08]
:0043CA47 8D04C540000000          lea eax, dword ptr [8*eax+00000040]
:0043CA4E 50                      push eax
:0043CA4F 6A0B                    push 0000000B
:0043CA51 E8D63DFDFF              call 0041082C
:0043CA56 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043CA0F(U), :0043CA1C(C)
|
:0043CA59 E859A5FEFF              call 00426FB7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C941(C)
|
:0043CA5E E900000000              jmp 0043CA63

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043CA5E(U)
|
:0043CA63 5F                      pop edi
:0043CA64 5E                      pop esi
:0043CA65 5B                      pop ebx
:0043CA66 C9                      leave
:0043CA67 C3                      ret


:0043CA68 55                      push ebp
:0043CA69 8BEC                    mov ebp, esp
:0043CA6B 53                      push ebx
:0043CA6C 56                      push esi
:0043CA6D 57                      push edi
:0043CA6E B968FB4600              mov ecx, 0046FB68
:0043CA73 E8F8F1FCFF              call 0040BC70
:0043CA78 E900000000              jmp 0043CA7D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043CA78(U)
|
:0043CA7D 5F                      pop edi
:0043CA7E 5E                      pop esi
:0043CA7F 5B                      pop ebx
:0043CA80 C9                      leave
:0043CA81 C3                      ret


:0043CA82 55                      push ebp
:0043CA83 8BEC                    mov ebp, esp
:0043CA85 83EC14                  sub esp, 00000014
:0043CA88 53                      push ebx
:0043CA89 56                      push esi
:0043CA8A 57                      push edi
:0043CA8B 894DEC                  mov dword ptr [ebp-14], ecx
:0043CA8E 8B45EC                  mov eax, dword ptr [ebp-14]
:0043CA91 8A402C                  mov al, byte ptr [eax+2C]
:0043CA94 50                      push eax
:0043CA95 B900FB4600              mov ecx, 0046FB00
:0043CA9A E8CEF5FFFF              call 0043C06D
:0043CA9F 8B45EC                  mov eax, dword ptr [ebp-14]
:0043CAA2 33C9                    xor ecx, ecx
:0043CAA4 8A482C                  mov cl, byte ptr [eax+2C]
:0043CAA7 85C9                    test ecx, ecx
:0043CAA9 0F8509000000            jne 0043CAB8
:0043CAAF C645F800                mov [ebp-08], 00
:0043CAB3 E904000000              jmp 0043CABC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043CAA9(C)
|
:0043CAB8 C645F80F                mov [ebp-08], 0F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043CAB3(U)
|
:0043CABC 8B45EC                  mov eax, dword ptr [ebp-14]
:0043CABF 33C9                    xor ecx, ecx
:0043CAC1 8A482C                  mov cl, byte ptr [eax+2C]
:0043CAC4 85C9                    test ecx, ecx
:0043CAC6 0F8509000000            jne 0043CAD5
:0043CACC C645FC0F                mov [ebp-04], 0F
:0043CAD0 E904000000              jmp 0043CAD9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043CAC6(C)
|
:0043CAD5 C645FC2D                mov [ebp-04], 2D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043CAD0(U)
|
:0043CAD9 C645F000                mov [ebp-10], 00
:0043CADD 33C0                    xor eax, eax
:0043CADF 8A45F8                  mov al, byte ptr [ebp-08]
:0043CAE2 8945F4                  mov dword ptr [ebp-0C], eax
:0043CAE5 E906000000              jmp 0043CAF0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043CB42(U)
|
:0043CAEA FF45F4                  inc [ebp-0C]
:0043CAED FE45F0                  inc [ebp-10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043CAE5(U)
|
:0043CAF0 33C0                    xor eax, eax
:0043CAF2 8A45FC                  mov al, byte ptr [ebp-04]
:0043CAF5 3B45F4                  cmp eax, dword ptr [ebp-0C]
:0043CAF8 0F8649000000            jbe 0043CB47
:0043CAFE 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043CB01 33C9                    xor ecx, ecx
:0043CB03 8A88B8FA4600            mov cl, byte ptr [eax+0046FAB8]
:0043CB09 81F9FF000000            cmp ecx, 000000FF
:0043CB0F 0F8428000000            je 0043CB3D
:0043CB15 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043CB18 33C9                    xor ecx, ecx
:0043CB1A 8A88B8FA4600            mov cl, byte ptr [eax+0046FAB8]
:0043CB20 8BC1                    mov eax, ecx
:0043CB22 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:0043CB25 C1E103                  shl ecx, 03
:0043CB28 2BC8                    sub ecx, eax
:0043CB2A 8D8998C04600            lea ecx, dword ptr [ecx+0046C098]
:0043CB30 E85113FFFF              call 0042DE86
:0043CB35 85C0                    test eax, eax
:0043CB37 0F8505000000            jne 0043CB42

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043CB0F(C)
|
:0043CB3D E905000000              jmp 0043CB47

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043CB37(C)
|
:0043CB42 E9A3FFFFFF              jmp 0043CAEA

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043CAF8(C), :0043CB3D(U)
|
:0043CB47 33C0                    xor eax, eax
:0043CB49 8A45F0                  mov al, byte ptr [ebp-10]
:0043CB4C E900000000              jmp 0043CB51

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043CB4C(U)
|
:0043CB51 5F                      pop edi
:0043CB52 5E                      pop esi
:0043CB53 5B                      pop ebx
:0043CB54 C9                      leave
:0043CB55 C3                      ret



* Referenced by a CALL at Addresses:
|:0044225B   , :00442278   
|
:0043CB56 55                      push ebp
:0043CB57 8BEC                    mov ebp, esp
:0043CB59 81ECE4010000            sub esp, 000001E4
:0043CB5F 53                      push ebx
:0043CB60 56                      push esi
:0043CB61 57                      push edi
:0043CB62 898D1CFEFFFF            mov dword ptr [ebp+FFFFFE1C], ecx
:0043CB68 C645F400                mov [ebp-0C], 00
:0043CB6C 837D0800                cmp dword ptr [ebp+08], 00000000
:0043CB70 0F8409000000            je 0043CB7F
:0043CB76 C645FC0F                mov [ebp-04], 0F
:0043CB7A E904000000              jmp 0043CB83

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043CB70(C)
|
:0043CB7F C645FC00                mov [ebp-04], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043CB7A(U)
|
:0043CB83 8D852CFEFFFF            lea eax, dword ptr [ebp+FFFFFE2C]
:0043CB89 8945F8                  mov dword ptr [ebp-08], eax
:0043CB8C C785A8FEFFFF00000000    mov dword ptr [ebp+FFFFFEA8], 00000000
:0043CB96 E909000000              jmp 0043CBA4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043CD73(U)
|
:0043CB9B FF85A8FEFFFF            inc dword ptr [ebp+FFFFFEA8]
:0043CBA1 FE45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043CB96(U)
|
:0043CBA4 83BDA8FEFFFF1E          cmp dword ptr [ebp+FFFFFEA8], 0000001E
:0043CBAB 0F83C7010000            jnb 0043CD78
:0043CBB1 33C0                    xor eax, eax
:0043CBB3 8A45FC                  mov al, byte ptr [ebp-04]
:0043CBB6 8B8DA8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEA8]
:0043CBBC 33D2                    xor edx, edx
:0043CBBE 8A9408B8FA4600          mov dl, byte ptr [eax+ecx+0046FAB8]
:0043CBC5 81FAFF000000            cmp edx, 000000FF
:0043CBCB 0F8431000000            je 0043CC02
:0043CBD1 33C0                    xor eax, eax
:0043CBD3 8A45FC                  mov al, byte ptr [ebp-04]
:0043CBD6 8B8DA8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEA8]
:0043CBDC 33D2                    xor edx, edx
:0043CBDE 8A9408B8FA4600          mov dl, byte ptr [eax+ecx+0046FAB8]
:0043CBE5 8BC2                    mov eax, edx
:0043CBE7 8D0C52                  lea ecx, dword ptr [edx+2*edx]
:0043CBEA C1E103                  shl ecx, 03
:0043CBED 2BC8                    sub ecx, eax
:0043CBEF 8D8998C04600            lea ecx, dword ptr [ecx+0046C098]
:0043CBF5 E88C12FFFF              call 0042DE86
:0043CBFA 85C0                    test eax, eax
:0043CBFC 0F8505000000            jne 0043CC07

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043CBCB(C)
|
:0043CC02 E971010000              jmp 0043CD78

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043CBFC(C)
|
:0043CC07 33C0                    xor eax, eax
:0043CC09 8A45FC                  mov al, byte ptr [ebp-04]
:0043CC0C 8B8DA8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEA8]
:0043CC12 33D2                    xor edx, edx
:0043CC14 8A9408B8FA4600          mov dl, byte ptr [eax+ecx+0046FAB8]
:0043CC1B 8BC2                    mov eax, edx
:0043CC1D 8D0C52                  lea ecx, dword ptr [edx+2*edx]
:0043CC20 C1E103                  shl ecx, 03
:0043CC23 2BC8                    sub ecx, eax
:0043CC25 8D8998C04600            lea ecx, dword ptr [ecx+0046C098]
:0043CC2B E800CCFCFF              call 00409830
:0043CC30 33C9                    xor ecx, ecx
:0043CC32 8AC8                    mov cl, al
:0043CC34 83F902                  cmp ecx, 00000002
:0043CC37 0F8536010000            jne 0043CD73
:0043CC3D 33C0                    xor eax, eax
:0043CC3F 8A45FC                  mov al, byte ptr [ebp-04]
:0043CC42 8B8DA8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEA8]
:0043CC48 33D2                    xor edx, edx
:0043CC4A 8A9408B8FA4600          mov dl, byte ptr [eax+ecx+0046FAB8]
:0043CC51 8BC2                    mov eax, edx
:0043CC53 8D0C52                  lea ecx, dword ptr [edx+2*edx]
:0043CC56 C1E103                  shl ecx, 03
:0043CC59 2BC8                    sub ecx, eax
:0043CC5B 8D8998C04600            lea ecx, dword ptr [ecx+0046C098]
:0043CC61 E81AC9FCFF              call 00409580
:0043CC66 50                      push eax
:0043CC67 E83EA70000              call 004473AA
:0043CC6C 83C404                  add esp, 00000004
:0043CC6F 8845F0                  mov byte ptr [ebp-10], al
:0043CC72 8B85A8FEFFFF            mov eax, dword ptr [ebp+FFFFFEA8]
:0043CC78 8D0480                  lea eax, dword ptr [eax+4*eax]
:0043CC7B C68445B8FEFFFF00        mov byte ptr [ebp+2*eax-00000148], 00

* Possible StringData Ref from Data Obj ->" "
                                  |
:0043CC83 6818344500              push 00453418
:0043CC88 8B85A8FEFFFF            mov eax, dword ptr [ebp+FFFFFEA8]
:0043CC8E 8D0480                  lea eax, dword ptr [eax+4*eax]
:0043CC91 8D8445B8FEFFFF          lea eax, dword ptr [ebp+2*eax-00000148]
:0043CC98 50                      push eax
:0043CC99 E82FA70000              call 004473CD
:0043CC9E 83C408                  add esp, 00000008
:0043CCA1 33C0                    xor eax, eax
:0043CCA3 8A45F0                  mov al, byte ptr [ebp-10]
:0043CCA6 83F804                  cmp eax, 00000004
:0043CCA9 0F851E000000            jne 0043CCCD

* Possible StringData Ref from Data Obj ->" "
                                  |
:0043CCAF 681C344500              push 0045341C
:0043CCB4 8B85A8FEFFFF            mov eax, dword ptr [ebp+FFFFFEA8]
:0043CCBA 8D0480                  lea eax, dword ptr [eax+4*eax]
:0043CCBD 8D8445B8FEFFFF          lea eax, dword ptr [ebp+2*eax-00000148]
:0043CCC4 50                      push eax
:0043CCC5 E803A70000              call 004473CD
:0043CCCA 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043CCA9(C)
|
:0043CCCD 33C0                    xor eax, eax
:0043CCCF 8A45FC                  mov al, byte ptr [ebp-04]
:0043CCD2 8B8DA8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEA8]
:0043CCD8 33D2                    xor edx, edx
:0043CCDA 8A9408B8FA4600          mov dl, byte ptr [eax+ecx+0046FAB8]
:0043CCE1 8BC2                    mov eax, edx
:0043CCE3 8D0C52                  lea ecx, dword ptr [edx+2*edx]
:0043CCE6 C1E103                  shl ecx, 03
:0043CCE9 2BC8                    sub ecx, eax
:0043CCEB 8D8998C04600            lea ecx, dword ptr [ecx+0046C098]
:0043CCF1 E88AC8FCFF              call 00409580
:0043CCF6 50                      push eax
:0043CCF7 8B85A8FEFFFF            mov eax, dword ptr [ebp+FFFFFEA8]
:0043CCFD 8D0480                  lea eax, dword ptr [eax+4*eax]
:0043CD00 8D8445B8FEFFFF          lea eax, dword ptr [ebp+2*eax-00000148]
:0043CD07 50                      push eax
:0043CD08 E8E3A60000              call 004473F0
:0043CD0D 83C408                  add esp, 00000008
:0043CD10 33C0                    xor eax, eax
:0043CD12 8A45F0                  mov al, byte ptr [ebp-10]
:0043CD15 83F804                  cmp eax, 00000004
:0043CD18 0F851E000000            jne 0043CD3C

* Possible StringData Ref from Data Obj ->" "
                                  |
:0043CD1E 6820344500              push 00453420
:0043CD23 8B85A8FEFFFF            mov eax, dword ptr [ebp+FFFFFEA8]
:0043CD29 8D0480                  lea eax, dword ptr [eax+4*eax]
:0043CD2C 8D8445B8FEFFFF          lea eax, dword ptr [ebp+2*eax-00000148]
:0043CD33 50                      push eax
:0043CD34 E8B7A60000              call 004473F0
:0043CD39 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043CD18(C)
|

* Possible StringData Ref from Data Obj ->" "
                                  |
:0043CD3C 6824344500              push 00453424
:0043CD41 8B85A8FEFFFF            mov eax, dword ptr [ebp+FFFFFEA8]
:0043CD47 8D0480                  lea eax, dword ptr [eax+4*eax]
:0043CD4A 8D8445B8FEFFFF          lea eax, dword ptr [ebp+2*eax-00000148]
:0043CD51 50                      push eax
:0043CD52 E899A60000              call 004473F0
:0043CD57 83C408                  add esp, 00000008
:0043CD5A 8B85A8FEFFFF            mov eax, dword ptr [ebp+FFFFFEA8]
:0043CD60 8D0480                  lea eax, dword ptr [eax+4*eax]
:0043CD63 8D8445B8FEFFFF          lea eax, dword ptr [ebp+2*eax-00000148]
:0043CD6A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043CD6D 8901                    mov dword ptr [ecx], eax
:0043CD6F 8345F804                add dword ptr [ebp-08], 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043CC37(C)
|
:0043CD73 E923FEFFFF              jmp 0043CB9B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043CBAB(C), :0043CC02(U)
|
:0043CD78 8B45F8                  mov eax, dword ptr [ebp-08]
:0043CD7B C70000000000            mov dword ptr [eax], 00000000
:0043CD81 33C0                    xor eax, eax
:0043CD83 8A45F4                  mov al, byte ptr [ebp-0C]
:0043CD86 85C0                    test eax, eax
:0043CD88 0F8E1B010000            jle 0043CEA9
:0043CD8E C68520FEFFFF00          mov byte ptr [ebp+FFFFFE20], 00
:0043CD95 C68524FEFFFF00          mov byte ptr [ebp+FFFFFE24], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043CEA4(U)
|
:0043CD9C B988534500              mov ecx, 00455388
:0043CDA1 E84C4FFCFF              call 00401CF2
:0043CDA6 B988534500              mov ecx, 00455388
:0043CDAB E8F0C6FCFF              call 004094A0
:0043CDB0 8985B0FEFFFF            mov dword ptr [ebp+FFFFFEB0], eax
:0043CDB6 B988534500              mov ecx, 00455388
:0043CDBB E800C7FCFF              call 004094C0
:0043CDC0 8985ACFEFFFF            mov dword ptr [ebp+FFFFFEAC], eax
:0043CDC6 8D8524FEFFFF            lea eax, dword ptr [ebp+FFFFFE24]
:0043CDCC 50                      push eax
:0043CDCD 6A06                    push 00000006
:0043CDCF 6A00                    push 00000000
:0043CDD1 68A0000000              push 000000A0
:0043CDD6 6A06                    push 00000006
:0043CDD8 8D852CFEFFFF            lea eax, dword ptr [ebp+FFFFFE2C]
:0043CDDE 50                      push eax
:0043CDDF 8B85ACFEFFFF            mov eax, dword ptr [ebp+FFFFFEAC]
:0043CDE5 50                      push eax
:0043CDE6 8B85B0FEFFFF            mov eax, dword ptr [ebp+FFFFFEB0]
:0043CDEC 50                      push eax
:0043CDED E802B0FFFF              call 00437DF4
:0043CDF2 83C420                  add esp, 00000020
:0043CDF5 888528FEFFFF            mov byte ptr [ebp+FFFFFE28], al
:0043CDFB 33C0                    xor eax, eax
:0043CDFD 8A8528FEFFFF            mov al, byte ptr [ebp+FFFFFE28]
:0043CE03 3DFF000000              cmp eax, 000000FF
:0043CE08 0F850A000000            jne 0043CE18
:0043CE0E E996000000              jmp 0043CEA9
:0043CE13 E98C000000              jmp 0043CEA4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043CE08(C)
|
:0043CE18 33C0                    xor eax, eax
:0043CE1A 8A45FC                  mov al, byte ptr [ebp-04]
:0043CE1D 33C9                    xor ecx, ecx
:0043CE1F 8A8D28FEFFFF            mov cl, byte ptr [ebp+FFFFFE28]
:0043CE25 03C1                    add eax, ecx
:0043CE27 888528FEFFFF            mov byte ptr [ebp+FFFFFE28], al
:0043CE2D 33C0                    xor eax, eax
:0043CE2F 8A8528FEFFFF            mov al, byte ptr [ebp+FFFFFE28]
:0043CE35 33C9                    xor ecx, ecx
:0043CE37 8A88B8FA4600            mov cl, byte ptr [eax+0046FAB8]
:0043CE3D 8BC1                    mov eax, ecx
:0043CE3F 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:0043CE42 C1E103                  shl ecx, 03
:0043CE45 2BC8                    sub ecx, eax
:0043CE47 8D8998C04600            lea ecx, dword ptr [ecx+0046C098]
:0043CE4D E8DEC2FCFF              call 00409130
:0043CE52 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043CE55 03C0                    add eax, eax
:0043CE57 8D04C0                  lea eax, dword ptr [eax+8*eax]
:0043CE5A 05E8564500              add eax, 004556E8
:0043CE5F 8985B4FEFFFF            mov dword ptr [ebp+FFFFFEB4], eax
:0043CE65 B900FB4600              mov ecx, 0046FB00
:0043CE6A E817D8FFFF              call 0043A686
:0043CE6F 33C0                    xor eax, eax
:0043CE71 8A8528FEFFFF            mov al, byte ptr [ebp+FFFFFE28]
:0043CE77 8A80B8FA4600            mov al, byte ptr [eax+0046FAB8]
:0043CE7D 50                      push eax
:0043CE7E 8B8D1CFEFFFF            mov ecx, dword ptr [ebp+FFFFFE1C]
:0043CE84 E828160000              call 0043E4B1
:0043CE89 6A00                    push 00000000
:0043CE8B 8B85B4FEFFFF            mov eax, dword ptr [ebp+FFFFFEB4]
:0043CE91 50                      push eax
:0043CE92 E8CD200000              call 0043EF64
:0043CE97 83C408                  add esp, 00000008
:0043CE9A C705BEFC460001000000    mov dword ptr [0046FCBE], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043CE13(U)
|
:0043CEA4 E9F3FEFFFF              jmp 0043CD9C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043CD88(C), :0043CE0E(U)
|
:0043CEA9 E900000000              jmp 0043CEAE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043CEA9(U)
|
:0043CEAE 5F                      pop edi
:0043CEAF 5E                      pop esi
:0043CEB0 5B                      pop ebx
:0043CEB1 C9                      leave
:0043CEB2 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00403536   , :00403DF7   , :004040D7   , :00404235   , :004044AE   
|:00404F9A   , :004055FC   , :004059D8   , :00405DA2   , :0040616A   
|:004064F7   , :004066EA   , :0040691F   , :00406B71   , :00406CB2   
|:00406E22   , :00406F96   , :0040710A   , :004072CD   , :0040761D   
|:0040791E   , :00407A87   , :00407C3C   , :00408350   , :0041DA17   
|
:0043CEB5 55                      push ebp
:0043CEB6 8BEC                    mov ebp, esp
:0043CEB8 83EC18                  sub esp, 00000018
:0043CEBB 53                      push ebx
:0043CEBC 56                      push esi
:0043CEBD 57                      push edi
:0043CEBE 894DE8                  mov dword ptr [ebp-18], ecx
:0043CEC1 33C0                    xor eax, eax
:0043CEC3 8A4508                  mov al, byte ptr [ebp+08]
:0043CEC6 8BC8                    mov ecx, eax
:0043CEC8 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043CECB C1E003                  shl eax, 03
:0043CECE 2BC1                    sub eax, ecx
:0043CED0 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043CED6 E8F5C4FCFF              call 004093D0
:0043CEDB 33C9                    xor ecx, ecx
:0043CEDD 8AC8                    mov cl, al
:0043CEDF 83F907                  cmp ecx, 00000007
:0043CEE2 0F8419000000            je 0043CF01
:0043CEE8 33C0                    xor eax, eax
:0043CEEA A0A4354500              mov al, byte ptr [004535A4]
:0043CEEF A804                    test al, 04
:0043CEF1 0F850A000000            jne 0043CF01
:0043CEF7 A0BCA64600              mov al, byte ptr [0046A6BC]
:0043CEFC E9AD030000              jmp 0043D2AE

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043CEE2(C), :0043CEF1(C)
|
:0043CF01 C745EC01000000          mov [ebp-14], 00000001
:0043CF08 8D4DF8                  lea ecx, dword ptr [ebp-08]
:0043CF0B E86049FCFF              call 00401870
:0043CF10 33C0                    xor eax, eax
:0043CF12 8A4508                  mov al, byte ptr [ebp+08]
:0043CF15 8BC8                    mov ecx, eax
:0043CF17 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043CF1A C1E003                  shl eax, 03
:0043CF1D 2BC1                    sub eax, ecx
:0043CF1F 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043CF25 E8D6C2FCFF              call 00409200
:0043CF2A 668B00                  mov ax, word ptr [eax]
:0043CF2D 668945FC                mov word ptr [ebp-04], ax
:0043CF31 68FF000000              push 000000FF
:0043CF36 68C0030000              push 000003C0
:0043CF3B 6A04                    push 00000004
:0043CF3D 6A00                    push 00000000
:0043CF3F 68E82C0000              push 00002CE8
:0043CF44 B950F94600              mov ecx, 0046F950
:0043CF49 E8D2A70000              call 00447720
:0043CF4E 50                      push eax
:0043CF4F E80FA50000              call 00447463
:0043CF54 83C40C                  add esp, 0000000C
:0043CF57 C645F0FF                mov [ebp-10], FF
:0043CF5B 6A00                    push 00000000
:0043CF5D 8B4510                  mov eax, dword ptr [ebp+10]
:0043CF60 50                      push eax
:0043CF61 8B450C                  mov eax, dword ptr [ebp+0C]
:0043CF64 50                      push eax
:0043CF65 8D45FC                  lea eax, dword ptr [ebp-04]
:0043CF68 50                      push eax
:0043CF69 33C0                    xor eax, eax
:0043CF6B 8A4508                  mov al, byte ptr [ebp+08]
:0043CF6E 8BC8                    mov ecx, eax
:0043CF70 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043CF73 C1E003                  shl eax, 03
:0043CF76 2BC1                    sub eax, ecx
:0043CF78 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043CF7E E84EC8FDFF              call 004197D1
:0043CF83 8845F4                  mov byte ptr [ebp-0C], al
:0043CF86 6A01                    push 00000001
:0043CF88 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043CF8B E8C0C8FCFF              call 00409850
:0043CF90 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043CF93 E808C9FCFF              call 004098A0
:0043CF98 8A4508                  mov al, byte ptr [ebp+08]
:0043CF9B A2F4FA4600              mov byte ptr [0046FAF4], al
:0043CFA0 33C0                    xor eax, eax
:0043CFA2 8A45F4                  mov al, byte ptr [ebp-0C]
:0043CFA5 3DFF000000              cmp eax, 000000FF
:0043CFAA 0F8559000000            jne 0043D009
:0043CFB0 33C0                    xor eax, eax
:0043CFB2 8A4510                  mov al, byte ptr [ebp+10]
:0043CFB5 83F801                  cmp eax, 00000001
:0043CFB8 0F8514000000            jne 0043CFD2

* Possible StringData Ref from Data Obj ->"÷ΧûҾӡ"
                                  |
:0043CFBE 6828344500              push 00453428
:0043CFC3 6A00                    push 00000000
:0043CFC5 E86BBFFFFF              call 00438F35
:0043CFCA 83C408                  add esp, 00000008
:0043CFCD E930000000              jmp 0043D002

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043CFB8(C)
|
:0043CFD2 33C0                    xor eax, eax
:0043CFD4 8A450C                  mov al, byte ptr [ebp+0C]
:0043CFD7 A880                    test al, 80
:0043CFD9 0F8414000000            je 0043CFF3

* Possible StringData Ref from Data Obj ->"÷Χûеоӡ"
                                  |
:0043CFDF 6840344500              push 00453440
:0043CFE4 6A00                    push 00000000
:0043CFE6 E84ABFFFFF              call 00438F35
:0043CFEB 83C408                  add esp, 00000008
:0043CFEE E90F000000              jmp 0043D002

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043CFD9(C)
|

* Possible StringData Ref from Data Obj ->"Χûеоӡ"
                                  |
:0043CFF3 6858344500              push 00453458
:0043CFF8 6A00                    push 00000000
:0043CFFA E836BFFFFF              call 00438F35
:0043CFFF 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043CFCD(U), :0043CFEE(U)
|
:0043D002 C745EC00000000          mov [ebp-14], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043CFAA(C), :0043D250(U)
|
:0043D009 837DEC00                cmp dword ptr [ebp-14], 00000000
:0043D00D 0F8442020000            je 0043D255
:0043D013 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043D016 E816DCFFFF              call 0043AC31
:0043D01B 50                      push eax
:0043D01C 8D4DF8                  lea ecx, dword ptr [ebp-08]
:0043D01F E86C48FCFF              call 00401890
:0043D024 33C0                    xor eax, eax
:0043D026 8A45F8                  mov al, byte ptr [ebp-08]
:0043D029 3DFF000000              cmp eax, 000000FF
:0043D02E 0F8510000000            jne 0043D044
:0043D034 C745EC00000000          mov [ebp-14], 00000000
:0043D03B C645F0FF                mov [ebp-10], FF
:0043D03F E911020000              jmp 0043D255

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D02E(C)
|
:0043D044 6A04                    push 00000004
:0043D046 6A00                    push 00000000
:0043D048 33C0                    xor eax, eax
:0043D04A A0C8FC4600              mov al, byte ptr [0046FCC8]
:0043D04F 33C9                    xor ecx, ecx
:0043D051 8A4DF9                  mov cl, byte ptr [ebp-07]
:0043D054 0FAFC1                  imul eax, ecx
:0043D057 33C9                    xor ecx, ecx
:0043D059 8A4DF8                  mov cl, byte ptr [ebp-08]
:0043D05C 03C1                    add eax, ecx
:0043D05E 05E82C0000              add eax, 00002CE8
:0043D063 50                      push eax
:0043D064 B950F94600              mov ecx, 0046F950
:0043D069 E8B2A60000              call 00447720
:0043D06E 33C9                    xor ecx, ecx
:0043D070 8A08                    mov cl, byte ptr [eax]
:0043D072 81F9FF000000            cmp ecx, 000000FF
:0043D078 0F8495010000            je 0043D213
:0043D07E 8D45F8                  lea eax, dword ptr [ebp-08]
:0043D081 50                      push eax
:0043D082 E8B6C4FDFF              call 0041953D
:0043D087 83C404                  add esp, 00000004
:0043D08A 8845F0                  mov byte ptr [ebp-10], al
:0043D08D 33C0                    xor eax, eax
:0043D08F 8A45F0                  mov al, byte ptr [ebp-10]
:0043D092 3DFF000000              cmp eax, 000000FF
:0043D097 0F8471010000            je 0043D20E
:0043D09D 33C0                    xor eax, eax
:0043D09F 8A4510                  mov al, byte ptr [ebp+10]
:0043D0A2 83F801                  cmp eax, 00000001
:0043D0A5 0F85B4000000            jne 0043D15F
:0043D0AB 33C0                    xor eax, eax
:0043D0AD 8A45F0                  mov al, byte ptr [ebp-10]
:0043D0B0 8BC8                    mov ecx, eax
:0043D0B2 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043D0B5 C1E003                  shl eax, 03
:0043D0B8 2BC1                    sub eax, ecx
:0043D0BA 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043D0C0 E85BC1FCFF              call 00409220
:0043D0C5 8BD8                    mov ebx, eax
:0043D0C7 33C0                    xor eax, eax
:0043D0C9 8A4508                  mov al, byte ptr [ebp+08]
:0043D0CC 8BC8                    mov ecx, eax
:0043D0CE 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043D0D1 C1E003                  shl eax, 03
:0043D0D4 2BC1                    sub eax, ecx
:0043D0D6 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043D0DC E83FC1FCFF              call 00409220
:0043D0E1 3BD8                    cmp ebx, eax
:0043D0E3 0F8424000000            je 0043D10D
:0043D0E9 6A0A                    push 0000000A
:0043D0EB B994A64600              mov ecx, 0046A694
:0043D0F0 E82FBFFDFF              call 00419024

* Possible StringData Ref from Data Obj ->"оӡ"
                                  |
:0043D0F5 6874344500              push 00453474
:0043D0FA 6A00                    push 00000000
:0043D0FC E834BEFFFF              call 00438F35
:0043D101 83C408                  add esp, 00000008
:0043D104 C645F0FF                mov [ebp-10], FF
:0043D108 E94D000000              jmp 0043D15A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D0E3(C)
|
:0043D10D 33C0                    xor eax, eax
:0043D10F 8A45F0                  mov al, byte ptr [ebp-10]
:0043D112 8BC8                    mov ecx, eax
:0043D114 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043D117 C1E003                  shl eax, 03
:0043D11A 2BC1                    sub eax, ecx
:0043D11C 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043D122 E85F0DFFFF              call 0042DE86
:0043D127 85C0                    test eax, eax
:0043D129 0F8524000000            jne 0043D153
:0043D12F 6A0A                    push 0000000A
:0043D131 B994A64600              mov ecx, 0046A694
:0043D136 E8E9BEFDFF              call 00419024

* Possible StringData Ref from Data Obj ->"ѡ֧ӡ"
                                  |
:0043D13B 6880344500              push 00453480
:0043D140 6A00                    push 00000000
:0043D142 E8EEBDFFFF              call 00438F35
:0043D147 83C408                  add esp, 00000008
:0043D14A C645F0FF                mov [ebp-10], FF
:0043D14E E907000000              jmp 0043D15A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D129(C)
|
:0043D153 C745EC00000000          mov [ebp-14], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043D108(U), :0043D14E(U)
|
:0043D15A E9AF000000              jmp 0043D20E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D0A5(C)
|
:0043D15F 33C0                    xor eax, eax
:0043D161 8A45F0                  mov al, byte ptr [ebp-10]
:0043D164 8BC8                    mov ecx, eax
:0043D166 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043D169 C1E003                  shl eax, 03
:0043D16C 2BC1                    sub eax, ecx
:0043D16E 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043D174 E8A7C0FCFF              call 00409220
:0043D179 8BD8                    mov ebx, eax
:0043D17B 33C0                    xor eax, eax
:0043D17D 8A4508                  mov al, byte ptr [ebp+08]
:0043D180 8BC8                    mov ecx, eax
:0043D182 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043D185 C1E003                  shl eax, 03
:0043D188 2BC1                    sub eax, ecx
:0043D18A 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043D190 E88BC0FCFF              call 00409220
:0043D195 3BD8                    cmp ebx, eax
:0043D197 0F8524000000            jne 0043D1C1
:0043D19D 6A0A                    push 0000000A
:0043D19F B994A64600              mov ecx, 0046A694
:0043D1A4 E87BBEFDFF              call 00419024

* Possible StringData Ref from Data Obj ->"ܹҾӡ"
                                  |
:0043D1A9 6894344500              push 00453494
:0043D1AE 6A00                    push 00000000
:0043D1B0 E880BDFFFF              call 00438F35
:0043D1B5 83C408                  add esp, 00000008
:0043D1B8 C645F0FF                mov [ebp-10], FF
:0043D1BC E94D000000              jmp 0043D20E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D197(C)
|
:0043D1C1 33C0                    xor eax, eax
:0043D1C3 8A45F0                  mov al, byte ptr [ebp-10]
:0043D1C6 8BC8                    mov ecx, eax
:0043D1C8 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043D1CB C1E003                  shl eax, 03
:0043D1CE 2BC1                    sub eax, ecx
:0043D1D0 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043D1D6 E8AB0CFFFF              call 0042DE86
:0043D1DB 85C0                    test eax, eax
:0043D1DD 0F8524000000            jne 0043D207
:0043D1E3 6A0A                    push 0000000A
:0043D1E5 B994A64600              mov ecx, 0046A694
:0043D1EA E835BEFDFF              call 00419024

* Possible StringData Ref from Data Obj ->"ѡ֧ӡ"
                                  |
:0043D1EF 68A8344500              push 004534A8
:0043D1F4 6A00                    push 00000000
:0043D1F6 E83ABDFFFF              call 00438F35
:0043D1FB 83C408                  add esp, 00000008
:0043D1FE C645F0FF                mov [ebp-10], FF
:0043D202 E907000000              jmp 0043D20E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D1DD(C)
|
:0043D207 C745EC00000000          mov [ebp-14], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043D097(C), :0043D15A(U), :0043D1BC(U), :0043D202(U)
|
:0043D20E E93D000000              jmp 0043D250

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D078(C)
|
:0043D213 6A0A                    push 0000000A
:0043D215 B994A64600              mov ecx, 0046A694
:0043D21A E805BEFDFF              call 00419024
:0043D21F 33C0                    xor eax, eax
:0043D221 8A4510                  mov al, byte ptr [ebp+10]
:0043D224 83F801                  cmp eax, 00000001
:0043D227 0F8514000000            jne 0043D241

* Possible StringData Ref from Data Obj ->"ڷΧڡ"
                                  |
:0043D22D 68BC344500              push 004534BC
:0043D232 6A00                    push 00000000
:0043D234 E8FCBCFFFF              call 00438F35
:0043D239 83C408                  add esp, 00000008
:0043D23C E90F000000              jmp 0043D250

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D227(C)
|

* Possible StringData Ref from Data Obj ->"ڹΧڡ"
                                  |
:0043D241 68CC344500              push 004534CC
:0043D246 6A00                    push 00000000
:0043D248 E8E8BCFFFF              call 00438F35
:0043D24D 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043D20E(U), :0043D23C(U)
|
:0043D250 E9B4FDFFFF              jmp 0043D009

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043D00D(C), :0043D03F(U)
|
:0043D255 6A00                    push 00000000
:0043D257 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043D25A E8F1C5FCFF              call 00409850
:0043D25F 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043D262 E8E8120000              call 0043E54F
:0043D267 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043D26A E831C6FCFF              call 004098A0
:0043D26F 33C0                    xor eax, eax
:0043D271 8A45F0                  mov al, byte ptr [ebp-10]
:0043D274 3DFF000000              cmp eax, 000000FF
:0043D279 0F850C000000            jne 0043D28B
:0043D27F 6A01                    push 00000001
:0043D281 B994A64600              mov ecx, 0046A694
:0043D286 E899BDFDFF              call 00419024

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D279(C)
|
:0043D28B 8B45E8                  mov eax, dword ptr [ebp-18]
:0043D28E C6404900                mov [eax+49], 00
:0043D292 8B45E8                  mov eax, dword ptr [ebp-18]
:0043D295 C7404A00000000          mov [eax+4A], 00000000
:0043D29C 6A00                    push 00000000
:0043D29E E8E58BFEFF              call 00425E88
:0043D2A3 83C404                  add esp, 00000004
:0043D2A6 8A45F0                  mov al, byte ptr [ebp-10]
:0043D2A9 E900000000              jmp 0043D2AE

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043CEFC(U), :0043D2A9(U)
|
:0043D2AE 5F                      pop edi
:0043D2AF 5E                      pop esi
:0043D2B0 5B                      pop ebx
:0043D2B1 C9                      leave
:0043D2B2 C20C00                  ret 000C



* Referenced by a CALL at Addresses:
|:00404BEB   , :00404C34   , :00404E1A   , :00404E87   , :00422119   
|:004222C8   , :00422665   , :00422735   , :004228A6   , :00422D3B   
|:00422D72   , :00422EBC   , :00422EF3   , :00422FD2   , :00423121   
|:004231A3   , :0042349B   , :0042AB35   , :0042C10B   , :0042D5F0   
|:0042D62C   , :0042D6AB   , :0042D810   , :0042D891   , :0042D9FC   
|:0042DB10   , :0042DB92   , :0042DD2E   , :00439D9E   , :0043A123   
|:0043A157   , :0043A263   , :0043A540   , :0043B9F1   , :0043BFC4   
|:0043C547   , :0043C6F3   , :0043C81A   , :0043C8FE   , :0043DA0F   
|:0043DA6B   , :0043DAC6   , :0043DBDA   , :0043DC13   , :0043DC6F   
|:0043DCA8   , :0043DE37   , :0043E299   , :0043ECCD   , :0043ECE7   
|:0043ED38   , :0043F1AA   , :0043F21E   , :0043F269   , :0043F304   
|:00440389   , :00443D89   
|
:0043D2B5 55                      push ebp
:0043D2B6 8BEC                    mov ebp, esp
:0043D2B8 53                      push ebx
:0043D2B9 56                      push esi
:0043D2BA 57                      push edi
:0043D2BB 68B0010000              push 000001B0
:0043D2C0 6878020000              push 00000278
:0043D2C5 6A30                    push 00000030
:0043D2C7 6A08                    push 00000008
:0043D2C9 E8CF7A0000              call 00444D9D
:0043D2CE 83C410                  add esp, 00000010
:0043D2D1 6A00                    push 00000000
:0043D2D3 6A00                    push 00000000
:0043D2D5 8B451C                  mov eax, dword ptr [ebp+1C]
:0043D2D8 50                      push eax
:0043D2D9 E8217A0000              call 00444CFF
:0043D2DE 83C40C                  add esp, 0000000C
:0043D2E1 8B4518                  mov eax, dword ptr [ebp+18]
:0043D2E4 50                      push eax
:0043D2E5 8B4514                  mov eax, dword ptr [ebp+14]
:0043D2E8 50                      push eax
:0043D2E9 8B4510                  mov eax, dword ptr [ebp+10]
:0043D2EC 50                      push eax
:0043D2ED 8B450C                  mov eax, dword ptr [ebp+0C]
:0043D2F0 50                      push eax
:0043D2F1 8B4508                  mov eax, dword ptr [ebp+08]
:0043D2F4 50                      push eax
:0043D2F5 E8A5840000              call 0044579F
:0043D2FA 83C414                  add esp, 00000014
:0043D2FD 6A00                    push 00000000
:0043D2FF 6A00                    push 00000000
:0043D301 6A00                    push 00000000
:0043D303 E8F7790000              call 00444CFF
:0043D308 83C40C                  add esp, 0000000C
:0043D30B 68B8010000              push 000001B8
:0043D310 6880020000              push 00000280
:0043D315 6A00                    push 00000000
:0043D317 6A00                    push 00000000
:0043D319 E87F7A0000              call 00444D9D
:0043D31E 83C410                  add esp, 00000010
:0043D321 E900000000              jmp 0043D326

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D321(U)
|
:0043D326 5F                      pop edi
:0043D327 5E                      pop esi
:0043D328 5B                      pop ebx
:0043D329 C9                      leave
:0043D32A C3                      ret



* Referenced by a CALL at Addresses:
|:004226B3   , :00422D1E   , :00422E9F   , :0042AA09   , :00439D32   
|:00439EF5   , :0043BCC9   , :0043C00A   , :0043C518   , :0043C84F   
|:0043EAFD   
|
:0043D32B 55                      push ebp
:0043D32C 8BEC                    mov ebp, esp
:0043D32E 53                      push ebx
:0043D32F 56                      push esi
:0043D330 57                      push edi
:0043D331 8B4518                  mov eax, dword ptr [ebp+18]
:0043D334 50                      push eax
:0043D335 8B4514                  mov eax, dword ptr [ebp+14]
:0043D338 50                      push eax
:0043D339 8B4510                  mov eax, dword ptr [ebp+10]
:0043D33C 50                      push eax
:0043D33D 8B450C                  mov eax, dword ptr [ebp+0C]
:0043D340 50                      push eax
:0043D341 8B4508                  mov eax, dword ptr [ebp+08]
:0043D344 50                      push eax
:0043D345 E811860000              call 0044595B
:0043D34A 83C414                  add esp, 00000014
:0043D34D E900000000              jmp 0043D352

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D34D(U)
|
:0043D352 5F                      pop edi
:0043D353 5E                      pop esi
:0043D354 5B                      pop ebx
:0043D355 C9                      leave
:0043D356 C3                      ret



* Referenced by a CALL at Address:
|:0043D8E0   
|
:0043D357 55                      push ebp
:0043D358 8BEC                    mov ebp, esp
:0043D35A 83EC18                  sub esp, 00000018
:0043D35D 53                      push ebx
:0043D35E 56                      push esi
:0043D35F 57                      push edi
:0043D360 894DEC                  mov dword ptr [ebp-14], ecx
:0043D363 C745F000000000          mov [ebp-10], 00000000
:0043D36A 8B45EC                  mov eax, dword ptr [ebp-14]
:0043D36D 668B403E                mov ax, word ptr [eax+3E]
:0043D371 668945FC                mov word ptr [ebp-04], ax
:0043D375 8B4508                  mov eax, dword ptr [ebp+08]
:0043D378 C1E804                  shr eax, 04
:0043D37B 8945F8                  mov dword ptr [ebp-08], eax
:0043D37E 8B450C                  mov eax, dword ptr [ebp+0C]
:0043D381 C1E804                  shr eax, 04
:0043D384 8945F4                  mov dword ptr [ebp-0C], eax
:0043D387 8B45EC                  mov eax, dword ptr [ebp-14]
:0043D38A 33C9                    xor ecx, ecx
:0043D38C 8A4849                  mov cl, byte ptr [eax+49]
:0043D38F 894DE8                  mov dword ptr [ebp-18], ecx
:0043D392 E94F000000              jmp 0043D3E6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D3F4(C)
|
:0043D397 33C0                    xor eax, eax
:0043D399 8A45FC                  mov al, byte ptr [ebp-04]
:0043D39C 3B45F8                  cmp eax, dword ptr [ebp-08]
:0043D39F 0F8737000000            ja 0043D3DC
:0043D3A5 33C0                    xor eax, eax
:0043D3A7 8A45FC                  mov al, byte ptr [ebp-04]
:0043D3AA 83C003                  add eax, 00000003
:0043D3AD 3B45F8                  cmp eax, dword ptr [ebp-08]
:0043D3B0 0F8626000000            jbe 0043D3DC
:0043D3B6 33C0                    xor eax, eax
:0043D3B8 8A45FD                  mov al, byte ptr [ebp-03]
:0043D3BB 3B45F4                  cmp eax, dword ptr [ebp-0C]
:0043D3BE 0F8718000000            ja 0043D3DC
:0043D3C4 33C0                    xor eax, eax
:0043D3C6 8A45FD                  mov al, byte ptr [ebp-03]
:0043D3C9 83C003                  add eax, 00000003
:0043D3CC 3B45F4                  cmp eax, dword ptr [ebp-0C]
:0043D3CF 0F8607000000            jbe 0043D3DC
:0043D3D5 C745F001000000          mov [ebp-10], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043D39F(C), :0043D3B0(C), :0043D3BE(C), :0043D3CF(C)
|
:0043D3DC E91E000000              jmp 0043D3FF
:0043D3E1 E919000000              jmp 0043D3FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D392(U)
|
:0043D3E6 837DE800                cmp dword ptr [ebp-18], 00000000
:0043D3EA 0F8C0F000000            jl 0043D3FF
:0043D3F0 837DE804                cmp dword ptr [ebp-18], 00000004
:0043D3F4 0F8E9DFFFFFF            jle 0043D397
:0043D3FA E900000000              jmp 0043D3FF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043D3DC(U), :0043D3E1(U), :0043D3EA(C), :0043D3FA(U)
|
:0043D3FF 8B45F0                  mov eax, dword ptr [ebp-10]
:0043D402 E900000000              jmp 0043D407

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D402(U)
|
:0043D407 5F                      pop edi
:0043D408 5E                      pop esi
:0043D409 5B                      pop ebx
:0043D40A C9                      leave
:0043D40B C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:004098D3   , :0042BF18   , :0043AC20   
|
:0043D40E 55                      push ebp
:0043D40F 8BEC                    mov ebp, esp
:0043D411 81EC90000000            sub esp, 00000090
:0043D417 53                      push ebx
:0043D418 56                      push esi
:0043D419 57                      push edi
:0043D41A 898D70FFFFFF            mov dword ptr [ebp+FFFFFF70], ecx
:0043D420 33C0                    xor eax, eax
:0043D422 8A450C                  mov al, byte ptr [ebp+0C]
:0043D425 8B8D70FFFFFF            mov ecx, dword ptr [ebp+FFFFFF70]
:0043D42B 034114                  add eax, dword ptr [ecx+14]
:0043D42E 33C9                    xor ecx, ecx
:0043D430 8A0DC8FC4600            mov cl, byte ptr [0046FCC8]
:0043D436 0FAFC1                  imul eax, ecx
:0043D439 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043D43C 33C9                    xor ecx, ecx
:0043D43E 8A4D08                  mov cl, byte ptr [ebp+08]
:0043D441 03C1                    add eax, ecx
:0043D443 8B8D70FFFFFF            mov ecx, dword ptr [ebp+FFFFFF70]
:0043D449 034110                  add eax, dword ptr [ecx+10]
:0043D44C 898574FFFFFF            mov dword ptr [ebp+FFFFFF74], eax
:0043D452 33C0                    xor eax, eax
:0043D454 8A450C                  mov al, byte ptr [ebp+0C]
:0043D457 8B8D70FFFFFF            mov ecx, dword ptr [ebp+FFFFFF70]
:0043D45D 0FAF4108                imul eax, dword ptr [ecx+08]
:0043D461 99                      cdq
:0043D462 83E20F                  and edx, 0000000F
:0043D465 03C2                    add eax, edx
:0043D467 C1F804                  sar eax, 04
:0043D46A 33C9                    xor ecx, ecx
:0043D46C 8A4D08                  mov cl, byte ptr [ebp+08]
:0043D46F 03C1                    add eax, ecx
:0043D471 894590                  mov dword ptr [ebp-70], eax
:0043D474 6A04                    push 00000004
:0043D476 6A00                    push 00000000
:0043D478 6A00                    push 00000000
:0043D47A B950F94600              mov ecx, 0046F950
:0043D47F E89CA20000              call 00447720
:0043D484 8B8D74FFFFFF            mov ecx, dword ptr [ebp+FFFFFF74]
:0043D48A 03C8                    add ecx, eax
:0043D48C 894DAC                  mov dword ptr [ebp-54], ecx
:0043D48F 33C0                    xor eax, eax
:0043D491 8A450C                  mov al, byte ptr [ebp+0C]
:0043D494 8B8D70FFFFFF            mov ecx, dword ptr [ebp+FFFFFF70]
:0043D49A 034114                  add eax, dword ptr [ecx+14]
:0043D49D B903000000              mov ecx, 00000003
:0043D4A2 99                      cdq
:0043D4A3 F7F9                    idiv ecx
:0043D4A5 8BD8                    mov ebx, eax
:0043D4A7 33C0                    xor eax, eax
:0043D4A9 A0C8FC4600              mov al, byte ptr [0046FCC8]
:0043D4AE 0FAFD8                  imul ebx, eax
:0043D4B1 33C0                    xor eax, eax
:0043D4B3 8A4508                  mov al, byte ptr [ebp+08]
:0043D4B6 8B8D70FFFFFF            mov ecx, dword ptr [ebp+FFFFFF70]
:0043D4BC 034110                  add eax, dword ptr [ecx+10]
:0043D4BF B903000000              mov ecx, 00000003
:0043D4C4 99                      cdq
:0043D4C5 F7F9                    idiv ecx
:0043D4C7 03D8                    add ebx, eax
:0043D4C9 6A04                    push 00000004
:0043D4CB 6A00                    push 00000000
:0043D4CD 6A00                    push 00000000
:0043D4CF B950F94600              mov ecx, 0046F950
:0043D4D4 E847A20000              call 00447720
:0043D4D9 03D8                    add ebx, eax
:0043D4DB 81C3E82C0000            add ebx, 00002CE8
:0043D4E1 895DF8                  mov dword ptr [ebp-08], ebx
:0043D4E4 6A04                    push 00000004
:0043D4E6 6A00                    push 00000000
:0043D4E8 6A00                    push 00000000
:0043D4EA B950F94600              mov ecx, 0046F950
:0043D4EF E82CA20000              call 00447720
:0043D4F4 8B4D90                  mov ecx, dword ptr [ebp-70]
:0043D4F7 03C8                    add ecx, eax
:0043D4F9 81C140290000            add ecx, 00002940
:0043D4FF 894DA4                  mov dword ptr [ebp-5C], ecx
:0043D502 6A04                    push 00000004
:0043D504 6A00                    push 00000000
:0043D506 6A00                    push 00000000
:0043D508 B950F94600              mov ecx, 0046F950
:0043D50D E80EA20000              call 00447720
:0043D512 8B4D90                  mov ecx, dword ptr [ebp-70]
:0043D515 03C8                    add ecx, eax
:0043D517 81C168340000            add ecx, 00003468
:0043D51D 894D80                  mov dword ptr [ebp-80], ecx
:0043D520 33C0                    xor eax, eax
:0043D522 8A450C                  mov al, byte ptr [ebp+0C]
:0043D525 8B8D70FFFFFF            mov ecx, dword ptr [ebp+FFFFFF70]
:0043D52B 034114                  add eax, dword ptr [ecx+14]
:0043D52E B903000000              mov ecx, 00000003
:0043D533 99                      cdq
:0043D534 F7F9                    idiv ecx
:0043D536 8BD8                    mov ebx, eax
:0043D538 33C0                    xor eax, eax
:0043D53A A0C8FC4600              mov al, byte ptr [0046FCC8]
:0043D53F 0FAFD8                  imul ebx, eax
:0043D542 33C0                    xor eax, eax
:0043D544 8A4508                  mov al, byte ptr [ebp+08]
:0043D547 8B8D70FFFFFF            mov ecx, dword ptr [ebp+FFFFFF70]
:0043D54D 034110                  add eax, dword ptr [ecx+10]
:0043D550 B903000000              mov ecx, 00000003
:0043D555 99                      cdq
:0043D556 F7F9                    idiv ecx
:0043D558 03D8                    add ebx, eax
:0043D55A 6A04                    push 00000004
:0043D55C 6A00                    push 00000000
:0043D55E 6A00                    push 00000000
:0043D560 B950F94600              mov ecx, 0046F950
:0043D565 E8B6A10000              call 00447720
:0043D56A 03D8                    add ebx, eax
:0043D56C 81C380250000            add ebx, 00002580
:0043D572 895DB0                  mov dword ptr [ebp-50], ebx
:0043D575 33C0                    xor eax, eax
:0043D577 A0C8FC4600              mov al, byte ptr [0046FCC8]
:0043D57C 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043D57F 83E803                  sub eax, 00000003
:0043D582 8945D4                  mov dword ptr [ebp-2C], eax
:0043D585 8B8570FFFFFF            mov eax, dword ptr [ebp+FFFFFF70]
:0043D58B 8B4008                  mov eax, dword ptr [eax+08]
:0043D58E 99                      cdq
:0043D58F 83E20F                  and edx, 0000000F
:0043D592 03C2                    add eax, edx
:0043D594 C1F804                  sar eax, 04
:0043D597 83E803                  sub eax, 00000003
:0043D59A 898578FFFFFF            mov dword ptr [ebp+FFFFFF78], eax
:0043D5A0 33C9                    xor ecx, ecx
:0043D5A2 8A0DC8FC4600            mov cl, byte ptr [0046FCC8]
:0043D5A8 33C0                    xor eax, eax
:0043D5AA 8A4510                  mov al, byte ptr [ebp+10]
:0043D5AD BB03000000              mov ebx, 00000003
:0043D5B2 99                      cdq
:0043D5B3 F7FB                    idiv ebx
:0043D5B5 2BC8                    sub ecx, eax
:0043D5B7 894DFC                  mov dword ptr [ebp-04], ecx
:0043D5BA B827000000              mov eax, 00000027
:0043D5BF 33C9                    xor ecx, ecx
:0043D5C1 8A4D10                  mov cl, byte ptr [ebp+10]
:0043D5C4 2BC1                    sub eax, ecx
:0043D5C6 83C04E                  add eax, 0000004E
:0043D5C9 894584                  mov dword ptr [ebp-7C], eax
:0043D5CC 33C0                    xor eax, eax
:0043D5CE A0C8FC4600              mov al, byte ptr [0046FCC8]
:0043D5D3 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043D5D6 33C9                    xor ecx, ecx
:0043D5D8 8A4D10                  mov cl, byte ptr [ebp+10]
:0043D5DB 2BC1                    sub eax, ecx
:0043D5DD 33C9                    xor ecx, ecx
:0043D5DF 8A0DC8FC4600            mov cl, byte ptr [0046FCC8]
:0043D5E5 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:0043D5E8 8D0448                  lea eax, dword ptr [eax+2*ecx]
:0043D5EB 8945C0                  mov dword ptr [ebp-40], eax
:0043D5EE B998FC4600              mov ecx, 0046FC98
:0043D5F3 E89875FEFF              call 00424B90
:0043D5F8 33C9                    xor ecx, ecx
:0043D5FA 8AC8                    mov cl, al
:0043D5FC 85C9                    test ecx, ecx
:0043D5FE 0F850F000000            jne 0043D613
:0043D604 C7857CFFFFFF00000000    mov dword ptr [ebp+FFFFFF7C], 00000000
:0043D60E E90A000000              jmp 0043D61D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D5FE(C)
|
:0043D613 C7857CFFFFFF01000000    mov dword ptr [ebp+FFFFFF7C], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D60E(U)
|
:0043D61D 8B8570FFFFFF            mov eax, dword ptr [ebp+FFFFFF70]
:0043D623 33C9                    xor ecx, ecx
:0043D625 8A4820                  mov cl, byte ptr [eax+20]
:0043D628 894DF0                  mov dword ptr [ebp-10], ecx
:0043D62B 8B8570FFFFFF            mov eax, dword ptr [ebp+FFFFFF70]
:0043D631 33C9                    xor ecx, ecx
:0043D633 8A4821                  mov cl, byte ptr [eax+21]
:0043D636 894DBC                  mov dword ptr [ebp-44], ecx
:0043D639 8B8570FFFFFF            mov eax, dword ptr [ebp+FFFFFF70]
:0043D63F 33C9                    xor ecx, ecx
:0043D641 8A4820                  mov cl, byte ptr [eax+20]
:0043D644 8B8570FFFFFF            mov eax, dword ptr [ebp+FFFFFF70]
:0043D64A 33D2                    xor edx, edx
:0043D64C 8A5022                  mov dl, byte ptr [eax+22]
:0043D64F 03CA                    add ecx, edx
:0043D651 894DE4                  mov dword ptr [ebp-1C], ecx
:0043D654 8B8570FFFFFF            mov eax, dword ptr [ebp+FFFFFF70]
:0043D65A 33C9                    xor ecx, ecx
:0043D65C 8A4821                  mov cl, byte ptr [eax+21]
:0043D65F 8B8570FFFFFF            mov eax, dword ptr [ebp+FFFFFF70]
:0043D665 33D2                    xor edx, edx
:0043D667 8A5023                  mov dl, byte ptr [eax+23]
:0043D66A 03CA                    add ecx, edx
:0043D66C 894DB4                  mov dword ptr [ebp-4C], ecx
:0043D66F 33C0                    xor eax, eax
:0043D671 8A4508                  mov al, byte ptr [ebp+08]
:0043D674 C1E004                  shl eax, 04
:0043D677 8B8D70FFFFFF            mov ecx, dword ptr [ebp+FFFFFF70]
:0043D67D 0301                    add eax, dword ptr [ecx]
:0043D67F 8945A0                  mov dword ptr [ebp-60], eax
:0043D682 33C0                    xor eax, eax
:0043D684 8A450C                  mov al, byte ptr [ebp+0C]
:0043D687 C1E004                  shl eax, 04
:0043D68A 8B8D70FFFFFF            mov ecx, dword ptr [ebp+FFFFFF70]
:0043D690 034104                  add eax, dword ptr [ecx+04]
:0043D693 894594                  mov dword ptr [ebp-6C], eax
:0043D696 8B8570FFFFFF            mov eax, dword ptr [ebp+FFFFFF70]
:0043D69C 8B4008                  mov eax, dword ptr [eax+08]
:0043D69F 8B8D70FFFFFF            mov ecx, dword ptr [ebp+FFFFFF70]
:0043D6A5 0301                    add eax, dword ptr [ecx]
:0043D6A7 33C9                    xor ecx, ecx
:0043D6A9 8A4D10                  mov cl, byte ptr [ebp+10]
:0043D6AC C1E104                  shl ecx, 04
:0043D6AF 034DA0                  add ecx, dword ptr [ebp-60]
:0043D6B2 3BC1                    cmp eax, ecx
:0043D6B4 0F8C02000000            jl 0043D6BC
:0043D6BA 8BC1                    mov eax, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D6B4(C)
|
:0043D6BC 8945DC                  mov dword ptr [ebp-24], eax
:0043D6BF 33C0                    xor eax, eax
:0043D6C1 8A4514                  mov al, byte ptr [ebp+14]
:0043D6C4 C1E004                  shl eax, 04
:0043D6C7 034594                  add eax, dword ptr [ebp-6C]
:0043D6CA 8B8D70FFFFFF            mov ecx, dword ptr [ebp+FFFFFF70]
:0043D6D0 8B4904                  mov ecx, dword ptr [ecx+04]
:0043D6D3 8B9570FFFFFF            mov edx, dword ptr [ebp+FFFFFF70]
:0043D6D9 034A0C                  add ecx, dword ptr [edx+0C]
:0043D6DC 3BC1                    cmp eax, ecx
:0043D6DE 0F8C02000000            jl 0043D6E6
:0043D6E4 8BC1                    mov eax, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D6DE(C)
|
:0043D6E6 8945CC                  mov dword ptr [ebp-34], eax
:0043D6E9 8B8D70FFFFFF            mov ecx, dword ptr [ebp+FFFFFF70]
:0043D6EF E8F0CFFFFF              call 0043A6E4
:0043D6F4 E89E98FEFF              call 00426F97
:0043D6F9 8B4594                  mov eax, dword ptr [ebp-6C]
:0043D6FC 8945C8                  mov dword ptr [ebp-38], eax
:0043D6FF E922000000              jmp 0043D726

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DCB5(U)
|
:0043D704 8345C830                add dword ptr [ebp-38], 00000030
:0043D708 8B45FC                  mov eax, dword ptr [ebp-04]
:0043D70B 0145B0                  add dword ptr [ebp-50], eax
:0043D70E 8B45FC                  mov eax, dword ptr [ebp-04]
:0043D711 0145F8                  add dword ptr [ebp-08], eax
:0043D714 8B45C0                  mov eax, dword ptr [ebp-40]
:0043D717 0145AC                  add dword ptr [ebp-54], eax
:0043D71A 8B4584                  mov eax, dword ptr [ebp-7C]
:0043D71D 0145A4                  add dword ptr [ebp-5C], eax
:0043D720 8B4584                  mov eax, dword ptr [ebp-7C]
:0043D723 014580                  add dword ptr [ebp-80], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D6FF(U)
|
:0043D726 8B45CC                  mov eax, dword ptr [ebp-34]
:0043D729 3945C8                  cmp dword ptr [ebp-38], eax
:0043D72C 0F8388050000            jnb 0043DCBA
:0043D732 8B45A0                  mov eax, dword ptr [ebp-60]
:0043D735 8945D8                  mov dword ptr [ebp-28], eax
:0043D738 E916000000              jmp 0043D753

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DCB0(U)
|
:0043D73D 8345D830                add dword ptr [ebp-28], 00000030
:0043D741 FF45B0                  inc [ebp-50]
:0043D744 FF45F8                  inc [ebp-08]
:0043D747 8345AC03                add dword ptr [ebp-54], 00000003
:0043D74B 8345A403                add dword ptr [ebp-5C], 00000003
:0043D74F 83458003                add dword ptr [ebp-80], 00000003

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D738(U)
|
:0043D753 8B45D8                  mov eax, dword ptr [ebp-28]
:0043D756 3945DC                  cmp dword ptr [ebp-24], eax
:0043D759 0F8656050000            jbe 0043DCB5
:0043D75F C645C404                mov [ebp-3C], 04
:0043D763 8B45B0                  mov eax, dword ptr [ebp-50]
:0043D766 8A00                    mov al, byte ptr [eax]
:0043D768 884588                  mov byte ptr [ebp-78], al
:0043D76B 8B45AC                  mov eax, dword ptr [ebp-54]
:0043D76E 89458C                  mov dword ptr [ebp-74], eax
:0043D771 8B45A4                  mov eax, dword ptr [ebp-5C]
:0043D774 8945D0                  mov dword ptr [ebp-30], eax
:0043D777 8B4580                  mov eax, dword ptr [ebp-80]
:0043D77A 8945EC                  mov dword ptr [ebp-14], eax
:0043D77D 8B45C8                  mov eax, dword ptr [ebp-38]
:0043D780 89459C                  mov dword ptr [ebp-64], eax
:0043D783 E925000000              jmp 0043D7AD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DA35(U)
|
:0043D788 83459C10                add dword ptr [ebp-64], 00000010
:0043D78C 8B45D4                  mov eax, dword ptr [ebp-2C]
:0043D78F 01458C                  add dword ptr [ebp-74], eax
:0043D792 8B45D4                  mov eax, dword ptr [ebp-2C]
:0043D795 018574FFFFFF            add dword ptr [ebp+FFFFFF74], eax
:0043D79B 8B8578FFFFFF            mov eax, dword ptr [ebp+FFFFFF78]
:0043D7A1 0145D0                  add dword ptr [ebp-30], eax
:0043D7A4 8B8578FFFFFF            mov eax, dword ptr [ebp+FFFFFF78]
:0043D7AA 0145EC                  add dword ptr [ebp-14], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D783(U)
|
:0043D7AD 8B45C8                  mov eax, dword ptr [ebp-38]
:0043D7B0 83C030                  add eax, 00000030
:0043D7B3 3B459C                  cmp eax, dword ptr [ebp-64]
:0043D7B6 0F867E020000            jbe 0043DA3A
:0043D7BC 8B45D8                  mov eax, dword ptr [ebp-28]
:0043D7BF 8945A8                  mov dword ptr [ebp-58], eax
:0043D7C2 E913000000              jmp 0043D7DA

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043D83B(U), :0043D88C(U), :0043DA30(U)
|
:0043D7C7 8345A810                add dword ptr [ebp-58], 00000010
:0043D7CB FF458C                  inc [ebp-74]
:0043D7CE FF8574FFFFFF            inc dword ptr [ebp+FFFFFF74]
:0043D7D4 FF45D0                  inc [ebp-30]
:0043D7D7 FF45EC                  inc [ebp-14]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D7C2(U)
|
:0043D7DA 8B45D8                  mov eax, dword ptr [ebp-28]
:0043D7DD 83C030                  add eax, 00000030
:0043D7E0 3B45A8                  cmp eax, dword ptr [ebp-58]
:0043D7E3 0F864C020000            jbe 0043DA35
:0043D7E9 8B8570FFFFFF            mov eax, dword ptr [ebp+FFFFFF70]
:0043D7EF 83782400                cmp dword ptr [eax+24], 00000000
:0043D7F3 0F8498000000            je 0043D891
:0043D7F9 33C0                    xor eax, eax
:0043D7FB 8A4588                  mov al, byte ptr [ebp-78]
:0043D7FE 3DFF000000              cmp eax, 000000FF
:0043D803 0F8437000000            je 0043D840
:0043D809 8B45B4                  mov eax, dword ptr [ebp-4C]
:0043D80C 50                      push eax
:0043D80D 8B45E4                  mov eax, dword ptr [ebp-1C]
:0043D810 50                      push eax
:0043D811 8B45BC                  mov eax, dword ptr [ebp-44]
:0043D814 50                      push eax
:0043D815 8B45F0                  mov eax, dword ptr [ebp-10]
:0043D818 50                      push eax
:0043D819 8B459C                  mov eax, dword ptr [ebp-64]
:0043D81C 50                      push eax
:0043D81D 8B45A8                  mov eax, dword ptr [ebp-58]
:0043D820 50                      push eax
:0043D821 E823060000              call 0043DE49
:0043D826 83C418                  add esp, 00000018
:0043D829 85C0                    test eax, eax
:0043D82B 0F840F000000            je 0043D840
:0043D831 33C0                    xor eax, eax
:0043D833 8A45C4                  mov al, byte ptr [ebp-3C]
:0043D836 24FB                    and al, FB
:0043D838 8845C4                  mov byte ptr [ebp-3C], al
:0043D83B E987FFFFFF              jmp 0043D7C7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043D803(C), :0043D82B(C)
|
:0043D840 8B45F0                  mov eax, dword ptr [ebp-10]
:0043D843 C1E004                  shl eax, 04
:0043D846 3B45A8                  cmp eax, dword ptr [ebp-58]
:0043D849 0F8742000000            ja 0043D891
:0043D84F 8B45E4                  mov eax, dword ptr [ebp-1C]
:0043D852 C1E004                  shl eax, 04
:0043D855 3B45A8                  cmp eax, dword ptr [ebp-58]
:0043D858 0F8633000000            jbe 0043D891
:0043D85E 8B45BC                  mov eax, dword ptr [ebp-44]
:0043D861 C1E004                  shl eax, 04
:0043D864 83C030                  add eax, 00000030
:0043D867 3B459C                  cmp eax, dword ptr [ebp-64]
:0043D86A 0F8721000000            ja 0043D891
:0043D870 8B45B4                  mov eax, dword ptr [ebp-4C]
:0043D873 C1E004                  shl eax, 04
:0043D876 83C030                  add eax, 00000030
:0043D879 3B459C                  cmp eax, dword ptr [ebp-64]
:0043D87C 0F860F000000            jbe 0043D891
:0043D882 33C0                    xor eax, eax
:0043D884 8A45C4                  mov al, byte ptr [ebp-3C]
:0043D887 24FB                    and al, FB
:0043D889 8845C4                  mov byte ptr [ebp-3C], al
:0043D88C E936FFFFFF              jmp 0043D7C7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043D7F3(C), :0043D849(C), :0043D858(C), :0043D86A(C), :0043D87C(C)
|
:0043D891 8B458C                  mov eax, dword ptr [ebp-74]
:0043D894 8A00                    mov al, byte ptr [eax]
:0043D896 8845F4                  mov byte ptr [ebp-0C], al
:0043D899 8B8570FFFFFF            mov eax, dword ptr [ebp+FFFFFF70]
:0043D89F 83782800                cmp dword ptr [eax+28], 00000000
:0043D8A3 0F8425000000            je 0043D8CE
:0043D8A9 8B45F8                  mov eax, dword ptr [ebp-08]
:0043D8AC 33C9                    xor ecx, ecx
:0043D8AE 8A08                    mov cl, byte ptr [eax]
:0043D8B0 81F9FF000000            cmp ecx, 000000FF
:0043D8B6 0F8409000000            je 0043D8C5
:0043D8BC C6459800                mov [ebp-68], 00
:0043D8C0 E904000000              jmp 0043D8C9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D8B6(C)
|
:0043D8C5 C6459801                mov [ebp-68], 01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D8C0(U)
|
:0043D8C9 E904000000              jmp 0043D8D2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D8A3(C)
|
:0043D8CE C6459800                mov [ebp-68], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D8C9(U)
|
:0043D8D2 8B459C                  mov eax, dword ptr [ebp-64]
:0043D8D5 50                      push eax
:0043D8D6 8B45A8                  mov eax, dword ptr [ebp-58]
:0043D8D9 50                      push eax
:0043D8DA 8B8D70FFFFFF            mov ecx, dword ptr [ebp+FFFFFF70]
:0043D8E0 E872FAFFFF              call 0043D357
:0043D8E5 85C0                    test eax, eax
:0043D8E7 0F8420000000            je 0043D90D
:0043D8ED 33C0                    xor eax, eax
:0043D8EF 8A45C4                  mov al, byte ptr [ebp-3C]
:0043D8F2 0C01                    or al, 01
:0043D8F4 8845C4                  mov byte ptr [ebp-3C], al
:0043D8F7 6A04                    push 00000004
:0043D8F9 6A00                    push 00000000
:0043D8FB 6800000100              push 00010000
:0043D900 B9E8E44600              mov ecx, 0046E4E8
:0043D905 E8169E0000              call 00447720
:0043D90A 8945E0                  mov dword ptr [ebp-20], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D8E7(C)
|
:0043D90D 8B5D8C                  mov ebx, dword ptr [ebp-74]
:0043D910 B950F94600              mov ecx, 0046F950
:0043D915 E8C6B7FCFF              call 004090E0
:0043D91A 2BD8                    sub ebx, eax
:0043D91C 895DB8                  mov dword ptr [ebp-48], ebx
:0043D91F 833D5836450000          cmp dword ptr [00453658], 00000000
:0043D926 0F841D000000            je 0043D949
:0043D92C 6A04                    push 00000004
:0043D92E 6A00                    push 00000000
:0043D930 8B45B8                  mov eax, dword ptr [ebp-48]
:0043D933 C1E008                  shl eax, 08
:0043D936 50                      push eax
:0043D937 B980F94600              mov ecx, 0046F980
:0043D93C E8DF9D0000              call 00447720
:0043D941 8945E8                  mov dword ptr [ebp-18], eax
:0043D944 E91D000000              jmp 0043D966

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D926(C)
|
:0043D949 33DB                    xor ebx, ebx
:0043D94B 8A5DF4                  mov bl, byte ptr [ebp-0C]
:0043D94E C1E308                  shl ebx, 08
:0043D951 6A04                    push 00000004
:0043D953 6A00                    push 00000000
:0043D955 6A00                    push 00000000
:0043D957 B9E8E44600              mov ecx, 0046E4E8
:0043D95C E8BF9D0000              call 00447720
:0043D961 03D8                    add ebx, eax
:0043D963 895DE8                  mov dword ptr [ebp-18], ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D944(U)
|
:0043D966 33C0                    xor eax, eax
:0043D968 8A4588                  mov al, byte ptr [ebp-78]
:0043D96B 3DFF000000              cmp eax, 000000FF
:0043D970 0F846A000000            je 0043D9E0
:0043D976 33C0                    xor eax, eax
:0043D978 8A4588                  mov al, byte ptr [ebp-78]
:0043D97B 83F82D                  cmp eax, 0000002D
:0043D97E 0F8C1A000000            jl 0043D99E
:0043D984 33C0                    xor eax, eax
:0043D986 8A4588                  mov al, byte ptr [ebp-78]
:0043D989 3DFF000000              cmp eax, 000000FF
:0043D98E 0F840A000000            je 0043D99E
:0043D994 33C0                    xor eax, eax
:0043D996 8A45C4                  mov al, byte ptr [ebp-3C]
:0043D999 0C02                    or al, 02
:0043D99B 8845C4                  mov byte ptr [ebp-3C], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043D97E(C), :0043D98E(C)
|
:0043D99E B998FC4600              mov ecx, 0046FC98
:0043D9A3 E8E871FEFF              call 00424B90
:0043D9A8 33C9                    xor ecx, ecx
:0043D9AA 8AC8                    mov cl, al
:0043D9AC 85C9                    test ecx, ecx
:0043D9AE 0F850F000000            jne 0043D9C3
:0043D9B4 C7857CFFFFFF00000000    mov dword ptr [ebp+FFFFFF7C], 00000000
:0043D9BE E90A000000              jmp 0043D9CD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D9AE(C)
|
:0043D9C3 C7857CFFFFFF01000000    mov dword ptr [ebp+FFFFFF7C], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D9BE(U)
|
:0043D9CD 8B45D0                  mov eax, dword ptr [ebp-30]
:0043D9D0 C600FF                  mov byte ptr [eax], FF
:0043D9D3 8A4598                  mov al, byte ptr [ebp-68]
:0043D9D6 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043D9D9 8801                    mov byte ptr [ecx], al
:0043D9DB E910000000              jmp 0043D9F0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D970(C)
|
:0043D9E0 8A45F4                  mov al, byte ptr [ebp-0C]
:0043D9E3 8B4DD0                  mov ecx, dword ptr [ebp-30]
:0043D9E6 8801                    mov byte ptr [ecx], al
:0043D9E8 8A4598                  mov al, byte ptr [ebp-68]
:0043D9EB 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043D9EE 8801                    mov byte ptr [ecx], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D9DB(U)
|
:0043D9F0 33C0                    xor eax, eax
:0043D9F2 8A4598                  mov al, byte ptr [ebp-68]
:0043D9F5 85C0                    test eax, eax
:0043D9F7 0F851F000000            jne 0043DA1C
:0043D9FD 6A00                    push 00000000
:0043D9FF 8B45E8                  mov eax, dword ptr [ebp-18]
:0043DA02 50                      push eax
:0043DA03 6A10                    push 00000010
:0043DA05 6A10                    push 00000010
:0043DA07 8B459C                  mov eax, dword ptr [ebp-64]
:0043DA0A 50                      push eax
:0043DA0B 8B45A8                  mov eax, dword ptr [ebp-58]
:0043DA0E 50                      push eax
:0043DA0F E8A1F8FFFF              call 0043D2B5
:0043DA14 83C418                  add esp, 00000018
:0043DA17 E914000000              jmp 0043DA30

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D9F7(C)
|
:0043DA1C 8B45E8                  mov eax, dword ptr [ebp-18]
:0043DA1F 50                      push eax
:0043DA20 8B459C                  mov eax, dword ptr [ebp-64]
:0043DA23 50                      push eax
:0043DA24 8B45A8                  mov eax, dword ptr [ebp-58]
:0043DA27 50                      push eax
:0043DA28 E89E020000              call 0043DCCB
:0043DA2D 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DA17(U)
|
:0043DA30 E992FDFFFF              jmp 0043D7C7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D7E3(C)
|
:0043DA35 E94EFDFFFF              jmp 0043D788

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D7B6(C)
|
:0043DA3A 8B857CFFFFFF            mov eax, dword ptr [ebp+FFFFFF7C]
:0043DA40 8D04C0                  lea eax, dword ptr [eax+8*eax]
:0043DA43 C1E008                  shl eax, 08
:0043DA46 89857CFFFFFF            mov dword ptr [ebp+FFFFFF7C], eax
:0043DA4C 33C0                    xor eax, eax
:0043DA4E 8A45C4                  mov al, byte ptr [ebp-3C]
:0043DA51 A801                    test al, 01
:0043DA53 0F841A000000            je 0043DA73
:0043DA59 6A04                    push 00000004
:0043DA5B 8B45E0                  mov eax, dword ptr [ebp-20]
:0043DA5E 50                      push eax
:0043DA5F 6A30                    push 00000030
:0043DA61 6A30                    push 00000030
:0043DA63 8B45C8                  mov eax, dword ptr [ebp-38]
:0043DA66 50                      push eax
:0043DA67 8B45D8                  mov eax, dword ptr [ebp-28]
:0043DA6A 50                      push eax
:0043DA6B E845F8FFFF              call 0043D2B5
:0043DA70 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DA53(C)
|
:0043DA73 33C0                    xor eax, eax
:0043DA75 8A45C4                  mov al, byte ptr [ebp-3C]
:0043DA78 A802                    test al, 02
:0043DA7A 0F844E000000            je 0043DACE
:0043DA80 33C0                    xor eax, eax
:0043DA82 8A45C4                  mov al, byte ptr [ebp-3C]
:0043DA85 A804                    test al, 04
:0043DA87 0F8441000000            je 0043DACE
:0043DA8D 6A04                    push 00000004
:0043DA8F 33DB                    xor ebx, ebx
:0043DA91 8A5D88                  mov bl, byte ptr [ebp-78]
:0043DA94 8D9CDB6BFEFFFF          lea ebx, dword ptr [ebx+8*ebx-00000195]
:0043DA9B C1E309                  shl ebx, 09
:0043DA9E 6A04                    push 00000004
:0043DAA0 6A00                    push 00000000
:0043DAA2 6800F20200              push 0002F200
:0043DAA7 B9E8E44600              mov ecx, 0046E4E8
:0043DAAC E86F9C0000              call 00447720
:0043DAB1 03D8                    add ebx, eax
:0043DAB3 039D7CFFFFFF            add ebx, dword ptr [ebp+FFFFFF7C]
:0043DAB9 53                      push ebx
:0043DABA 6A30                    push 00000030
:0043DABC 6A30                    push 00000030
:0043DABE 8B45C8                  mov eax, dword ptr [ebp-38]
:0043DAC1 50                      push eax
:0043DAC2 8B45D8                  mov eax, dword ptr [ebp-28]
:0043DAC5 50                      push eax
:0043DAC6 E8EAF7FFFF              call 0043D2B5
:0043DACB 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043DA7A(C), :0043DA87(C)
|
:0043DACE 33C0                    xor eax, eax
:0043DAD0 8A4588                  mov al, byte ptr [ebp-78]
:0043DAD3 83F82D                  cmp eax, 0000002D
:0043DAD6 0F8DD4010000            jnl 0043DCB0
:0043DADC 33C0                    xor eax, eax
:0043DADE 8A45C4                  mov al, byte ptr [ebp-3C]
:0043DAE1 A804                    test al, 04
:0043DAE3 0F84C7010000            je 0043DCB0
:0043DAE9 33C0                    xor eax, eax
:0043DAEB 8A4588                  mov al, byte ptr [ebp-78]
:0043DAEE 8BC8                    mov ecx, eax
:0043DAF0 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043DAF3 C1E003                  shl eax, 03
:0043DAF6 2BC1                    sub eax, ecx
:0043DAF8 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043DAFE E82DBDFCFF              call 00409830
:0043DB03 33C9                    xor ecx, ecx
:0043DB05 8AC8                    mov cl, al
:0043DB07 83F902                  cmp ecx, 00000002
:0043DB0A 0F85A0010000            jne 0043DCB0
:0043DB10 33C0                    xor eax, eax
:0043DB12 8A4588                  mov al, byte ptr [ebp-78]
:0043DB15 8BC8                    mov ecx, eax
:0043DB17 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043DB1A C1E003                  shl eax, 03
:0043DB1D 2BC1                    sub eax, ecx
:0043DB1F 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043DB25 E85C03FFFF              call 0042DE86
:0043DB2A 85C0                    test eax, eax
:0043DB2C 0F844A010000            je 0043DC7C
:0043DB32 6A10                    push 00000010
:0043DB34 33C0                    xor eax, eax
:0043DB36 8A4588                  mov al, byte ptr [ebp-78]
:0043DB39 8BC8                    mov ecx, eax
:0043DB3B 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043DB3E C1E003                  shl eax, 03
:0043DB41 2BC1                    sub eax, ecx
:0043DB43 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043DB49 E802B6FCFF              call 00409150
:0043DB4E 85C0                    test eax, eax
:0043DB50 0F85CA000000            jne 0043DC20
:0043DB56 6A40                    push 00000040
:0043DB58 33C0                    xor eax, eax
:0043DB5A 8A4588                  mov al, byte ptr [ebp-78]
:0043DB5D 8BC8                    mov ecx, eax
:0043DB5F 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043DB62 C1E003                  shl eax, 03
:0043DB65 2BC1                    sub eax, ecx
:0043DB67 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043DB6D E8EEB7FCFF              call 00409360
:0043DB72 85C0                    test eax, eax
:0043DB74 0F856D000000            jne 0043DBE7
:0043DB7A 6880000000              push 00000080
:0043DB7F 33C0                    xor eax, eax
:0043DB81 8A4588                  mov al, byte ptr [ebp-78]
:0043DB84 8BC8                    mov ecx, eax
:0043DB86 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043DB89 C1E003                  shl eax, 03
:0043DB8C 2BC1                    sub eax, ecx
:0043DB8E 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043DB94 E8C7B7FCFF              call 00409360
:0043DB99 85C0                    test eax, eax
:0043DB9B 0F8546000000            jne 0043DBE7
:0043DBA1 6A04                    push 00000004
:0043DBA3 6A04                    push 00000004
:0043DBA5 6A00                    push 00000000
:0043DBA7 33C0                    xor eax, eax
:0043DBA9 8A4588                  mov al, byte ptr [ebp-78]
:0043DBAC 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043DBAF 8D04C0                  lea eax, dword ptr [eax+8*eax]
:0043DBB2 C1E009                  shl eax, 09
:0043DBB5 50                      push eax
:0043DBB6 B9D0E44600              mov ecx, 0046E4D0
:0043DBBB E8609B0000              call 00447720
:0043DBC0 8B8D7CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF7C]
:0043DBC6 8D840100120000          lea eax, dword ptr [ecx+eax+00001200]
:0043DBCD 50                      push eax
:0043DBCE 6A30                    push 00000030
:0043DBD0 6A30                    push 00000030
:0043DBD2 8B45C8                  mov eax, dword ptr [ebp-38]
:0043DBD5 50                      push eax
:0043DBD6 8B45D8                  mov eax, dword ptr [ebp-28]
:0043DBD9 50                      push eax
:0043DBDA E8D6F6FFFF              call 0043D2B5
:0043DBDF 83C418                  add esp, 00000018
:0043DBE2 E934000000              jmp 0043DC1B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043DB74(C), :0043DB9B(C)
|
:0043DBE7 6A04                    push 00000004
:0043DBE9 33DB                    xor ebx, ebx
:0043DBEB 8A5D88                  mov bl, byte ptr [ebp-78]
:0043DBEE 8D1CDB                  lea ebx, dword ptr [ebx+8*ebx]
:0043DBF1 C1E308                  shl ebx, 08
:0043DBF4 6A04                    push 00000004
:0043DBF6 6A00                    push 00000000
:0043DBF8 6A00                    push 00000000
:0043DBFA B980E34600              mov ecx, 0046E380
:0043DBFF E81C9B0000              call 00447720
:0043DC04 03D8                    add ebx, eax
:0043DC06 53                      push ebx
:0043DC07 6A30                    push 00000030
:0043DC09 6A30                    push 00000030
:0043DC0B 8B45C8                  mov eax, dword ptr [ebp-38]
:0043DC0E 50                      push eax
:0043DC0F 8B45D8                  mov eax, dword ptr [ebp-28]
:0043DC12 50                      push eax
:0043DC13 E89DF6FFFF              call 0043D2B5
:0043DC18 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DBE2(U)
|
:0043DC1B E957000000              jmp 0043DC77

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DB50(C)
|
:0043DC20 6A04                    push 00000004
:0043DC22 33C0                    xor eax, eax
:0043DC24 8A4588                  mov al, byte ptr [ebp-78]
:0043DC27 8BC8                    mov ecx, eax
:0043DC29 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043DC2C C1E003                  shl eax, 03
:0043DC2F 2BC1                    sub eax, ecx
:0043DC31 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043DC37 E8E4B5FCFF              call 00409220
:0043DC3C 83F801                  cmp eax, 00000001
:0043DC3F 1BDB                    sbb ebx, ebx
:0043DC41 81E300120000            and ebx, 00001200
:0043DC47 6A04                    push 00000004
:0043DC49 6A00                    push 00000000
:0043DC4B 6800040300              push 00030400
:0043DC50 B9E8E44600              mov ecx, 0046E4E8
:0043DC55 E8C69A0000              call 00447720
:0043DC5A 03D8                    add ebx, eax
:0043DC5C 039D7CFFFFFF            add ebx, dword ptr [ebp+FFFFFF7C]
:0043DC62 53                      push ebx
:0043DC63 6A30                    push 00000030
:0043DC65 6A30                    push 00000030
:0043DC67 8B45C8                  mov eax, dword ptr [ebp-38]
:0043DC6A 50                      push eax
:0043DC6B 8B45D8                  mov eax, dword ptr [ebp-28]
:0043DC6E 50                      push eax
:0043DC6F E841F6FFFF              call 0043D2B5
:0043DC74 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DC1B(U)
|
:0043DC77 E934000000              jmp 0043DCB0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DB2C(C)
|
:0043DC7C 6A04                    push 00000004
:0043DC7E 33DB                    xor ebx, ebx
:0043DC80 8A5D88                  mov bl, byte ptr [ebp-78]
:0043DC83 8D1CDB                  lea ebx, dword ptr [ebx+8*ebx]
:0043DC86 C1E308                  shl ebx, 08
:0043DC89 6A04                    push 00000004
:0043DC8B 6A00                    push 00000000
:0043DC8D 6A00                    push 00000000
:0043DC8F B980E34600              mov ecx, 0046E380
:0043DC94 E8879A0000              call 00447720
:0043DC99 03D8                    add ebx, eax
:0043DC9B 53                      push ebx
:0043DC9C 6A30                    push 00000030
:0043DC9E 6A30                    push 00000030
:0043DCA0 8B45C8                  mov eax, dword ptr [ebp-38]
:0043DCA3 50                      push eax
:0043DCA4 8B45D8                  mov eax, dword ptr [ebp-28]
:0043DCA7 50                      push eax
:0043DCA8 E808F6FFFF              call 0043D2B5
:0043DCAD 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043DAD6(C), :0043DAE3(C), :0043DB0A(C), :0043DC77(U)
|
:0043DCB0 E988FAFFFF              jmp 0043D73D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D759(C)
|
:0043DCB5 E94AFAFFFF              jmp 0043D704

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D72C(C)
|
:0043DCBA E8F892FEFF              call 00426FB7
:0043DCBF E900000000              jmp 0043DCC4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DCBF(U)
|
:0043DCC4 5F                      pop edi
:0043DCC5 5E                      pop esi
:0043DCC6 5B                      pop ebx
:0043DCC7 C9                      leave
:0043DCC8 C21000                  ret 0010



* Referenced by a CALL at Address:
|:0043DA28   
|
:0043DCCB 55                      push ebp
:0043DCCC 8BEC                    mov ebp, esp
:0043DCCE 81EC0C010000            sub esp, 0000010C
:0043DCD4 53                      push ebx
:0043DCD5 56                      push esi
:0043DCD6 57                      push edi
:0043DCD7 6800010000              push 00000100
:0043DCDC 8D85F8FEFFFF            lea eax, dword ptr [ebp+FFFFFEF8]
:0043DCE2 50                      push eax
:0043DCE3 8B4510                  mov eax, dword ptr [ebp+10]
:0043DCE6 50                      push eax
:0043DCE7 E861970000              call 0044744D
:0043DCEC 83C40C                  add esp, 0000000C
:0043DCEF 8D85F8FEFFFF            lea eax, dword ptr [ebp+FFFFFEF8]
:0043DCF5 8945FC                  mov dword ptr [ebp-04], eax
:0043DCF8 C745F800000000          mov [ebp-08], 00000000
:0043DCFF E903000000              jmp 0043DD07

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DE1D(U)
|
:0043DD04 FF45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DCFF(U)
|
:0043DD07 837DF808                cmp dword ptr [ebp-08], 00000008
:0043DD0B 0F8311010000            jnb 0043DE22
:0043DD11 C785F4FEFFFF00000000    mov dword ptr [ebp+FFFFFEF4], 00000000
:0043DD1B E906000000              jmp 0043DD26

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DD4F(U)
|
:0043DD20 FF85F4FEFFFF            inc dword ptr [ebp+FFFFFEF4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DD1B(U)
|
:0043DD26 83BDF4FEFFFF04          cmp dword ptr [ebp+FFFFFEF4], 00000004
:0043DD2D 0F8321000000            jnb 0043DD54
:0043DD33 8B45FC                  mov eax, dword ptr [ebp-04]
:0043DD36 33C9                    xor ecx, ecx
:0043DD38 668B08                  mov cx, word ptr [eax]
:0043DD3B 33C0                    xor eax, eax
:0043DD3D 66A1E8324500            mov ax, word ptr [004532E8]
:0043DD43 23C8                    and ecx, eax
:0043DD45 8B45FC                  mov eax, dword ptr [ebp-04]
:0043DD48 668908                  mov word ptr [eax], cx
:0043DD4B 8345FC02                add dword ptr [ebp-04], 00000002
:0043DD4F E9CCFFFFFF              jmp 0043DD20

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DD2D(C)
|
:0043DD54 C785F4FEFFFF00000000    mov dword ptr [ebp+FFFFFEF4], 00000000
:0043DD5E E906000000              jmp 0043DD69

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DD92(U)
|
:0043DD63 FF85F4FEFFFF            inc dword ptr [ebp+FFFFFEF4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DD5E(U)
|
:0043DD69 83BDF4FEFFFF04          cmp dword ptr [ebp+FFFFFEF4], 00000004
:0043DD70 0F8321000000            jnb 0043DD97
:0043DD76 8B45FC                  mov eax, dword ptr [ebp-04]
:0043DD79 33C9                    xor ecx, ecx
:0043DD7B 668B08                  mov cx, word ptr [eax]
:0043DD7E 33C0                    xor eax, eax
:0043DD80 66A1EC324500            mov ax, word ptr [004532EC]
:0043DD86 23C8                    and ecx, eax
:0043DD88 8B45FC                  mov eax, dword ptr [ebp-04]
:0043DD8B 668908                  mov word ptr [eax], cx
:0043DD8E 8345FC02                add dword ptr [ebp-04], 00000002
:0043DD92 E9CCFFFFFF              jmp 0043DD63

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DD70(C)
|
:0043DD97 C785F4FEFFFF00000000    mov dword ptr [ebp+FFFFFEF4], 00000000
:0043DDA1 E906000000              jmp 0043DDAC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DDD5(U)
|
:0043DDA6 FF85F4FEFFFF            inc dword ptr [ebp+FFFFFEF4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DDA1(U)
|
:0043DDAC 83BDF4FEFFFF04          cmp dword ptr [ebp+FFFFFEF4], 00000004
:0043DDB3 0F8321000000            jnb 0043DDDA
:0043DDB9 8B45FC                  mov eax, dword ptr [ebp-04]
:0043DDBC 33C9                    xor ecx, ecx
:0043DDBE 668B08                  mov cx, word ptr [eax]
:0043DDC1 33C0                    xor eax, eax
:0043DDC3 66A1F0324500            mov ax, word ptr [004532F0]
:0043DDC9 23C8                    and ecx, eax
:0043DDCB 8B45FC                  mov eax, dword ptr [ebp-04]
:0043DDCE 668908                  mov word ptr [eax], cx
:0043DDD1 8345FC02                add dword ptr [ebp-04], 00000002
:0043DDD5 E9CCFFFFFF              jmp 0043DDA6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DDB3(C)
|
:0043DDDA C785F4FEFFFF00000000    mov dword ptr [ebp+FFFFFEF4], 00000000
:0043DDE4 E906000000              jmp 0043DDEF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DE18(U)
|
:0043DDE9 FF85F4FEFFFF            inc dword ptr [ebp+FFFFFEF4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DDE4(U)
|
:0043DDEF 83BDF4FEFFFF04          cmp dword ptr [ebp+FFFFFEF4], 00000004
:0043DDF6 0F8321000000            jnb 0043DE1D
:0043DDFC 8B45FC                  mov eax, dword ptr [ebp-04]
:0043DDFF 33C9                    xor ecx, ecx
:0043DE01 668B08                  mov cx, word ptr [eax]
:0043DE04 33C0                    xor eax, eax
:0043DE06 66A1F4324500            mov ax, word ptr [004532F4]
:0043DE0C 23C8                    and ecx, eax
:0043DE0E 8B45FC                  mov eax, dword ptr [ebp-04]
:0043DE11 668908                  mov word ptr [eax], cx
:0043DE14 8345FC02                add dword ptr [ebp-04], 00000002
:0043DE18 E9CCFFFFFF              jmp 0043DDE9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DDF6(C)
|
:0043DE1D E9E2FEFFFF              jmp 0043DD04

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DD0B(C)
|
:0043DE22 6A00                    push 00000000
:0043DE24 8D85F8FEFFFF            lea eax, dword ptr [ebp+FFFFFEF8]
:0043DE2A 50                      push eax
:0043DE2B 6A10                    push 00000010
:0043DE2D 6A10                    push 00000010
:0043DE2F 8B450C                  mov eax, dword ptr [ebp+0C]
:0043DE32 50                      push eax
:0043DE33 8B4508                  mov eax, dword ptr [ebp+08]
:0043DE36 50                      push eax
:0043DE37 E879F4FFFF              call 0043D2B5
:0043DE3C 83C418                  add esp, 00000018
:0043DE3F E900000000              jmp 0043DE44

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DE3F(U)
|
:0043DE44 5F                      pop edi
:0043DE45 5E                      pop esi
:0043DE46 5B                      pop ebx
:0043DE47 C9                      leave
:0043DE48 C3                      ret



* Referenced by a CALL at Address:
|:0043D821   
|
:0043DE49 55                      push ebp
:0043DE4A 8BEC                    mov ebp, esp
:0043DE4C 83EC0C                  sub esp, 0000000C
:0043DE4F 53                      push ebx
:0043DE50 56                      push esi
:0043DE51 57                      push edi
:0043DE52 C745F400000000          mov [ebp-0C], 00000000
:0043DE59 B903000000              mov ecx, 00000003
:0043DE5E 8B4510                  mov eax, dword ptr [ebp+10]
:0043DE61 2BD2                    sub edx, edx
:0043DE63 F7F1                    div ecx
:0043DE65 8855FC                  mov byte ptr [ebp-04], dl
:0043DE68 B903000000              mov ecx, 00000003
:0043DE6D 8B4514                  mov eax, dword ptr [ebp+14]
:0043DE70 2BD2                    sub edx, edx
:0043DE72 F7F1                    div ecx
:0043DE74 8855F8                  mov byte ptr [ebp-08], dl
:0043DE77 33C0                    xor eax, eax
:0043DE79 33C9                    xor ecx, ecx
:0043DE7B 8A4DFC                  mov cl, byte ptr [ebp-04]
:0043DE7E 2BC1                    sub eax, ecx
:0043DE80 F7D8                    neg eax
:0043DE82 294510                  sub dword ptr [ebp+10], eax
:0043DE85 33C0                    xor eax, eax
:0043DE87 33C9                    xor ecx, ecx
:0043DE89 8A4DF8                  mov cl, byte ptr [ebp-08]
:0043DE8C 2BC1                    sub eax, ecx
:0043DE8E F7D8                    neg eax
:0043DE90 294514                  sub dword ptr [ebp+14], eax
:0043DE93 33C0                    xor eax, eax
:0043DE95 8A45FC                  mov al, byte ptr [ebp-04]
:0043DE98 014518                  add dword ptr [ebp+18], eax
:0043DE9B 33C0                    xor eax, eax
:0043DE9D 8A45F8                  mov al, byte ptr [ebp-08]
:0043DEA0 01451C                  add dword ptr [ebp+1C], eax
:0043DEA3 B903000000              mov ecx, 00000003
:0043DEA8 8B4518                  mov eax, dword ptr [ebp+18]
:0043DEAB 2BD2                    sub edx, edx
:0043DEAD F7F1                    div ecx
:0043DEAF 85D2                    test edx, edx
:0043DEB1 0F8505000000            jne 0043DEBC
:0043DEB7 E916000000              jmp 0043DED2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DEB1(C)
|
:0043DEBC B903000000              mov ecx, 00000003
:0043DEC1 BB03000000              mov ebx, 00000003
:0043DEC6 8B4518                  mov eax, dword ptr [ebp+18]
:0043DEC9 2BD2                    sub edx, edx
:0043DECB F7F3                    div ebx
:0043DECD 2BCA                    sub ecx, edx
:0043DECF 014D18                  add dword ptr [ebp+18], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DEB7(U)
|
:0043DED2 B903000000              mov ecx, 00000003
:0043DED7 8B451C                  mov eax, dword ptr [ebp+1C]
:0043DEDA 2BD2                    sub edx, edx
:0043DEDC F7F1                    div ecx
:0043DEDE 85D2                    test edx, edx
:0043DEE0 0F8505000000            jne 0043DEEB
:0043DEE6 E916000000              jmp 0043DF01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DEE0(C)
|
:0043DEEB B903000000              mov ecx, 00000003
:0043DEF0 BB03000000              mov ebx, 00000003
:0043DEF5 8B451C                  mov eax, dword ptr [ebp+1C]
:0043DEF8 2BD2                    sub edx, edx
:0043DEFA F7F3                    div ebx
:0043DEFC 2BCA                    sub ecx, edx
:0043DEFE 014D1C                  add dword ptr [ebp+1C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DEE6(U)
|
:0043DF01 B900FB4600              mov ecx, 0046FB00
:0043DF06 E8F500FFFF              call 0042E000
:0043DF0B 8B4D10                  mov ecx, dword ptr [ebp+10]
:0043DF0E C1E104                  shl ecx, 04
:0043DF11 03C1                    add eax, ecx
:0043DF13 894510                  mov dword ptr [ebp+10], eax
:0043DF16 B900FB4600              mov ecx, 0046FB00
:0043DF1B E80001FFFF              call 0042E020
:0043DF20 8B4D14                  mov ecx, dword ptr [ebp+14]
:0043DF23 C1E104                  shl ecx, 04
:0043DF26 03C1                    add eax, ecx
:0043DF28 894514                  mov dword ptr [ebp+14], eax
:0043DF2B B900FB4600              mov ecx, 0046FB00
:0043DF30 E8CB00FFFF              call 0042E000
:0043DF35 8B4D18                  mov ecx, dword ptr [ebp+18]
:0043DF38 C1E104                  shl ecx, 04
:0043DF3B 03C1                    add eax, ecx
:0043DF3D 894518                  mov dword ptr [ebp+18], eax
:0043DF40 B900FB4600              mov ecx, 0046FB00
:0043DF45 E8D600FFFF              call 0042E020
:0043DF4A 8B4D1C                  mov ecx, dword ptr [ebp+1C]
:0043DF4D C1E104                  shl ecx, 04
:0043DF50 03C1                    add eax, ecx
:0043DF52 89451C                  mov dword ptr [ebp+1C], eax
:0043DF55 8B4508                  mov eax, dword ptr [ebp+08]
:0043DF58 394510                  cmp dword ptr [ebp+10], eax
:0043DF5B 0F872B000000            ja 0043DF8C
:0043DF61 8B4508                  mov eax, dword ptr [ebp+08]
:0043DF64 394518                  cmp dword ptr [ebp+18], eax
:0043DF67 0F861F000000            jbe 0043DF8C
:0043DF6D 8B450C                  mov eax, dword ptr [ebp+0C]
:0043DF70 394514                  cmp dword ptr [ebp+14], eax
:0043DF73 0F8713000000            ja 0043DF8C
:0043DF79 8B450C                  mov eax, dword ptr [ebp+0C]
:0043DF7C 39451C                  cmp dword ptr [ebp+1C], eax
:0043DF7F 0F8607000000            jbe 0043DF8C
:0043DF85 C745F401000000          mov [ebp-0C], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043DF5B(C), :0043DF67(C), :0043DF73(C), :0043DF7F(C)
|
:0043DF8C 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043DF8F E900000000              jmp 0043DF94

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DF8F(U)
|
:0043DF94 5F                      pop edi
:0043DF95 5E                      pop esi
:0043DF96 5B                      pop ebx
:0043DF97 C9                      leave
:0043DF98 C3                      ret



* Referenced by a CALL at Address:
|:00442FA0   
|
:0043DF99 55                      push ebp
:0043DF9A 8BEC                    mov ebp, esp
:0043DF9C 83EC28                  sub esp, 00000028
:0043DF9F 53                      push ebx
:0043DFA0 56                      push esi
:0043DFA1 57                      push edi
:0043DFA2 894DDC                  mov dword ptr [ebp-24], ecx
:0043DFA5 833D1C33450000          cmp dword ptr [0045331C], 00000000
:0043DFAC 0F8432000000            je 0043DFE4
:0043DFB2 C745E800000000          mov [ebp-18], 00000000
:0043DFB9 E903000000              jmp 0043DFC1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DFD5(U)
|
:0043DFBE FF45E8                  inc [ebp-18]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DFB9(U)
|
:0043DFC1 837DE803                cmp dword ptr [ebp-18], 00000003
:0043DFC5 0F830F000000            jnb 0043DFDA
:0043DFCB 8B45E8                  mov eax, dword ptr [ebp-18]
:0043DFCE C68080FB460000          mov byte ptr [eax+0046FB80], 00
:0043DFD5 E9E4FFFFFF              jmp 0043DFBE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DFC5(C)
|
:0043DFDA C7051C33450000000000    mov dword ptr [0045331C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DFAC(C)
|
:0043DFE4 8B4508                  mov eax, dword ptr [ebp+08]
:0043DFE7 33C9                    xor ecx, ecx
:0043DFE9 8A4801                  mov cl, byte ptr [eax+01]
:0043DFEC 85C9                    test ecx, ecx
:0043DFEE 0F8E0D010000            jle 0043E101
:0043DFF4 8B4508                  mov eax, dword ptr [ebp+08]
:0043DFF7 33C9                    xor ecx, ecx
:0043DFF9 8A4801                  mov cl, byte ptr [eax+01]
:0043DFFC 83F904                  cmp ecx, 00000004
:0043DFFF 0F8DFC000000            jnl 0043E101
:0043E005 8B4508                  mov eax, dword ptr [ebp+08]
:0043E008 33C9                    xor ecx, ecx
:0043E00A 8A08                    mov cl, byte ptr [eax]
:0043E00C 83F908                  cmp ecx, 00000008
:0043E00F 0F8DEC000000            jnl 0043E101
:0043E015 C745E400000000          mov [ebp-1C], 00000000
:0043E01C 8B4508                  mov eax, dword ptr [ebp+08]
:0043E01F 33C9                    xor ecx, ecx
:0043E021 8A4801                  mov cl, byte ptr [eax+01]
:0043E024 33C0                    xor eax, eax
:0043E026 8A817FFB4600            mov al, byte ptr [ecx+0046FB7F]
:0043E02C 8945D8                  mov dword ptr [ebp-28], eax
:0043E02F BA01000000              mov edx, 00000001
:0043E034 B907000000              mov ecx, 00000007
:0043E039 8B5D08                  mov ebx, dword ptr [ebp+08]
:0043E03C 33C0                    xor eax, eax
:0043E03E 8A03                    mov al, byte ptr [ebx]
:0043E040 2BC8                    sub ecx, eax
:0043E042 D3E2                    shl edx, cl
:0043E044 8B45D8                  mov eax, dword ptr [ebp-28]
:0043E047 32C2                    xor al, dl
:0043E049 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043E04C 33D2                    xor edx, edx
:0043E04E 8A5101                  mov dl, byte ptr [ecx+01]
:0043E051 88827FFB4600            mov byte ptr [edx+0046FB7F], al
:0043E057 C745E800000000          mov [ebp-18], 00000000
:0043E05E E903000000              jmp 0043E066

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E0D0(U)
|
:0043E063 FF45E8                  inc [ebp-18]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E05E(U)
|
:0043E066 837DE803                cmp dword ptr [ebp-18], 00000003
:0043E06A 0F8365000000            jnb 0043E0D5
:0043E070 837DE400                cmp dword ptr [ebp-1C], 00000000
:0043E074 0F855B000000            jne 0043E0D5
:0043E07A C745E401000000          mov [ebp-1C], 00000001
:0043E081 C745E000000000          mov [ebp-20], 00000000
:0043E088 E903000000              jmp 0043E090

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E0CB(U)
|
:0043E08D FF45E0                  inc [ebp-20]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E088(U)
|
:0043E090 837DE003                cmp dword ptr [ebp-20], 00000003
:0043E094 0F8336000000            jnb 0043E0D0
:0043E09A 8B45E8                  mov eax, dword ptr [ebp-18]
:0043E09D 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043E0A0 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0043E0A3 33D2                    xor edx, edx
:0043E0A5 8A940810334500          mov dl, byte ptr [eax+ecx+00453310]
:0043E0AC 8B45E0                  mov eax, dword ptr [ebp-20]
:0043E0AF 33C9                    xor ecx, ecx
:0043E0B1 8A8880FB4600            mov cl, byte ptr [eax+0046FB80]
:0043E0B7 3BD1                    cmp edx, ecx
:0043E0B9 0F840C000000            je 0043E0CB
:0043E0BF C745E400000000          mov [ebp-1C], 00000000
:0043E0C6 E905000000              jmp 0043E0D0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E0B9(C)
|
:0043E0CB E9BDFFFFFF              jmp 0043E08D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043E094(C), :0043E0C6(U)
|
:0043E0D0 E98EFFFFFF              jmp 0043E063

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043E06A(C), :0043E074(C)
|
:0043E0D5 837DE400                cmp dword ptr [ebp-1C], 00000000
:0043E0D9 0F841D000000            je 0043E0FC

* Possible StringData Ref from Data Obj ->"Ϊģʽ"
                                  |
:0043E0DF 68E0344500              push 004534E0
:0043E0E4 6A00                    push 00000000
:0043E0E6 E84AAEFFFF              call 00438F35
:0043E0EB 83C408                  add esp, 00000008
:0043E0EE 33C0                    xor eax, eax
:0043E0F0 A0A4354500              mov al, byte ptr [004535A4]
:0043E0F5 0C02                    or al, 02
:0043E0F7 A2A4354500              mov byte ptr [004535A4], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E0D9(C)
|
:0043E0FC E94F000000              jmp 0043E150

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043DFEE(C), :0043DFFF(C), :0043E00F(C)
|
:0043E101 8B4508                  mov eax, dword ptr [ebp+08]
:0043E104 33C9                    xor ecx, ecx
:0043E106 8A08                    mov cl, byte ptr [eax]
:0043E108 85C9                    test ecx, ecx
:0043E10A 0F8540000000            jne 0043E150
:0043E110 33C0                    xor eax, eax
:0043E112 A0C9FC4600              mov al, byte ptr [0046FCC9]
:0043E117 48                      dec eax
:0043E118 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043E11B 33D2                    xor edx, edx
:0043E11D 8A5101                  mov dl, byte ptr [ecx+01]
:0043E120 3BC2                    cmp eax, edx
:0043E122 0F8528000000            jne 0043E150
:0043E128 C745E800000000          mov [ebp-18], 00000000
:0043E12F E903000000              jmp 0043E137

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E14B(U)
|
:0043E134 FF45E8                  inc [ebp-18]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E12F(U)
|
:0043E137 837DE803                cmp dword ptr [ebp-18], 00000003
:0043E13B 0F830F000000            jnb 0043E150
:0043E141 8B45E8                  mov eax, dword ptr [ebp-18]
:0043E144 C68080FB460000          mov byte ptr [eax+0046FB80], 00
:0043E14B E9E4FFFFFF              jmp 0043E134

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043E0FC(U), :0043E10A(C), :0043E122(C), :0043E13B(C)
|
:0043E150 8B4508                  mov eax, dword ptr [ebp+08]
:0043E153 33C9                    xor ecx, ecx
:0043E155 8A08                    mov cl, byte ptr [eax]
:0043E157 8D0449                  lea eax, dword ptr [ecx+2*ecx]
:0043E15A 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043E15D 2B4110                  sub eax, dword ptr [ecx+10]
:0043E160 8945F8                  mov dword ptr [ebp-08], eax
:0043E163 8B4508                  mov eax, dword ptr [ebp+08]
:0043E166 33C9                    xor ecx, ecx
:0043E168 8A4801                  mov cl, byte ptr [eax+01]
:0043E16B 8D0449                  lea eax, dword ptr [ecx+2*ecx]
:0043E16E 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043E171 2B4114                  sub eax, dword ptr [ecx+14]
:0043E174 83C003                  add eax, 00000003
:0043E177 8945F0                  mov dword ptr [ebp-10], eax
:0043E17A 8B4508                  mov eax, dword ptr [ebp+08]
:0043E17D 33C9                    xor ecx, ecx
:0043E17F 8A08                    mov cl, byte ptr [eax]
:0043E181 81F9FF000000            cmp ecx, 000000FF
:0043E187 0F8519000000            jne 0043E1A6
:0043E18D 8B4508                  mov eax, dword ptr [ebp+08]
:0043E190 33C9                    xor ecx, ecx
:0043E192 8A4801                  mov cl, byte ptr [eax+01]
:0043E195 81F9FF000000            cmp ecx, 000000FF
:0043E19B 0F8505000000            jne 0043E1A6
:0043E1A1 E954020000              jmp 0043E3FA

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043E187(C), :0043E19B(C)
|
:0043E1A6 B968F94600              mov ecx, 0046F968
:0043E1AB E830AFFCFF              call 004090E0
:0043E1B0 50                      push eax
:0043E1B1 6A30                    push 00000030
:0043E1B3 6A30                    push 00000030
:0043E1B5 8B45F0                  mov eax, dword ptr [ebp-10]
:0043E1B8 C1E004                  shl eax, 04
:0043E1BB 50                      push eax
:0043E1BC 8B45F8                  mov eax, dword ptr [ebp-08]
:0043E1BF C1E004                  shl eax, 04
:0043E1C2 83C008                  add eax, 00000008
:0043E1C5 50                      push eax
:0043E1C6 E890770000              call 0044595B
:0043E1CB 83C414                  add esp, 00000014
:0043E1CE 837DF80E                cmp dword ptr [ebp-08], 0000000E
:0043E1D2 0F8D0C000000            jnl 0043E1E4
:0043E1D8 C745F403000000          mov [ebp-0C], 00000003
:0043E1DF E907000000              jmp 0043E1EB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E1D2(C)
|
:0043E1E4 C745F4F7FFFFFF          mov [ebp-0C], FFFFFFF7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E1DF(U)
|
:0043E1EB 837DF00C                cmp dword ptr [ebp-10], 0000000C
:0043E1EF 0F8D0C000000            jnl 0043E201
:0043E1F5 C745EC00000000          mov [ebp-14], 00000000
:0043E1FC E907000000              jmp 0043E208

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E1EF(C)
|
:0043E201 C745ECFDFFFFFF          mov [ebp-14], FFFFFFFD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E1FC(U)
|
:0043E208 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043E20B 0145F8                  add dword ptr [ebp-08], eax
:0043E20E 8B45EC                  mov eax, dword ptr [ebp-14]
:0043E211 0145F0                  add dword ptr [ebp-10], eax
:0043E214 6A04                    push 00000004
:0043E216 B910BC4600              mov ecx, 0046BC10
:0043E21B E8611CFEFF              call 0041FE81
:0043E220 6A07                    push 00000007
:0043E222 B910BC4600              mov ecx, 0046BC10
:0043E227 E8A71AFEFF              call 0041FCD3
:0043E22C 6A00                    push 00000000
:0043E22E B910BC4600              mov ecx, 0046BC10
:0043E233 E8981BFEFF              call 0041FDD0
:0043E238 E85A8DFEFF              call 00426F97
:0043E23D 6A05                    push 00000005
:0043E23F 6A09                    push 00000009
:0043E241 8B45F0                  mov eax, dword ptr [ebp-10]
:0043E244 83E803                  sub eax, 00000003
:0043E247 50                      push eax
:0043E248 8B45F8                  mov eax, dword ptr [ebp-08]
:0043E24B 50                      push eax
:0043E24C 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043E24F E8F6C3FFFF              call 0043A64A
:0043E254 6A50                    push 00000050
:0043E256 6890000000              push 00000090
:0043E25B 8B45F0                  mov eax, dword ptr [ebp-10]
:0043E25E C1E004                  shl eax, 04
:0043E261 50                      push eax
:0043E262 8B45F8                  mov eax, dword ptr [ebp-08]
:0043E265 C1E004                  shl eax, 04
:0043E268 83C008                  add eax, 00000008
:0043E26B 50                      push eax
:0043E26C E821C2FFFF              call 0043A492
:0043E271 83C410                  add esp, 00000010
:0043E274 6A00                    push 00000000
:0043E276 B968F94600              mov ecx, 0046F968
:0043E27B E860AEFCFF              call 004090E0
:0043E280 50                      push eax
:0043E281 6A30                    push 00000030
:0043E283 6A30                    push 00000030
:0043E285 8B45F0                  mov eax, dword ptr [ebp-10]
:0043E288 C1E004                  shl eax, 04
:0043E28B 83C010                  add eax, 00000010
:0043E28E 50                      push eax
:0043E28F 8B45F8                  mov eax, dword ptr [ebp-08]
:0043E292 C1E004                  shl eax, 04
:0043E295 83C010                  add eax, 00000010
:0043E298 50                      push eax
:0043E299 E817F0FFFF              call 0043D2B5
:0043E29E 83C418                  add esp, 00000018
:0043E2A1 8B4508                  mov eax, dword ptr [ebp+08]
:0043E2A4 50                      push eax
:0043E2A5 E830B3FDFF              call 004195DA
:0043E2AA 83C404                  add esp, 00000004
:0043E2AD 8845FC                  mov byte ptr [ebp-04], al
:0043E2B0 8B45F0                  mov eax, dword ptr [ebp-10]
:0043E2B3 C1E004                  shl eax, 04
:0043E2B6 83C010                  add eax, 00000010
:0043E2B9 50                      push eax
:0043E2BA 8B45F8                  mov eax, dword ptr [ebp-08]
:0043E2BD 03C0                    add eax, eax
:0043E2BF 83C00A                  add eax, 0000000A
:0043E2C2 50                      push eax
:0043E2C3 B910BC4600              mov ecx, 0046BC10
:0043E2C8 E83A19FEFF              call 0041FC07
:0043E2CD 33C0                    xor eax, eax
:0043E2CF 8A45FC                  mov al, byte ptr [ebp-04]
:0043E2D2 8B048568324500          mov eax, dword ptr [4*eax+00453268]
:0043E2D9 50                      push eax

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:0043E2DA 68F0344500              push 004534F0
:0043E2DF 6810BC4600              push 0046BC10
:0043E2E4 E83A28FEFF              call 00420B23
:0043E2E9 83C40C                  add esp, 0000000C
:0043E2EC 8B45F0                  mov eax, dword ptr [ebp-10]
:0043E2EF C1E004                  shl eax, 04
:0043E2F2 83C030                  add eax, 00000030
:0043E2F5 50                      push eax
:0043E2F6 8B45F8                  mov eax, dword ptr [ebp-08]
:0043E2F9 03C0                    add eax, eax
:0043E2FB 83C009                  add eax, 00000009
:0043E2FE 50                      push eax
:0043E2FF B910BC4600              mov ecx, 0046BC10
:0043E304 E8FE18FEFF              call 0041FC07
:0043E309 33C0                    xor eax, eax
:0043E30B 8A45FC                  mov al, byte ptr [ebp-04]
:0043E30E 83F807                  cmp eax, 00000007
:0043E311 0F8438000000            je 0043E34F
:0043E317 33C0                    xor eax, eax
:0043E319 8A45FC                  mov al, byte ptr [ebp-04]
:0043E31C 83F808                  cmp eax, 00000008
:0043E31F 0F842A000000            je 0043E34F
:0043E325 33C0                    xor eax, eax
:0043E327 8A45FC                  mov al, byte ptr [ebp-04]
:0043E32A 83F809                  cmp eax, 00000009
:0043E32D 0F841C000000            je 0043E34F
:0043E333 33C0                    xor eax, eax
:0043E335 8A45FC                  mov al, byte ptr [ebp-04]
:0043E338 83F80C                  cmp eax, 0000000C
:0043E33B 0F840E000000            je 0043E34F
:0043E341 33C0                    xor eax, eax
:0043E343 8A45FC                  mov al, byte ptr [ebp-04]
:0043E346 83F80D                  cmp eax, 0000000D
:0043E349 0F8517000000            jne 0043E366

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043E311(C), :0043E31F(C), :0043E32D(C), :0043E33B(C)
|

* Possible StringData Ref from Data Obj ->"Իָ"
                                  |
:0043E34F 68F4344500              push 004534F4
:0043E354 6810BC4600              push 0046BC10
:0043E359 E8C527FEFF              call 00420B23
:0043E35E 83C408                  add esp, 00000008
:0043E361 E966000000              jmp 0043E3CC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E349(C)
|
:0043E366 33C0                    xor eax, eax
:0043E368 8A45FC                  mov al, byte ptr [ebp-04]
:0043E36B 83F811                  cmp eax, 00000011
:0043E36E 0F8446000000            je 0043E3BA
:0043E374 33C0                    xor eax, eax
:0043E376 8A45FC                  mov al, byte ptr [ebp-04]
:0043E379 83F812                  cmp eax, 00000012
:0043E37C 0F8438000000            je 0043E3BA
:0043E382 33C0                    xor eax, eax
:0043E384 8A45FC                  mov al, byte ptr [ebp-04]
:0043E387 83F813                  cmp eax, 00000013
:0043E38A 0F842A000000            je 0043E3BA
:0043E390 33C0                    xor eax, eax
:0043E392 8A45FC                  mov al, byte ptr [ebp-04]
:0043E395 83F814                  cmp eax, 00000014
:0043E398 0F841C000000            je 0043E3BA
:0043E39E 33C0                    xor eax, eax
:0043E3A0 8A45FC                  mov al, byte ptr [ebp-04]
:0043E3A3 83F815                  cmp eax, 00000015
:0043E3A6 0F840E000000            je 0043E3BA
:0043E3AC 33C0                    xor eax, eax
:0043E3AE 8A45FC                  mov al, byte ptr [ebp-04]
:0043E3B1 83F816                  cmp eax, 00000016
:0043E3B4 0F8512000000            jne 0043E3CC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043E36E(C), :0043E37C(C), :0043E38A(C), :0043E398(C), :0043E3A6(C)
|

* Possible StringData Ref from Data Obj ->"ƶ"
                                  |
:0043E3BA 6800354500              push 00453500
:0043E3BF 6810BC4600              push 0046BC10
:0043E3C4 E85A27FEFF              call 00420B23
:0043E3C9 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043E361(U), :0043E3B4(C)
|
:0043E3CC E8E68BFEFF              call 00426FB7
:0043E3D1 E81191FFFF              call 004374E7
:0043E3D6 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043E3D9 E823000000              call 0043E401
:0043E3DE E80491FFFF              call 004374E7
:0043E3E3 6A01                    push 00000001
:0043E3E5 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043E3E8 E853FCFEFF              call 0042E040
:0043E3ED 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043E3F0 E891C2FFFF              call 0043A686
:0043E3F5 E900000000              jmp 0043E3FA

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043E1A1(U), :0043E3F5(U)
|
:0043E3FA 5F                      pop edi
:0043E3FB 5E                      pop esi
:0043E3FC 5B                      pop ebx
:0043E3FD C9                      leave
:0043E3FE C20400                  ret 0004



* Referenced by a CALL at Address:
|:0043E3D9   
|
:0043E401 55                      push ebp
:0043E402 8BEC                    mov ebp, esp
:0043E404 83EC08                  sub esp, 00000008
:0043E407 53                      push ebx
:0043E408 56                      push esi
:0043E409 57                      push edi
:0043E40A 894DF8                  mov dword ptr [ebp-08], ecx
:0043E40D C645FC0A                mov [ebp-04], 0A
:0043E411 33C0                    xor eax, eax
:0043E413 8A45FC                  mov al, byte ptr [ebp-04]
:0043E416 50                      push eax
:0043E417 E86C7AFEFF              call 00425E88
:0043E41C 83C404                  add esp, 00000004
:0043E41F 6A01                    push 00000001
:0043E421 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043E424 E817FCFEFF              call 0042E040
:0043E429 6A01                    push 00000001
:0043E42B E82A90FFFF              call 0043745A
:0043E430 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E48E(U)
|
:0043E433 E84590FFFF              call 0043747D
:0043E438 85C0                    test eax, eax
:0043E43A 0F8553000000            jne 0043E493
:0043E440 B9B0FA4600              mov ecx, 0046FAB0
:0043E445 E866A2FDFF              call 004186B0
:0043E44A 85C0                    test eax, eax
:0043E44C 0F843C000000            je 0043E48E
:0043E452 33C0                    xor eax, eax
:0043E454 8A45FC                  mov al, byte ptr [ebp-04]
:0043E457 3401                    xor al, 01
:0043E459 8845FC                  mov byte ptr [ebp-04], al
:0043E45C 33C0                    xor eax, eax
:0043E45E 8A45FC                  mov al, byte ptr [ebp-04]
:0043E461 50                      push eax
:0043E462 E8217AFEFF              call 00425E88
:0043E467 83C404                  add esp, 00000004
:0043E46A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043E46D E872C2FFFF              call 0043A6E4
:0043E472 B998FC4600              mov ecx, 0046FC98
:0043E477 E8A4FEFDFF              call 0041E320
:0043E47C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043E47F E81CB4FCFF              call 004098A0
:0043E484 6A01                    push 00000001
:0043E486 E8CF8FFFFF              call 0043745A
:0043E48B 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E44C(C)
|
:0043E48E E9A0FFFFFF              jmp 0043E433

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E43A(C)
|
:0043E493 6A00                    push 00000000
:0043E495 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043E498 E8A3FBFEFF              call 0042E040
:0043E49D 6A00                    push 00000000
:0043E49F E8E479FEFF              call 00425E88
:0043E4A4 83C404                  add esp, 00000004
:0043E4A7 E900000000              jmp 0043E4AC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E4A7(U)
|
:0043E4AC 5F                      pop edi
:0043E4AD 5E                      pop esi
:0043E4AE 5B                      pop ebx
:0043E4AF C9                      leave
:0043E4B0 C3                      ret



* Referenced by a CALL at Addresses:
|:0043C75C   , :0043CE84   , :004425AC   
|
:0043E4B1 55                      push ebp
:0043E4B2 8BEC                    mov ebp, esp
:0043E4B4 83EC08                  sub esp, 00000008
:0043E4B7 53                      push ebx
:0043E4B8 56                      push esi
:0043E4B9 57                      push edi
:0043E4BA 894DF8                  mov dword ptr [ebp-08], ecx
:0043E4BD 33C0                    xor eax, eax
:0043E4BF 8A4508                  mov al, byte ptr [ebp+08]
:0043E4C2 8BC8                    mov ecx, eax
:0043E4C4 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043E4C7 C1E003                  shl eax, 03
:0043E4CA 2BC1                    sub eax, ecx
:0043E4CC 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043E4D2 E859B3FCFF              call 00409830
:0043E4D7 33C9                    xor ecx, ecx
:0043E4D9 8AC8                    mov cl, al
:0043E4DB 83F904                  cmp ecx, 00000004
:0043E4DE 0F845F000000            je 0043E543
:0043E4E4 33C0                    xor eax, eax
:0043E4E6 8A4508                  mov al, byte ptr [ebp+08]
:0043E4E9 8BC8                    mov ecx, eax
:0043E4EB 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043E4EE C1E003                  shl eax, 03
:0043E4F1 2BC1                    sub eax, ecx
:0043E4F3 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043E4F9 E802ADFCFF              call 00409200
:0043E4FE 668B00                  mov ax, word ptr [eax]
:0043E501 668945FC                mov word ptr [ebp-04], ax
:0043E505 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043E508 E842000000              call 0043E54F
:0043E50D 8B45FD                  mov eax, dword ptr [ebp-03]
:0043E510 50                      push eax
:0043E511 8B45FC                  mov eax, dword ptr [ebp-04]
:0043E514 50                      push eax
:0043E515 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043E518 E8CBCCFFFF              call 0043B1E8
:0043E51D 33C0                    xor eax, eax
:0043E51F 8A4508                  mov al, byte ptr [ebp+08]
:0043E522 8BC8                    mov ecx, eax
:0043E524 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043E527 C1E003                  shl eax, 03
:0043E52A 2BC1                    sub eax, ecx
:0043E52C 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043E532 E8F0D9FEFF              call 0042BF27
:0043E537 8D45FC                  lea eax, dword ptr [ebp-04]
:0043E53A 50                      push eax
:0043E53B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043E53E E860000000              call 0043E5A3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E4DE(C)
|
:0043E543 E900000000              jmp 0043E548

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E543(U)
|
:0043E548 5F                      pop edi
:0043E549 5E                      pop esi
:0043E54A 5B                      pop ebx
:0043E54B C9                      leave
:0043E54C C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00404B5D   , :00404D8C   , :00427E18   , :0043A9FC   , :0043D262   
|:0043E508   , :0043E976   , :00441B79   , :00442149   , :004421F4   
|
:0043E54F 55                      push ebp
:0043E550 8BEC                    mov ebp, esp
:0043E552 83EC0C                  sub esp, 0000000C
:0043E555 53                      push ebx
:0043E556 56                      push esi
:0043E557 57                      push edi
:0043E558 894DF4                  mov dword ptr [ebp-0C], ecx
:0043E55B 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043E55E 8A403E                  mov al, byte ptr [eax+3E]
:0043E561 8845FC                  mov byte ptr [ebp-04], al
:0043E564 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043E567 33C9                    xor ecx, ecx
:0043E569 8A483F                  mov cl, byte ptr [eax+3F]
:0043E56C 83E903                  sub ecx, 00000003
:0043E56F 884DF8                  mov byte ptr [ebp-08], cl
:0043E572 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043E575 C6403EFF                mov [eax+3E], FF
:0043E579 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043E57C C6403FFF                mov [eax+3F], FF
:0043E580 6A03                    push 00000003
:0043E582 6A03                    push 00000003
:0043E584 8B45F8                  mov eax, dword ptr [ebp-08]
:0043E587 50                      push eax
:0043E588 8B45FC                  mov eax, dword ptr [ebp-04]
:0043E58B 50                      push eax
:0043E58C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043E58F E899C5FFFF              call 0043AB2D
:0043E594 E89131FCFF              call 0040172A
:0043E599 E900000000              jmp 0043E59E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E599(U)
|
:0043E59E 5F                      pop edi
:0043E59F 5E                      pop esi
:0043E5A0 5B                      pop ebx
:0043E5A1 C9                      leave
:0043E5A2 C3                      ret



* Referenced by a CALL at Addresses:
|:00427DA5   , :0043AA1C   , :0043E53E   
|
:0043E5A3 55                      push ebp
:0043E5A4 8BEC                    mov ebp, esp
:0043E5A6 83EC14                  sub esp, 00000014
:0043E5A9 53                      push ebx
:0043E5AA 56                      push esi
:0043E5AB 57                      push edi
:0043E5AC 894DEC                  mov dword ptr [ebp-14], ecx
:0043E5AF 8B4508                  mov eax, dword ptr [ebp+08]
:0043E5B2 33C9                    xor ecx, ecx
:0043E5B4 8A08                    mov cl, byte ptr [eax]
:0043E5B6 8D0449                  lea eax, dword ptr [ecx+2*ecx]
:0043E5B9 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043E5BC 2B4110                  sub eax, dword ptr [ecx+10]
:0043E5BF 8945FC                  mov dword ptr [ebp-04], eax
:0043E5C2 8B4508                  mov eax, dword ptr [ebp+08]
:0043E5C5 33C9                    xor ecx, ecx
:0043E5C7 8A4801                  mov cl, byte ptr [eax+01]
:0043E5CA 8D0449                  lea eax, dword ptr [ecx+2*ecx]
:0043E5CD 83C003                  add eax, 00000003
:0043E5D0 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043E5D3 2B4114                  sub eax, dword ptr [ecx+14]
:0043E5D6 8945F8                  mov dword ptr [ebp-08], eax
:0043E5D9 837DFC00                cmp dword ptr [ebp-04], 00000000
:0043E5DD 0F82ED000000            jb 0043E6D0
:0043E5E3 8B45EC                  mov eax, dword ptr [ebp-14]
:0043E5E6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043E5E9 394808                  cmp dword ptr [eax+08], ecx
:0043E5EC 0F86DE000000            jbe 0043E6D0
:0043E5F2 837DF800                cmp dword ptr [ebp-08], 00000000
:0043E5F6 0F82D4000000            jb 0043E6D0
:0043E5FC 8B45EC                  mov eax, dword ptr [ebp-14]
:0043E5FF 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043E602 39480C                  cmp dword ptr [eax+0C], ecx
:0043E605 0F86C5000000            jbe 0043E6D0
:0043E60B 8A45FC                  mov al, byte ptr [ebp-04]
:0043E60E 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043E611 88413E                  mov byte ptr [ecx+3E], al
:0043E614 8A45F8                  mov al, byte ptr [ebp-08]
:0043E617 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043E61A 88413F                  mov byte ptr [ecx+3F], al
:0043E61D 6A03                    push 00000003
:0043E61F 6A03                    push 00000003
:0043E621 8B45F8                  mov eax, dword ptr [ebp-08]
:0043E624 83E803                  sub eax, 00000003
:0043E627 50                      push eax
:0043E628 8B45FC                  mov eax, dword ptr [ebp-04]
:0043E62B 50                      push eax
:0043E62C 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043E62F E8F9C4FFFF              call 0043AB2D
:0043E634 8B4508                  mov eax, dword ptr [ebp+08]
:0043E637 33DB                    xor ebx, ebx
:0043E639 8A5801                  mov bl, byte ptr [eax+01]
:0043E63C 33C0                    xor eax, eax
:0043E63E A0C8FC4600              mov al, byte ptr [0046FCC8]
:0043E643 0FAFD8                  imul ebx, eax
:0043E646 8B4508                  mov eax, dword ptr [ebp+08]
:0043E649 33C9                    xor ecx, ecx
:0043E64B 8A08                    mov cl, byte ptr [eax]
:0043E64D 03D9                    add ebx, ecx
:0043E64F 6A04                    push 00000004
:0043E651 6A00                    push 00000000
:0043E653 6A00                    push 00000000
:0043E655 B950F94600              mov ecx, 0046F950
:0043E65A E8C1900000              call 00447720
:0043E65F 8A840380250000          mov al, byte ptr [ebx+eax+00002580]
:0043E666 8845F4                  mov byte ptr [ebp-0C], al
:0043E669 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043E66C 50                      push eax
:0043E66D 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043E670 E8E9C7FFFF              call 0043AE5E
:0043E675 8B4508                  mov eax, dword ptr [ebp+08]
:0043E678 50                      push eax
:0043E679 E85CAFFDFF              call 004195DA
:0043E67E 83C404                  add esp, 00000004
:0043E681 33C9                    xor ecx, ecx
:0043E683 8AC8                    mov cl, al
:0043E685 8B048D68324500          mov eax, dword ptr [4*ecx+00453268]
:0043E68C 8945F0                  mov dword ptr [ebp-10], eax
:0043E68F E8BB30FCFF              call 0040174F
:0043E694 6A0C                    push 0000000C
:0043E696 BB08000000              mov ebx, 00000008
:0043E69B 8B45F0                  mov eax, dword ptr [ebp-10]
:0043E69E 50                      push eax
:0043E69F E8068D0000              call 004473AA
:0043E6A4 83C404                  add esp, 00000004
:0043E6A7 2BD8                    sub ebx, eax
:0043E6A9 C1EB01                  shr ebx, 01
:0043E6AC 83C346                  add ebx, 00000046
:0043E6AF 53                      push ebx
:0043E6B0 B910BC4600              mov ecx, 0046BC10
:0043E6B5 E84D15FEFF              call 0041FC07
:0043E6BA 8B45F0                  mov eax, dword ptr [ebp-10]
:0043E6BD 50                      push eax

* Possible StringData Ref from Data Obj ->"M4C7%s"
                                  |
:0043E6BE 680C354500              push 0045350C
:0043E6C3 6810BC4600              push 0046BC10
:0043E6C8 E85624FEFF              call 00420B23
:0043E6CD 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043E5DD(C), :0043E5EC(C), :0043E5F6(C), :0043E605(C)
|
:0043E6D0 E900000000              jmp 0043E6D5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E6D0(U)
|
:0043E6D5 5F                      pop edi
:0043E6D6 5E                      pop esi
:0043E6D7 5B                      pop ebx
:0043E6D8 C9                      leave
:0043E6D9 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0043B72C   
|
:0043E6DC 55                      push ebp
:0043E6DD 8BEC                    mov ebp, esp
:0043E6DF 83EC10                  sub esp, 00000010
:0043E6E2 53                      push ebx
:0043E6E3 56                      push esi
:0043E6E4 57                      push edi
:0043E6E5 894DF4                  mov dword ptr [ebp-0C], ecx
:0043E6E8 33C0                    xor eax, eax
:0043E6EA A0F4FA4600              mov al, byte ptr [0046FAF4]
:0043E6EF 8BC8                    mov ecx, eax
:0043E6F1 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043E6F4 C1E003                  shl eax, 03
:0043E6F7 2BC1                    sub eax, ecx
:0043E6F9 0598C04600              add eax, 0046C098
:0043E6FE 8945F8                  mov dword ptr [ebp-08], eax
:0043E701 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043E704 E8F7AAFCFF              call 00409200
:0043E709 668B00                  mov ax, word ptr [eax]
:0043E70C 668945FC                mov word ptr [ebp-04], ax
:0043E710 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043E713 33C9                    xor ecx, ecx
:0043E715 8A4849                  mov cl, byte ptr [eax+49]
:0043E718 894DF0                  mov dword ptr [ebp-10], ecx
:0043E71B E96D000000              jmp 0043E78D
:0043E720 6A14                    push 00000014
:0043E722 E86177FEFF              call 00425E88
:0043E727 83C404                  add esp, 00000004
:0043E72A E985000000              jmp 0043E7B4
:0043E72F 6A15                    push 00000015
:0043E731 E85277FEFF              call 00425E88
:0043E736 83C404                  add esp, 00000004
:0043E739 E976000000              jmp 0043E7B4
:0043E73E 8B4508                  mov eax, dword ptr [ebp+08]
:0043E741 50                      push eax
:0043E742 8B45FC                  mov eax, dword ptr [ebp-04]
:0043E745 50                      push eax
:0043E746 E875000000              call 0043E7C0
:0043E74B 83C408                  add esp, 00000008
:0043E74E 33C9                    xor ecx, ecx
:0043E750 8AC8                    mov cl, al
:0043E752 83C10C                  add ecx, 0000000C
:0043E755 51                      push ecx
:0043E756 E82D77FEFF              call 00425E88
:0043E75B 83C404                  add esp, 00000004
:0043E75E E951000000              jmp 0043E7B4
:0043E763 8B4508                  mov eax, dword ptr [ebp+08]
:0043E766 50                      push eax
:0043E767 8B45FC                  mov eax, dword ptr [ebp-04]
:0043E76A 50                      push eax
:0043E76B E850000000              call 0043E7C0
:0043E770 83C408                  add esp, 00000008
:0043E773 33C9                    xor ecx, ecx
:0043E775 8AC8                    mov cl, al
:0043E777 83C110                  add ecx, 00000010
:0043E77A 51                      push ecx
:0043E77B E80877FEFF              call 00425E88
:0043E780 83C404                  add esp, 00000004
:0043E783 E92C000000              jmp 0043E7B4
:0043E788 E927000000              jmp 0043E7B4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E71B(U)
|
:0043E78D FF4DF0                  dec [ebp-10]
:0043E790 837DF003                cmp dword ptr [ebp-10], 00000003
:0043E794 0F871A000000            ja 0043E7B4
:0043E79A 8B45F0                  mov eax, dword ptr [ebp-10]
:0043E79D FF2485A4E74300          jmp dword ptr [4*eax+0043E7A4]

:0043E7A4 20E74300                DWORD 0043E720
:0043E7A8 2FE74300                DWORD 0043E72F
:0043E7AC 3EE74300                DWORD 0043E73E
:0043E7B0 63E74300                DWORD 0043E763



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043E72A(U), :0043E739(U), :0043E75E(U), :0043E783(U), :0043E788(U)
|:0043E794(C)
|
:0043E7B4 E900000000              jmp 0043E7B9
:0043E7B9 5F                      pop edi
:0043E7BA 5E                      pop esi
:0043E7BB 5B                      pop ebx
:0043E7BC C9                      leave
:0043E7BD C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0043E746   , :0043E76B   
|
:0043E7C0 55                      push ebp
:0043E7C1 8BEC                    mov ebp, esp
:0043E7C3 83EC04                  sub esp, 00000004
:0043E7C6 53                      push ebx
:0043E7C7 56                      push esi
:0043E7C8 57                      push edi
:0043E7C9 C645FCFF                mov [ebp-04], FF
:0043E7CD 33C0                    xor eax, eax
:0043E7CF 8A450D                  mov al, byte ptr [ebp+0D]
:0043E7D2 33C9                    xor ecx, ecx
:0043E7D4 8A4D09                  mov cl, byte ptr [ebp+09]
:0043E7D7 3BC1                    cmp eax, ecx
:0043E7D9 0F8D09000000            jnl 0043E7E8
:0043E7DF C645FC00                mov [ebp-04], 00
:0043E7E3 E94C000000              jmp 0043E834

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E7D9(C)
|
:0043E7E8 33C0                    xor eax, eax
:0043E7EA 8A450C                  mov al, byte ptr [ebp+0C]
:0043E7ED 33C9                    xor ecx, ecx
:0043E7EF 8A4D08                  mov cl, byte ptr [ebp+08]
:0043E7F2 3BC1                    cmp eax, ecx
:0043E7F4 0F8E09000000            jle 0043E803
:0043E7FA C645FC01                mov [ebp-04], 01
:0043E7FE E931000000              jmp 0043E834

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E7F4(C)
|
:0043E803 33C0                    xor eax, eax
:0043E805 8A450D                  mov al, byte ptr [ebp+0D]
:0043E808 33C9                    xor ecx, ecx
:0043E80A 8A4D09                  mov cl, byte ptr [ebp+09]
:0043E80D 3BC1                    cmp eax, ecx
:0043E80F 0F8E09000000            jle 0043E81E
:0043E815 C645FC02                mov [ebp-04], 02
:0043E819 E916000000              jmp 0043E834

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E80F(C)
|
:0043E81E 33C0                    xor eax, eax
:0043E820 8A450C                  mov al, byte ptr [ebp+0C]
:0043E823 33C9                    xor ecx, ecx
:0043E825 8A4D08                  mov cl, byte ptr [ebp+08]
:0043E828 3BC1                    cmp eax, ecx
:0043E82A 0F8D04000000            jnl 0043E834
:0043E830 C645FC03                mov [ebp-04], 03

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043E7E3(U), :0043E7FE(U), :0043E819(U), :0043E82A(C)
|
:0043E834 8A45FC                  mov al, byte ptr [ebp-04]
:0043E837 E900000000              jmp 0043E83C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E837(U)
|
:0043E83C 5F                      pop edi
:0043E83D 5E                      pop esi
:0043E83E 5B                      pop ebx
:0043E83F C9                      leave
:0043E840 C3                      ret



* Referenced by a CALL at Address:
|:0040282E   
|
:0043E841 55                      push ebp
:0043E842 8BEC                    mov ebp, esp
:0043E844 83EC08                  sub esp, 00000008
:0043E847 53                      push ebx
:0043E848 56                      push esi
:0043E849 57                      push edi
:0043E84A 894DF8                  mov dword ptr [ebp-08], ecx
:0043E84D 8B45F8                  mov eax, dword ptr [ebp-08]
:0043E850 C6404800                mov [eax+48], 00
:0043E854 33C0                    xor eax, eax
:0043E856 8A4508                  mov al, byte ptr [ebp+08]
:0043E859 3DFF000000              cmp eax, 000000FF
:0043E85E 0F8519000000            jne 0043E87D
:0043E864 8B45F8                  mov eax, dword ptr [ebp-08]
:0043E867 C7404030000000          mov [eax+40], 00000030
:0043E86E 8B45F8                  mov eax, dword ptr [ebp-08]
:0043E871 C7404430000000          mov [eax+44], 00000030
:0043E878 E9DE000000              jmp 0043E95B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E85E(C)
|
:0043E87D 33DB                    xor ebx, ebx
:0043E87F 8A5D08                  mov bl, byte ptr [ebp+08]
:0043E882 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043E885 E8A662FEFF              call 00424B30
:0043E88A B903000000              mov ecx, 00000003
:0043E88F 99                      cdq
:0043E890 F7F9                    idiv ecx
:0043E892 2BD8                    sub ebx, eax
:0043E894 C1E304                  shl ebx, 04
:0043E897 8D1C5B                  lea ebx, dword ptr [ebx+2*ebx]
:0043E89A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043E89D E85EF7FEFF              call 0042E000
:0043E8A2 03D8                    add ebx, eax
:0043E8A4 8B45F8                  mov eax, dword ptr [ebp-08]
:0043E8A7 895840                  mov dword ptr [eax+40], ebx
:0043E8AA 33DB                    xor ebx, ebx
:0043E8AC 8A5D0C                  mov bl, byte ptr [ebp+0C]
:0043E8AF 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043E8B2 E89962FEFF              call 00424B50
:0043E8B7 B903000000              mov ecx, 00000003
:0043E8BC 99                      cdq
:0043E8BD F7F9                    idiv ecx
:0043E8BF 2BD8                    sub ebx, eax
:0043E8C1 C1E304                  shl ebx, 04
:0043E8C4 8D1C5B                  lea ebx, dword ptr [ebx+2*ebx]
:0043E8C7 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043E8CA E851F7FEFF              call 0042E020
:0043E8CF 03D8                    add ebx, eax
:0043E8D1 8B45F8                  mov eax, dword ptr [ebp-08]
:0043E8D4 895844                  mov dword ptr [eax+44], ebx
:0043E8D7 8B45F8                  mov eax, dword ptr [ebp-08]
:0043E8DA 8B4044                  mov eax, dword ptr [eax+44]
:0043E8DD C1E804                  shr eax, 04
:0043E8E0 83E814                  sub eax, 00000014
:0043E8E3 8945FC                  mov dword ptr [ebp-04], eax
:0043E8E6 837DFC00                cmp dword ptr [ebp-04], 00000000
:0043E8EA 0F8C21000000            jl 0043E911
:0043E8F0 33C0                    xor eax, eax
:0043E8F2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043E8F5 C1E104                  shl ecx, 04
:0043E8F8 2BC1                    sub eax, ecx
:0043E8FA F7D8                    neg eax
:0043E8FC 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043E8FF 294144                  sub dword ptr [ecx+44], eax
:0043E902 C705F0FA4600F0FFFFFF    mov dword ptr [0046FAF0], FFFFFFF0
:0043E90C E90A000000              jmp 0043E91B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E8EA(C)
|
:0043E911 C705F0FA460010000000    mov dword ptr [0046FAF0], 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E90C(U)
|
:0043E91B 8B45F8                  mov eax, dword ptr [ebp-08]
:0043E91E 8B4040                  mov eax, dword ptr [eax+40]
:0043E921 83E0F0                  and eax, FFFFFFF0
:0043E924 B9D0000000              mov ecx, 000000D0
:0043E929 83E1F0                  and ecx, FFFFFFF0
:0043E92C 3BC1                    cmp eax, ecx
:0043E92E 0F8216000000            jb 0043E94A
:0043E934 8B45F8                  mov eax, dword ptr [ebp-08]
:0043E937 83684070                sub dword ptr [eax+40], 00000070
:0043E93B C705ECFA4600F0FFFFFF    mov dword ptr [0046FAEC], FFFFFFF0
:0043E945 E911000000              jmp 0043E95B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E92E(C)
|
:0043E94A 8B45F8                  mov eax, dword ptr [ebp-08]
:0043E94D 83404050                add dword ptr [eax+40], 00000050
:0043E951 C705ECFA460010000000    mov dword ptr [0046FAEC], 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043E878(U), :0043E945(U)
|
:0043E95B E900000000              jmp 0043E960

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E95B(U)
|
:0043E960 5F                      pop edi
:0043E961 5E                      pop esi
:0043E962 5B                      pop ebx
:0043E963 C9                      leave
:0043E964 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:00402870   , :00402C33   , :0040320B   
|
:0043E967 55                      push ebp
:0043E968 8BEC                    mov ebp, esp
:0043E96A 83EC08                  sub esp, 00000008
:0043E96D 53                      push ebx
:0043E96E 56                      push esi
:0043E96F 57                      push edi
:0043E970 894DF8                  mov dword ptr [ebp-08], ecx
:0043E973 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043E976 E8D4FBFFFF              call 0043E54F
:0043E97B 8B4514                  mov eax, dword ptr [ebp+14]
:0043E97E 50                      push eax
:0043E97F 6A00                    push 00000000
:0043E981 8B4510                  mov eax, dword ptr [ebp+10]
:0043E984 50                      push eax
:0043E985 33C0                    xor eax, eax
:0043E987 8A450C                  mov al, byte ptr [ebp+0C]
:0043E98A 83C840                  or eax, 00000040
:0043E98D 50                      push eax
:0043E98E 6A08                    push 00000008
:0043E990 8B4508                  mov eax, dword ptr [ebp+08]
:0043E993 50                      push eax
:0043E994 8B45F8                  mov eax, dword ptr [ebp-08]
:0043E997 8B4044                  mov eax, dword ptr [eax+44]
:0043E99A 50                      push eax
:0043E99B 8B45F8                  mov eax, dword ptr [ebp-08]
:0043E99E 8B4040                  mov eax, dword ptr [eax+40]
:0043E9A1 50                      push eax
:0043E9A2 E84D94FFFF              call 00437DF4
:0043E9A7 83C420                  add esp, 00000020
:0043E9AA 8845FC                  mov byte ptr [ebp-04], al
:0043E9AD 8B45F8                  mov eax, dword ptr [ebp-08]
:0043E9B0 FE4048                  inc [eax+48]
:0043E9B3 A1ECFA4600              mov eax, dword ptr [0046FAEC]
:0043E9B8 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043E9BB 014140                  add dword ptr [ecx+40], eax
:0043E9BE A1F0FA4600              mov eax, dword ptr [0046FAF0]
:0043E9C3 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043E9C6 014144                  add dword ptr [ecx+44], eax
:0043E9C9 8A45FC                  mov al, byte ptr [ebp-04]
:0043E9CC E900000000              jmp 0043E9D1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E9CC(U)
|
:0043E9D1 5F                      pop edi
:0043E9D2 5E                      pop esi
:0043E9D3 5B                      pop ebx
:0043E9D4 C9                      leave
:0043E9D5 C21000                  ret 0010



* Referenced by a CALL at Addresses:
|:00402C43   , :00402DC5   , :0040322E   , :0040384C   
|
:0043E9D8 55                      push ebp
:0043E9D9 8BEC                    mov ebp, esp
:0043E9DB 83EC04                  sub esp, 00000004
:0043E9DE 53                      push ebx
:0043E9DF 56                      push esi
:0043E9E0 57                      push edi
:0043E9E1 894DFC                  mov dword ptr [ebp-04], ecx
:0043E9E4 6A01                    push 00000001
:0043E9E6 B994A64600              mov ecx, 0046A694
:0043E9EB E834A6FDFF              call 00419024
:0043E9F0 8B45FC                  mov eax, dword ptr [ebp-04]
:0043E9F3 FE4848                  dec [eax+48]
:0043E9F6 33C0                    xor eax, eax
:0043E9F8 2B05ECFA4600            sub eax, dword ptr [0046FAEC]
:0043E9FE F7D8                    neg eax
:0043EA00 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043EA03 294140                  sub dword ptr [ecx+40], eax
:0043EA06 33C0                    xor eax, eax
:0043EA08 2B05F0FA4600            sub eax, dword ptr [0046FAF0]
:0043EA0E F7D8                    neg eax
:0043EA10 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043EA13 294144                  sub dword ptr [ecx+44], eax
:0043EA16 8B45FC                  mov eax, dword ptr [ebp-04]
:0043EA19 33C9                    xor ecx, ecx
:0043EA1B 8A4848                  mov cl, byte ptr [eax+48]
:0043EA1E 85C9                    test ecx, ecx
:0043EA20 0F8510000000            jne 0043EA36
:0043EA26 6A18                    push 00000018
:0043EA28 6A27                    push 00000027
:0043EA2A 6A00                    push 00000000
:0043EA2C 6A00                    push 00000000
:0043EA2E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043EA31 E8F7C0FFFF              call 0043AB2D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043EA20(C)
|
:0043EA36 E900000000              jmp 0043EA3B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043EA36(U)
|
:0043EA3B 5F                      pop edi
:0043EA3C 5E                      pop esi
:0043EA3D 5B                      pop ebx
:0043EA3E C9                      leave
:0043EA3F C3                      ret



* Referenced by a CALL at Addresses:
|:00402435   , :00403F07   , :00405062   , :004056B9   , :00405837   
|:00405A83   , :00405C01   , :00405E4A   , :00405FD0   , :00406230   
|:004063C0   , :004065B8   , :004067AB   , :00406D1D   , :00406E8D   
|:00407001   , :00407175   , :0040736C   , :004074A0   , :004076BC   
|:004077F0   , :004079A9   , :00407B29   , :00407D00   , :004084BB   
|:00408CA2   , :0042462A   , :0042469E   
|
:0043EA40 55                      push ebp
:0043EA41 8BEC                    mov ebp, esp
:0043EA43 83EC28                  sub esp, 00000028
:0043EA46 53                      push ebx
:0043EA47 56                      push esi
:0043EA48 57                      push edi
:0043EA49 894DDC                  mov dword ptr [ebp-24], ecx
:0043EA4C 33DB                    xor ebx, ebx
:0043EA4E 8A5D08                  mov bl, byte ptr [ebp+08]
:0043EA51 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043EA54 E8D760FEFF              call 00424B30
:0043EA59 2BD8                    sub ebx, eax
:0043EA5B C1E304                  shl ebx, 04
:0043EA5E 83C308                  add ebx, 00000008
:0043EA61 895DFC                  mov dword ptr [ebp-04], ebx
:0043EA64 33DB                    xor ebx, ebx
:0043EA66 8A5D0C                  mov bl, byte ptr [ebp+0C]
:0043EA69 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043EA6C E8DF60FEFF              call 00424B50
:0043EA71 2BD8                    sub ebx, eax
:0043EA73 83C303                  add ebx, 00000003
:0043EA76 C1E304                  shl ebx, 04
:0043EA79 895DF4                  mov dword ptr [ebp-0C], ebx
:0043EA7C 33C0                    xor eax, eax
:0043EA7E 8A4510                  mov al, byte ptr [ebp+10]
:0043EA81 83F807                  cmp eax, 00000007
:0043EA84 0F8F40000000            jg 0043EACA
:0043EA8A B994A64600              mov ecx, 0046A694
:0043EA8F E87C030000              call 0043EE10
:0043EA94 8845EC                  mov byte ptr [ebp-14], al
:0043EA97 33C0                    xor eax, eax
:0043EA99 8A45EC                  mov al, byte ptr [ebp-14]
:0043EA9C 83F823                  cmp eax, 00000023
:0043EA9F 0F8425000000            je 0043EACA
:0043EAA5 33C0                    xor eax, eax
:0043EAA7 8A45EC                  mov al, byte ptr [ebp-14]
:0043EAAA 83F824                  cmp eax, 00000024
:0043EAAD 0F8417000000            je 0043EACA
:0043EAB3 33C0                    xor eax, eax
:0043EAB5 8A4510                  mov al, byte ptr [ebp+10]
:0043EAB8 8B0485C8324500          mov eax, dword ptr [4*eax+004532C8]
:0043EABF 50                      push eax
:0043EAC0 B994A64600              mov ecx, 0046A694
:0043EAC5 E85AA5FDFF              call 00419024

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043EA84(C), :0043EA9F(C), :0043EAAD(C)
|
:0043EACA 33C0                    xor eax, eax
:0043EACC 8A4510                  mov al, byte ptr [ebp+10]
:0043EACF 83F802                  cmp eax, 00000002
:0043EAD2 0F8C2D000000            jl 0043EB05
:0043EAD8 33C0                    xor eax, eax
:0043EADA 8A4510                  mov al, byte ptr [ebp+10]
:0043EADD 83F808                  cmp eax, 00000008
:0043EAE0 0F841F000000            je 0043EB05
:0043EAE6 B968F94600              mov ecx, 0046F968
:0043EAEB E8F0A5FCFF              call 004090E0
:0043EAF0 50                      push eax
:0043EAF1 6A30                    push 00000030
:0043EAF3 6A30                    push 00000030
:0043EAF5 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043EAF8 50                      push eax
:0043EAF9 8B45FC                  mov eax, dword ptr [ebp-04]
:0043EAFC 50                      push eax
:0043EAFD E829E8FFFF              call 0043D32B
:0043EB02 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043EAD2(C), :0043EAE0(C)
|
:0043EB05 33C0                    xor eax, eax
:0043EB07 8A4510                  mov al, byte ptr [ebp+10]
:0043EB0A 83F802                  cmp eax, 00000002
:0043EB0D 0F8E0E000000            jle 0043EB21
:0043EB13 33C0                    xor eax, eax
:0043EB15 8A4510                  mov al, byte ptr [ebp+10]
:0043EB18 83F808                  cmp eax, 00000008
:0043EB1B 0F8509000000            jne 0043EB2A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043EB0D(C)
|
:0043EB21 C645F001                mov [ebp-10], 01
:0043EB25 E904000000              jmp 0043EB2E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043EB1B(C)
|
:0043EB2A C645F002                mov [ebp-10], 02

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043EB25(U)
|
:0043EB2E C645F800                mov [ebp-08], 00
:0043EB32 E903000000              jmp 0043EB3A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043ECFE(U)
|
:0043EB37 FE45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043EB32(U)
|
:0043EB3A 33C0                    xor eax, eax
:0043EB3C 8A45F8                  mov al, byte ptr [ebp-08]
:0043EB3F 33C9                    xor ecx, ecx
:0043EB41 8A4DF0                  mov cl, byte ptr [ebp-10]
:0043EB44 3BC1                    cmp eax, ecx
:0043EB46 0F8DB7010000            jnl 0043ED03
:0043EB4C 33C0                    xor eax, eax
:0043EB4E 8A4510                  mov al, byte ptr [ebp+10]
:0043EB51 83F808                  cmp eax, 00000008
:0043EB54 0F853C000000            jne 0043EB96
:0043EB5A B9D0A64600              mov ecx, 0046A6D0
:0043EB5F E81CA6FCFF              call 00409180
:0043EB64 A8F0                    test al, F0
:0043EB66 0F8525000000            jne 0043EB91
:0043EB6C B9D8BC4600              mov ecx, 0046BCD8
:0043EB71 E85449FEFF              call 004234CA
:0043EB76 6A00                    push 00000000
:0043EB78 68FF000000              push 000000FF
:0043EB7D B9D8BC4600              mov ecx, 0046BCD8
:0043EB82 E8FC4AFEFF              call 00423683
:0043EB87 B9D8BC4600              mov ecx, 0046BCD8
:0043EB8C E8A546FEFF              call 00423236

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043EB66(C)
|
:0043EB91 E968010000              jmp 0043ECFE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043EB54(C)
|
:0043EB96 33C0                    xor eax, eax
:0043EB98 8A4510                  mov al, byte ptr [ebp+10]
:0043EB9B 83F802                  cmp eax, 00000002
:0043EB9E 0F8D32000000            jnl 0043EBD6
:0043EBA4 B9D0A64600              mov ecx, 0046A6D0
:0043EBA9 E8D2A5FCFF              call 00409180
:0043EBAE A8F0                    test al, F0
:0043EBB0 0F851B000000            jne 0043EBD1
:0043EBB6 6A00                    push 00000000
:0043EBB8 68FF000000              push 000000FF
:0043EBBD B9D8BC4600              mov ecx, 0046BCD8
:0043EBC2 E8BC4AFEFF              call 00423683
:0043EBC7 B9D8BC4600              mov ecx, 0046BCD8
:0043EBCC E86546FEFF              call 00423236

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043EBB0(C)
|
:0043EBD1 E928010000              jmp 0043ECFE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043EB9E(C)
|
:0043EBD6 B9D0A64600              mov ecx, 0046A6D0
:0043EBDB E8A0A5FCFF              call 00409180
:0043EBE0 A8F0                    test al, F0
:0043EBE2 0F8516010000            jne 0043ECFE
:0043EBE8 33C0                    xor eax, eax
:0043EBEA 8A4510                  mov al, byte ptr [ebp+10]
:0043EBED 8945D8                  mov dword ptr [ebp-28], eax
:0043EBF0 E93B000000              jmp 0043EC30
:0043EBF5 33C0                    xor eax, eax
:0043EBF7 8A4514                  mov al, byte ptr [ebp+14]
:0043EBFA 85C0                    test eax, eax
:0043EBFC 0F8409000000            je 0043EC0B
:0043EC02 C645E400                mov [ebp-1C], 00
:0043EC06 E904000000              jmp 0043EC0F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043EBFC(C)
|
:0043EC0B C645E401                mov [ebp-1C], 01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043EC06(U)
|
:0043EC0F E94C000000              jmp 0043EC60
:0043EC14 C645E402                mov [ebp-1C], 02
:0043EC18 E943000000              jmp 0043EC60
:0043EC1D C645E403                mov [ebp-1C], 03
:0043EC21 E93A000000              jmp 0043EC60
:0043EC26 E935000000              jmp 0043EC60
:0043EC2B E930000000              jmp 0043EC60

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043EBF0(U)
|
:0043EC30 836DD802                sub dword ptr [ebp-28], 00000002
:0043EC34 837DD805                cmp dword ptr [ebp-28], 00000005
:0043EC38 0F8722000000            ja 0043EC60
:0043EC3E 8B45D8                  mov eax, dword ptr [ebp-28]
:0043EC41 FF248548EC4300          jmp dword ptr [4*eax+0043EC48]

:0043EC48 F5EB4300                DWORD 0043EBF5
:0043EC4C F5EB4300                DWORD 0043EBF5
:0043EC50 14EC4300                DWORD 0043EC14
:0043EC54 14EC4300                DWORD 0043EC14
:0043EC58 14EC4300                DWORD 0043EC14
:0043EC5C 1DEC4300                DWORD 0043EC1D



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043EC0F(U), :0043EC18(U), :0043EC21(U), :0043EC26(U), :0043EC2B(U)
|:0043EC38(C)
|
:0043EC60 C645E800                mov [ebp-18], 00
:0043EC64 E903000000              jmp 0043EC6C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043ECF9(U)
|
:0043EC69 FE45E8                  inc [ebp-18]
:0043EC6C 33C0                    xor eax, eax
:0043EC6E 8A45E8                  mov al, byte ptr [ebp-18]
:0043EC71 83F802                  cmp eax, 00000002
:0043EC74 0F8D84000000            jnl 0043ECFE
:0043EC7A 6A01                    push 00000001
:0043EC7C E8D987FFFF              call 0043745A
:0043EC81 83C404                  add esp, 00000004
:0043EC84 E80E83FEFF              call 00426F97
:0043EC89 33DB                    xor ebx, ebx
:0043EC8B 8A5DE4                  mov bl, byte ptr [ebp-1C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043EC49(U)
|
:0043EC8E 33C0                    xor eax, eax
:0043EC90 8A45E8                  mov al, byte ptr [ebp-18]
:0043EC93 8D1C58                  lea ebx, dword ptr [eax+2*ebx]
:0043EC96 8D1CDB                  lea ebx, dword ptr [ebx+8*ebx]
:0043EC99 C1E308                  shl ebx, 08
:0043EC9C 6A04                    push 00000004
:0043EC9E 6A00                    push 00000000
:0043ECA0 6800510400              push 00045100
:0043ECA5 B9E8E44600              mov ecx, 0046E4E8
:0043ECAA E8718A0000              call 00447720
:0043ECAF 03D8                    add ebx, eax
:0043ECB1 895DE0                  mov dword ptr [ebp-20], ebx
:0043ECB4 6A00                    push 00000000
:0043ECB6 B968F94600              mov ecx, 0046F968
:0043ECBB E820A4FCFF              call 004090E0
:0043ECC0 50                      push eax
:0043ECC1 6A30                    push 00000030
:0043ECC3 6A30                    push 00000030
:0043ECC5 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043ECC8 50                      push eax
:0043ECC9 8B45FC                  mov eax, dword ptr [ebp-04]
:0043ECCC 50                      push eax
:0043ECCD E8E3E5FFFF              call 0043D2B5
:0043ECD2 83C418                  add esp, 00000018
:0043ECD5 6A04                    push 00000004
:0043ECD7 8B45E0                  mov eax, dword ptr [ebp-20]
:0043ECDA 50                      push eax
:0043ECDB 6A30                    push 00000030
:0043ECDD 6A30                    push 00000030
:0043ECDF 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043ECE2 50                      push eax
:0043ECE3 8B45FC                  mov eax, dword ptr [ebp-04]
:0043ECE6 50                      push eax
:0043ECE7 E8C9E5FFFF              call 0043D2B5
:0043ECEC 83C418                  add esp, 00000018
:0043ECEF E8C382FEFF              call 00426FB7
:0043ECF4 E8CF86FFFF              call 004373C8
:0043ECF9 E96BFFFFFF              jmp 0043EC69

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043EB91(U), :0043EBD1(U), :0043EBE2(C), :0043EC74(C)
|
:0043ECFE E934FEFFFF              jmp 0043EB37

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043EB46(C)
|
:0043ED03 33C0                    xor eax, eax
:0043ED05 8A4510                  mov al, byte ptr [ebp+10]
:0043ED08 83F802                  cmp eax, 00000002
:0043ED0B 0F8C2F000000            jl 0043ED40
:0043ED11 33C0                    xor eax, eax
:0043ED13 8A4510                  mov al, byte ptr [ebp+10]
:0043ED16 83F808                  cmp eax, 00000008
:0043ED19 0F8421000000            je 0043ED40
:0043ED1F 6A00                    push 00000000
:0043ED21 B968F94600              mov ecx, 0046F968
:0043ED26 E8B5A3FCFF              call 004090E0
:0043ED2B 50                      push eax
:0043ED2C 6A30                    push 00000030
:0043ED2E 6A30                    push 00000030
:0043ED30 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043ED33 50                      push eax
:0043ED34 8B45FC                  mov eax, dword ptr [ebp-04]
:0043ED37 50                      push eax
:0043ED38 E878E5FFFF              call 0043D2B5
:0043ED3D 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043ED0B(C), :0043ED19(C)
|
:0043ED40 E900000000              jmp 0043ED45

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043ED40(U)
|
:0043ED45 5F                      pop edi
:0043ED46 5E                      pop esi
:0043ED47 5B                      pop ebx
:0043ED48 C9                      leave
:0043ED49 C21000                  ret 0010


:0043ED4C CC                      int 03
:0043ED4D CC                      int 03
:0043ED4E CC                      int 03
:0043ED4F CC                      int 03

* Referenced by a CALL at Address:
|:00439AA5   
|
:0043ED50 55                      push ebp
:0043ED51 8BEC                    mov ebp, esp
:0043ED53 83EC04                  sub esp, 00000004
:0043ED56 53                      push ebx
:0043ED57 56                      push esi
:0043ED58 57                      push edi
:0043ED59 894DFC                  mov dword ptr [ebp-04], ecx
:0043ED5C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043ED5F 83C120                  add ecx, 00000020
:0043ED62 E8092BFCFF              call 00401870
:0043ED67 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043ED6A 83C122                  add ecx, 00000022
:0043ED6D E8FE2AFCFF              call 00401870
:0043ED72 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043ED75 83C13E                  add ecx, 0000003E
:0043ED78 E8F32AFCFF              call 00401870
:0043ED7D E900000000              jmp 0043ED82

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043ED7D(U)
|
:0043ED82 8B45FC                  mov eax, dword ptr [ebp-04]
:0043ED85 5F                      pop edi
:0043ED86 5E                      pop esi
:0043ED87 5B                      pop ebx
:0043ED88 C9                      leave
:0043ED89 C3                      ret


:0043ED8A CC                      int 03
:0043ED8B CC                      int 03
:0043ED8C CC                      int 03
:0043ED8D CC                      int 03
:0043ED8E CC                      int 03
:0043ED8F CC                      int 03

* Referenced by a CALL at Address:
|:00439ADC   
|
:0043ED90 55                      push ebp
:0043ED91 8BEC                    mov ebp, esp
:0043ED93 83EC04                  sub esp, 00000004
:0043ED96 53                      push ebx
:0043ED97 56                      push esi
:0043ED98 57                      push edi
:0043ED99 894DFC                  mov dword ptr [ebp-04], ecx
:0043ED9C E900000000              jmp 0043EDA1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043ED9C(U)
|
:0043EDA1 5F                      pop edi
:0043EDA2 5E                      pop esi
:0043EDA3 5B                      pop ebx
:0043EDA4 C9                      leave
:0043EDA5 C3                      ret


:0043EDA6 CC                      int 03
:0043EDA7 CC                      int 03
:0043EDA8 CC                      int 03
:0043EDA9 CC                      int 03
:0043EDAA CC                      int 03
:0043EDAB CC                      int 03
:0043EDAC CC                      int 03
:0043EDAD CC                      int 03
:0043EDAE CC                      int 03
:0043EDAF CC                      int 03

* Referenced by a CALL at Addresses:
|:0043A695   , :00442DCD   
|
:0043EDB0 55                      push ebp
:0043EDB1 8BEC                    mov ebp, esp
:0043EDB3 83EC04                  sub esp, 00000004
:0043EDB6 53                      push ebx
:0043EDB7 56                      push esi
:0043EDB8 57                      push edi
:0043EDB9 894DFC                  mov dword ptr [ebp-04], ecx
:0043EDBC 8B45FC                  mov eax, dword ptr [ebp-04]
:0043EDBF 8B4024                  mov eax, dword ptr [eax+24]
:0043EDC2 E900000000              jmp 0043EDC7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043EDC2(U)
|
:0043EDC7 5F                      pop edi
:0043EDC8 5E                      pop esi
:0043EDC9 5B                      pop ebx
:0043EDCA C9                      leave
:0043EDCB C3                      ret


:0043EDCC CC                      int 03
:0043EDCD CC                      int 03
:0043EDCE CC                      int 03
:0043EDCF CC                      int 03

* Referenced by a CALL at Addresses:
|:0043B753   , :0043FEA2   
|
:0043EDD0 55                      push ebp
:0043EDD1 8BEC                    mov ebp, esp
:0043EDD3 83EC04                  sub esp, 00000004
:0043EDD6 53                      push ebx
:0043EDD7 56                      push esi
:0043EDD8 57                      push edi
:0043EDD9 894DFC                  mov dword ptr [ebp-04], ecx
:0043EDDC 8B45FC                  mov eax, dword ptr [ebp-04]
:0043EDDF 8A4015                  mov al, byte ptr [eax+15]
:0043EDE2 E900000000              jmp 0043EDE7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043EDE2(U)
|
:0043EDE7 5F                      pop edi
:0043EDE8 5E                      pop esi
:0043EDE9 5B                      pop ebx
:0043EDEA C9                      leave
:0043EDEB C3                      ret


:0043EDEC CC                      int 03
:0043EDED CC                      int 03
:0043EDEE CC                      int 03
:0043EDEF CC                      int 03

* Referenced by a CALL at Addresses:
|:0043C258   , :00440022   
|
:0043EDF0 55                      push ebp
:0043EDF1 8BEC                    mov ebp, esp
:0043EDF3 83EC04                  sub esp, 00000004
:0043EDF6 53                      push ebx
:0043EDF7 56                      push esi
:0043EDF8 57                      push edi
:0043EDF9 894DFC                  mov dword ptr [ebp-04], ecx
:0043EDFC 8B45FC                  mov eax, dword ptr [ebp-04]
:0043EDFF 8A402C                  mov al, byte ptr [eax+2C]
:0043EE02 E900000000              jmp 0043EE07

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043EE02(U)
|
:0043EE07 5F                      pop edi
:0043EE08 5E                      pop esi
:0043EE09 5B                      pop ebx
:0043EE0A C9                      leave
:0043EE0B C3                      ret


:0043EE0C CC                      int 03
:0043EE0D CC                      int 03
:0043EE0E CC                      int 03
:0043EE0F CC                      int 03

* Referenced by a CALL at Address:
|:0043EA8F   
|
:0043EE10 55                      push ebp
:0043EE11 8BEC                    mov ebp, esp
:0043EE13 83EC04                  sub esp, 00000004
:0043EE16 53                      push ebx
:0043EE17 56                      push esi
:0043EE18 57                      push edi
:0043EE19 894DFC                  mov dword ptr [ebp-04], ecx
:0043EE1C 8B45FC                  mov eax, dword ptr [ebp-04]
:0043EE1F 8B00                    mov eax, dword ptr [eax]
:0043EE21 E900000000              jmp 0043EE26

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043EE21(U)
|
:0043EE26 5F                      pop edi
:0043EE27 5E                      pop esi
:0043EE28 5B                      pop ebx
:0043EE29 C9                      leave
:0043EE2A C3                      ret


:0043EE2B CC                      int 03
:0043EE2C CC                      int 03
:0043EE2D CC                      int 03
:0043EE2E CC                      int 03
:0043EE2F CC                      int 03
:0043EE30 55                      push ebp
:0043EE31 8BEC                    mov ebp, esp
:0043EE33 53                      push ebx
:0043EE34 56                      push esi
:0043EE35 57                      push edi
:0043EE36 E80F000000              call 0043EE4A
:0043EE3B E824000000              call 0043EE64
:0043EE40 E900000000              jmp 0043EE45

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043EE40(U)
|
:0043EE45 5F                      pop edi
:0043EE46 5E                      pop esi
:0043EE47 5B                      pop ebx
:0043EE48 C9                      leave
:0043EE49 C3                      ret



* Referenced by a CALL at Address:
|:0043EE36   
|
:0043EE4A 55                      push ebp
:0043EE4B 8BEC                    mov ebp, esp
:0043EE4D 53                      push ebx
:0043EE4E 56                      push esi
:0043EE4F 57                      push edi
:0043EE50 B998FC4600              mov ecx, 0046FC98
:0043EE55 E806520000              call 00444060
:0043EE5A E900000000              jmp 0043EE5F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043EE5A(U)
|
:0043EE5F 5F                      pop edi
:0043EE60 5E                      pop esi
:0043EE61 5B                      pop ebx
:0043EE62 C9                      leave
:0043EE63 C3                      ret



* Referenced by a CALL at Address:
|:0043EE3B   
|
:0043EE64 55                      push ebp
:0043EE65 8BEC                    mov ebp, esp
:0043EE67 53                      push ebx
:0043EE68 56                      push esi
:0043EE69 57                      push edi
:0043EE6A 6881EE4300              push 0043EE81
:0043EE6F E86C8E0000              call 00447CE0
:0043EE74 83C404                  add esp, 00000004
:0043EE77 E900000000              jmp 0043EE7C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043EE77(U)
|
:0043EE7C 5F                      pop edi
:0043EE7D 5E                      pop esi
:0043EE7E 5B                      pop ebx
:0043EE7F C9                      leave
:0043EE80 C3                      ret


:0043EE81 55                      push ebp
:0043EE82 8BEC                    mov ebp, esp
:0043EE84 53                      push ebx
:0043EE85 56                      push esi
:0043EE86 57                      push edi
:0043EE87 B998FC4600              mov ecx, 0046FC98
:0043EE8C E8EF510000              call 00444080
:0043EE91 E900000000              jmp 0043EE96

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043EE91(U)
|
:0043EE96 5F                      pop edi
:0043EE97 5E                      pop esi
:0043EE98 5B                      pop ebx
:0043EE99 C9                      leave
:0043EE9A C3                      ret


:0043EE9B 55                      push ebp
:0043EE9C 8BEC                    mov ebp, esp
:0043EE9E 53                      push ebx
:0043EE9F 56                      push esi
:0043EEA0 57                      push edi
:0043EEA1 E80A000000              call 0043EEB0
:0043EEA6 E900000000              jmp 0043EEAB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043EEA6(U)
|
:0043EEAB 5F                      pop edi
:0043EEAC 5E                      pop esi
:0043EEAD 5B                      pop ebx
:0043EEAE C9                      leave
:0043EEAF C3                      ret



* Referenced by a CALL at Address:
|:0043EEA1   
|
:0043EEB0 55                      push ebp
:0043EEB1 8BEC                    mov ebp, esp
:0043EEB3 53                      push ebx
:0043EEB4 56                      push esi
:0043EEB5 57                      push edi
:0043EEB6 B9C8FC4600              mov ecx, 0046FCC8
:0043EEBB E8B029FCFF              call 00401870
:0043EEC0 E900000000              jmp 0043EEC5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043EEC0(U)
|
:0043EEC5 5F                      pop edi
:0043EEC6 5E                      pop esi
:0043EEC7 5B                      pop ebx
:0043EEC8 C9                      leave
:0043EEC9 C3                      ret


:0043EECA 55                      push ebp
:0043EECB 8BEC                    mov ebp, esp
:0043EECD 53                      push ebx
:0043EECE 56                      push esi
:0043EECF 57                      push edi
:0043EED0 6A28                    push 00000028
:0043EED2 6A00                    push 00000000
:0043EED4 B910BC4600              mov ecx, 0046BC10
:0043EED9 E8290DFEFF              call 0041FC07
:0043EEDE A150364500              mov eax, dword ptr [00453650]
:0043EEE3 50                      push eax
:0043EEE4 6A01                    push 00000001
:0043EEE6 B910BC4600              mov ecx, 0046BC10
:0043EEEB E8170DFEFF              call 0041FC07
:0043EEF0 6A0F                    push 0000000F
:0043EEF2 B910BC4600              mov ecx, 0046BC10
:0043EEF7 E8D70DFEFF              call 0041FCD3
:0043EEFC 6A00                    push 00000000
:0043EEFE B910BC4600              mov ecx, 0046BC10
:0043EF03 E8C80EFEFF              call 0041FDD0
:0043EF08 6A00                    push 00000000
:0043EF0A B910BC4600              mov ecx, 0046BC10
:0043EF0F E86D0FFEFF              call 0041FE81
:0043EF14 8D4508                  lea eax, dword ptr [ebp+08]
:0043EF17 50                      push eax
:0043EF18 E85406FEFF              call 0041F571
:0043EF1D 83C404                  add esp, 00000004
:0043EF20 6A02                    push 00000002
:0043EF22 E89486FFFF              call 004375BB
:0043EF27 83C404                  add esp, 00000004
:0043EF2A 83055036450010          add dword ptr [00453650], 00000010
:0043EF31 833D5036450060          cmp dword ptr [00453650], 00000060
:0043EF38 0F860A000000            jbe 0043EF48
:0043EF3E C7055036450028000000    mov dword ptr [00453650], 00000028

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043EF38(C), :0043EF55(U)
|
:0043EF48 E83085FFFF              call 0043747D
:0043EF4D 85C0                    test eax, eax
:0043EF4F 0F8405000000            je 0043EF5A
:0043EF55 E9EEFFFFFF              jmp 0043EF48

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043EF4F(C)
|
:0043EF5A E900000000              jmp 0043EF5F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043EF5A(U)
|
:0043EF5F 5F                      pop edi
:0043EF60 5E                      pop esi
:0043EF61 5B                      pop ebx
:0043EF62 C9                      leave
:0043EF63 C3                      ret



* Referenced by a CALL at Addresses:
|:00402D31   , :00410B93   , :0041DDE0   , :0041DE38   , :0041DEA1   
|:0041DEF9   , :00435725   , :00436398   , :0043CE92   
|
:0043EF64 55                      push ebp
:0043EF65 8BEC                    mov ebp, esp
:0043EF67 6AFF                    push FFFFFFFF
:0043EF69 6861FD4300              push 0043FD61
:0043EF6E 64A100000000            mov eax, dword ptr fs:[00000000]
:0043EF74 50                      push eax
:0043EF75 64892500000000          mov dword ptr fs:[00000000], esp
:0043EF7C 81ECB8010000            sub esp, 000001B8
:0043EF82 53                      push ebx
:0043EF83 56                      push esi
:0043EF84 57                      push edi
:0043EF85 C7458800000000          mov [ebp-78], 00000000
:0043EF8C 8B4508                  mov eax, dword ptr [ebp+08]
:0043EF8F 50                      push eax
:0043EF90 E877FFFDFF              call 0041EF0C
:0043EF95 83C404                  add esp, 00000004
:0043EF98 50                      push eax
:0043EF99 E8C3A0FEFF              call 00429061
:0043EF9E 83C404                  add esp, 00000004
:0043EFA1 888578FFFFFF            mov byte ptr [ebp+FFFFFF78], al
:0043EFA7 E83B85FFFF              call 004374E7
:0043EFAC 6A05                    push 00000005
:0043EFAE 837D0C01                cmp dword ptr [ebp+0C], 00000001
:0043EFB2 1BC0                    sbb eax, eax
:0043EFB4 83E018                  and eax, 00000018
:0043EFB7 0510010000              add eax, 00000110
:0043EFBC 50                      push eax
:0043EFBD 6870010000              push 00000170
:0043EFC2 6A60                    push 00000060
:0043EFC4 6888000000              push 00000088
:0043EFC9 B958BC4600              mov ecx, 0046BC58
:0043EFCE E88F1FFEFF              call 00420F62
:0043EFD3 6A07                    push 00000007
:0043EFD5 B910BC4600              mov ecx, 0046BC10
:0043EFDA E8F40CFEFF              call 0041FCD3
:0043EFDF 6A04                    push 00000004
:0043EFE1 B910BC4600              mov ecx, 0046BC10
:0043EFE6 E8960EFEFF              call 0041FE81
:0043EFEB 6A00                    push 00000000
:0043EFED B910BC4600              mov ecx, 0046BC10
:0043EFF2 E8D90DFEFF              call 0041FDD0
:0043EFF7 E89B7FFEFF              call 00426F97
:0043EFFC 6A00                    push 00000000
:0043EFFE 6A01                    push 00000001
:0043F000 6A60                    push 00000060
:0043F002 6A50                    push 00000050
:0043F004 6A68                    push 00000068
:0043F006 6890000000              push 00000090
:0043F00B B958BC4600              mov ecx, 0046BC58
:0043F010 E8551DFEFF              call 00420D6A
:0043F015 6A00                    push 00000000
:0043F017 6A06                    push 00000006
:0043F019 6A40                    push 00000040
:0043F01B 6888000000              push 00000088
:0043F020 6888000000              push 00000088
:0043F025 6860010000              push 00000160
:0043F02A B958BC4600              mov ecx, 0046BC58
:0043F02F E8361DFEFF              call 00420D6A
:0043F034 6A00                    push 00000000
:0043F036 6A07                    push 00000007
:0043F038 6A40                    push 00000040
:0043F03A 6A40                    push 00000040
:0043F03C 6888000000              push 00000088
:0043F041 68E0000000              push 000000E0
:0043F046 B958BC4600              mov ecx, 0046BC58
:0043F04B E81A1DFEFF              call 00420D6A
:0043F050 C78574FFFFFF00000000    mov dword ptr [ebp+FFFFFF74], 00000000
:0043F05A C7458098000000          mov [ebp-80], 00000098
:0043F061 E90D000000              jmp 0043F073

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F0F1(U)
|
:0043F066 FF8574FFFFFF            inc dword ptr [ebp+FFFFFF74]
:0043F06C 814580C8000000          add dword ptr [ebp-80], 000000C8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F061(U)
|
:0043F073 83BD74FFFFFF02          cmp dword ptr [ebp+FFFFFF74], 00000002
:0043F07A 0F8376000000            jnb 0043F0F6
:0043F080 C7458868000000          mov [ebp-78], 00000068
:0043F087 C7857CFFFFFF00000000    mov dword ptr [ebp+FFFFFF7C], 00000000
:0043F091 E90A000000              jmp 0043F0A0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F0EC(U)
|
:0043F096 FF857CFFFFFF            inc dword ptr [ebp+FFFFFF7C]
:0043F09C 83458818                add dword ptr [ebp-78], 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F091(U)
|
:0043F0A0 83BD7CFFFFFF06          cmp dword ptr [ebp+FFFFFF7C], 00000006
:0043F0A7 0F8344000000            jnb 0043F0F1
:0043F0AD 8B4588                  mov eax, dword ptr [ebp-78]
:0043F0B0 83C068                  add eax, 00000068
:0043F0B3 50                      push eax
:0043F0B4 8B4580                  mov eax, dword ptr [ebp-80]
:0043F0B7 C1E803                  shr eax, 03
:0043F0BA 50                      push eax
:0043F0BB B910BC4600              mov ecx, 0046BC10
:0043F0C0 E8420BFEFF              call 0041FC07
:0043F0C5 8B8574FFFFFF            mov eax, dword ptr [ebp+FFFFFF74]
:0043F0CB 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043F0CE 8B8D7CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF7C]
:0043F0D4 C1E102                  shl ecx, 02
:0043F0D7 8B84C1C82C4500          mov eax, dword ptr [ecx+8*eax+00452CC8]
:0043F0DE 50                      push eax
:0043F0DF 6810BC4600              push 0046BC10
:0043F0E4 E83A1AFEFF              call 00420B23
:0043F0E9 83C408                  add esp, 00000008
:0043F0EC E9A5FFFFFF              jmp 0043F096

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F0A7(C)
|
:0043F0F1 E970FFFFFF              jmp 0043F066

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F07A(C)
|
:0043F0F6 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0043F0FA 0F8511020000            jne 0043F311
:0043F100 8B4588                  mov eax, dword ptr [ebp-78]
:0043F103 83C06C                  add eax, 0000006C
:0043F106 50                      push eax
:0043F107 6A13                    push 00000013
:0043F109 B910BC4600              mov ecx, 0046BC10
:0043F10E E8F40AFEFF              call 0041FC07

* Possible StringData Ref from Data Obj ->"״̬"
                                  |
:0043F113 68D8374500              push 004537D8
:0043F118 6810BC4600              push 0046BC10
:0043F11D E86519FEFF              call 00420A87
:0043F122 83C408                  add esp, 00000008
:0043F125 6A04                    push 00000004
:0043F127 6A00                    push 00000000
:0043F129 6800280300              push 00032800
:0043F12E B9E8E44600              mov ecx, 0046E4E8
:0043F133 E8E8850000              call 00447720
:0043F138 894598                  mov dword ptr [ebp-68], eax
:0043F13B C74588CC000000          mov [ebp-78], 000000CC
:0043F142 33C0                    xor eax, eax
:0043F144 8A8578FFFFFF            mov al, byte ptr [ebp+FFFFFF78]
:0043F14A 8BC8                    mov ecx, eax
:0043F14C 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043F14F C1E003                  shl eax, 03
:0043F152 2BC1                    sub eax, ecx
:0043F154 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043F15A E871A5FCFF              call 004096D0
:0043F15F 884584                  mov byte ptr [ebp-7C], al
:0043F162 33C0                    xor eax, eax
:0043F164 8A4584                  mov al, byte ptr [ebp-7C]
:0043F167 83F802                  cmp eax, 00000002
:0043F16A 0F8442000000            je 0043F1B2
:0043F170 33C0                    xor eax, eax
:0043F172 8A4584                  mov al, byte ptr [ebp-7C]
:0043F175 83F802                  cmp eax, 00000002
:0043F178 0F8C0E000000            jl 0043F18C
:0043F17E 33C0                    xor eax, eax
:0043F180 8A4584                  mov al, byte ptr [ebp-7C]
:0043F183 48                      dec eax
:0043F184 884584                  mov byte ptr [ebp-7C], al
:0043F187 E900000000              jmp 0043F18C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043F178(C), :0043F187(U)
|
:0043F18C 6A00                    push 00000000
:0043F18E 33C0                    xor eax, eax
:0043F190 8A4584                  mov al, byte ptr [ebp-7C]
:0043F193 8D04C0                  lea eax, dword ptr [eax+8*eax]
:0043F196 C1E006                  shl eax, 06
:0043F199 034598                  add eax, dword ptr [ebp-68]
:0043F19C 50                      push eax
:0043F19D 6A18                    push 00000018
:0043F19F 6A18                    push 00000018
:0043F1A1 8B4588                  mov eax, dword ptr [ebp-78]
:0043F1A4 50                      push eax
:0043F1A5 68D0010000              push 000001D0
:0043F1AA E806E1FFFF              call 0043D2B5
:0043F1AF 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F16A(C)
|
:0043F1B2 83458818                add dword ptr [ebp-78], 00000018
:0043F1B6 33C0                    xor eax, eax
:0043F1B8 8A8578FFFFFF            mov al, byte ptr [ebp+FFFFFF78]
:0043F1BE 8BC8                    mov ecx, eax
:0043F1C0 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043F1C3 C1E003                  shl eax, 03
:0043F1C6 2BC1                    sub eax, ecx
:0043F1C8 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043F1CE E85DA5FCFF              call 00409730
:0043F1D3 884584                  mov byte ptr [ebp-7C], al
:0043F1D6 33C0                    xor eax, eax
:0043F1D8 8A4584                  mov al, byte ptr [ebp-7C]
:0043F1DB 83F802                  cmp eax, 00000002
:0043F1DE 0F8442000000            je 0043F226
:0043F1E4 33C0                    xor eax, eax
:0043F1E6 8A4584                  mov al, byte ptr [ebp-7C]
:0043F1E9 83F802                  cmp eax, 00000002
:0043F1EC 0F8C0E000000            jl 0043F200
:0043F1F2 33C0                    xor eax, eax
:0043F1F4 8A4584                  mov al, byte ptr [ebp-7C]
:0043F1F7 48                      dec eax
:0043F1F8 884584                  mov byte ptr [ebp-7C], al
:0043F1FB E900000000              jmp 0043F200

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043F1EC(C), :0043F1FB(U)
|
:0043F200 6A00                    push 00000000
:0043F202 33C0                    xor eax, eax
:0043F204 8A4584                  mov al, byte ptr [ebp-7C]
:0043F207 8D04C0                  lea eax, dword ptr [eax+8*eax]
:0043F20A C1E006                  shl eax, 06
:0043F20D 034598                  add eax, dword ptr [ebp-68]
:0043F210 50                      push eax
:0043F211 6A18                    push 00000018
:0043F213 6A18                    push 00000018
:0043F215 8B4588                  mov eax, dword ptr [ebp-78]
:0043F218 50                      push eax
:0043F219 68D0010000              push 000001D0
:0043F21E E892E0FFFF              call 0043D2B5
:0043F223 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F1DE(C)
|
:0043F226 83458818                add dword ptr [ebp-78], 00000018
:0043F22A 6A01                    push 00000001
:0043F22C 33C0                    xor eax, eax
:0043F22E 8A8578FFFFFF            mov al, byte ptr [ebp+FFFFFF78]
:0043F234 8BC8                    mov ecx, eax
:0043F236 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043F239 C1E003                  shl eax, 03
:0043F23C 2BC1                    sub eax, ecx
:0043F23E 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043F244 E8079FFCFF              call 00409150
:0043F249 85C0                    test eax, eax
:0043F24B 0F8420000000            je 0043F271
:0043F251 6A00                    push 00000000
:0043F253 8B4598                  mov eax, dword ptr [ebp-68]
:0043F256 0500090000              add eax, 00000900
:0043F25B 50                      push eax
:0043F25C 6A18                    push 00000018
:0043F25E 6A18                    push 00000018
:0043F260 8B4588                  mov eax, dword ptr [ebp-78]
:0043F263 50                      push eax
:0043F264 68D0010000              push 000001D0
:0043F269 E847E0FFFF              call 0043D2B5
:0043F26E 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F24B(C)
|
:0043F271 6A04                    push 00000004
:0043F273 6A00                    push 00000000
:0043F275 6800280300              push 00032800
:0043F27A B9E8E44600              mov ecx, 0046E4E8
:0043F27F E89C840000              call 00447720
:0043F284 05400B0000              add eax, 00000B40
:0043F289 894598                  mov dword ptr [ebp-68], eax
:0043F28C C74588D0000000          mov [ebp-78], 000000D0
:0043F293 C6458402                mov [ebp-7C], 02
:0043F297 C7857CFFFFFF00000000    mov dword ptr [ebp+FFFFFF7C], 00000000
:0043F2A1 E915000000              jmp 0043F2BB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F30C(U)
|
:0043F2A6 FF857CFFFFFF            inc dword ptr [ebp+FFFFFF7C]
:0043F2AC 81459840020000          add dword ptr [ebp-68], 00000240
:0043F2B3 83458820                add dword ptr [ebp-78], 00000020
:0043F2B7 C0658401                shl byte ptr [ebp-7C], 01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F2A1(U)
|
:0043F2BB 83BD7CFFFFFF05          cmp dword ptr [ebp+FFFFFF7C], 00000005
:0043F2C2 0F8349000000            jnb 0043F311
:0043F2C8 8B4584                  mov eax, dword ptr [ebp-7C]
:0043F2CB 50                      push eax
:0043F2CC 33C0                    xor eax, eax
:0043F2CE 8A8578FFFFFF            mov al, byte ptr [ebp+FFFFFF78]
:0043F2D4 8BC8                    mov ecx, eax
:0043F2D6 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043F2D9 C1E003                  shl eax, 03
:0043F2DC 2BC1                    sub eax, ecx
:0043F2DE 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043F2E4 E8679EFCFF              call 00409150
:0043F2E9 85C0                    test eax, eax
:0043F2EB 0F841B000000            je 0043F30C
:0043F2F1 6A00                    push 00000000
:0043F2F3 8B4598                  mov eax, dword ptr [ebp-68]
:0043F2F6 50                      push eax
:0043F2F7 6A18                    push 00000018
:0043F2F9 6A18                    push 00000018
:0043F2FB 6860010000              push 00000160
:0043F300 8B4588                  mov eax, dword ptr [ebp-78]
:0043F303 50                      push eax
:0043F304 E8ACDFFFFF              call 0043D2B5
:0043F309 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F2EB(C)
|
:0043F30C E995FFFFFF              jmp 0043F2A6

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043F0FA(C), :0043F2C2(C)
|
:0043F311 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043F314 E8874D0000              call 004440A0
:0043F319 894598                  mov dword ptr [ebp-68], eax
:0043F31C 8B4598                  mov eax, dword ptr [ebp-68]
:0043F31F 50                      push eax
:0043F320 E885800000              call 004473AA
:0043F325 83C404                  add esp, 00000004
:0043F328 894588                  mov dword ptr [ebp-78], eax
:0043F32B 6A70                    push 00000070
:0043F32D 6A24                    push 00000024
:0043F32F B910BC4600              mov ecx, 0046BC10
:0043F334 E8CE08FEFF              call 0041FC07
:0043F339 8B4598                  mov eax, dword ptr [ebp-68]
:0043F33C 50                      push eax

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:0043F33D 68E0374500              push 004537E0
:0043F342 6810BC4600              push 0046BC10
:0043F347 E8D717FEFF              call 00420B23
:0043F34C 83C40C                  add esp, 0000000C
:0043F34F 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043F352 E889A1FCFF              call 004094E0
:0043F357 894598                  mov dword ptr [ebp-68], eax
:0043F35A 8B4598                  mov eax, dword ptr [ebp-68]
:0043F35D 50                      push eax
:0043F35E E847800000              call 004473AA
:0043F363 83C404                  add esp, 00000004
:0043F366 894588                  mov dword ptr [ebp-78], eax
:0043F369 6A70                    push 00000070
:0043F36B 6A1D                    push 0000001D
:0043F36D B910BC4600              mov ecx, 0046BC10
:0043F372 E89008FEFF              call 0041FC07
:0043F377 8B4598                  mov eax, dword ptr [ebp-68]
:0043F37A 50                      push eax

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:0043F37B 68E4374500              push 004537E4
:0043F380 6810BC4600              push 0046BC10
:0043F385 E89917FEFF              call 00420B23
:0043F38A 83C40C                  add esp, 0000000C
:0043F38D 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043F390 E83B9FFCFF              call 004092D0
:0043F395 884584                  mov byte ptr [ebp-7C], al
:0043F398 33C0                    xor eax, eax
:0043F39A 8A4584                  mov al, byte ptr [ebp-7C]
:0043F39D 8B0485F82C4500          mov eax, dword ptr [4*eax+00452CF8]
:0043F3A4 894598                  mov dword ptr [ebp-68], eax
:0043F3A7 8B4508                  mov eax, dword ptr [ebp+08]
:0043F3AA 50                      push eax
:0043F3AB E85CFBFDFF              call 0041EF0C
:0043F3B0 83C404                  add esp, 00000004
:0043F3B3 89458C                  mov dword ptr [ebp-74], eax
:0043F3B6 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0043F3BA 0F8435000000            je 0043F3F5
:0043F3C0 8B458C                  mov eax, dword ptr [ebp-74]
:0043F3C3 50                      push eax
:0043F3C4 E8F49CFEFF              call 004290BD
:0043F3C9 83C404                  add esp, 00000004
:0043F3CC 884584                  mov byte ptr [ebp-7C], al
:0043F3CF 33C0                    xor eax, eax
:0043F3D1 8A4584                  mov al, byte ptr [ebp-7C]
:0043F3D4 3DFF000000              cmp eax, 000000FF
:0043F3D9 0F8511000000            jne 0043F3F0
:0043F3DF 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043F3E2 E8E99EFCFF              call 004092D0
:0043F3E7 33C9                    xor ecx, ecx
:0043F3E9 8AC8                    mov cl, al
:0043F3EB 03C9                    add ecx, ecx
:0043F3ED 884D84                  mov byte ptr [ebp-7C], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F3D9(C)
|
:0043F3F0 E912000000              jmp 0043F407

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F3BA(C)
|
:0043F3F5 8B8578FFFFFF            mov eax, dword ptr [ebp+FFFFFF78]
:0043F3FB 50                      push eax
:0043F3FC E8209EFEFF              call 00429221
:0043F401 83C404                  add esp, 00000004
:0043F404 884584                  mov byte ptr [ebp-7C], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F3F0(U)
|
:0043F407 8D8D58FEFFFF            lea ecx, dword ptr [ebp+FFFFFE58]
:0043F40D E85EA2FCFF              call 00409670

* Possible StringData Ref from Data Obj ->"C:CHR_BS.E2"
                                  |
:0043F412 68682C4500              push 00452C68
:0043F417 8D8D58FEFFFF            lea ecx, dword ptr [ebp+FFFFFE58]
:0043F41D E8ED80FEFF              call 0042750F
:0043F422 85C0                    test eax, eax
:0043F424 0F845A000000            je 0043F484
:0043F42A 6A04                    push 00000004
:0043F42C 6A00                    push 00000000
:0043F42E 68B01E0400              push 00041EB0
:0043F433 B918E54600              mov ecx, 0046E518
:0043F438 E8E3820000              call 00447720
:0043F43D 894590                  mov dword ptr [ebp-70], eax
:0043F440 8B4590                  mov eax, dword ptr [ebp-70]
:0043F443 50                      push eax
:0043F444 33C0                    xor eax, eax
:0043F446 8A4584                  mov al, byte ptr [ebp-7C]
:0043F449 50                      push eax
:0043F44A 8D8D58FEFFFF            lea ecx, dword ptr [ebp+FFFFFE58]
:0043F450 E82C82FEFF              call 00427681
:0043F455 8D8D58FEFFFF            lea ecx, dword ptr [ebp+FFFFFE58]
:0043F45B E8C09FFCFF              call 00409420
:0043F460 6A07                    push 00000007
:0043F462 E86E580000              call 00444CD5
:0043F467 83C404                  add esp, 00000004
:0043F46A 8B4590                  mov eax, dword ptr [ebp-70]
:0043F46D 50                      push eax
:0043F46E 6A30                    push 00000030
:0043F470 6A30                    push 00000030
:0043F472 6890000000              push 00000090
:0043F477 68E8000000              push 000000E8
:0043F47C E81E630000              call 0044579F
:0043F481 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F424(C)
|
:0043F484 8B4508                  mov eax, dword ptr [ebp+08]
:0043F487 50                      push eax
:0043F488 E87FFAFDFF              call 0041EF0C
:0043F48D 83C404                  add esp, 00000004
:0043F490 85C0                    test eax, eax
:0043F492 0F85E6000000            jne 0043F57E
:0043F498 6894000000              push 00000094
:0043F49D 6A2D                    push 0000002D
:0043F49F B910BC4600              mov ecx, 0046BC10
:0043F4A4 E85E07FEFF              call 0041FC07
:0043F4A9 B9D0A64600              mov ecx, 0046A6D0
:0043F4AE E88DFFFDFF              call 0041F440
:0043F4B3 50                      push eax

* Possible StringData Ref from Data Obj ->"C7B0M4ֽ%8u"
                                  |
:0043F4B4 68E8374500              push 004537E8
:0043F4B9 6810BC4600              push 0046BC10
:0043F4BE E86016FEFF              call 00420B23
:0043F4C3 83C40C                  add esp, 0000000C
:0043F4C6 6A07                    push 00000007
:0043F4C8 E808580000              call 00444CD5
:0043F4CD 83C404                  add esp, 00000004
:0043F4D0 6A00                    push 00000000
:0043F4D2 6A00                    push 00000000
:0043F4D4 6A04                    push 00000004
:0043F4D6 E824580000              call 00444CFF
:0043F4DB 83C40C                  add esp, 0000000C
:0043F4DE C78574FFFFFF00000000    mov dword ptr [ebp+FFFFFF74], 00000000
:0043F4E8 8B8574FFFFFF            mov eax, dword ptr [ebp+FFFFFF74]
:0043F4EE 89857CFFFFFF            mov dword ptr [ebp+FFFFFF7C], eax
:0043F4F4 E90D000000              jmp 0043F506

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F574(U)
|
:0043F4F9 83857CFFFFFF0A          add dword ptr [ebp+FFFFFF7C], 0000000A
:0043F500 FF8574FFFFFF            inc dword ptr [ebp+FFFFFF74]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F4F4(U)
|
:0043F506 B9D0A64600              mov ecx, 0046A6D0
:0043F50B E870FEFDFF              call 0041F380
:0043F510 3B857CFFFFFF            cmp eax, dword ptr [ebp+FFFFFF7C]
:0043F516 0F865D000000            jbe 0043F579
:0043F51C 83BD7CFFFFFF64          cmp dword ptr [ebp+FFFFFF7C], 00000064
:0043F523 0F8350000000            jnb 0043F579
:0043F529 6A04                    push 00000004
:0043F52B 6A00                    push 00000000
:0043F52D 8B8574FFFFFF            mov eax, dword ptr [ebp+FFFFFF74]
:0043F533 83E001                  and eax, 00000001
:0043F536 83F801                  cmp eax, 00000001
:0043F539 1BC0                    sbb eax, eax
:0043F53B 25E0FEFFFF              and eax, FFFFFEE0
:0043F540 0560970000              add eax, 00009760
:0043F545 50                      push eax
:0043F546 B940CF4600              mov ecx, 0046CF40
:0043F54B E8D0810000              call 00447720
:0043F550 50                      push eax
:0043F551 6A18                    push 00000018
:0043F553 6A0C                    push 0000000C
:0043F555 68A8000000              push 000000A8
:0043F55A 8B8574FFFFFF            mov eax, dword ptr [ebp+FFFFFF74]
:0043F560 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043F563 C1E002                  shl eax, 02
:0043F566 0568010000              add eax, 00000168
:0043F56B 50                      push eax
:0043F56C E82E620000              call 0044579F
:0043F571 83C414                  add esp, 00000014
:0043F574 E980FFFFFF              jmp 0043F4F9

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043F516(C), :0043F523(C)
|
:0043F579 E9CE000000              jmp 0043F64C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F492(C)
|
:0043F57E 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0043F582 0F85C4000000            jne 0043F64C
:0043F588 68A0000000              push 000000A0
:0043F58D 6A32                    push 00000032
:0043F58F B910BC4600              mov ecx, 0046BC10
:0043F594 E86E06FEFF              call 0041FC07
:0043F599 33C0                    xor eax, eax
:0043F59B 8A8578FFFFFF            mov al, byte ptr [ebp+FFFFFF78]
:0043F5A1 8BC8                    mov ecx, eax
:0043F5A3 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043F5A6 C1E003                  shl eax, 03
:0043F5A9 2BC1                    sub eax, ecx
:0043F5AB 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043F5B1 E86A9CFCFF              call 00409220
:0043F5B6 85C0                    test eax, eax
:0043F5B8 0F8470000000            je 0043F62E
:0043F5BE 33C0                    xor eax, eax
:0043F5C0 8A8578FFFFFF            mov al, byte ptr [ebp+FFFFFF78]
:0043F5C6 8BC8                    mov ecx, eax
:0043F5C8 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043F5CB C1E003                  shl eax, 03
:0043F5CE 2BC1                    sub eax, ecx
:0043F5D0 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043F5D6 E8F59DFCFF              call 004093D0
:0043F5DB 33C9                    xor ecx, ecx
:0043F5DD 8AC8                    mov cl, al
:0043F5DF 83F907                  cmp ecx, 00000007
:0043F5E2 0F8523000000            jne 0043F60B
:0043F5E8 6A17                    push 00000017
:0043F5EA B910BC4600              mov ecx, 0046BC10
:0043F5EF E8DF06FEFF              call 0041FCD3

* Possible StringData Ref from Data Obj ->"Ҿ"
                                  |
:0043F5F4 68FC374500              push 004537FC
:0043F5F9 6810BC4600              push 0046BC10
:0043F5FE E82015FEFF              call 00420B23
:0043F603 83C408                  add esp, 00000008
:0043F606 E91E000000              jmp 0043F629

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F5E2(C)
|
:0043F60B 6A0D                    push 0000000D
:0043F60D B910BC4600              mov ecx, 0046BC10
:0043F612 E8BC06FEFF              call 0041FCD3

* Possible StringData Ref from Data Obj ->"Ԯ"
                                  |
:0043F617 6804384500              push 00453804
:0043F61C 6810BC4600              push 0046BC10
:0043F621 E8FD14FEFF              call 00420B23
:0043F626 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F606(U)
|
:0043F629 E91E000000              jmp 0043F64C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F5B8(C)
|
:0043F62E 6A0F                    push 0000000F
:0043F630 B910BC4600              mov ecx, 0046BC10
:0043F635 E89906FEFF              call 0041FCD3

* Possible StringData Ref from Data Obj ->"о"
                                  |
:0043F63A 680C384500              push 0045380C
:0043F63F 6810BC4600              push 0046BC10
:0043F644 E8DA14FEFF              call 00420B23
:0043F649 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043F579(U), :0043F582(C), :0043F629(U)
|
:0043F64C 6A17                    push 00000017
:0043F64E B910BC4600              mov ecx, 0046BC10
:0043F653 E87B06FEFF              call 0041FCD3
:0043F658 8B4598                  mov eax, dword ptr [ebp-68]
:0043F65B 50                      push eax
:0043F65C E8497D0000              call 004473AA
:0043F661 83C404                  add esp, 00000004
:0043F664 894588                  mov dword ptr [ebp-78], eax
:0043F667 B808000000              mov eax, 00000008
:0043F66C 2B4588                  sub eax, dword ptr [ebp-78]
:0043F66F C1E801                  shr eax, 01
:0043F672 83C012                  add eax, 00000012
:0043F675 894580                  mov dword ptr [ebp-80], eax
:0043F678 6888000000              push 00000088
:0043F67D 8B4580                  mov eax, dword ptr [ebp-80]
:0043F680 83C012                  add eax, 00000012
:0043F683 50                      push eax
:0043F684 B910BC4600              mov ecx, 0046BC10
:0043F689 E87905FEFF              call 0041FC07
:0043F68E 8B4598                  mov eax, dword ptr [ebp-68]
:0043F691 50                      push eax

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:0043F692 6814384500              push 00453814
:0043F697 6810BC4600              push 0046BC10
:0043F69C E88214FEFF              call 00420B23
:0043F6A1 83C40C                  add esp, 0000000C
:0043F6A4 68A0000000              push 000000A0
:0043F6A9 6A25                    push 00000025
:0043F6AB B910BC4600              mov ecx, 0046BC10
:0043F6B0 E85205FEFF              call 0041FC07
:0043F6B5 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043F6B8 E8C39BFCFF              call 00409280
:0043F6BD 33C9                    xor ecx, ecx
:0043F6BF 8AC8                    mov cl, al
:0043F6C1 51                      push ecx

* Possible StringData Ref from Data Obj ->"Lv.%2u"
                                  |
:0043F6C2 6818384500              push 00453818
:0043F6C7 6810BC4600              push 0046BC10
:0043F6CC E85214FEFF              call 00420B23
:0043F6D1 83C40C                  add esp, 0000000C
:0043F6D4 C74588D0000000          mov [ebp-78], 000000D0
:0043F6DB C7857CFFFFFF00000000    mov dword ptr [ebp+FFFFFF7C], 00000000
:0043F6E5 E90A000000              jmp 0043F6F4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F73F(U)
|
:0043F6EA FF857CFFFFFF            inc dword ptr [ebp+FFFFFF7C]
:0043F6F0 83458818                add dword ptr [ebp-78], 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F6E5(U)
|
:0043F6F4 83BD7CFFFFFF03          cmp dword ptr [ebp+FFFFFF7C], 00000003
:0043F6FB 0F8343000000            jnb 0043F744
:0043F701 6A00                    push 00000000
:0043F703 B910BC4600              mov ecx, 0046BC10
:0043F708 E8C306FEFF              call 0041FDD0
:0043F70D 6A00                    push 00000000
:0043F70F B910BC4600              mov ecx, 0046BC10
:0043F714 E86807FEFF              call 0041FE81
:0043F719 6880000000              push 00000080
:0043F71E 68FF000000              push 000000FF
:0043F723 8B4508                  mov eax, dword ptr [ebp+08]
:0043F726 50                      push eax
:0043F727 8B4588                  mov eax, dword ptr [ebp-78]
:0043F72A 50                      push eax
:0043F72B 68D0000000              push 000000D0
:0043F730 8B857CFFFFFF            mov eax, dword ptr [ebp+FFFFFF7C]
:0043F736 50                      push eax
:0043F737 E8F010FDFF              call 0041082C
:0043F73C 83C418                  add esp, 00000018
:0043F73F E9A6FFFFFF              jmp 0043F6EA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F6FB(C)
|
:0043F744 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0043F748 0F853F000000            jne 0043F78D
:0043F74E 6880000000              push 00000080
:0043F753 33C0                    xor eax, eax
:0043F755 8A8578FFFFFF            mov al, byte ptr [ebp+FFFFFF78]
:0043F75B 8BC8                    mov ecx, eax
:0043F75D 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043F760 C1E003                  shl eax, 03
:0043F763 2BC1                    sub eax, ecx
:0043F765 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043F76B E840A0FCFF              call 004097B0
:0043F770 50                      push eax
:0043F771 8B4508                  mov eax, dword ptr [ebp+08]
:0043F774 50                      push eax
:0043F775 8B4588                  mov eax, dword ptr [ebp-78]
:0043F778 50                      push eax
:0043F779 68D0000000              push 000000D0
:0043F77E 6A0B                    push 0000000B
:0043F780 E8A710FDFF              call 0041082C
:0043F785 83C418                  add esp, 00000018
:0043F788 E921000000              jmp 0043F7AE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F748(C)
|
:0043F78D 6880000000              push 00000080
:0043F792 68E8030000              push 000003E8
:0043F797 8B4508                  mov eax, dword ptr [ebp+08]
:0043F79A 50                      push eax
:0043F79B 8B4588                  mov eax, dword ptr [ebp-78]
:0043F79E 50                      push eax
:0043F79F 68D0000000              push 000000D0
:0043F7A4 6A03                    push 00000003
:0043F7A6 E88110FDFF              call 0041082C
:0043F7AB 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F788(U)
|
:0043F7AE 83458818                add dword ptr [ebp-78], 00000018
:0043F7B2 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0043F7B6 0F8543000000            jne 0043F7FF
:0043F7BC 6880000000              push 00000080
:0043F7C1 33C0                    xor eax, eax
:0043F7C3 8A8578FFFFFF            mov al, byte ptr [ebp+FFFFFF78]
:0043F7C9 8BC8                    mov ecx, eax
:0043F7CB 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043F7CE C1E003                  shl eax, 03
:0043F7D1 2BC1                    sub eax, ecx
:0043F7D3 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043F7D9 E8829AFCFF              call 00409260
:0043F7DE 33C9                    xor ecx, ecx
:0043F7E0 8AC8                    mov cl, al
:0043F7E2 51                      push ecx
:0043F7E3 8B4508                  mov eax, dword ptr [ebp+08]
:0043F7E6 50                      push eax
:0043F7E7 8B4588                  mov eax, dword ptr [ebp-78]
:0043F7EA 50                      push eax
:0043F7EB 68D0000000              push 000000D0
:0043F7F0 6A0C                    push 0000000C
:0043F7F2 E83510FDFF              call 0041082C
:0043F7F7 83C418                  add esp, 00000018
:0043F7FA E921000000              jmp 0043F820

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F7B6(C)
|
:0043F7FF 6880000000              push 00000080
:0043F804 68FF000000              push 000000FF
:0043F809 8B4508                  mov eax, dword ptr [ebp+08]
:0043F80C 50                      push eax
:0043F80D 8B4588                  mov eax, dword ptr [ebp-78]
:0043F810 50                      push eax
:0043F811 68D0000000              push 000000D0
:0043F816 6A04                    push 00000004
:0043F818 E80F10FDFF              call 0041082C
:0043F81D 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F7FA(U)
|
:0043F820 83458818                add dword ptr [ebp-78], 00000018
:0043F824 6880000000              push 00000080
:0043F829 6A64                    push 00000064
:0043F82B 8B4508                  mov eax, dword ptr [ebp+08]
:0043F82E 50                      push eax
:0043F82F 8B4588                  mov eax, dword ptr [ebp-78]
:0043F832 50                      push eax
:0043F833 68D0000000              push 000000D0
:0043F838 6A05                    push 00000005
:0043F83A E8ED0FFDFF              call 0041082C
:0043F83F 83C418                  add esp, 00000018
:0043F842 68D0000000              push 000000D0
:0043F847 6A35                    push 00000035
:0043F849 B910BC4600              mov ecx, 0046BC10
:0043F84E E8B403FEFF              call 0041FC07
:0043F853 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0043F857 0F8420000000            je 0043F87D
:0043F85D 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043F860 E806D3FCFF              call 0040CB6B
:0043F865 50                      push eax

* Possible StringData Ref from Data Obj ->"%3u"
                                  |
:0043F866 6820384500              push 00453820
:0043F86B 6810BC4600              push 0046BC10
:0043F870 E8AE12FEFF              call 00420B23
:0043F875 83C40C                  add esp, 0000000C
:0043F878 E930000000              jmp 0043F8AD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F857(C)
|
:0043F87D 33C0                    xor eax, eax
:0043F87F 8A8578FFFFFF            mov al, byte ptr [ebp+FFFFFF78]
:0043F885 8BC8                    mov ecx, eax
:0043F887 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043F88A C1E003                  shl eax, 03
:0043F88D 2BC1                    sub eax, ecx
:0043F88F 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043F895 E89DA8FEFF              call 0042A137
:0043F89A 50                      push eax

* Possible StringData Ref from Data Obj ->"%3u"
                                  |
:0043F89B 6824384500              push 00453824
:0043F8A0 6810BC4600              push 0046BC10
:0043F8A5 E87912FEFF              call 00420B23
:0043F8AA 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F878(U)
|
:0043F8AD 68E8000000              push 000000E8
:0043F8B2 6A35                    push 00000035
:0043F8B4 B910BC4600              mov ecx, 0046BC10
:0043F8B9 E84903FEFF              call 0041FC07
:0043F8BE 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0043F8C2 0F8420000000            je 0043F8E8
:0043F8C8 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043F8CB E8DCD2FCFF              call 0040CBAC
:0043F8D0 50                      push eax

* Possible StringData Ref from Data Obj ->"%3u"
                                  |
:0043F8D1 6828384500              push 00453828
:0043F8D6 6810BC4600              push 0046BC10
:0043F8DB E84312FEFF              call 00420B23
:0043F8E0 83C40C                  add esp, 0000000C
:0043F8E3 E930000000              jmp 0043F918

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F8C2(C)
|
:0043F8E8 33C0                    xor eax, eax
:0043F8EA 8A8578FFFFFF            mov al, byte ptr [ebp+FFFFFF78]
:0043F8F0 8BC8                    mov ecx, eax
:0043F8F2 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043F8F5 C1E003                  shl eax, 03
:0043F8F8 2BC1                    sub eax, ecx
:0043F8FA 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043F900 E822A9FEFF              call 0042A227
:0043F905 50                      push eax

* Possible StringData Ref from Data Obj ->"%3u"
                                  |
:0043F906 682C384500              push 0045382C
:0043F90B 6810BC4600              push 0046BC10
:0043F910 E80E12FEFF              call 00420B23
:0043F915 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F8E3(U)
|
:0043F918 6800010000              push 00000100
:0043F91D 6A35                    push 00000035
:0043F91F B910BC4600              mov ecx, 0046BC10
:0043F924 E8DE02FEFF              call 0041FC07
:0043F929 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0043F92D 0F8424000000            je 0043F957
:0043F933 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043F936 E8B2D2FCFF              call 0040CBED
:0043F93B 33C9                    xor ecx, ecx
:0043F93D 8AC8                    mov cl, al
:0043F93F 51                      push ecx

* Possible StringData Ref from Data Obj ->"%3u"
                                  |
:0043F940 6830384500              push 00453830
:0043F945 6810BC4600              push 0046BC10
:0043F94A E8D411FEFF              call 00420B23
:0043F94F 83C40C                  add esp, 0000000C
:0043F952 E934000000              jmp 0043F98B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F92D(C)
|
:0043F957 33C0                    xor eax, eax
:0043F959 8A8578FFFFFF            mov al, byte ptr [ebp+FFFFFF78]
:0043F95F 8BC8                    mov ecx, eax
:0043F961 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043F964 C1E003                  shl eax, 03
:0043F967 2BC1                    sub eax, ecx
:0043F969 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043F96F E8EFA8FEFF              call 0042A263
:0043F974 33C9                    xor ecx, ecx
:0043F976 8AC8                    mov cl, al
:0043F978 51                      push ecx

* Possible StringData Ref from Data Obj ->"%3u"
                                  |
:0043F979 6834384500              push 00453834
:0043F97E 6810BC4600              push 0046BC10
:0043F983 E89B11FEFF              call 00420B23
:0043F988 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F952(U)
|
:0043F98B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043F98E E80D9EFFFF              call 004397A0
:0043F993 50                      push eax
:0043F994 6A70                    push 00000070
:0043F996 6898000000              push 00000098
:0043F99B E83D77FEFF              call 004270DD
:0043F9A0 83C40C                  add esp, 0000000C
:0043F9A3 6A04                    push 00000004
:0043F9A5 6A00                    push 00000000
:0043F9A7 33C0                    xor eax, eax
:0043F9A9 8A4584                  mov al, byte ptr [ebp-7C]
:0043F9AC C1E009                  shl eax, 09
:0043F9AF 0500580000              add eax, 00005800
:0043F9B4 50                      push eax
:0043F9B5 B918E54600              mov ecx, 0046E518
:0043F9BA E8617D0000              call 00447720
:0043F9BF 894598                  mov dword ptr [ebp-68], eax
:0043F9C2 E8F075FEFF              call 00426FB7
:0043F9C7 6A00                    push 00000000
:0043F9C9 6A00                    push 00000000
:0043F9CB 6A00                    push 00000000
:0043F9CD 6A00                    push 00000000
:0043F9CF 6A00                    push 00000000
:0043F9D1 6A00                    push 00000000
:0043F9D3 6A00                    push 00000000
:0043F9D5 8D8D5CFFFFFF            lea ecx, dword ptr [ebp+FFFFFF5C]
:0043F9DB E840C3FCFF              call 0040BD20
:0043F9E0 C745FC00000000          mov [ebp-04], 00000000
:0043F9E7 6A00                    push 00000000
:0043F9E9 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->"ȷ"
                                  |
:0043F9EB 6838384500              push 00453838
:0043F9F0 6A10                    push 00000010
:0043F9F2 6A06                    push 00000006
:0043F9F4 6A70                    push 00000070
:0043F9F6 6A37                    push 00000037
:0043F9F8 8D8D5CFFFFFF            lea ecx, dword ptr [ebp+FFFFFF5C]
:0043F9FE E82DC2FCFF              call 0040BC30
:0043FA03 8D8D5CFFFFFF            lea ecx, dword ptr [ebp+FFFFFF5C]
:0043FA09 E8781CFEFF              call 00421686
:0043FA0E 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043FA11 E872D2FCFF              call 0040CC88
:0043FA16 884584                  mov byte ptr [ebp-7C], al
:0043FA19 6A00                    push 00000000
:0043FA1B 6A00                    push 00000000
:0043FA1D 6A00                    push 00000000
:0043FA1F 6A00                    push 00000000
:0043FA21 6A00                    push 00000000
:0043FA23 6A00                    push 00000000
:0043FA25 6A00                    push 00000000
:0043FA27 8D4DDC                  lea ecx, dword ptr [ebp-24]
:0043FA2A E8F1C2FCFF              call 0040BD20
:0043FA2F C645FC01                mov [ebp-04], 01
:0043FA33 33C0                    xor eax, eax
:0043FA35 8A4584                  mov al, byte ptr [ebp-7C]
:0043FA38 85C0                    test eax, eax
:0043FA3A 0F8411010000            je 0043FB51
:0043FA40 6818010000              push 00000118
:0043FA45 6A31                    push 00000031
:0043FA47 B910BC4600              mov ecx, 0046BC10
:0043FA4C E8B601FEFF              call 0041FC07
:0043FA51 6A01                    push 00000001
:0043FA53 6A00                    push 00000000
:0043FA55 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043FA58 E801D0FCFF              call 0040CA5E
:0043FA5D 33C9                    xor ecx, ecx
:0043FA5F 8AC8                    mov cl, al
:0043FA61 894D88                  mov dword ptr [ebp-78], ecx
:0043FA64 817D88FF000000          cmp dword ptr [ebp-78], 000000FF
:0043FA6B 0F841F000000            je 0043FA90
:0043FA71 8B4588                  mov eax, dword ptr [ebp-78]
:0043FA74 50                      push eax
:0043FA75 E894EBFDFF              call 0041E60E
:0043FA7A 83C404                  add esp, 00000004
:0043FA7D 50                      push eax

* Possible StringData Ref from Data Obj ->"%12s"
                                  |
:0043FA7E 6840384500              push 00453840
:0043FA83 6810BC4600              push 0046BC10
:0043FA88 E89610FEFF              call 00420B23
:0043FA8D 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043FA6B(C)
|
:0043FA90 6830010000              push 00000130
:0043FA95 6A31                    push 00000031
:0043FA97 B910BC4600              mov ecx, 0046BC10
:0043FA9C E86601FEFF              call 0041FC07
:0043FAA1 6A01                    push 00000001
:0043FAA3 6A01                    push 00000001
:0043FAA5 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043FAA8 E8B1CFFCFF              call 0040CA5E
:0043FAAD 33C9                    xor ecx, ecx
:0043FAAF 8AC8                    mov cl, al
:0043FAB1 894D88                  mov dword ptr [ebp-78], ecx
:0043FAB4 817D88FF000000          cmp dword ptr [ebp-78], 000000FF
:0043FABB 0F841F000000            je 0043FAE0
:0043FAC1 8B4588                  mov eax, dword ptr [ebp-78]
:0043FAC4 50                      push eax
:0043FAC5 E844EBFDFF              call 0041E60E
:0043FACA 83C404                  add esp, 00000004
:0043FACD 50                      push eax

* Possible StringData Ref from Data Obj ->"%12s"
                                  |
:0043FACE 6848384500              push 00453848
:0043FAD3 6810BC4600              push 0046BC10
:0043FAD8 E84610FEFF              call 00420B23
:0043FADD 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043FABB(C)
|
:0043FAE0 6848010000              push 00000148
:0043FAE5 6A31                    push 00000031
:0043FAE7 B910BC4600              mov ecx, 0046BC10
:0043FAEC E81601FEFF              call 0041FC07
:0043FAF1 6A01                    push 00000001
:0043FAF3 6A02                    push 00000002
:0043FAF5 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043FAF8 E861CFFCFF              call 0040CA5E
:0043FAFD 33C9                    xor ecx, ecx
:0043FAFF 8AC8                    mov cl, al
:0043FB01 894D88                  mov dword ptr [ebp-78], ecx
:0043FB04 817D88FF000000          cmp dword ptr [ebp-78], 000000FF
:0043FB0B 0F841F000000            je 0043FB30
:0043FB11 8B4588                  mov eax, dword ptr [ebp-78]
:0043FB14 50                      push eax
:0043FB15 E8F4EAFDFF              call 0041E60E
:0043FB1A 83C404                  add esp, 00000004
:0043FB1D 50                      push eax

* Possible StringData Ref from Data Obj ->"%12s"
                                  |
:0043FB1E 6850384500              push 00453850
:0043FB23 6810BC4600              push 0046BC10
:0043FB28 E8F60FFEFF              call 00420B23
:0043FB2D 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043FB0B(C)
|
:0043FB30 6A20                    push 00000020
:0043FB32 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->""
                                  |
:0043FB34 6858384500              push 00453858
:0043FB39 6A10                    push 00000010
:0043FB3B 6A06                    push 00000006
:0043FB3D 6A70                    push 00000070
:0043FB3F 6A31                    push 00000031
:0043FB41 8D4DDC                  lea ecx, dword ptr [ebp-24]
:0043FB44 E8E7C0FCFF              call 0040BC30
:0043FB49 8D4DDC                  lea ecx, dword ptr [ebp-24]
:0043FB4C E8351BFEFF              call 00421686

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043FA3A(C)
|
:0043FB51 33C0                    xor eax, eax
:0043FB53 A0A4354500              mov al, byte ptr [004535A4]
:0043FB58 A802                    test al, 02
:0043FB5A 0F8427000000            je 0043FB87
:0043FB60 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0043FB64 0F851D000000            jne 0043FB87
:0043FB6A 33C0                    xor eax, eax
:0043FB6C 8A8578FFFFFF            mov al, byte ptr [ebp+FFFFFF78]
:0043FB72 8BC8                    mov ecx, eax
:0043FB74 8D0440                  lea eax, dword ptr [eax+2*eax]
:0043FB77 C1E003                  shl eax, 03
:0043FB7A 2BC1                    sub eax, ecx
:0043FB7C 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0043FB82 E86899FEFF              call 004294EF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043FB5A(C), :0043FB64(C)
|
:0043FB87 6A00                    push 00000000
:0043FB89 E8FA62FEFF              call 00425E88
:0043FB8E 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043FD23(U)
|
:0043FB91 E8E778FFFF              call 0043747D
:0043FB96 A380534500              mov dword ptr [00455380], eax
:0043FB9B 833D8053450002          cmp dword ptr [00455380], 00000002
:0043FBA2 0F850A000000            jne 0043FBB2
:0043FBA8 E83A79FFFF              call 004374E7
:0043FBAD E976010000              jmp 0043FD28

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043FBA2(C)
|
:0043FBB2 8D8D5CFFFFFF            lea ecx, dword ptr [ebp+FFFFFF5C]
:0043FBB8 E8FD1CFEFF              call 004218BA
:0043FBBD 33C9                    xor ecx, ecx
:0043FBBF 8AC8                    mov cl, al
:0043FBC1 81F9FF000000            cmp ecx, 000000FF
:0043FBC7 0F8405000000            je 0043FBD2
:0043FBCD E956010000              jmp 0043FD28

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043FBC7(C)
|
:0043FBD2 33C0                    xor eax, eax
:0043FBD4 8A4584                  mov al, byte ptr [ebp-7C]
:0043FBD7 85C0                    test eax, eax
:0043FBD9 0F8444010000            je 0043FD23
:0043FBDF 833D8053450001          cmp dword ptr [00455380], 00000001
:0043FBE6 0F8537010000            jne 0043FD23
:0043FBEC 8D4DDC                  lea ecx, dword ptr [ebp-24]
:0043FBEF E8C61CFEFF              call 004218BA
:0043FBF4 888554FEFFFF            mov byte ptr [ebp+FFFFFE54], al
:0043FBFA 33C0                    xor eax, eax
:0043FBFC 8A8554FEFFFF            mov al, byte ptr [ebp+FFFFFE54]
:0043FC02 3DFF000000              cmp eax, 000000FF
:0043FC07 0F8416010000            je 0043FD23
:0043FC0D 8D459C                  lea eax, dword ptr [ebp-64]
:0043FC10 894594                  mov dword ptr [ebp-6C], eax
:0043FC13 C7857CFFFFFF00000000    mov dword ptr [ebp+FFFFFF7C], 00000000
:0043FC1D C68540FEFFFF00          mov byte ptr [ebp+FFFFFE40], 00
:0043FC24 E906000000              jmp 0043FC2F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043FC99(U)
|
:0043FC29 FF857CFFFFFF            inc dword ptr [ebp+FFFFFF7C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043FC24(U)
|
:0043FC2F 83BD7CFFFFFF0F          cmp dword ptr [ebp+FFFFFF7C], 0000000F
:0043FC36 0F8362000000            jnb 0043FC9E
:0043FC3C 8B857CFFFFFF            mov eax, dword ptr [ebp+FFFFFF7C]
:0043FC42 50                      push eax
:0043FC43 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043FC46 E8B598FCFF              call 00409500
:0043FC4B 88853CFEFFFF            mov byte ptr [ebp+FFFFFE3C], al
:0043FC51 33C0                    xor eax, eax
:0043FC53 8A853CFEFFFF            mov al, byte ptr [ebp+FFFFFE3C]
:0043FC59 3DFF000000              cmp eax, 000000FF
:0043FC5E 0F8435000000            je 0043FC99
:0043FC64 8A853CFEFFFF            mov al, byte ptr [ebp+FFFFFE3C]
:0043FC6A 33C9                    xor ecx, ecx
:0043FC6C 8A8D40FEFFFF            mov cl, byte ptr [ebp+FFFFFE40]
:0043FC72 88840D44FEFFFF          mov byte ptr [ebp+ecx-000001BC], al
:0043FC79 FE8540FEFFFF            inc byte ptr [ebp+FFFFFE40]
:0043FC7F 33C0                    xor eax, eax
:0043FC81 8A853CFEFFFF            mov al, byte ptr [ebp+FFFFFE3C]
:0043FC87 50                      push eax
:0043FC88 E881E9FDFF              call 0041E60E
:0043FC8D 83C404                  add esp, 00000004
:0043FC90 8B4D94                  mov ecx, dword ptr [ebp-6C]
:0043FC93 8901                    mov dword ptr [ecx], eax
:0043FC95 83459404                add dword ptr [ebp-6C], 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043FC5E(C)
|
:0043FC99 E98BFFFFFF              jmp 0043FC29

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043FC36(C)
|
:0043FC9E 33C0                    xor eax, eax
:0043FCA0 8A8540FEFFFF            mov al, byte ptr [ebp+FFFFFE40]
:0043FCA6 C6840544FEFFFFFF        mov byte ptr [ebp+eax-000001BC], FF
:0043FCAE 8B4594                  mov eax, dword ptr [ebp-6C]
:0043FCB1 C70000000000            mov dword ptr [eax], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043FD1E(U)
|
:0043FCB7 6A00                    push 00000000
:0043FCB9 6A0C                    push 0000000C
:0043FCBB 6A00                    push 00000000
:0043FCBD 6880000000              push 00000080
:0043FCC2 6A0F                    push 0000000F
:0043FCC4 8D459C                  lea eax, dword ptr [ebp-64]
:0043FCC7 50                      push eax
:0043FCC8 6A68                    push 00000068
:0043FCCA 6870010000              push 00000170
:0043FCCF E82081FFFF              call 00437DF4
:0043FCD4 83C420                  add esp, 00000020
:0043FCD7 33C9                    xor ecx, ecx
:0043FCD9 8AC8                    mov cl, al
:0043FCDB 894D88                  mov dword ptr [ebp-78], ecx
:0043FCDE 817D88FF000000          cmp dword ptr [ebp-78], 000000FF
:0043FCE5 0F842E000000            je 0043FD19
:0043FCEB 6A00                    push 00000000
:0043FCED B994A64600              mov ecx, 0046A694
:0043FCF2 E82D93FDFF              call 00419024
:0043FCF7 8B4588                  mov eax, dword ptr [ebp-78]
:0043FCFA 33C9                    xor ecx, ecx
:0043FCFC 8A8C0544FEFFFF          mov cl, byte ptr [ebp+eax-000001BC]
:0043FD03 8BC1                    mov eax, ecx
:0043FD05 C1E104                  shl ecx, 04
:0043FD08 8D8C0118AA4600          lea ecx, dword ptr [ecx+eax+0046AA18]
:0043FD0F E832E9FDFF              call 0041E646
:0043FD14 E905000000              jmp 0043FD1E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043FCE5(C)
|
:0043FD19 E905000000              jmp 0043FD23

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043FD14(U)
|
:0043FD1E E994FFFFFF              jmp 0043FCB7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043FBD9(C), :0043FBE6(C), :0043FC07(C), :0043FD19(U)
|
:0043FD23 E969FEFFFF              jmp 0043FB91

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043FBAD(U), :0043FBCD(U)
|
:0043FD28 B958BC4600              mov ecx, 0046BC58
:0043FD2D E8AA12FEFF              call 00420FDC
:0043FD32 C645FC00                mov [ebp-04], 00
:0043FD36 E811000000              call 0043FD4C
:0043FD3B C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0043FD42 E80E000000              call 0043FD55
:0043FD47 E91F000000              jmp 0043FD6B

* Referenced by a CALL at Address:
|:0043FD36   
|
:0043FD4C 8D4DDC                  lea ecx, dword ptr [ebp-24]
:0043FD4F E81CBFFCFF              call 0040BC70
:0043FD54 C3                      ret



* Referenced by a CALL at Address:
|:0043FD42   
|
:0043FD55 8D8D5CFFFFFF            lea ecx, dword ptr [ebp+FFFFFF5C]
:0043FD5B E810BFFCFF              call 0040BC70
:0043FD60 C3                      ret


:0043FD61 B8F0C24400              mov eax, 0044C2F0
:0043FD66 E955830000              jmp 004480C0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043FD47(U)
|
:0043FD6B 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043FD6E 64A300000000            mov dword ptr fs:[00000000], eax
:0043FD74 5F                      pop edi
:0043FD75 5E                      pop esi
:0043FD76 5B                      pop ebx
:0043FD77 C9                      leave
:0043FD78 C3                      ret



* Referenced by a CALL at Address:
|:00425E79   
|
:0043FD79 55                      push ebp
:0043FD7A 8BEC                    mov ebp, esp
:0043FD7C 83EC18                  sub esp, 00000018
:0043FD7F 53                      push ebx
:0043FD80 56                      push esi
:0043FD81 57                      push edi
:0043FD82 A198D44500              mov eax, dword ptr [0045D498]
:0043FD87 50                      push eax

* Reference To: USER32.GetMenu, Ord:0101h
                                  |
:0043FD88 FF1580744700            Call dword ptr [00477480]
:0043FD8E 8945F4                  mov dword ptr [ebp-0C], eax
:0043FD91 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043FD94 50                      push eax

* Reference To: USER32.GetMenuItemCount, Ord:0105h
                                  |
:0043FD95 FF1578744700            Call dword ptr [00477478]
:0043FD9B 8945F0                  mov dword ptr [ebp-10], eax
:0043FD9E 6A01                    push 00000001
:0043FDA0 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043FDA3 50                      push eax

* Reference To: USER32.GetSubMenu, Ord:011Fh
                                  |
:0043FDA4 FF15E4734700            Call dword ptr [004773E4]
:0043FDAA 8945FC                  mov dword ptr [ebp-04], eax
:0043FDAD 6A02                    push 00000002
:0043FDAF 8B45FC                  mov eax, dword ptr [ebp-04]
:0043FDB2 50                      push eax

* Reference To: USER32.GetSubMenu, Ord:011Fh
                                  |
:0043FDB3 FF15E4734700            Call dword ptr [004773E4]
:0043FDB9 8945F8                  mov dword ptr [ebp-08], eax
:0043FDBC 6A02                    push 00000002
:0043FDBE 8B45F8                  mov eax, dword ptr [ebp-08]
:0043FDC1 50                      push eax
:0043FDC2 E89A5EFEFF              call 00425C61
:0043FDC7 83C408                  add esp, 00000008
:0043FDCA B9D0A64600              mov ecx, 0046A6D0
:0043FDCF E84CBCFCFF              call 0040BA20
:0043FDD4 8945EC                  mov dword ptr [ebp-14], eax
:0043FDD7 6808040000              push 00000408
:0043FDDC 8B45EC                  mov eax, dword ptr [ebp-14]
:0043FDDF 2500200000              and eax, 00002000
:0043FDE4 83F801                  cmp eax, 00000001
:0043FDE7 1BC0                    sbb eax, eax
:0043FDE9 F7D8                    neg eax
:0043FDEB 50                      push eax
:0043FDEC 8B45F8                  mov eax, dword ptr [ebp-08]
:0043FDEF 50                      push eax

* Reference To: USER32.CheckMenuItem, Ord:002Dh
                                  |
:0043FDF0 FF1510744700            Call dword ptr [00477410]
:0043FDF6 6A03                    push 00000003
:0043FDF8 8B45FC                  mov eax, dword ptr [ebp-04]
:0043FDFB 50                      push eax

* Reference To: USER32.GetSubMenu, Ord:011Fh
                                  |
:0043FDFC FF15E4734700            Call dword ptr [004773E4]
:0043FE02 8945F8                  mov dword ptr [ebp-08], eax
:0043FE05 6A02                    push 00000002
:0043FE07 8B45F8                  mov eax, dword ptr [ebp-08]
:0043FE0A 50                      push eax
:0043FE0B E8515EFEFF              call 00425C61
:0043FE10 83C408                  add esp, 00000008
:0043FE13 B9D0A64600              mov ecx, 0046A6D0
:0043FE18 E803BCFCFF              call 0040BA20
:0043FE1D 8945EC                  mov dword ptr [ebp-14], eax
:0043FE20 6808040000              push 00000408
:0043FE25 8B45EC                  mov eax, dword ptr [ebp-14]
:0043FE28 2500100000              and eax, 00001000
:0043FE2D 83F801                  cmp eax, 00000001
:0043FE30 1BC0                    sbb eax, eax
:0043FE32 F7D8                    neg eax
:0043FE34 50                      push eax
:0043FE35 8B45F8                  mov eax, dword ptr [ebp-08]
:0043FE38 50                      push eax

* Reference To: USER32.CheckMenuItem, Ord:002Dh
                                  |
:0043FE39 FF1510744700            Call dword ptr [00477410]
:0043FE3F 6A04                    push 00000004
:0043FE41 8B45FC                  mov eax, dword ptr [ebp-04]
:0043FE44 50                      push eax

* Reference To: USER32.GetSubMenu, Ord:011Fh
                                  |
:0043FE45 FF15E4734700            Call dword ptr [004773E4]
:0043FE4B 8945F8                  mov dword ptr [ebp-08], eax
:0043FE4E 6A05                    push 00000005
:0043FE50 8B45F8                  mov eax, dword ptr [ebp-08]
:0043FE53 50                      push eax
:0043FE54 E8085EFEFF              call 00425C61
:0043FE59 83C408                  add esp, 00000008
:0043FE5C B9D0A64600              mov ecx, 0046A6D0
:0043FE61 E81A93FCFF              call 00409180
:0043FE66 8945EC                  mov dword ptr [ebp-14], eax
:0043FE69 8365EC0F                and dword ptr [ebp-14], 0000000F
:0043FE6D 6808040000              push 00000408
:0043FE72 8B45EC                  mov eax, dword ptr [ebp-14]
:0043FE75 50                      push eax
:0043FE76 8B45F8                  mov eax, dword ptr [ebp-08]
:0043FE79 50                      push eax

* Reference To: USER32.CheckMenuItem, Ord:002Dh
                                  |
:0043FE7A FF1510744700            Call dword ptr [00477410]
:0043FE80 6A05                    push 00000005
:0043FE82 8B45FC                  mov eax, dword ptr [ebp-04]
:0043FE85 50                      push eax

* Reference To: USER32.GetSubMenu, Ord:011Fh
                                  |
:0043FE86 FF15E4734700            Call dword ptr [004773E4]
:0043FE8C 8945F8                  mov dword ptr [ebp-08], eax
:0043FE8F 6A04                    push 00000004
:0043FE91 8B45F8                  mov eax, dword ptr [ebp-08]
:0043FE94 50                      push eax
:0043FE95 E8C75DFEFF              call 00425C61
:0043FE9A 83C408                  add esp, 00000008
:0043FE9D B9D0A64600              mov ecx, 0046A6D0
:0043FEA2 E829EFFFFF              call 0043EDD0
:0043FEA7 33C9                    xor ecx, ecx
:0043FEA9 8AC8                    mov cl, al
:0043FEAB 49                      dec ecx
:0043FEAC 884DE8                  mov byte ptr [ebp-18], cl
:0043FEAF 6808040000              push 00000408
:0043FEB4 33C0                    xor eax, eax
:0043FEB6 8A45E8                  mov al, byte ptr [ebp-18]
:0043FEB9 50                      push eax
:0043FEBA 8B45F8                  mov eax, dword ptr [ebp-08]
:0043FEBD 50                      push eax

* Reference To: USER32.CheckMenuItem, Ord:002Dh
                                  |
:0043FEBE FF1510744700            Call dword ptr [00477410]
:0043FEC4 6A06                    push 00000006
:0043FEC6 8B45FC                  mov eax, dword ptr [ebp-04]
:0043FEC9 50                      push eax

* Reference To: USER32.GetSubMenu, Ord:011Fh
                                  |
:0043FECA FF15E4734700            Call dword ptr [004773E4]
:0043FED0 8945F8                  mov dword ptr [ebp-08], eax
:0043FED3 6A02                    push 00000002
:0043FED5 8B45F8                  mov eax, dword ptr [ebp-08]
:0043FED8 50                      push eax
:0043FED9 E8835DFEFF              call 00425C61
:0043FEDE 83C408                  add esp, 00000008
:0043FEE1 B9D0A64600              mov ecx, 0046A6D0
:0043FEE6 E89592FCFF              call 00409180
:0043FEEB 8945EC                  mov dword ptr [ebp-14], eax
:0043FEEE 8B45EC                  mov eax, dword ptr [ebp-14]
:0043FEF1 25F0000000              and eax, 000000F0
:0043FEF6 C1E804                  shr eax, 04
:0043FEF9 8945EC                  mov dword ptr [ebp-14], eax
:0043FEFC 6808040000              push 00000408
:0043FF01 8B45EC                  mov eax, dword ptr [ebp-14]
:0043FF04 50                      push eax
:0043FF05 8B45F8                  mov eax, dword ptr [ebp-08]
:0043FF08 50                      push eax

* Reference To: USER32.CheckMenuItem, Ord:002Dh
                                  |
:0043FF09 FF1510744700            Call dword ptr [00477410]
:0043FF0F 6A07                    push 00000007
:0043FF11 8B45FC                  mov eax, dword ptr [ebp-04]
:0043FF14 50                      push eax

* Reference To: USER32.GetSubMenu, Ord:011Fh
                                  |
:0043FF15 FF15E4734700            Call dword ptr [004773E4]
:0043FF1B 8945F8                  mov dword ptr [ebp-08], eax
:0043FF1E 6A02                    push 00000002
:0043FF20 8B45F8                  mov eax, dword ptr [ebp-08]
:0043FF23 50                      push eax
:0043FF24 E8385DFEFF              call 00425C61
:0043FF29 83C408                  add esp, 00000008
:0043FF2C B9D0A64600              mov ecx, 0046A6D0
:0043FF31 E84A92FCFF              call 00409180
:0043FF36 8945EC                  mov dword ptr [ebp-14], eax
:0043FF39 6808040000              push 00000408
:0043FF3E 8B45EC                  mov eax, dword ptr [ebp-14]
:0043FF41 2500100000              and eax, 00001000
:0043FF46 83F801                  cmp eax, 00000001
:0043FF49 1BC0                    sbb eax, eax
:0043FF4B F7D8                    neg eax
:0043FF4D 50                      push eax
:0043FF4E 8B45F8                  mov eax, dword ptr [ebp-08]
:0043FF51 50                      push eax

* Reference To: USER32.CheckMenuItem, Ord:002Dh
                                  |
:0043FF52 FF1510744700            Call dword ptr [00477410]
:0043FF58 6A08                    push 00000008
:0043FF5A 8B45FC                  mov eax, dword ptr [ebp-04]
:0043FF5D 50                      push eax

* Reference To: USER32.GetSubMenu, Ord:011Fh
                                  |
:0043FF5E FF15E4734700            Call dword ptr [004773E4]
:0043FF64 8945F8                  mov dword ptr [ebp-08], eax
:0043FF67 6A02                    push 00000002
:0043FF69 8B45F8                  mov eax, dword ptr [ebp-08]
:0043FF6C 50                      push eax
:0043FF6D E8EF5CFEFF              call 00425C61
:0043FF72 83C408                  add esp, 00000008
:0043FF75 B9D0A64600              mov ecx, 0046A6D0
:0043FF7A E8A1BAFCFF              call 0040BA20
:0043FF7F 8945EC                  mov dword ptr [ebp-14], eax
:0043FF82 6808040000              push 00000408
:0043FF87 8B45EC                  mov eax, dword ptr [ebp-14]
:0043FF8A 2500400000              and eax, 00004000
:0043FF8F 83F801                  cmp eax, 00000001
:0043FF92 1BC0                    sbb eax, eax
:0043FF94 F7D8                    neg eax
:0043FF96 50                      push eax
:0043FF97 8B45F8                  mov eax, dword ptr [ebp-08]
:0043FF9A 50                      push eax

* Reference To: USER32.CheckMenuItem, Ord:002Dh
                                  |
:0043FF9B FF1510744700            Call dword ptr [00477410]
:0043FFA1 6A09                    push 00000009
:0043FFA3 8B45FC                  mov eax, dword ptr [ebp-04]
:0043FFA6 50                      push eax

* Reference To: USER32.GetSubMenu, Ord:011Fh
                                  |
:0043FFA7 FF15E4734700            Call dword ptr [004773E4]
:0043FFAD 8945F8                  mov dword ptr [ebp-08], eax
:0043FFB0 6A02                    push 00000002
:0043FFB2 8B45F8                  mov eax, dword ptr [ebp-08]
:0043FFB5 50                      push eax
:0043FFB6 E8A65CFEFF              call 00425C61
:0043FFBB 83C408                  add esp, 00000008
:0043FFBE B9D0A64600              mov ecx, 0046A6D0
:0043FFC3 E8B891FCFF              call 00409180
:0043FFC8 8945EC                  mov dword ptr [ebp-14], eax
:0043FFCB 8B45EC                  mov eax, dword ptr [ebp-14]
:0043FFCE 2500010000              and eax, 00000100
:0043FFD3 C1E808                  shr eax, 08
:0043FFD6 8945EC                  mov dword ptr [ebp-14], eax
:0043FFD9 6808040000              push 00000408
:0043FFDE 837DEC01                cmp dword ptr [ebp-14], 00000001
:0043FFE2 1BC0                    sbb eax, eax
:0043FFE4 F7D8                    neg eax
:0043FFE6 50                      push eax
:0043FFE7 8B45F8                  mov eax, dword ptr [ebp-08]
:0043FFEA 50                      push eax

* Reference To: USER32.CheckMenuItem, Ord:002Dh
                                  |
:0043FFEB FF1510744700            Call dword ptr [00477410]
:0043FFF1 6A02                    push 00000002
:0043FFF3 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043FFF6 50                      push eax

* Reference To: USER32.GetSubMenu, Ord:011Fh
                                  |
:0043FFF7 FF15E4734700            Call dword ptr [004773E4]
:0043FFFD 8945FC                  mov dword ptr [ebp-04], eax
:00440000 6A00                    push 00000000
:00440002 8B45FC                  mov eax, dword ptr [ebp-04]
:00440005 50                      push eax

* Reference To: USER32.GetSubMenu, Ord:011Fh
                                  |
:00440006 FF15E4734700            Call dword ptr [004773E4]
:0044000C 8945F8                  mov dword ptr [ebp-08], eax
:0044000F 6A02                    push 00000002
:00440011 8B45F8                  mov eax, dword ptr [ebp-08]
:00440014 50                      push eax
:00440015 E8475CFEFF              call 00425C61
:0044001A 83C408                  add esp, 00000008
:0044001D B900FB4600              mov ecx, 0046FB00
:00440022 E8C9EDFFFF              call 0043EDF0
:00440027 33C9                    xor ecx, ecx
:00440029 8AC8                    mov cl, al
:0044002B 85C9                    test ecx, ecx
:0044002D 0F850C000000            jne 0044003F
:00440033 C745EC00000000          mov [ebp-14], 00000000
:0044003A E907000000              jmp 00440046

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044002D(C)
|
:0044003F C745EC01000000          mov [ebp-14], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044003A(U)
|
:00440046 E900000000              jmp 0044004B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440046(U)
|
:0044004B 5F                      pop edi
:0044004C 5E                      pop esi
:0044004D 5B                      pop ebx
:0044004E C9                      leave
:0044004F C3                      ret



* Referenced by a CALL at Address:
|:00442E94   
|
:00440050 55                      push ebp
:00440051 8BEC                    mov ebp, esp
:00440053 83EC0C                  sub esp, 0000000C
:00440056 53                      push ebx
:00440057 56                      push esi
:00440058 57                      push edi
:00440059 C645F400                mov [ebp-0C], 00
:0044005D B988534500              mov ecx, 00455388
:00440062 E83994FCFF              call 004094A0
:00440067 8945FC                  mov dword ptr [ebp-04], eax
:0044006A B988534500              mov ecx, 00455388
:0044006F E84C94FCFF              call 004094C0
:00440074 8945F8                  mov dword ptr [ebp-08], eax
:00440077 837DFC08                cmp dword ptr [ebp-04], 00000008
:0044007B 0F8225000000            jb 004400A6
:00440081 817DFC10010000          cmp dword ptr [ebp-04], 00000110
:00440088 0F8318000000            jnb 004400A6
:0044008E 837DF808                cmp dword ptr [ebp-08], 00000008
:00440092 0F820E000000            jb 004400A6
:00440098 837DF820                cmp dword ptr [ebp-08], 00000020
:0044009C 0F8304000000            jnb 004400A6
:004400A2 C645F401                mov [ebp-0C], 01

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044007B(C), :00440088(C), :00440092(C), :0044009C(C)
|
:004400A6 33C0                    xor eax, eax
:004400A8 8A45F4                  mov al, byte ptr [ebp-0C]
:004400AB E900000000              jmp 004400B0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004400AB(U)
|
:004400B0 5F                      pop edi
:004400B1 5E                      pop esi
:004400B2 5B                      pop ebx
:004400B3 C9                      leave
:004400B4 C3                      ret



* Referenced by a CALL at Address:
|:004422F1   
|
:004400B5 55                      push ebp
:004400B6 8BEC                    mov ebp, esp
:004400B8 83EC04                  sub esp, 00000004
:004400BB 53                      push ebx
:004400BC 56                      push esi
:004400BD 57                      push edi
:004400BE E80D010000              call 004401D0
:004400C3 A07C534500              mov al, byte ptr [0045537C]
:004400C8 8845FC                  mov byte ptr [ebp-04], al
:004400CB 33C0                    xor eax, eax
:004400CD A074534500              mov al, byte ptr [00455374]
:004400D2 85C0                    test eax, eax
:004400D4 0F8527000000            jne 00440101
:004400DA 33C0                    xor eax, eax
:004400DC A070534500              mov al, byte ptr [00455370]
:004400E1 83F821                  cmp eax, 00000021
:004400E4 0F8D17000000            jnl 00440101
:004400EA 33C0                    xor eax, eax
:004400EC A070534500              mov al, byte ptr [00455370]
:004400F1 B903000000              mov ecx, 00000003
:004400F6 99                      cdq
:004400F7 F7F9                    idiv ecx
:004400F9 83C064                  add eax, 00000064
:004400FC A27C534500              mov byte ptr [0045537C], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004400D4(C), :004400E4(C)
|
:00440101 33C0                    xor eax, eax
:00440103 8A45FC                  mov al, byte ptr [ebp-04]
:00440106 33C9                    xor ecx, ecx
:00440108 8A0D7C534500            mov cl, byte ptr [0045537C]
:0044010E 3BC1                    cmp eax, ecx
:00440110 0F840E000000            je 00440124
:00440116 A07C534500              mov al, byte ptr [0045537C]
:0044011B 50                      push eax
:0044011C E830000000              call 00440151
:00440121 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440110(C)
|
:00440124 B988534500              mov ecx, 00455388
:00440129 E84E1CFCFF              call 00401D7C
:0044012E 85C0                    test eax, eax
:00440130 0F840F000000            je 00440145
:00440136 E8AC73FFFF              call 004374E7
:0044013B A07C534500              mov al, byte ptr [0045537C]
:00440140 E907000000              jmp 0044014C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440130(C)
|
:00440145 B0FF                    mov al, FF
:00440147 E900000000              jmp 0044014C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00440140(U), :00440147(U)
|
:0044014C 5F                      pop edi
:0044014D 5E                      pop esi
:0044014E 5B                      pop ebx
:0044014F C9                      leave
:00440150 C3                      ret



* Referenced by a CALL at Address:
|:0044011C   
|
:00440151 55                      push ebp
:00440152 8BEC                    mov ebp, esp
:00440154 83EC04                  sub esp, 00000004
:00440157 53                      push ebx
:00440158 56                      push esi
:00440159 57                      push edi
:0044015A E8F015FCFF              call 0040174F
:0044015F 33C0                    xor eax, eax
:00440161 8A4508                  mov al, byte ptr [ebp+08]
:00440164 83F864                  cmp eax, 00000064
:00440167 0F8C59000000            jl 004401C6
:0044016D 33C0                    xor eax, eax
:0044016F 8A4508                  mov al, byte ptr [ebp+08]
:00440172 83F86F                  cmp eax, 0000006F
:00440175 0F8F4B000000            jg 004401C6
:0044017B 33C0                    xor eax, eax
:0044017D 8A4508                  mov al, byte ptr [ebp+08]
:00440180 8B048578344500          mov eax, dword ptr [4*eax+00453478]
:00440187 8945FC                  mov dword ptr [ebp-04], eax
:0044018A 6A0C                    push 0000000C
:0044018C BB08000000              mov ebx, 00000008
:00440191 8B45FC                  mov eax, dword ptr [ebp-04]
:00440194 50                      push eax
:00440195 E810720000              call 004473AA
:0044019A 83C404                  add esp, 00000004
:0044019D 2BD8                    sub ebx, eax
:0044019F C1EB01                  shr ebx, 01
:004401A2 83C346                  add ebx, 00000046
:004401A5 53                      push ebx
:004401A6 B910BC4600              mov ecx, 0046BC10
:004401AB E857FAFDFF              call 0041FC07
:004401B0 8B45FC                  mov eax, dword ptr [ebp-04]
:004401B3 50                      push eax

* Possible StringData Ref from Data Obj ->"M4C7%s"
                                  |
:004401B4 6860384500              push 00453860
:004401B9 6810BC4600              push 0046BC10
:004401BE E86009FEFF              call 00420B23
:004401C3 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00440167(C), :00440175(C)
|
:004401C6 E900000000              jmp 004401CB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004401C6(U)
|
:004401CB 5F                      pop edi
:004401CC 5E                      pop esi
:004401CD 5B                      pop ebx
:004401CE C9                      leave
:004401CF C3                      ret



* Referenced by a CALL at Address:
|:004400BE   
|
:004401D0 55                      push ebp
:004401D1 8BEC                    mov ebp, esp
:004401D3 83EC08                  sub esp, 00000008
:004401D6 53                      push ebx
:004401D7 56                      push esi
:004401D8 57                      push edi
:004401D9 B988534500              mov ecx, 00455388
:004401DE E8BD92FCFF              call 004094A0
:004401E3 8945FC                  mov dword ptr [ebp-04], eax
:004401E6 B988534500              mov ecx, 00455388
:004401EB E8D092FCFF              call 004094C0
:004401F0 8945F8                  mov dword ptr [ebp-08], eax
:004401F3 837DFC08                cmp dword ptr [ebp-04], 00000008
:004401F7 0F823B000000            jb 00440238
:004401FD 817DFC10010000          cmp dword ptr [ebp-04], 00000110
:00440204 0F832E000000            jnb 00440238
:0044020A 837DF808                cmp dword ptr [ebp-08], 00000008
:0044020E 0F8224000000            jb 00440238
:00440214 837DF820                cmp dword ptr [ebp-08], 00000020
:00440218 0F831A000000            jnb 00440238
:0044021E 8B45FC                  mov eax, dword ptr [ebp-04]
:00440221 83E808                  sub eax, 00000008
:00440224 C1E803                  shr eax, 03
:00440227 A270534500              mov byte ptr [00455370], al
:0044022C C6057453450000          mov byte ptr [00455374], 00
:00440233 E951000000              jmp 00440289

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004401F7(C), :00440204(C), :0044020E(C), :00440218(C)
|
:00440238 817DFC80020000          cmp dword ptr [ebp-04], 00000280
:0044023F 0F8317000000            jnb 0044025C
:00440245 837DF828                cmp dword ptr [ebp-08], 00000028
:00440249 0F820D000000            jb 0044025C
:0044024F 817DF8E0010000          cmp dword ptr [ebp-08], 000001E0
:00440256 0F820C000000            jb 00440268

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044023F(C), :00440249(C)
|
:0044025C C60570534500FF          mov byte ptr [00455370], FF
:00440263 E921000000              jmp 00440289

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440256(C)
|
:00440268 C16DFC03                shr dword ptr [ebp-04], 03
:0044026C 836DF828                sub dword ptr [ebp-08], 00000028
:00440270 C16DF803                shr dword ptr [ebp-08], 03
:00440274 8A45FC                  mov al, byte ptr [ebp-04]
:00440277 A270534500              mov byte ptr [00455370], al
:0044027C 8A45F8                  mov al, byte ptr [ebp-08]
:0044027F A274534500              mov byte ptr [00455374], al
:00440284 E900000000              jmp 00440289

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00440233(U), :00440263(U), :00440284(U)
|
:00440289 5F                      pop edi
:0044028A 5E                      pop esi
:0044028B 5B                      pop ebx
:0044028C C9                      leave
:0044028D C3                      ret



* Referenced by a CALL at Address:
|:004434A2   
|
:0044028E 55                      push ebp
:0044028F 8BEC                    mov ebp, esp
:00440291 83EC08                  sub esp, 00000008
:00440294 53                      push ebx
:00440295 56                      push esi
:00440296 57                      push edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004402E2(U)
|
:00440297 B998FC4600              mov ecx, 0046FC98
:0044029C E83FDDFEFF              call 0042DFE0
:004402A1 33C9                    xor ecx, ecx
:004402A3 8AC8                    mov cl, al
:004402A5 85C9                    test ecx, ecx
:004402A7 0F853A000000            jne 004402E7
:004402AD B9B0C44600              mov ecx, 0046C4B0
:004402B2 E8C2EDFEFF              call 0042F079
:004402B7 8945FC                  mov dword ptr [ebp-04], eax
:004402BA 817DFCFFFF0000          cmp dword ptr [ebp-04], 0000FFFF
:004402C1 0F8416000000            je 004402DD
:004402C7 8B45FC                  mov eax, dword ptr [ebp-04]
:004402CA 50                      push eax
:004402CB B9B0C44600              mov ecx, 0046C4B0
:004402D0 E8B3F8FEFF              call 0042FB88
:004402D5 8945F8                  mov dword ptr [ebp-08], eax
:004402D8 E905000000              jmp 004402E2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004402C1(C)
|
:004402DD E905000000              jmp 004402E7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004402D8(U)
|
:004402E2 E9B0FFFFFF              jmp 00440297

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004402A7(C), :004402DD(U)
|
:004402E7 8B45F8                  mov eax, dword ptr [ebp-08]
:004402EA E900000000              jmp 004402EF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004402EA(U)
|
:004402EF 5F                      pop edi
:004402F0 5E                      pop esi
:004402F1 5B                      pop ebx
:004402F2 C9                      leave
:004402F3 C3                      ret



* Referenced by a CALL at Address:
|:0043BC18   
|
:004402F4 55                      push ebp
:004402F5 8BEC                    mov ebp, esp
:004402F7 81EC08010000            sub esp, 00000108
:004402FD 53                      push ebx
:004402FE 56                      push esi
:004402FF 57                      push edi
:00440300 898DF8FEFFFF            mov dword ptr [ebp+FFFFFEF8], ecx
:00440306 E88C6CFEFF              call 00426F97
:0044030B 6A00                    push 00000000
:0044030D 6A00                    push 00000000
:0044030F 6A00                    push 00000000
:00440311 E8E9490000              call 00444CFF
:00440316 83C40C                  add esp, 0000000C
:00440319 8D8DFCFEFFFF            lea ecx, dword ptr [ebp+FFFFFEFC]
:0044031F E84C93FCFF              call 00409670

* Possible StringData Ref from Data Obj ->"C:SMLMAP.E2"
                                  |
:00440324 68782C4500              push 00452C78
:00440329 8D8DFCFEFFFF            lea ecx, dword ptr [ebp+FFFFFEFC]
:0044032F E8DB71FEFF              call 0042750F
:00440334 6A04                    push 00000004
:00440336 6A00                    push 00000000
:00440338 6A00                    push 00000000
:0044033A B918E54600              mov ecx, 0046E518
:0044033F E8DC730000              call 00447720
:00440344 50                      push eax
:00440345 8B85F8FEFFFF            mov eax, dword ptr [ebp+FFFFFEF8]
:0044034B 33C9                    xor ecx, ecx
:0044034D 8A08                    mov cl, byte ptr [eax]
:0044034F 51                      push ecx
:00440350 8D8DFCFEFFFF            lea ecx, dword ptr [ebp+FFFFFEFC]
:00440356 E82673FEFF              call 00427681
:0044035B 8D8DFCFEFFFF            lea ecx, dword ptr [ebp+FFFFFEFC]
:00440361 E8BA90FCFF              call 00409420
:00440366 6A00                    push 00000000
:00440368 B918E54600              mov ecx, 0046E518
:0044036D E86E8DFCFF              call 004090E0
:00440372 50                      push eax
:00440373 8B4514                  mov eax, dword ptr [ebp+14]
:00440376 C1E002                  shl eax, 02
:00440379 50                      push eax
:0044037A 8B4510                  mov eax, dword ptr [ebp+10]
:0044037D C1E002                  shl eax, 02
:00440380 50                      push eax
:00440381 8B450C                  mov eax, dword ptr [ebp+0C]
:00440384 50                      push eax
:00440385 8B4508                  mov eax, dword ptr [ebp+08]
:00440388 50                      push eax
:00440389 E827CFFFFF              call 0043D2B5
:0044038E 83C418                  add esp, 00000018
:00440391 E8216CFEFF              call 00426FB7
:00440396 E900000000              jmp 0044039B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440396(U)
|
:0044039B 5F                      pop edi
:0044039C 5E                      pop esi
:0044039D 5B                      pop ebx
:0044039E C9                      leave
:0044039F C21000                  ret 0010



* Referenced by a CALL at Address:
|:004407D7   
|
:004403A2 55                      push ebp
:004403A3 8BEC                    mov ebp, esp
:004403A5 81EC34010000            sub esp, 00000134
:004403AB 53                      push ebx
:004403AC 56                      push esi
:004403AD 57                      push edi
:004403AE 898DCCFEFFFF            mov dword ptr [ebp+FFFFFECC], ecx
:004403B4 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:004403BA E8B192FCFF              call 00409670
:004403BF 8D4DF0                  lea ecx, dword ptr [ebp-10]
:004403C2 E82990FCFF              call 004093F0
:004403C7 C745F800000000          mov [ebp-08], 00000000

* Possible StringData Ref from Data Obj ->"B:HEXEFF.E2"
                                  |
:004403CE 6848354500              push 00453548
:004403D3 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:004403D9 E83171FEFF              call 0042750F
:004403DE 6A04                    push 00000004
:004403E0 6A00                    push 00000000
:004403E2 6800000100              push 00010000
:004403E7 B9E8E44600              mov ecx, 0046E4E8
:004403EC E82F730000              call 00447720
:004403F1 50                      push eax
:004403F2 6A00                    push 00000000
:004403F4 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:004403FA E88272FEFF              call 00427681
:004403FF 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00440405 E81690FCFF              call 00409420

* Possible StringData Ref from Data Obj ->"B:HEXZMAP.E2"
                                  |
:0044040A 6828354500              push 00453528
:0044040F 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00440415 E8F570FEFF              call 0042750F
:0044041A B968F94600              mov ecx, 0046F968
:0044041F E8BC8CFCFF              call 004090E0
:00440424 50                      push eax
:00440425 8B85CCFEFFFF            mov eax, dword ptr [ebp+FFFFFECC]
:0044042B 33C9                    xor ecx, ecx
:0044042D 8A08                    mov cl, byte ptr [eax]
:0044042F 51                      push ecx
:00440430 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00440436 E84672FEFF              call 00427681
:0044043B 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00440441 E8DA8FFCFF              call 00409420
:00440446 B968F94600              mov ecx, 0046F968
:0044044B E8908CFCFF              call 004090E0
:00440450 8A00                    mov al, byte ptr [eax]
:00440452 8885D0FEFFFF            mov byte ptr [ebp+FFFFFED0], al
:00440458 6A04                    push 00000004
:0044045A 6A00                    push 00000000
:0044045C 6A00                    push 00000000
:0044045E B968F94600              mov ecx, 0046F968
:00440463 E8B8720000              call 00447720
:00440468 33C9                    xor ecx, ecx
:0044046A 8A4801                  mov cl, byte ptr [eax+01]
:0044046D BB03000000              mov ebx, 00000003
:00440472 8BC1                    mov eax, ecx
:00440474 99                      cdq
:00440475 F7FB                    idiv ebx
:00440477 A2C8FC4600              mov byte ptr [0046FCC8], al
:0044047C 6A04                    push 00000004
:0044047E 6A00                    push 00000000
:00440480 6A00                    push 00000000
:00440482 B968F94600              mov ecx, 0046F968
:00440487 E894720000              call 00447720
:0044048C 33C9                    xor ecx, ecx
:0044048E 8A4802                  mov cl, byte ptr [eax+02]
:00440491 BB03000000              mov ebx, 00000003
:00440496 8BC1                    mov eax, ecx
:00440498 99                      cdq
:00440499 F7FB                    idiv ebx
:0044049B A2C9FC4600              mov byte ptr [0046FCC9], al
:004404A0 33C0                    xor eax, eax
:004404A2 A0C8FC4600              mov al, byte ptr [0046FCC8]
:004404A7 33C9                    xor ecx, ecx
:004404A9 8A0DC9FC4600            mov cl, byte ptr [0046FCC9]
:004404AF 0FAFC1                  imul eax, ecx
:004404B2 8D04C0                  lea eax, dword ptr [eax+8*eax]
:004404B5 50                      push eax
:004404B6 B950F94600              mov ecx, 0046F950
:004404BB E8208CFCFF              call 004090E0
:004404C0 50                      push eax
:004404C1 6A04                    push 00000004
:004404C3 6A00                    push 00000000
:004404C5 6A00                    push 00000000
:004404C7 B968F94600              mov ecx, 0046F968
:004404CC E84F720000              call 00447720
:004404D1 83C003                  add eax, 00000003
:004404D4 50                      push eax
:004404D5 E8736F0000              call 0044744D
:004404DA 83C40C                  add esp, 0000000C
:004404DD 33C0                    xor eax, eax
:004404DF A0C8FC4600              mov al, byte ptr [0046FCC8]
:004404E4 33C9                    xor ecx, ecx
:004404E6 8A0DC9FC4600            mov cl, byte ptr [0046FCC9]
:004404EC 0FAFC1                  imul eax, ecx
:004404EF 50                      push eax
:004404F0 6A04                    push 00000004
:004404F2 6A00                    push 00000000
:004404F4 68C0210000              push 000021C0
:004404F9 B950F94600              mov ecx, 0046F950
:004404FE E81D720000              call 00447720
:00440503 50                      push eax
:00440504 33DB                    xor ebx, ebx
:00440506 8A1DC8FC4600            mov bl, byte ptr [0046FCC8]
:0044050C 33C0                    xor eax, eax
:0044050E A0C9FC4600              mov al, byte ptr [0046FCC9]
:00440513 0FAFD8                  imul ebx, eax
:00440516 8D1CDB                  lea ebx, dword ptr [ebx+8*ebx]
:00440519 6A04                    push 00000004
:0044051B 6A00                    push 00000000
:0044051D 6A00                    push 00000000
:0044051F B968F94600              mov ecx, 0046F968
:00440524 E8F7710000              call 00447720
:00440529 03D8                    add ebx, eax
:0044052B 83C303                  add ebx, 00000003
:0044052E 53                      push ebx
:0044052F E8196F0000              call 0044744D
:00440534 83C40C                  add esp, 0000000C

* Possible StringData Ref from Data Obj ->"B:HEXZCHP.E2"
                                  |
:00440537 6838354500              push 00453538
:0044053C 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00440542 E8C86FFEFF              call 0042750F
:00440547 B9E8E44600              mov ecx, 0046E4E8
:0044054C E88F8BFCFF              call 004090E0
:00440551 50                      push eax
:00440552 6A00                    push 00000000
:00440554 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0044055A E82271FEFF              call 00427681
:0044055F 6A04                    push 00000004
:00440561 6A00                    push 00000000
:00440563 6A00                    push 00000000
:00440565 B9E8E44600              mov ecx, 0046E4E8
:0044056A E8B1710000              call 00447720
:0044056F 0500420000              add eax, 00004200
:00440574 50                      push eax
:00440575 33C0                    xor eax, eax
:00440577 8A85D0FEFFFF            mov al, byte ptr [ebp+FFFFFED0]
:0044057D 40                      inc eax
:0044057E 50                      push eax
:0044057F 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00440585 E8F770FEFF              call 00427681
:0044058A 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00440590 E88B8EFCFF              call 00409420
:00440595 B990A64600              mov ecx, 0046A690
:0044059A E85189FDFF              call 00418EF0
:0044059F C7055836450000000000    mov dword ptr [00453658], 00000000
:004405A9 E8E969FEFF              call 00426F97
:004405AE E8AF6AFEFF              call 00427062
:004405B3 8B8DCCFEFFFF            mov ecx, dword ptr [ebp+FFFFFECC]
:004405B9 E8023B0000              call 004440C0
:004405BE 50                      push eax
:004405BF E8E66D0000              call 004473AA
:004405C4 83C404                  add esp, 00000004
:004405C7 8945F8                  mov dword ptr [ebp-08], eax
:004405CA 6A00                    push 00000000
:004405CC 6A06                    push 00000006
:004405CE 6A38                    push 00000038
:004405D0 8B45F8                  mov eax, dword ptr [ebp-08]
:004405D3 C1E003                  shl eax, 03
:004405D6 83C040                  add eax, 00000040
:004405D9 50                      push eax
:004405DA 68C8000000              push 000000C8
:004405DF B840010000              mov eax, 00000140
:004405E4 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004405E7 C1E102                  shl ecx, 02
:004405EA 2BC1                    sub eax, ecx
:004405EC 83E820                  sub eax, 00000020
:004405EF 50                      push eax
:004405F0 B958BC4600              mov ecx, 0046BC58
:004405F5 E87007FEFF              call 00420D6A
:004405FA 68DC000000              push 000000DC
:004405FF B828000000              mov eax, 00000028
:00440604 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00440607 C1E901                  shr ecx, 01
:0044060A 2BC1                    sub eax, ecx
:0044060C 50                      push eax
:0044060D B910BC4600              mov ecx, 0046BC10
:00440612 E8F0F5FDFF              call 0041FC07
:00440617 8B8DCCFEFFFF            mov ecx, dword ptr [ebp+FFFFFECC]
:0044061D E89E3A0000              call 004440C0
:00440622 50                      push eax

* Possible StringData Ref from Data Obj ->"M4C7%s"
                                  |
:00440623 686C384500              push 0045386C
:00440628 6810BC4600              push 0046BC10
:0044062D E8F104FEFF              call 00420B23
:00440632 83C40C                  add esp, 0000000C
:00440635 E87D69FEFF              call 00426FB7

* Possible StringData Ref from Data Obj ->"C:M01.E2"
                                  |
:0044063A B878384500              mov eax, 00453878
:0044063F 8D8DD4FEFFFF            lea ecx, dword ptr [ebp+FFFFFED4]
:00440645 8B10                    mov edx, dword ptr [eax]
:00440647 8911                    mov dword ptr [ecx], edx
:00440649 8B5004                  mov edx, dword ptr [eax+04]
:0044064C 895104                  mov dword ptr [ecx+04], edx
:0044064F 8A4008                  mov al, byte ptr [eax+08]
:00440652 884108                  mov byte ptr [ecx+08], al
:00440655 8D85DDFEFFFF            lea eax, dword ptr [ebp+FFFFFEDD]
:0044065B C70000000000            mov dword ptr [eax], 00000000
:00440661 C7400400000000          mov [eax+04], 00000000
:00440668 66C740080000            mov [eax+08], 0000
:0044066E C6400A00                mov [eax+0A], 00
:00440672 8B85CCFEFFFF            mov eax, dword ptr [ebp+FFFFFECC]
:00440678 33C9                    xor ecx, ecx
:0044067A 8A08                    mov cl, byte ptr [eax]
:0044067C BB0A000000              mov ebx, 0000000A
:00440681 8D4101                  lea eax, dword ptr [ecx+01]
:00440684 99                      cdq
:00440685 F7FB                    idiv ebx
:00440687 83C030                  add eax, 00000030
:0044068A 8885D7FEFFFF            mov byte ptr [ebp+FFFFFED7], al
:00440690 8B85CCFEFFFF            mov eax, dword ptr [ebp+FFFFFECC]
:00440696 33C9                    xor ecx, ecx
:00440698 8A08                    mov cl, byte ptr [eax]
:0044069A BB0A000000              mov ebx, 0000000A
:0044069F 8D4101                  lea eax, dword ptr [ecx+01]
:004406A2 99                      cdq
:004406A3 F7FB                    idiv ebx
:004406A5 8D4230                  lea eax, dword ptr [edx+30]
:004406A8 8885D8FEFFFF            mov byte ptr [ebp+FFFFFED8], al
:004406AE 6A04                    push 00000004
:004406B0 8D85D4FEFFFF            lea eax, dword ptr [ebp+FFFFFED4]
:004406B6 50                      push eax
:004406B7 8D4DF0                  lea ecx, dword ptr [ebp-10]
:004406BA E8F86E0000              call 004475B7
:004406BF 8945F4                  mov dword ptr [ebp-0C], eax
:004406C2 6A04                    push 00000004
:004406C4 6A00                    push 00000000
:004406C6 6A00                    push 00000000
:004406C8 B980F94600              mov ecx, 0046F980
:004406CD E84E700000              call 00447720
:004406D2 8945FC                  mov dword ptr [ebp-04], eax
:004406D5 837DF400                cmp dword ptr [ebp-0C], 00000000
:004406D9 0F8436000000            je 00440715
:004406DF 6800C02100              push 0021C000
:004406E4 8B45FC                  mov eax, dword ptr [ebp-04]
:004406E7 50                      push eax
:004406E8 8D4DF0                  lea ecx, dword ptr [ebp-10]
:004406EB E8306CFEFF              call 00427320
:004406F0 8985E8FEFFFF            mov dword ptr [ebp+FFFFFEE8], eax
:004406F6 83BDE8FEFFFF00          cmp dword ptr [ebp+FFFFFEE8], 00000000
:004406FD 0F840A000000            je 0044070D
:00440703 C7055836450001000000    mov dword ptr [00453658], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004406FD(C)
|
:0044070D 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00440710 E80B8DFCFF              call 00409420

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004406D9(C)
|
:00440715 833D5836450000          cmp dword ptr [00453658], 00000000
:0044071C 0F8532000000            jne 00440754
:00440722 6A04                    push 00000004
:00440724 6A00                    push 00000000
:00440726 6A00                    push 00000000
:00440728 B980F94600              mov ecx, 0046F980
:0044072D E8EE6F0000              call 00447720
:00440732 50                      push eax
:00440733 8D85D4FEFFFF            lea eax, dword ptr [ebp+FFFFFED4]
:00440739 50                      push eax
:0044073A E8E35FFEFF              call 00426722
:0044073F 83C408                  add esp, 00000008
:00440742 85C0                    test eax, eax
:00440744 0F840A000000            je 00440754
:0044074A C7055836450001000000    mov dword ptr [00453658], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044071C(C), :00440744(C)
|
:00440754 B988C04600              mov ecx, 0046C088
:00440759 E89777FEFF              call 00427EF5
:0044075E E900000000              jmp 00440763

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044075E(U)
|
:00440763 5F                      pop edi
:00440764 5E                      pop esi
:00440765 5B                      pop ebx
:00440766 C9                      leave
:00440767 C3                      ret



* Referenced by a CALL at Addresses:
|:00427CB5   , :0044350A   
|
:00440768 55                      push ebp
:00440769 8BEC                    mov ebp, esp
:0044076B 83EC10                  sub esp, 00000010
:0044076E 53                      push ebx
:0044076F 56                      push esi
:00440770 57                      push edi
:00440771 894DF0                  mov dword ptr [ebp-10], ecx
:00440774 B9D0A64600              mov ecx, 0046A6D0
:00440779 E8028AFCFF              call 00409180
:0044077E 83E00F                  and eax, 0000000F
:00440781 8A8040364500            mov al, byte ptr [eax+00453640]
:00440787 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044078A 884125                  mov byte ptr [ecx+25], al
:0044078D C705982B4500FFFF0000    mov dword ptr [00452B98], 0000FFFF
:00440797 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044079A E8D7320000              call 00443A76
:0044079F C605A435450000          mov byte ptr [004535A4], 00
:004407A6 C605AC35450000          mov byte ptr [004535AC], 00
:004407AD 8B45F0                  mov eax, dword ptr [ebp-10]
:004407B0 C6400500                mov [eax+05], 00
:004407B4 8B45F0                  mov eax, dword ptr [ebp-10]
:004407B7 C6400100                mov [eax+01], 00
:004407BB 8B45F0                  mov eax, dword ptr [ebp-10]
:004407BE C6402400                mov [eax+24], 00
:004407C2 B988C04600              mov ecx, 0046C088
:004407C7 E81D71FEFF              call 004278E9
:004407CC 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004407CF E8CE320000              call 00443AA2
:004407D4 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004407D7 E8C6FBFFFF              call 004403A2
:004407DC 68FF000000              push 000000FF
:004407E1 68C0030000              push 000003C0
:004407E6 6A04                    push 00000004
:004407E8 6A00                    push 00000000
:004407EA 6880250000              push 00002580
:004407EF B950F94600              mov ecx, 0046F950
:004407F4 E8276F0000              call 00447720
:004407F9 50                      push eax
:004407FA E8646C0000              call 00447463
:004407FF 83C40C                  add esp, 0000000C
:00440802 6880010000              push 00000180
:00440807 6870020000              push 00000270
:0044080C 6A30                    push 00000030
:0044080E 6A08                    push 00000008
:00440810 B900FB4600              mov ecx, 0046FB00
:00440815 E8479DFFFF              call 0043A561
:0044081A B9B0C44600              mov ecx, 0046C4B0
:0044081F E8BC380000              call 004440E0
:00440824 85C0                    test eax, eax
:00440826 0F8557000000            jne 00440883
:0044082C 8B45F0                  mov eax, dword ptr [ebp-10]
:0044082F C6400200                mov [eax+02], 00
:00440833 C605A0FB460000          mov byte ptr [0046FBA0], 00
:0044083A 8B45F0                  mov eax, dword ptr [ebp-10]
:0044083D C6400401                mov [eax+04], 01
:00440841 C645F400                mov [ebp-0C], 00
:00440845 E903000000              jmp 0044084D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440879(U)
|
:0044084A FE45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440845(U)
|
:0044084D 33C0                    xor eax, eax
:0044084F 8A45F4                  mov al, byte ptr [ebp-0C]
:00440852 83F82D                  cmp eax, 0000002D
:00440855 0F8D23000000            jnl 0044087E
:0044085B 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044085E 50                      push eax
:0044085F 33C0                    xor eax, eax
:00440861 8A45F4                  mov al, byte ptr [ebp-0C]
:00440864 8BC8                    mov ecx, eax
:00440866 8D0440                  lea eax, dword ptr [eax+2*eax]
:00440869 C1E003                  shl eax, 03
:0044086C 2BC1                    sub eax, ecx
:0044086E 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00440874 E849ABFEFF              call 0042B3C2
:00440879 E9CCFFFFFF              jmp 0044084A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440855(C)
|
:0044087E E94F000000              jmp 004408D2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440826(C)
|
:00440883 B9B0C44600              mov ecx, 0046C4B0
:00440888 E8B3380000              call 00444140
:0044088D 85C0                    test eax, eax
:0044088F 0F8413000000            je 004408A8
:00440895 8B45F0                  mov eax, dword ptr [ebp-10]
:00440898 C6400200                mov [eax+02], 00
:0044089C C605A0FB460000          mov byte ptr [0046FBA0], 00
:004408A3 E92A000000              jmp 004408D2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044088F(C)
|
:004408A8 33C0                    xor eax, eax
:004408AA A0A0FB4600              mov al, byte ptr [0046FBA0]
:004408AF 85C0                    test eax, eax
:004408B1 0F8510000000            jne 004408C7
:004408B7 8B45F0                  mov eax, dword ptr [ebp-10]
:004408BA 8A4002                  mov al, byte ptr [eax+02]
:004408BD A2A0FB4600              mov byte ptr [0046FBA0], al
:004408C2 E90B000000              jmp 004408D2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004408B1(C)
|
:004408C7 A0A0FB4600              mov al, byte ptr [0046FBA0]
:004408CC 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004408CF 884102                  mov byte ptr [ecx+02], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044087E(U), :004408A3(U), :004408C2(U)
|
:004408D2 B9B0C44600              mov ecx, 0046C4B0
:004408D7 E834380000              call 00444110
:004408DC 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004408DF 884103                  mov byte ptr [ecx+03], al
:004408E2 E8B066FEFF              call 00426F97
:004408E7 6A02                    push 00000002
:004408E9 E82E63FEFF              call 00426C1C
:004408EE 83C404                  add esp, 00000004
:004408F1 6A01                    push 00000001
:004408F3 E86151FEFF              call 00425A59
:004408F8 83C404                  add esp, 00000004
:004408FB 6A00                    push 00000000
:004408FD E8C951FEFF              call 00425ACB
:00440902 83C404                  add esp, 00000004
:00440905 E89D53FEFF              call 00425CA7
:0044090A 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044090D E838040000              call 00440D4A
:00440912 C645F400                mov [ebp-0C], 00
:00440916 E903000000              jmp 0044091E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004409BF(U)
|
:0044091B FE45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440916(U)
|
:0044091E 33C0                    xor eax, eax
:00440920 8A45F4                  mov al, byte ptr [ebp-0C]
:00440923 83F82D                  cmp eax, 0000002D
:00440926 0F8D98000000            jnl 004409C4
:0044092C 33C0                    xor eax, eax
:0044092E 8A45F4                  mov al, byte ptr [ebp-0C]
:00440931 8BC8                    mov ecx, eax
:00440933 8D0440                  lea eax, dword ptr [eax+2*eax]
:00440936 C1E003                  shl eax, 03
:00440939 2BC1                    sub eax, ecx
:0044093B 0598C04600              add eax, 0046C098
:00440940 8945FC                  mov dword ptr [ebp-04], eax
:00440943 6A04                    push 00000004
:00440945 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00440948 E8E389FCFF              call 00409330
:0044094D 33C0                    xor eax, eax
:0044094F 8A45F4                  mov al, byte ptr [ebp-0C]
:00440952 83F80F                  cmp eax, 0000000F
:00440955 0F8D64000000            jnl 004409BF
:0044095B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044095E E8CD87FCFF              call 00409130
:00440963 8D0440                  lea eax, dword ptr [eax+2*eax]
:00440966 03C0                    add eax, eax
:00440968 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:0044096F E8DC04FDFF              call 00410E50
:00440974 33C9                    xor ecx, ecx
:00440976 8AC8                    mov cl, al
:00440978 85C9                    test ecx, ecx
:0044097A 0F8426000000            je 004409A6
:00440980 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00440983 E8A887FCFF              call 00409130
:00440988 8D0440                  lea eax, dword ptr [eax+2*eax]
:0044098B 03C0                    add eax, eax
:0044098D 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:00440994 E8B704FDFF              call 00410E50
:00440999 33C9                    xor ecx, ecx
:0044099B 8AC8                    mov cl, al
:0044099D 83F906                  cmp ecx, 00000006
:004409A0 0F850F000000            jne 004409B5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044097A(C)
|
:004409A6 6A07                    push 00000007
:004409A8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004409AB E826BAFEFF              call 0042C3D6
:004409B0 E90A000000              jmp 004409BF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004409A0(C)
|
:004409B5 6A01                    push 00000001
:004409B7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004409BA E817BAFEFF              call 0042C3D6

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00440955(C), :004409B0(U)
|
:004409BF E957FFFFFF              jmp 0044091B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440926(C)
|
:004409C4 B9B0C44600              mov ecx, 0046C4B0
:004409C9 E812370000              call 004440E0
:004409CE 85C0                    test eax, eax
:004409D0 0F8405000000            je 004409DB
:004409D6 E87B000000              call 00440A56

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004409D0(C)
|
:004409DB B998C04600              mov ecx, 0046C098
:004409E0 E81B88FCFF              call 00409200
:004409E5 668B00                  mov ax, word ptr [eax]
:004409E8 668945F8                mov word ptr [ebp-08], ax
:004409EC 6A01                    push 00000001
:004409EE 33C0                    xor eax, eax
:004409F0 8A45F9                  mov al, byte ptr [ebp-07]
:004409F3 8D0440                  lea eax, dword ptr [eax+2*eax]
:004409F6 50                      push eax
:004409F7 33C0                    xor eax, eax
:004409F9 8A45F8                  mov al, byte ptr [ebp-08]
:004409FC 8D0440                  lea eax, dword ptr [eax+2*eax]
:004409FF 50                      push eax
:00440A00 B900FB4600              mov ecx, 0046FB00
:00440A05 E821A5FFFF              call 0043AF2B
:00440A0A B900FB4600              mov ecx, 0046FB00
:00440A0F E85C370000              call 00444170
:00440A14 6A01                    push 00000001
:00440A16 6A06                    push 00000006
:00440A18 6890010000              push 00000190
:00440A1D 6880020000              push 00000280
:00440A22 6A28                    push 00000028
:00440A24 6A00                    push 00000000
:00440A26 B958BC4600              mov ecx, 0046BC58
:00440A2B E83A03FEFF              call 00420D6A
:00440A30 B900FB4600              mov ecx, 0046FB00
:00440A35 E8668EFCFF              call 004098A0
:00440A3A 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00440A3D E8D1310000              call 00443C13
:00440A42 E87065FEFF              call 00426FB7
:00440A47 E86269FFFF              call 004373AE
:00440A4C E900000000              jmp 00440A51

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440A4C(U)
|
:00440A51 5F                      pop edi
:00440A52 5E                      pop esi
:00440A53 5B                      pop ebx
:00440A54 C9                      leave
:00440A55 C3                      ret



* Referenced by a CALL at Address:
|:004409D6   
|
:00440A56 55                      push ebp
:00440A57 8BEC                    mov ebp, esp
:00440A59 83EC2C                  sub esp, 0000002C
:00440A5C 53                      push ebx
:00440A5D 56                      push esi
:00440A5E 57                      push edi
:00440A5F C745F400000000          mov [ebp-0C], 00000000
:00440A66 E903000000              jmp 00440A6E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440D3B(U)
|
:00440A6B FF45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440A66(U)
|
:00440A6E 837DF40F                cmp dword ptr [ebp-0C], 0000000F
:00440A72 0F83C8020000            jnb 00440D40
:00440A78 8B45F4                  mov eax, dword ptr [ebp-0C]
:00440A7B 8D0440                  lea eax, dword ptr [eax+2*eax]
:00440A7E C60445A8FB4600FF        mov byte ptr [2*eax+0046FBA8], FF
:00440A86 8B45F4                  mov eax, dword ptr [ebp-0C]
:00440A89 8BC8                    mov ecx, eax
:00440A8B 8D0440                  lea eax, dword ptr [eax+2*eax]
:00440A8E C1E003                  shl eax, 03
:00440A91 2BC1                    sub eax, ecx
:00440A93 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00440A99 E8928DFCFF              call 00409830
:00440A9E 33C9                    xor ecx, ecx
:00440AA0 8AC8                    mov cl, al
:00440AA2 83F901                  cmp ecx, 00000001
:00440AA5 0F8590020000            jne 00440D3B
:00440AAB 8A45F4                  mov al, byte ptr [ebp-0C]
:00440AAE 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00440AB1 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:00440AB4 88044DA8FB4600          mov byte ptr [2*ecx+0046FBA8], al
:00440ABB 8B45F4                  mov eax, dword ptr [ebp-0C]
:00440ABE 8BC8                    mov ecx, eax
:00440AC0 8D0440                  lea eax, dword ptr [eax+2*eax]
:00440AC3 C1E003                  shl eax, 03
:00440AC6 2BC1                    sub eax, ecx
:00440AC8 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00440ACE E8DD8CFCFF              call 004097B0
:00440AD3 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00440AD6 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:00440AD9 89044DA9FB4600          mov dword ptr [2*ecx+0046FBA9], eax
:00440AE0 8B45F4                  mov eax, dword ptr [ebp-0C]
:00440AE3 8BC8                    mov ecx, eax
:00440AE5 8D0440                  lea eax, dword ptr [eax+2*eax]
:00440AE8 C1E003                  shl eax, 03
:00440AEB 2BC1                    sub eax, ecx
:00440AED 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00440AF3 E86887FCFF              call 00409260
:00440AF8 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00440AFB 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:00440AFE 88044DADFB4600          mov byte ptr [2*ecx+0046FBAD], al
:00440B05 C745EC01000000          mov [ebp-14], 00000001
:00440B0C 68C4000000              push 000000C4
:00440B11 8B45F4                  mov eax, dword ptr [ebp-0C]
:00440B14 8BC8                    mov ecx, eax
:00440B16 8D0440                  lea eax, dword ptr [eax+2*eax]
:00440B19 C1E003                  shl eax, 03
:00440B1C 2BC1                    sub eax, ecx
:00440B1E 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00440B24 E80788FCFF              call 00409330
:00440B29 68FF000000              push 000000FF
:00440B2E 8B45F4                  mov eax, dword ptr [ebp-0C]
:00440B31 8BC8                    mov ecx, eax
:00440B33 8D0440                  lea eax, dword ptr [eax+2*eax]
:00440B36 C1E003                  shl eax, 03
:00440B39 2BC1                    sub eax, ecx
:00440B3B 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00440B41 E88A8CFCFF              call 004097D0
:00440B46 C745F000000000          mov [ebp-10], 00000000
:00440B4D E903000000              jmp 00440B55

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440C33(U)
|
:00440B52 FF45F0                  inc [ebp-10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440B4D(U)
|
:00440B55 837DF00F                cmp dword ptr [ebp-10], 0000000F
:00440B59 0F83D9000000            jnb 00440C38
:00440B5F 8B45F0                  mov eax, dword ptr [ebp-10]
:00440B62 50                      push eax
:00440B63 B9B0C44600              mov ecx, 0046C4B0
:00440B68 E8D3AFFCFF              call 0040BB40
:00440B6D 8945F8                  mov dword ptr [ebp-08], eax
:00440B70 8B45F8                  mov eax, dword ptr [ebp-08]
:00440B73 8945FC                  mov dword ptr [ebp-04], eax
:00440B76 8B45FC                  mov eax, dword ptr [ebp-04]
:00440B79 8B00                    mov eax, dword ptr [eax]
:00440B7B 8945E8                  mov dword ptr [ebp-18], eax
:00440B7E 8B45F4                  mov eax, dword ptr [ebp-0C]
:00440B81 8BC8                    mov ecx, eax
:00440B83 8D0440                  lea eax, dword ptr [eax+2*eax]
:00440B86 C1E003                  shl eax, 03
:00440B89 2BC1                    sub eax, ecx
:00440B8B 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00440B91 E89A85FCFF              call 00409130
:00440B96 3B45E8                  cmp eax, dword ptr [ebp-18]
:00440B99 0F8594000000            jne 00440C33
:00440B9F 8B45FC                  mov eax, dword ptr [ebp-04]
:00440BA2 83C004                  add eax, 00000004
:00440BA5 8945E4                  mov dword ptr [ebp-1C], eax
:00440BA8 8B45FC                  mov eax, dword ptr [ebp-04]
:00440BAB 8B4006                  mov eax, dword ptr [eax+06]
:00440BAE 8945E0                  mov dword ptr [ebp-20], eax
:00440BB1 8B45F4                  mov eax, dword ptr [ebp-0C]
:00440BB4 8BC8                    mov ecx, eax
:00440BB6 8D0440                  lea eax, dword ptr [eax+2*eax]
:00440BB9 C1E003                  shl eax, 03
:00440BBC 2BC1                    sub eax, ecx
:00440BBE 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00440BC4 E85AA8FEFF              call 0042B423
:00440BC9 8B45E0                  mov eax, dword ptr [ebp-20]
:00440BCC 83E004                  and eax, 00000004
:00440BCF 83E804                  sub eax, 00000004
:00440BD2 83F801                  cmp eax, 00000001
:00440BD5 1BC0                    sbb eax, eax
:00440BD7 83E0FE                  and eax, FFFFFFFE
:00440BDA 83C003                  add eax, 00000003
:00440BDD 50                      push eax
:00440BDE 8B45F4                  mov eax, dword ptr [ebp-0C]
:00440BE1 8BC8                    mov ecx, eax
:00440BE3 8D0440                  lea eax, dword ptr [eax+2*eax]
:00440BE6 C1E003                  shl eax, 03
:00440BE9 2BC1                    sub eax, ecx
:00440BEB 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00440BF1 E82AD6FDFF              call 0041E220
:00440BF6 8B45E0                  mov eax, dword ptr [ebp-20]
:00440BF9 83E004                  and eax, 00000004
:00440BFC 83E804                  sub eax, 00000004
:00440BFF 83F801                  cmp eax, 00000001
:00440C02 1BC0                    sbb eax, eax
:00440C04 F7D8                    neg eax
:00440C06 50                      push eax
:00440C07 8B45E4                  mov eax, dword ptr [ebp-1C]
:00440C0A 8A4001                  mov al, byte ptr [eax+01]
:00440C0D 50                      push eax
:00440C0E 8B45E4                  mov eax, dword ptr [ebp-1C]
:00440C11 8A00                    mov al, byte ptr [eax]
:00440C13 50                      push eax
:00440C14 8B45F4                  mov eax, dword ptr [ebp-0C]
:00440C17 8BC8                    mov ecx, eax
:00440C19 8D0440                  lea eax, dword ptr [eax+2*eax]
:00440C1C C1E003                  shl eax, 03
:00440C1F 2BC1                    sub eax, ecx
:00440C21 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00440C27 E841ADFEFF              call 0042B96D
:00440C2C C745EC00000000          mov [ebp-14], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440B99(C)
|
:00440C33 E91AFFFFFF              jmp 00440B52

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440B59(C)
|
:00440C38 837DEC00                cmp dword ptr [ebp-14], 00000000
:00440C3C 0F84F9000000            je 00440D3B
:00440C42 C745F000000000          mov [ebp-10], 00000000
:00440C49 E903000000              jmp 00440C51

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440D36(U)
|
:00440C4E FF45F0                  inc [ebp-10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440C49(U)
|
:00440C51 837DF00F                cmp dword ptr [ebp-10], 0000000F
:00440C55 0F83E0000000            jnb 00440D3B
:00440C5B 8B45F0                  mov eax, dword ptr [ebp-10]
:00440C5E 50                      push eax
:00440C5F B9B0C44600              mov ecx, 0046C4B0
:00440C64 E8D7AEFCFF              call 0040BB40
:00440C69 8945F8                  mov dword ptr [ebp-08], eax
:00440C6C 8B45F8                  mov eax, dword ptr [ebp-08]
:00440C6F 8945FC                  mov dword ptr [ebp-04], eax
:00440C72 8B45FC                  mov eax, dword ptr [ebp-04]
:00440C75 8B00                    mov eax, dword ptr [eax]
:00440C77 8945DC                  mov dword ptr [ebp-24], eax
:00440C7A 817DDC00040000          cmp dword ptr [ebp-24], 00000400
:00440C81 0F82AF000000            jb 00440D36
:00440C87 8B45FC                  mov eax, dword ptr [ebp-04]
:00440C8A 83C004                  add eax, 00000004
:00440C8D 8945D8                  mov dword ptr [ebp-28], eax
:00440C90 8B45FC                  mov eax, dword ptr [ebp-04]
:00440C93 8B4006                  mov eax, dword ptr [eax+06]
:00440C96 8945D4                  mov dword ptr [ebp-2C], eax
:00440C99 8B45F4                  mov eax, dword ptr [ebp-0C]
:00440C9C 8BC8                    mov ecx, eax
:00440C9E 8D0440                  lea eax, dword ptr [eax+2*eax]
:00440CA1 C1E003                  shl eax, 03
:00440CA4 2BC1                    sub eax, ecx
:00440CA6 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00440CAC E872A7FEFF              call 0042B423
:00440CB1 8B45D4                  mov eax, dword ptr [ebp-2C]
:00440CB4 83E004                  and eax, 00000004
:00440CB7 83E804                  sub eax, 00000004
:00440CBA 83F801                  cmp eax, 00000001
:00440CBD 1BC0                    sbb eax, eax
:00440CBF 83E0FE                  and eax, FFFFFFFE
:00440CC2 83C003                  add eax, 00000003
:00440CC5 50                      push eax
:00440CC6 8B45F4                  mov eax, dword ptr [ebp-0C]
:00440CC9 8BC8                    mov ecx, eax
:00440CCB 8D0440                  lea eax, dword ptr [eax+2*eax]
:00440CCE C1E003                  shl eax, 03
:00440CD1 2BC1                    sub eax, ecx
:00440CD3 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00440CD9 E842D5FDFF              call 0041E220
:00440CDE 8B45D4                  mov eax, dword ptr [ebp-2C]
:00440CE1 83E004                  and eax, 00000004
:00440CE4 83E804                  sub eax, 00000004
:00440CE7 83F801                  cmp eax, 00000001
:00440CEA 1BC0                    sbb eax, eax
:00440CEC F7D8                    neg eax
:00440CEE 50                      push eax
:00440CEF 8B45D8                  mov eax, dword ptr [ebp-28]
:00440CF2 8A4001                  mov al, byte ptr [eax+01]
:00440CF5 50                      push eax
:00440CF6 8B45D8                  mov eax, dword ptr [ebp-28]
:00440CF9 8A00                    mov al, byte ptr [eax]
:00440CFB 50                      push eax
:00440CFC 8B45F4                  mov eax, dword ptr [ebp-0C]
:00440CFF 8BC8                    mov ecx, eax
:00440D01 8D0440                  lea eax, dword ptr [eax+2*eax]
:00440D04 C1E003                  shl eax, 03
:00440D07 2BC1                    sub eax, ecx
:00440D09 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00440D0F E859ACFEFF              call 0042B96D
:00440D14 8B45F4                  mov eax, dword ptr [ebp-0C]
:00440D17 8BC8                    mov ecx, eax
:00440D19 8D0440                  lea eax, dword ptr [eax+2*eax]
:00440D1C C1E003                  shl eax, 03
:00440D1F 2BC1                    sub eax, ecx
:00440D21 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00440D27 E80484FCFF              call 00409130
:00440D2C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00440D2F 8901                    mov dword ptr [ecx], eax
:00440D31 E905000000              jmp 00440D3B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440C81(C)
|
:00440D36 E913FFFFFF              jmp 00440C4E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00440AA5(C), :00440C3C(C), :00440C55(C), :00440D31(U)
|
:00440D3B E92BFDFFFF              jmp 00440A6B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440A72(C)
|
:00440D40 E900000000              jmp 00440D45

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440D40(U)
|
:00440D45 5F                      pop edi
:00440D46 5E                      pop esi
:00440D47 5B                      pop ebx
:00440D48 C9                      leave
:00440D49 C3                      ret



* Referenced by a CALL at Address:
|:0044090D   
|
:00440D4A 55                      push ebp
:00440D4B 8BEC                    mov ebp, esp
:00440D4D 83EC48                  sub esp, 00000048
:00440D50 53                      push ebx
:00440D51 56                      push esi
:00440D52 57                      push edi
:00440D53 894DBC                  mov dword ptr [ebp-44], ecx
:00440D56 C645F400                mov [ebp-0C], 00
:00440D5A C645FC0F                mov [ebp-04], 0F
:00440D5E 8D4DE4                  lea ecx, dword ptr [ebp-1C]
:00440D61 E88A86FCFF              call 004093F0
:00440D66 A1442F4500              mov eax, dword ptr [00452F44]
:00440D6B 50                      push eax

* Possible StringData Ref from Data Obj ->"C:BAKDATA.E2"
                                  |
:00440D6C 68E82B4500              push 00452BE8
:00440D71 8D4DE4                  lea ecx, dword ptr [ebp-1C]
:00440D74 E83E680000              call 004475B7
:00440D79 6800340000              push 00003400
:00440D7E 6A04                    push 00000004
:00440D80 6A00                    push 00000000
:00440D82 6800360000              push 00003600
:00440D87 B968F94600              mov ecx, 0046F968
:00440D8C E88F690000              call 00447720
:00440D91 50                      push eax
:00440D92 68F03A0000              push 00003AF0
:00440D97 8D4DE4                  lea ecx, dword ptr [ebp-1C]
:00440D9A E8B186FCFF              call 00409450
:00440D9F 8D4DE4                  lea ecx, dword ptr [ebp-1C]
:00440DA2 E87986FCFF              call 00409420
:00440DA7 C605A8354500FF          mov byte ptr [004535A8], FF
:00440DAE C745E800000000          mov [ebp-18], 00000000
:00440DB5 E903000000              jmp 00440DBD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004411A6(U)
|
:00440DBA FF45E8                  inc [ebp-18]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440DB5(U)
|
:00440DBD 837DE82D                cmp dword ptr [ebp-18], 0000002D
:00440DC1 0F83E4030000            jnb 004411AB
:00440DC7 8B45E8                  mov eax, dword ptr [ebp-18]
:00440DCA 50                      push eax
:00440DCB B9B0C44600              mov ecx, 0046C4B0
:00440DD0 E86BADFCFF              call 0040BB40
:00440DD5 8945F0                  mov dword ptr [ebp-10], eax
:00440DD8 8B45F0                  mov eax, dword ptr [ebp-10]
:00440DDB 8945F8                  mov dword ptr [ebp-08], eax
:00440DDE 8B45F8                  mov eax, dword ptr [ebp-08]
:00440DE1 8B00                    mov eax, dword ptr [eax]
:00440DE3 8945D8                  mov dword ptr [ebp-28], eax
:00440DE6 8B45F8                  mov eax, dword ptr [ebp-08]
:00440DE9 83C004                  add eax, 00000004
:00440DEC 8945DC                  mov dword ptr [ebp-24], eax
:00440DEF 8B45F8                  mov eax, dword ptr [ebp-08]
:00440DF2 8B4006                  mov eax, dword ptr [eax+06]
:00440DF5 8945D4                  mov dword ptr [ebp-2C], eax
:00440DF8 817DD8FFFF0000          cmp dword ptr [ebp-28], 0000FFFF
:00440DFF 0F84A1030000            je 004411A6
:00440E05 817DD800040000          cmp dword ptr [ebp-28], 00000400
:00440E0C 0F8494030000            je 004411A6
:00440E12 817DD8EB000000          cmp dword ptr [ebp-28], 000000EB
:00440E19 0F830A000000            jnb 00440E29
:00440E1F F645D401                test [ebp-2C], 01
:00440E23 0F84C0000000            je 00440EE9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440E19(C)
|
:00440E29 8B45D8                  mov eax, dword ptr [ebp-28]
:00440E2C 8D0440                  lea eax, dword ptr [eax+2*eax]
:00440E2F 03C0                    add eax, eax
:00440E31 8D04C0                  lea eax, dword ptr [eax+8*eax]
:00440E34 05E8564500              add eax, 004556E8
:00440E39 8945D0                  mov dword ptr [ebp-30], eax
:00440E3C 6A04                    push 00000004
:00440E3E 6A00                    push 00000000
:00440E40 6800360000              push 00003600
:00440E45 B968F94600              mov ecx, 0046F968
:00440E4A E8D1680000              call 00447720
:00440E4F 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00440E52 8BD1                    mov edx, ecx
:00440E54 8D0C89                  lea ecx, dword ptr [ecx+4*ecx]
:00440E57 8D0C89                  lea ecx, dword ptr [ecx+4*ecx]
:00440E5A 03CA                    add ecx, edx
:00440E5C 03C1                    add eax, ecx
:00440E5E 8945E0                  mov dword ptr [ebp-20], eax
:00440E61 FF45E0                  inc [ebp-20]
:00440E64 8B45E0                  mov eax, dword ptr [ebp-20]
:00440E67 8945CC                  mov dword ptr [ebp-34], eax
:00440E6A FF45E0                  inc [ebp-20]
:00440E6D 8B45CC                  mov eax, dword ptr [ebp-34]
:00440E70 8A00                    mov al, byte ptr [eax]
:00440E72 50                      push eax
:00440E73 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00440E76 E8B5CFFCFF              call 0040DE30
:00440E7B 8B45E0                  mov eax, dword ptr [ebp-20]
:00440E7E 8945C8                  mov dword ptr [ebp-38], eax
:00440E81 FF45E0                  inc [ebp-20]
:00440E84 8B45C8                  mov eax, dword ptr [ebp-38]
:00440E87 8A00                    mov al, byte ptr [eax]
:00440E89 50                      push eax
:00440E8A 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00440E8D E86ECFFCFF              call 0040DE00
:00440E92 8B45E0                  mov eax, dword ptr [ebp-20]
:00440E95 8945C4                  mov dword ptr [ebp-3C], eax
:00440E98 FF45E0                  inc [ebp-20]
:00440E9B 8B45C4                  mov eax, dword ptr [ebp-3C]
:00440E9E 8A00                    mov al, byte ptr [eax]
:00440EA0 50                      push eax
:00440EA1 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00440EA4 E8B7CFFCFF              call 0040DE60
:00440EA9 8B45E0                  mov eax, dword ptr [ebp-20]
:00440EAC 33C9                    xor ecx, ecx
:00440EAE 8A08                    mov cl, byte ptr [eax]
:00440EB0 894DEC                  mov dword ptr [ebp-14], ecx
:00440EB3 FF45E0                  inc [ebp-20]
:00440EB6 8B45E0                  mov eax, dword ptr [ebp-20]
:00440EB9 33C9                    xor ecx, ecx
:00440EBB 8A08                    mov cl, byte ptr [eax]
:00440EBD C1E108                  shl ecx, 08
:00440EC0 014DEC                  add dword ptr [ebp-14], ecx
:00440EC3 FF45E0                  inc [ebp-20]
:00440EC6 8B45EC                  mov eax, dword ptr [ebp-14]
:00440EC9 50                      push eax
:00440ECA 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00440ECD E8EECFFCFF              call 0040DEC0
:00440ED2 8B45E0                  mov eax, dword ptr [ebp-20]
:00440ED5 8945C0                  mov dword ptr [ebp-40], eax
:00440ED8 FF45E0                  inc [ebp-20]
:00440EDB 8B45C0                  mov eax, dword ptr [ebp-40]
:00440EDE 8A00                    mov al, byte ptr [eax]
:00440EE0 50                      push eax
:00440EE1 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00440EE4 E8A7CFFCFF              call 0040DE90

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440E23(C)
|
:00440EE9 837DD800                cmp dword ptr [ebp-28], 00000000
:00440EED 0F8508000000            jne 00440EFB
:00440EF3 8A45F4                  mov al, byte ptr [ebp-0C]
:00440EF6 A2A8354500              mov byte ptr [004535A8], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440EED(C)
|
:00440EFB F645D401                test [ebp-2C], 01
:00440EFF 0F850B010000            jne 00441010
:00440F05 B9B0C44600              mov ecx, 0046C4B0
:00440F0A E8D1310000              call 004440E0
:00440F0F 85C0                    test eax, eax
:00440F11 0F85F4000000            jne 0044100B
:00440F17 8B45D8                  mov eax, dword ptr [ebp-28]
:00440F1A 50                      push eax
:00440F1B 33C0                    xor eax, eax
:00440F1D 8A45F4                  mov al, byte ptr [ebp-0C]
:00440F20 8BC8                    mov ecx, eax
:00440F22 8D0440                  lea eax, dword ptr [eax+2*eax]
:00440F25 C1E003                  shl eax, 03
:00440F28 2BC1                    sub eax, ecx
:00440F2A 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00440F30 E8AFA2FEFF              call 0042B1E4
:00440F35 F645D402                test [ebp-2C], 02
:00440F39 0F8567000000            jne 00440FA6
:00440F3F 8B45D4                  mov eax, dword ptr [ebp-2C]
:00440F42 83E004                  and eax, 00000004
:00440F45 83E804                  sub eax, 00000004
:00440F48 83F801                  cmp eax, 00000001
:00440F4B 1BC0                    sbb eax, eax
:00440F4D 83E0FE                  and eax, FFFFFFFE
:00440F50 83C003                  add eax, 00000003
:00440F53 50                      push eax
:00440F54 33C0                    xor eax, eax
:00440F56 8A45F4                  mov al, byte ptr [ebp-0C]
:00440F59 8BC8                    mov ecx, eax
:00440F5B 8D0440                  lea eax, dword ptr [eax+2*eax]
:00440F5E C1E003                  shl eax, 03
:00440F61 2BC1                    sub eax, ecx
:00440F63 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00440F69 E8B2D2FDFF              call 0041E220
:00440F6E 8B45D4                  mov eax, dword ptr [ebp-2C]
:00440F71 83E004                  and eax, 00000004
:00440F74 83E804                  sub eax, 00000004
:00440F77 83F801                  cmp eax, 00000001
:00440F7A 1BC0                    sbb eax, eax
:00440F7C F7D8                    neg eax
:00440F7E 50                      push eax
:00440F7F 8B45DC                  mov eax, dword ptr [ebp-24]
:00440F82 8A4001                  mov al, byte ptr [eax+01]
:00440F85 50                      push eax
:00440F86 8B45DC                  mov eax, dword ptr [ebp-24]
:00440F89 8A00                    mov al, byte ptr [eax]
:00440F8B 50                      push eax
:00440F8C 33C0                    xor eax, eax
:00440F8E 8A45F4                  mov al, byte ptr [ebp-0C]
:00440F91 8BC8                    mov ecx, eax
:00440F93 8D0440                  lea eax, dword ptr [eax+2*eax]
:00440F96 C1E003                  shl eax, 03
:00440F99 2BC1                    sub eax, ecx
:00440F9B 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00440FA1 E8C7A9FEFF              call 0042B96D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440F39(C)
|
:00440FA6 8B45D8                  mov eax, dword ptr [ebp-28]
:00440FA9 8D0440                  lea eax, dword ptr [eax+2*eax]
:00440FAC 03C0                    add eax, eax
:00440FAE 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:00440FB5 E82682FCFF              call 004091E0
:00440FBA 33C9                    xor ecx, ecx
:00440FBC 8AC8                    mov cl, al
:00440FBE 51                      push ecx
:00440FBF 33C0                    xor eax, eax
:00440FC1 8A45F4                  mov al, byte ptr [ebp-0C]
:00440FC4 8BC8                    mov ecx, eax
:00440FC6 8D0440                  lea eax, dword ptr [eax+2*eax]
:00440FC9 C1E003                  shl eax, 03
:00440FCC 2BC1                    sub eax, ecx
:00440FCE 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00440FD4 E86C94FEFF              call 0042A445
:00440FD9 8B45D8                  mov eax, dword ptr [ebp-28]
:00440FDC 8D0440                  lea eax, dword ptr [eax+2*eax]
:00440FDF 03C0                    add eax, eax
:00440FE1 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:00440FE8 E8A387FCFF              call 00409790
:00440FED 50                      push eax
:00440FEE 33C0                    xor eax, eax
:00440FF0 8A45F4                  mov al, byte ptr [ebp-0C]
:00440FF3 8BC8                    mov ecx, eax
:00440FF5 8D0440                  lea eax, dword ptr [eax+2*eax]
:00440FF8 C1E003                  shl eax, 03
:00440FFB 2BC1                    sub eax, ecx
:00440FFD 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00441003 E8D993FEFF              call 0042A3E1
:00441008 FE45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440F11(C)
|
:0044100B E996010000              jmp 004411A6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440EFF(C)
|
:00441010 8B45D8                  mov eax, dword ptr [ebp-28]
:00441013 33C9                    xor ecx, ecx
:00441015 8A4DFC                  mov cl, byte ptr [ebp-04]
:00441018 89048DDCFB4600          mov dword ptr [4*ecx+0046FBDC], eax
:0044101F 8B45D8                  mov eax, dword ptr [ebp-28]
:00441022 50                      push eax
:00441023 33C0                    xor eax, eax
:00441025 8A45FC                  mov al, byte ptr [ebp-04]
:00441028 8BC8                    mov ecx, eax
:0044102A 8D0440                  lea eax, dword ptr [eax+2*eax]
:0044102D C1E003                  shl eax, 03
:00441030 2BC1                    sub eax, ecx
:00441032 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00441038 E8A7A1FEFF              call 0042B1E4
:0044103D 8B45F0                  mov eax, dword ptr [ebp-10]
:00441040 8A400E                  mov al, byte ptr [eax+0E]
:00441043 50                      push eax
:00441044 8B45F0                  mov eax, dword ptr [ebp-10]
:00441047 8A400D                  mov al, byte ptr [eax+0D]
:0044104A 50                      push eax
:0044104B 33C0                    xor eax, eax
:0044104D 8A45FC                  mov al, byte ptr [ebp-04]
:00441050 8BC8                    mov ecx, eax
:00441052 8D0440                  lea eax, dword ptr [eax+2*eax]
:00441055 C1E003                  shl eax, 03
:00441058 2BC1                    sub eax, ecx
:0044105A 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00441060 E817A1FEFF              call 0042B17C
:00441065 8B45F0                  mov eax, dword ptr [ebp-10]
:00441068 8A4016                  mov al, byte ptr [eax+16]
:0044106B 50                      push eax
:0044106C 8B45F0                  mov eax, dword ptr [ebp-10]
:0044106F 8B4012                  mov eax, dword ptr [eax+12]
:00441072 50                      push eax
:00441073 8B45F0                  mov eax, dword ptr [ebp-10]
:00441076 8A4011                  mov al, byte ptr [eax+11]
:00441079 50                      push eax
:0044107A 8B45F0                  mov eax, dword ptr [ebp-10]
:0044107D 8A4010                  mov al, byte ptr [eax+10]
:00441080 50                      push eax
:00441081 8B45F0                  mov eax, dword ptr [ebp-10]
:00441084 8A400F                  mov al, byte ptr [eax+0F]
:00441087 50                      push eax
:00441088 33C0                    xor eax, eax
:0044108A 8A45FC                  mov al, byte ptr [ebp-04]
:0044108D 8BC8                    mov ecx, eax
:0044108F 8D0440                  lea eax, dword ptr [eax+2*eax]
:00441092 C1E003                  shl eax, 03
:00441095 2BC1                    sub eax, ecx
:00441097 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0044109D E8BDA1FEFF              call 0042B25F
:004410A2 F645D402                test [ebp-2C], 02
:004410A6 0F8567000000            jne 00441113
:004410AC 8B45D4                  mov eax, dword ptr [ebp-2C]
:004410AF 83E004                  and eax, 00000004
:004410B2 83E804                  sub eax, 00000004
:004410B5 83F801                  cmp eax, 00000001
:004410B8 1BC0                    sbb eax, eax
:004410BA 83E0FE                  and eax, FFFFFFFE
:004410BD 83C003                  add eax, 00000003
:004410C0 50                      push eax
:004410C1 33C0                    xor eax, eax
:004410C3 8A45FC                  mov al, byte ptr [ebp-04]
:004410C6 8BC8                    mov ecx, eax
:004410C8 8D0440                  lea eax, dword ptr [eax+2*eax]
:004410CB C1E003                  shl eax, 03
:004410CE 2BC1                    sub eax, ecx
:004410D0 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004410D6 E845D1FDFF              call 0041E220
:004410DB 8B45D4                  mov eax, dword ptr [ebp-2C]
:004410DE 83E004                  and eax, 00000004
:004410E1 83E804                  sub eax, 00000004
:004410E4 83F801                  cmp eax, 00000001
:004410E7 1BC0                    sbb eax, eax
:004410E9 F7D8                    neg eax
:004410EB 50                      push eax
:004410EC 8B45DC                  mov eax, dword ptr [ebp-24]
:004410EF 8A4001                  mov al, byte ptr [eax+01]
:004410F2 50                      push eax
:004410F3 8B45DC                  mov eax, dword ptr [ebp-24]
:004410F6 8A00                    mov al, byte ptr [eax]
:004410F8 50                      push eax
:004410F9 33C0                    xor eax, eax
:004410FB 8A45FC                  mov al, byte ptr [ebp-04]
:004410FE 8BC8                    mov ecx, eax
:00441100 8D0440                  lea eax, dword ptr [eax+2*eax]
:00441103 C1E003                  shl eax, 03
:00441106 2BC1                    sub eax, ecx
:00441108 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0044110E E85AA8FEFF              call 0042B96D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004410A6(C)
|
:00441113 8B45F0                  mov eax, dword ptr [ebp-10]
:00441116 8A400A                  mov al, byte ptr [eax+0A]
:00441119 50                      push eax
:0044111A 8B45D8                  mov eax, dword ptr [ebp-28]
:0044111D 50                      push eax
:0044111E B988C04600              mov ecx, 0046C088
:00441123 E8196DFEFF              call 00427E41
:00441128 8B45F0                  mov eax, dword ptr [ebp-10]
:0044112B 33C9                    xor ecx, ecx
:0044112D 8A480A                  mov cl, byte ptr [eax+0A]
:00441130 894DB8                  mov dword ptr [ebp-48], ecx
:00441133 E943000000              jmp 0044117B
:00441138 8B45F0                  mov eax, dword ptr [ebp-10]
:0044113B 33C9                    xor ecx, ecx
:0044113D 668B480B                mov cx, word ptr [eax+0B]
:00441141 51                      push ecx
:00441142 8B45D8                  mov eax, dword ptr [ebp-28]
:00441145 50                      push eax
:00441146 B988C04600              mov ecx, 0046C088
:0044114B E84D75FEFF              call 0042869D
:00441150 E94E000000              jmp 004411A3
:00441155 8B45F0                  mov eax, dword ptr [ebp-10]
:00441158 8A400C                  mov al, byte ptr [eax+0C]
:0044115B 50                      push eax
:0044115C 8B45F0                  mov eax, dword ptr [ebp-10]
:0044115F 8A400B                  mov al, byte ptr [eax+0B]
:00441162 50                      push eax
:00441163 8B45D8                  mov eax, dword ptr [ebp-28]
:00441166 50                      push eax
:00441167 B988C04600              mov ecx, 0046C088
:0044116C E8CD74FEFF              call 0042863E
:00441171 E92D000000              jmp 004411A3
:00441176 E928000000              jmp 004411A3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441133(U)
|
:0044117B 836DB803                sub dword ptr [ebp-48], 00000003
:0044117F 837DB803                cmp dword ptr [ebp-48], 00000003
:00441183 0F871A000000            ja 004411A3
:00441189 8B45B8                  mov eax, dword ptr [ebp-48]
:0044118C FF248593114400          jmp dword ptr [4*eax+00441193]

:00441193 38114400                DWORD 00441138
:00441197 55114400                DWORD 00441155
:0044119B 38114400                DWORD 00441138
:0044119F 55114400                DWORD 00441155



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00441150(U), :00441171(U), :00441176(U), :00441183(C)
|
:004411A3 FE45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00440DFF(C), :00440E0C(C), :0044100B(U)
|
:004411A6 E90FFCFFFF              jmp 00440DBA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440DC1(C)
|
:004411AB E903000000              jmp 004411B3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004411EF(U)
|
:004411B0 FE45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004411AB(U)
|
:004411B3 33C0                    xor eax, eax
:004411B5 8A45FC                  mov al, byte ptr [ebp-04]
:004411B8 83F82D                  cmp eax, 0000002D
:004411BB 0F8D33000000            jnl 004411F4
:004411C1 8B45FC                  mov eax, dword ptr [ebp-04]
:004411C4 50                      push eax
:004411C5 33C0                    xor eax, eax
:004411C7 8A45FC                  mov al, byte ptr [ebp-04]
:004411CA 8BC8                    mov ecx, eax
:004411CC 8D0440                  lea eax, dword ptr [eax+2*eax]
:004411CF C1E003                  shl eax, 03
:004411D2 2BC1                    sub eax, ecx
:004411D4 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004411DA E8E3A1FEFF              call 0042B3C2
:004411DF 33C0                    xor eax, eax
:004411E1 8A45FC                  mov al, byte ptr [ebp-04]
:004411E4 C70485DCFB4600FF000000  mov dword ptr [4*eax+0046FBDC], 000000FF
:004411EF E9BCFFFFFF              jmp 004411B0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004411BB(C)
|
:004411F4 C70590FC4600FF000000    mov dword ptr [0046FC90], 000000FF
:004411FE E900000000              jmp 00441203

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004411FE(U)
|
:00441203 5F                      pop edi
:00441204 5E                      pop esi
:00441205 5B                      pop ebx
:00441206 C9                      leave
:00441207 C3                      ret



* Referenced by a CALL at Address:
|:00441C4B   
|
:00441208 55                      push ebp
:00441209 8BEC                    mov ebp, esp
:0044120B 83EC2C                  sub esp, 0000002C
:0044120E 53                      push ebx
:0044120F 56                      push esi
:00441210 57                      push edi
:00441211 894DDC                  mov dword ptr [ebp-24], ecx
:00441214 C745F000000000          mov [ebp-10], 00000000
:0044121B 6A00                    push 00000000
:0044121D 6A00                    push 00000000
:0044121F 6A00                    push 00000000
:00441221 6A00                    push 00000000
:00441223 6A0C                    push 0000000C

* Possible Indirect StringData Ref from Data Obj ->"ܰON/OFF"
                                  |
:00441225 68C0354500              push 004535C0
:0044122A 6A40                    push 00000040
:0044122C 6A40                    push 00000040
:0044122E E8C16BFFFF              call 00437DF4
:00441233 83C420                  add esp, 00000020
:00441236 8845F4                  mov byte ptr [ebp-0C], al
:00441239 33C0                    xor eax, eax
:0044123B 8A45F4                  mov al, byte ptr [ebp-0C]
:0044123E 8945D8                  mov dword ptr [ebp-28], eax
:00441241 E962070000              jmp 004419A8
:00441246 33C0                    xor eax, eax
:00441248 A0A4354500              mov al, byte ptr [004535A4]
:0044124D A808                    test al, 08
:0044124F 0F8422000000            je 00441277

* Possible StringData Ref from Data Obj ->"[vnee"
                                  |
:00441255 68C4384500              push 004538C4
:0044125A 6A00                    push 00000000
:0044125C E8D47CFFFF              call 00438F35
:00441261 83C408                  add esp, 00000008
:00441264 33C0                    xor eax, eax
:00441266 A0A4354500              mov al, byte ptr [004535A4]
:0044126B 24F7                    and al, F7
:0044126D A2A4354500              mov byte ptr [004535A4], al
:00441272 E91D000000              jmp 00441294

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044124F(C)
|

* Possible StringData Ref from Data Obj ->"[vnm"
                                  |
:00441277 68D4384500              push 004538D4
:0044127C 6A00                    push 00000000
:0044127E E8B27CFFFF              call 00438F35
:00441283 83C408                  add esp, 00000008
:00441286 33C0                    xor eax, eax
:00441288 A0A4354500              mov al, byte ptr [004535A4]
:0044128D 0C08                    or al, 08
:0044128F A2A4354500              mov byte ptr [004535A4], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441272(U)
|
:00441294 E953070000              jmp 004419EC

* Possible StringData Ref from Data Obj ->"gdwIɏ܂B"
                                  |
:00441299 68E0384500              push 004538E0
:0044129E 6A00                    push 00000000
:004412A0 E8907CFFFF              call 00438F35
:004412A5 83C408                  add esp, 00000008
:004412A8 C745F001000000          mov [ebp-10], 00000001
:004412AF C745EC05000000          mov [ebp-14], 00000005

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441348(U)
|
:004412B6 837DEC05                cmp dword ptr [ebp-14], 00000005
:004412BA 0F840A000000            je 004412CA
:004412C0 837DEC06                cmp dword ptr [ebp-14], 00000006
:004412C4 0F8583000000            jne 0044134D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004412BA(C)
|
:004412CA 8B4DDC                  mov ecx, dword ptr [ebp-24]
:004412CD E80ECDFEFF              call 0042DFE0
:004412D2 33C9                    xor ecx, ecx
:004412D4 8AC8                    mov cl, al
:004412D6 85C9                    test ecx, ecx
:004412D8 0F8405000000            je 004412E3
:004412DE E96A000000              jmp 0044134D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004412D8(C)
|
:004412E3 B9B0C44600              mov ecx, 0046C4B0
:004412E8 E8C4E1FEFF              call 0042F4B1
:004412ED 8945E8                  mov dword ptr [ebp-18], eax
:004412F0 817DE8FFFF0000          cmp dword ptr [ebp-18], 0000FFFF
:004412F7 0F8416000000            je 00441313
:004412FD 8B45E8                  mov eax, dword ptr [ebp-18]
:00441300 50                      push eax
:00441301 B9B0C44600              mov ecx, 0046C4B0
:00441306 E87DE8FEFF              call 0042FB88
:0044130B 8945EC                  mov dword ptr [ebp-14], eax
:0044130E E935000000              jmp 00441348

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004412F7(C)
|
:00441313 B9B0C44600              mov ecx, 0046C4B0
:00441318 E85CDDFEFF              call 0042F079
:0044131D 8945E8                  mov dword ptr [ebp-18], eax
:00441320 817DE8FFFF0000          cmp dword ptr [ebp-18], 0000FFFF
:00441327 0F8416000000            je 00441343
:0044132D 8B45E8                  mov eax, dword ptr [ebp-18]
:00441330 50                      push eax
:00441331 B9B0C44600              mov ecx, 0046C4B0
:00441336 E84DE8FEFF              call 0042FB88
:0044133B 8945EC                  mov dword ptr [ebp-14], eax
:0044133E E905000000              jmp 00441348

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441327(C)
|
:00441343 E905000000              jmp 0044134D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044130E(U), :0044133E(U)
|
:00441348 E969FFFFFF              jmp 004412B6

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004412C4(C), :004412DE(U), :00441343(U)
|
:0044134D E99A060000              jmp 004419EC
:00441352 33C0                    xor eax, eax
:00441354 A0A4354500              mov al, byte ptr [004535A4]
:00441359 0C01                    or al, 01
:0044135B A2A4354500              mov byte ptr [004535A4], al
:00441360 C745F001000000          mov [ebp-10], 00000001
:00441367 C745F800000000          mov [ebp-08], 00000000
:0044136E E903000000              jmp 00441376

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004413BF(U)
|
:00441373 FF45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044136E(U)
|
:00441376 837DF80F                cmp dword ptr [ebp-08], 0000000F
:0044137A 0F8344000000            jnb 004413C4
:00441380 8B45F8                  mov eax, dword ptr [ebp-08]
:00441383 8BC8                    mov ecx, eax
:00441385 8D0440                  lea eax, dword ptr [eax+2*eax]
:00441388 C1E003                  shl eax, 03
:0044138B 2BC1                    sub eax, ecx
:0044138D 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00441393 E83880FCFF              call 004093D0
:00441398 33C9                    xor ecx, ecx
:0044139A 8AC8                    mov cl, al
:0044139C 83F907                  cmp ecx, 00000007
:0044139F 0F851A000000            jne 004413BF
:004413A5 6A01                    push 00000001
:004413A7 8B45F8                  mov eax, dword ptr [ebp-08]
:004413AA 8BC8                    mov ecx, eax
:004413AC 8D0440                  lea eax, dword ptr [eax+2*eax]
:004413AF C1E003                  shl eax, 03
:004413B2 2BC1                    sub eax, ecx
:004413B4 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004413BA E817B0FEFF              call 0042C3D6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044139F(C)
|
:004413BF E9AFFFFFFF              jmp 00441373

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044137A(C)
|

* Possible StringData Ref from Data Obj ->"OlvCɓ܂"
                                  |
:004413C4 6800394500              push 00453900
:004413C9 6A00                    push 00000000
:004413CB E8657BFFFF              call 00438F35
:004413D0 83C408                  add esp, 00000008
:004413D3 E914060000              jmp 004419EC
:004413D8 C745F800000000          mov [ebp-08], 00000000
:004413DF E903000000              jmp 004413E7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044140B(U)
|
:004413E4 FF45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004413DF(U)
|
:004413E7 837DF80F                cmp dword ptr [ebp-08], 0000000F
:004413EB 0F831F000000            jnb 00441410
:004413F1 6A07                    push 00000007
:004413F3 8B45F8                  mov eax, dword ptr [ebp-08]
:004413F6 8BC8                    mov ecx, eax
:004413F8 8D0440                  lea eax, dword ptr [eax+2*eax]
:004413FB C1E003                  shl eax, 03
:004413FE 2BC1                    sub eax, ecx
:00441400 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00441406 E8CBAFFEFF              call 0042C3D6
:0044140B E9D4FFFFFF              jmp 004413E4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004413EB(C)
|

* Possible StringData Ref from Data Obj ->"PLAYERȒS𑀍ł悤ɂȂ܂"
                                  |
:00441410 6818394500              push 00453918
:00441415 6A00                    push 00000000
:00441417 E8197BFFFF              call 00438F35
:0044141C 83C408                  add esp, 00000008
:0044141F E9C8050000              jmp 004419EC
:00441424 33C0                    xor eax, eax
:00441426 A0A4354500              mov al, byte ptr [004535A4]
:0044142B A804                    test al, 04
:0044142D 0F8422000000            je 00441455

* Possible StringData Ref from Data Obj ->"ΐ탂[hnee"
                                  |
:00441433 6848394500              push 00453948
:00441438 6A00                    push 00000000
:0044143A E8F67AFFFF              call 00438F35
:0044143F 83C408                  add esp, 00000008
:00441442 33C0                    xor eax, eax
:00441444 A0A4354500              mov al, byte ptr [004535A4]
:00441449 24FB                    and al, FB
:0044144B A2A4354500              mov byte ptr [004535A4], al
:00441450 E91D000000              jmp 00441472

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044142D(C)
|

* Possible StringData Ref from Data Obj ->"ΐ탂[hnm"
                                  |
:00441455 685C394500              push 0045395C
:0044145A 6A00                    push 00000000
:0044145C E8D47AFFFF              call 00438F35
:00441461 83C408                  add esp, 00000008
:00441464 33C0                    xor eax, eax
:00441466 A0A4354500              mov al, byte ptr [004535A4]
:0044146B 0C04                    or al, 04
:0044146D A2A4354500              mov byte ptr [004535A4], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441450(U)
|
:00441472 E975050000              jmp 004419EC
:00441477 C645FC0F                mov [ebp-04], 0F
:0044147B 33C0                    xor eax, eax
:0044147D A0A4354500              mov al, byte ptr [004535A4]
:00441482 A804                    test al, 04
:00441484 0F8404000000            je 0044148E
:0044148A C645FC2D                mov [ebp-04], 2D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441484(C)
|
:0044148E C745F800000000          mov [ebp-08], 00000000
:00441495 E903000000              jmp 0044149D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441502(U)
|
:0044149A FF45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441495(U)
|
:0044149D 33C0                    xor eax, eax
:0044149F 8A45FC                  mov al, byte ptr [ebp-04]
:004414A2 3B45F8                  cmp eax, dword ptr [ebp-08]
:004414A5 0F865C000000            jbe 00441507
:004414AB 8B45F8                  mov eax, dword ptr [ebp-08]
:004414AE 8BC8                    mov ecx, eax
:004414B0 8D0440                  lea eax, dword ptr [eax+2*eax]
:004414B3 C1E003                  shl eax, 03
:004414B6 2BC1                    sub eax, ecx
:004414B8 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004414BE E86D83FCFF              call 00409830
:004414C3 33C9                    xor ecx, ecx
:004414C5 8AC8                    mov cl, al
:004414C7 83F902                  cmp ecx, 00000002
:004414CA 0F8532000000            jne 00441502
:004414D0 8B45F8                  mov eax, dword ptr [ebp-08]
:004414D3 8BC8                    mov ecx, eax
:004414D5 8D0440                  lea eax, dword ptr [eax+2*eax]
:004414D8 C1E003                  shl eax, 03
:004414DB 2BC1                    sub eax, ecx
:004414DD 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004414E3 E8487CFCFF              call 00409130
:004414E8 8D0440                  lea eax, dword ptr [eax+2*eax]
:004414EB 03C0                    add eax, eax
:004414ED 8D04C0                  lea eax, dword ptr [eax+8*eax]
:004414F0 05E8564500              add eax, 004556E8
:004414F5 8945E4                  mov dword ptr [ebp-1C], eax
:004414F8 6A05                    push 00000005
:004414FA 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004414FD E8B2B2FCFF              call 0040C7B4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004414CA(C)
|
:00441502 E993FFFFFF              jmp 0044149A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004414A5(C)
|
:00441507 E9E0040000              jmp 004419EC
:0044150C 8B45DC                  mov eax, dword ptr [ebp-24]
:0044150F 33C9                    xor ecx, ecx
:00441511 8A4802                  mov cl, byte ptr [eax+02]
:00441514 83C105                  add ecx, 00000005
:00441517 8B45DC                  mov eax, dword ptr [ebp-24]
:0044151A 884802                  mov byte ptr [eax+02], cl
:0044151D E9CA040000              jmp 004419EC
:00441522 C745F800000000          mov [ebp-08], 00000000
:00441529 E903000000              jmp 00441531

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004415C3(U)
|
:0044152E FF45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441529(U)
|
:00441531 837DF80F                cmp dword ptr [ebp-08], 0000000F
:00441535 0F838D000000            jnb 004415C8
:0044153B 8B45F8                  mov eax, dword ptr [ebp-08]
:0044153E 8BC8                    mov ecx, eax
:00441540 8D0440                  lea eax, dword ptr [eax+2*eax]
:00441543 C1E003                  shl eax, 03
:00441546 2BC1                    sub eax, ecx
:00441548 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0044154E E8DD82FCFF              call 00409830
:00441553 33C9                    xor ecx, ecx
:00441555 8AC8                    mov cl, al
:00441557 83F902                  cmp ecx, 00000002
:0044155A 0F8563000000            jne 004415C3
:00441560 8B45F8                  mov eax, dword ptr [ebp-08]
:00441563 8BC8                    mov ecx, eax
:00441565 8D0440                  lea eax, dword ptr [eax+2*eax]
:00441568 C1E003                  shl eax, 03
:0044156B 2BC1                    sub eax, ecx
:0044156D 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00441573 E8B87BFCFF              call 00409130
:00441578 8D0440                  lea eax, dword ptr [eax+2*eax]
:0044157B 03C0                    add eax, eax
:0044157D 8D04C0                  lea eax, dword ptr [eax+8*eax]
:00441580 05E8564500              add eax, 004556E8
:00441585 8945E0                  mov dword ptr [ebp-20], eax
:00441588 6A63                    push 00000063
:0044158A 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0044158D E84E70FDFF              call 004185E0
:00441592 68FF000000              push 000000FF
:00441597 68E8030000              push 000003E8
:0044159C 68FF000000              push 000000FF
:004415A1 68FF000000              push 000000FF
:004415A6 68FF000000              push 000000FF
:004415AB 8B45F8                  mov eax, dword ptr [ebp-08]
:004415AE 8BC8                    mov ecx, eax
:004415B0 8D0440                  lea eax, dword ptr [eax+2*eax]
:004415B3 C1E003                  shl eax, 03
:004415B6 2BC1                    sub eax, ecx
:004415B8 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004415BE E89C9CFEFF              call 0042B25F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044155A(C)
|
:004415C3 E966FFFFFF              jmp 0044152E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441535(C)
|

* Possible StringData Ref from Data Obj ->"C6 5 C7ɂȂ܂"
                                  |
:004415C8 686C394500              push 0045396C
:004415CD 6A00                    push 00000000
:004415CF E86179FFFF              call 00438F35
:004415D4 83C408                  add esp, 00000008
:004415D7 6850C30000              push 0000C350
:004415DC B9D0A64600              mov ecx, 0046A6D0
:004415E1 E8DA6FFDFF              call 004185C0
:004415E6 E901040000              jmp 004419EC
:004415EB C745F800000000          mov [ebp-08], 00000000
:004415F2 E903000000              jmp 004415FA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441635(U)
|
:004415F7 FF45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004415F2(U)
|
:004415FA 837DF80F                cmp dword ptr [ebp-08], 0000000F
:004415FE 0F8336000000            jnb 0044163A
:00441604 8B45F8                  mov eax, dword ptr [ebp-08]
:00441607 8BC8                    mov ecx, eax
:00441609 8D0440                  lea eax, dword ptr [eax+2*eax]
:0044160C C1E003                  shl eax, 03
:0044160F 2BC1                    sub eax, ecx
:00441611 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00441617 E81482FCFF              call 00409830
:0044161C 33C9                    xor ecx, ecx
:0044161E 8AC8                    mov cl, al
:00441620 83F902                  cmp ecx, 00000002
:00441623 0F850C000000            jne 00441635
:00441629 8B45F8                  mov eax, dword ptr [ebp-08]
:0044162C 50                      push eax
:0044162D E8D9030000              call 00441A0B
:00441632 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441623(C)
|
:00441635 E9BDFFFFFF              jmp 004415F7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004415FE(C)
|
:0044163A E9AD030000              jmp 004419EC
:0044163F C645FC0F                mov [ebp-04], 0F
:00441643 33C0                    xor eax, eax
:00441645 A0A4354500              mov al, byte ptr [004535A4]
:0044164A A804                    test al, 04
:0044164C 0F8404000000            je 00441656
:00441652 C645FC2D                mov [ebp-04], 2D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044164C(C)
|
:00441656 6A00                    push 00000000
:00441658 6A00                    push 00000000
:0044165A 6A00                    push 00000000
:0044165C 6A00                    push 00000000
:0044165E 6A02                    push 00000002

* Possible Indirect StringData Ref from Data Obj ->"{"
                                  |
:00441660 6898384500              push 00453898
:00441665 6A40                    push 00000040
:00441667 6A40                    push 00000040
:00441669 E88667FFFF              call 00437DF4
:0044166E 83C420                  add esp, 00000020
:00441671 8845F4                  mov byte ptr [ebp-0C], al
:00441674 C745F800000000          mov [ebp-08], 00000000
:0044167B E903000000              jmp 00441683

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441825(U)
|
:00441680 FF45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044167B(U)
|
:00441683 33C0                    xor eax, eax
:00441685 8A45FC                  mov al, byte ptr [ebp-04]
:00441688 3B45F8                  cmp eax, dword ptr [ebp-08]
:0044168B 0F8699010000            jbe 0044182A
:00441691 8B45F8                  mov eax, dword ptr [ebp-08]
:00441694 8BC8                    mov ecx, eax
:00441696 8D0440                  lea eax, dword ptr [eax+2*eax]
:00441699 C1E003                  shl eax, 03
:0044169C 2BC1                    sub eax, ecx
:0044169E 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004416A4 E88781FCFF              call 00409830
:004416A9 33C9                    xor ecx, ecx
:004416AB 8AC8                    mov cl, al
:004416AD 83F902                  cmp ecx, 00000002
:004416B0 0F856F010000            jne 00441825
:004416B6 33C0                    xor eax, eax
:004416B8 8A45F4                  mov al, byte ptr [ebp-0C]
:004416BB 85C0                    test eax, eax
:004416BD 0F85A1000000            jne 00441764
:004416C3 8B45F8                  mov eax, dword ptr [ebp-08]
:004416C6 8BC8                    mov ecx, eax
:004416C8 8D0440                  lea eax, dword ptr [eax+2*eax]
:004416CB C1E003                  shl eax, 03
:004416CE 2BC1                    sub eax, ecx
:004416D0 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004416D6 E8C57BFCFF              call 004092A0
:004416DB 33C9                    xor ecx, ecx
:004416DD 8AC8                    mov cl, al
:004416DF 83F927                  cmp ecx, 00000027
:004416E2 0F8530000000            jne 00441718
:004416E8 6A00                    push 00000000
:004416EA 8B45F8                  mov eax, dword ptr [ebp-08]
:004416ED 8BC8                    mov ecx, eax
:004416EF 8D0440                  lea eax, dword ptr [eax+2*eax]
:004416F2 C1E003                  shl eax, 03
:004416F5 2BC1                    sub eax, ecx
:004416F7 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004416FD E82E7AFCFF              call 00409130
:00441702 8D0440                  lea eax, dword ptr [eax+2*eax]
:00441705 03C0                    add eax, eax
:00441707 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:0044170E E89D7EFCFF              call 004095B0
:00441713 E947000000              jmp 0044175F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004416E2(C)
|
:00441718 8B45F8                  mov eax, dword ptr [ebp-08]
:0044171B 8BC8                    mov ecx, eax
:0044171D 8D0440                  lea eax, dword ptr [eax+2*eax]
:00441720 C1E003                  shl eax, 03
:00441723 2BC1                    sub eax, ecx
:00441725 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0044172B E8707BFCFF              call 004092A0
:00441730 33C9                    xor ecx, ecx
:00441732 8AC8                    mov cl, al
:00441734 41                      inc ecx
:00441735 51                      push ecx
:00441736 8B45F8                  mov eax, dword ptr [ebp-08]
:00441739 8BC8                    mov ecx, eax
:0044173B 8D0440                  lea eax, dword ptr [eax+2*eax]
:0044173E C1E003                  shl eax, 03
:00441741 2BC1                    sub eax, ecx
:00441743 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00441749 E8E279FCFF              call 00409130
:0044174E 8D0440                  lea eax, dword ptr [eax+2*eax]
:00441751 03C0                    add eax, eax
:00441753 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:0044175A E8517EFCFF              call 004095B0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441713(U)
|
:0044175F E9A9000000              jmp 0044180D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004416BD(C)
|
:00441764 33C0                    xor eax, eax
:00441766 8A45F4                  mov al, byte ptr [ebp-0C]
:00441769 83F801                  cmp eax, 00000001
:0044176C 0F859B000000            jne 0044180D
:00441772 8B45F8                  mov eax, dword ptr [ebp-08]
:00441775 8BC8                    mov ecx, eax
:00441777 8D0440                  lea eax, dword ptr [eax+2*eax]
:0044177A C1E003                  shl eax, 03
:0044177D 2BC1                    sub eax, ecx
:0044177F 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00441785 E8167BFCFF              call 004092A0
:0044178A 33C9                    xor ecx, ecx
:0044178C 8AC8                    mov cl, al
:0044178E 85C9                    test ecx, ecx
:00441790 0F8530000000            jne 004417C6
:00441796 6A27                    push 00000027
:00441798 8B45F8                  mov eax, dword ptr [ebp-08]
:0044179B 8BC8                    mov ecx, eax
:0044179D 8D0440                  lea eax, dword ptr [eax+2*eax]
:004417A0 C1E003                  shl eax, 03
:004417A3 2BC1                    sub eax, ecx
:004417A5 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004417AB E88079FCFF              call 00409130
:004417B0 8D0440                  lea eax, dword ptr [eax+2*eax]
:004417B3 03C0                    add eax, eax
:004417B5 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:004417BC E8EF7DFCFF              call 004095B0
:004417C1 E947000000              jmp 0044180D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441790(C)
|
:004417C6 8B45F8                  mov eax, dword ptr [ebp-08]
:004417C9 8BC8                    mov ecx, eax
:004417CB 8D0440                  lea eax, dword ptr [eax+2*eax]
:004417CE C1E003                  shl eax, 03
:004417D1 2BC1                    sub eax, ecx
:004417D3 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004417D9 E8C27AFCFF              call 004092A0
:004417DE 33C9                    xor ecx, ecx
:004417E0 8AC8                    mov cl, al
:004417E2 49                      dec ecx
:004417E3 51                      push ecx
:004417E4 8B45F8                  mov eax, dword ptr [ebp-08]
:004417E7 8BC8                    mov ecx, eax
:004417E9 8D0440                  lea eax, dword ptr [eax+2*eax]
:004417EC C1E003                  shl eax, 03
:004417EF 2BC1                    sub eax, ecx
:004417F1 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004417F7 E83479FCFF              call 00409130
:004417FC 8D0440                  lea eax, dword ptr [eax+2*eax]
:004417FF 03C0                    add eax, eax
:00441801 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:00441808 E8A37DFCFF              call 004095B0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044175F(U), :0044176C(C), :004417C1(U)
|
:0044180D 8B45F8                  mov eax, dword ptr [ebp-08]
:00441810 8BC8                    mov ecx, eax
:00441812 8D0440                  lea eax, dword ptr [eax+2*eax]
:00441815 C1E003                  shl eax, 03
:00441818 2BC1                    sub eax, ecx
:0044181A 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00441820 E8FE9BFEFF              call 0042B423

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004416B0(C)
|
:00441825 E956FEFFFF              jmp 00441680

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044168B(C)
|
:0044182A E9BD010000              jmp 004419EC
:0044182F 6A00                    push 00000000
:00441831 6A00                    push 00000000
:00441833 6A00                    push 00000000
:00441835 6A00                    push 00000000
:00441837 6A02                    push 00000002

* Possible Indirect StringData Ref from Data Obj ->"{"
                                  |
:00441839 6898384500              push 00453898
:0044183E 6A40                    push 00000040
:00441840 6A40                    push 00000040
:00441842 E8AD65FFFF              call 00437DF4
:00441847 83C420                  add esp, 00000020
:0044184A 8845F4                  mov byte ptr [ebp-0C], al
:0044184D 33C0                    xor eax, eax
:0044184F 8A45F4                  mov al, byte ptr [ebp-0C]
:00441852 85C0                    test eax, eax
:00441854 0F852F000000            jne 00441889
:0044185A 6A2B                    push 0000002B
:0044185C B994A64600              mov ecx, 0046A694
:00441861 E8BE77FDFF              call 00419024

* Possible StringData Ref from Data Obj ->"E̎MAXɂ܂B"
                                  |
:00441866 688C394500              push 0045398C
:0044186B 6A00                    push 00000000
:0044186D E8C376FFFF              call 00438F35
:00441872 83C408                  add esp, 00000008
:00441875 68B4000000              push 000000B4
:0044187A B9D0A64600              mov ecx, 0046A6D0
:0044187F E81CA1FCFF              call 0040B9A0
:00441884 E935000000              jmp 004418BE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441854(C)
|
:00441889 33C0                    xor eax, eax
:0044188B 8A45F4                  mov al, byte ptr [ebp-0C]
:0044188E 83F801                  cmp eax, 00000001
:00441891 0F8527000000            jne 004418BE
:00441897 6A2C                    push 0000002C
:00441899 B994A64600              mov ecx, 0046A694
:0044189E E88177FDFF              call 00419024

* Possible StringData Ref from Data Obj ->"E̎0ɂ܂B"
                                  |
:004418A3 68A8394500              push 004539A8
:004418A8 6A00                    push 00000000
:004418AA E88676FFFF              call 00438F35
:004418AF 83C408                  add esp, 00000008
:004418B2 6A00                    push 00000000
:004418B4 B9D0A64600              mov ecx, 0046A6D0
:004418B9 E8E2A0FCFF              call 0040B9A0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00441884(U), :00441891(C)
|
:004418BE E929010000              jmp 004419EC
:004418C3 B9D0A64600              mov ecx, 0046A6D0
:004418C8 E8E3A1FCFF              call 0040BAB0
:004418CD 8B048588384500          mov eax, dword ptr [4*eax+00453888]
:004418D4 50                      push eax

* Possible StringData Ref from Data Obj ->"%słBύX܂"
                                  |
:004418D5 68C4394500              push 004539C4
:004418DA 6A02                    push 00000002
:004418DC E85476FFFF              call 00438F35
:004418E1 83C40C                  add esp, 0000000C
:004418E4 85C0                    test eax, eax
:004418E6 0F84B2000000            je 0044199E
:004418EC 6A00                    push 00000000
:004418EE 6A00                    push 00000000
:004418F0 6A00                    push 00000000
:004418F2 6A00                    push 00000000
:004418F4 6A03                    push 00000003

* Possible Indirect StringData Ref from Data Obj ->""
                                  |
:004418F6 68F8354500              push 004535F8
:004418FB 6A40                    push 00000040
:004418FD 6A40                    push 00000040
:004418FF E8F064FFFF              call 00437DF4
:00441904 83C420                  add esp, 00000020
:00441907 8845F4                  mov byte ptr [ebp-0C], al
:0044190A 33C0                    xor eax, eax
:0044190C 8A45F4                  mov al, byte ptr [ebp-0C]
:0044190F 3DFF000000              cmp eax, 000000FF
:00441914 0F8484000000            je 0044199E
:0044191A 33C0                    xor eax, eax
:0044191C 8A45F4                  mov al, byte ptr [ebp-0C]
:0044191F 8B048588384500          mov eax, dword ptr [4*eax+00453888]
:00441926 50                      push eax

* Possible StringData Ref from Data Obj ->"%sɂ܂"
                                  |
:00441927 68E0394500              push 004539E0
:0044192C 6A00                    push 00000000
:0044192E E80276FFFF              call 00438F35
:00441933 83C40C                  add esp, 0000000C
:00441936 33C0                    xor eax, eax
:00441938 8A45F4                  mov al, byte ptr [ebp-0C]
:0044193B 8945D4                  mov dword ptr [ebp-2C], eax
:0044193E E938000000              jmp 0044197B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044197F(C)
|
:00441943 6A00                    push 00000000
:00441945 B9D0A64600              mov ecx, 0046A6D0
:0044194A E891A1FCFF              call 0040BAE0
:0044194F E94A000000              jmp 0044199E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441989(C)
|
:00441954 6A01                    push 00000001
:00441956 B9D0A64600              mov ecx, 0046A6D0
:0044195B E880A1FCFF              call 0040BAE0
:00441960 E939000000              jmp 0044199E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441993(C)
|
:00441965 6A02                    push 00000002
:00441967 B9D0A64600              mov ecx, 0046A6D0
:0044196C E86FA1FCFF              call 0040BAE0
:00441971 E928000000              jmp 0044199E
:00441976 E923000000              jmp 0044199E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044193E(U)
|
:0044197B 837DD400                cmp dword ptr [ebp-2C], 00000000
:0044197F 0F84BEFFFFFF            je 00441943
:00441985 837DD401                cmp dword ptr [ebp-2C], 00000001
:00441989 0F84C5FFFFFF            je 00441954
:0044198F 837DD402                cmp dword ptr [ebp-2C], 00000002
:00441993 0F84CCFFFFFF            je 00441965
:00441999 E900000000              jmp 0044199E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004418E6(C), :00441914(C), :0044194F(U), :00441960(U), :00441971(U)
|:00441976(U), :00441999(U)
|
:0044199E E949000000              jmp 004419EC
:004419A3 E944000000              jmp 004419EC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441241(U)
|
:004419A8 837DD80B                cmp dword ptr [ebp-28], 0000000B
:004419AC 0F873A000000            ja 004419EC
:004419B2 8B45D8                  mov eax, dword ptr [ebp-28]
:004419B5 FF2485BC194400          jmp dword ptr [4*eax+004419BC]

:004419BC 46124400                DWORD 00441246
:004419C0 99124400                DWORD 00441299
:004419C4 52134400                DWORD 00441352
:004419C8 D8134400                DWORD 004413D8
:004419CC 24144400                DWORD 00441424
:004419D0 77144400                DWORD 00441477
:004419D4 0C154400                DWORD 0044150C
:004419D8 22154400                DWORD 00441522
:004419DC EB154400                DWORD 004415EB
:004419E0 3F164400                DWORD 0044163F
:004419E4 2F184400                DWORD 0044182F
:004419E8 C3184400                DWORD 004418C3



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00441294(U), :0044134D(U), :004413D3(U), :0044141F(U), :00441472(U)
|:00441507(U), :0044151D(U), :004415E6(U), :0044163A(U), :0044182A(U)
|:004418BE(U), :0044199E(U), :004419A3(U), :004419AC(C)
|
:004419EC 6A18                    push 00000018
:004419EE 6A27                    push 00000027
:004419F0 6A00                    push 00000000
:004419F2 6A00                    push 00000000
:004419F4 B900FB4600              mov ecx, 0046FB00
:004419F9 E82F91FFFF              call 0043AB2D
:004419FE 8B45F0                  mov eax, dword ptr [ebp-10]
:00441A01 E900000000              jmp 00441A06

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441A01(U)
|
:00441A06 5F                      pop edi
:00441A07 5E                      pop esi
:00441A08 5B                      pop ebx
:00441A09 C9                      leave
:00441A0A C3                      ret



* Referenced by a CALL at Address:
|:0044162D   
|
:00441A0B 55                      push ebp
:00441A0C 8BEC                    mov ebp, esp
:00441A0E 83EC24                  sub esp, 00000024
:00441A11 53                      push ebx
:00441A12 56                      push esi
:00441A13 57                      push edi
:00441A14 C645E000                mov [ebp-20], 00
:00441A18 C645E101                mov [ebp-1F], 01
:00441A1C C645E203                mov [ebp-1E], 03
:00441A20 C645E304                mov [ebp-1D], 04
:00441A24 C645E406                mov [ebp-1C], 06
:00441A28 C645E507                mov [ebp-1B], 07
:00441A2C C645E609                mov [ebp-1A], 09
:00441A30 C645E70A                mov [ebp-19], 0A
:00441A34 C645E80C                mov [ebp-18], 0C
:00441A38 C645E90D                mov [ebp-17], 0D
:00441A3C C645EA0F                mov [ebp-16], 0F
:00441A40 C645EB10                mov [ebp-15], 10
:00441A44 C645EC12                mov [ebp-14], 12
:00441A48 C645ED13                mov [ebp-13], 13
:00441A4C C645EE15                mov [ebp-12], 15
:00441A50 C645EF17                mov [ebp-11], 17
:00441A54 C645F019                mov [ebp-10], 19
:00441A58 33C0                    xor eax, eax
:00441A5A 8A4508                  mov al, byte ptr [ebp+08]
:00441A5D 8BC8                    mov ecx, eax
:00441A5F 8D0440                  lea eax, dword ptr [eax+2*eax]
:00441A62 C1E003                  shl eax, 03
:00441A65 2BC1                    sub eax, ecx
:00441A67 0598C04600              add eax, 0046C098
:00441A6C 8945F8                  mov dword ptr [ebp-08], eax
:00441A6F C645DC01                mov [ebp-24], 01
:00441A73 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00441A76 E82578FCFF              call 004092A0
:00441A7B 8845FC                  mov byte ptr [ebp-04], al
:00441A7E 33C0                    xor eax, eax
:00441A80 8A45FC                  mov al, byte ptr [ebp-04]
:00441A83 83F820                  cmp eax, 00000020
:00441A86 0F8C13000000            jl 00441A9F
:00441A8C 33C0                    xor eax, eax
:00441A8E 8A45FC                  mov al, byte ptr [ebp-04]
:00441A91 83F827                  cmp eax, 00000027
:00441A94 0F8F05000000            jg 00441A9F
:00441A9A E9B3000000              jmp 00441B52

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00441A86(C), :00441A94(C)
|
:00441A9F C745F400000000          mov [ebp-0C], 00000000
:00441AA6 E903000000              jmp 00441AAE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441AD7(U)
|
:00441AAB FF45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441AA6(U)
|
:00441AAE 837DF411                cmp dword ptr [ebp-0C], 00000011
:00441AB2 0F8324000000            jnb 00441ADC
:00441AB8 8B45F4                  mov eax, dword ptr [ebp-0C]
:00441ABB 33C9                    xor ecx, ecx
:00441ABD 8A4C05E0                mov cl, byte ptr [ebp+eax-20]
:00441AC1 33C0                    xor eax, eax
:00441AC3 8A45FC                  mov al, byte ptr [ebp-04]
:00441AC6 3BC8                    cmp ecx, eax
:00441AC8 0F8509000000            jne 00441AD7
:00441ACE C645DC00                mov [ebp-24], 00
:00441AD2 E905000000              jmp 00441ADC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441AC8(C)
|
:00441AD7 E9CFFFFFFF              jmp 00441AAB

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00441AB2(C), :00441AD2(U)
|
:00441ADC 33C0                    xor eax, eax
:00441ADE 8A45DC                  mov al, byte ptr [ebp-24]
:00441AE1 85C0                    test eax, eax
:00441AE3 0F8405000000            je 00441AEE
:00441AE9 E964000000              jmp 00441B52

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441AE3(C)
|
:00441AEE FE45FC                  inc [ebp-04]
:00441AF1 33C0                    xor eax, eax
:00441AF3 8A45FC                  mov al, byte ptr [ebp-04]
:00441AF6 8B0485F82C4500          mov eax, dword ptr [4*eax+00452CF8]
:00441AFD 50                      push eax
:00441AFE 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00441B01 E87A7AFCFF              call 00409580
:00441B06 50                      push eax

* Possible StringData Ref from Data Obj ->"%sΪ%s"
                                  |
:00441B07 68EC394500              push 004539EC
:00441B0C 6A00                    push 00000000
:00441B0E E82274FFFF              call 00438F35
:00441B13 83C410                  add esp, 00000010
:00441B16 8B45FC                  mov eax, dword ptr [ebp-04]
:00441B19 50                      push eax
:00441B1A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00441B1D E80E76FCFF              call 00409130
:00441B22 8D0440                  lea eax, dword ptr [eax+2*eax]
:00441B25 03C0                    add eax, eax
:00441B27 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:00441B2E E87D7AFCFF              call 004095B0
:00441B33 33C0                    xor eax, eax
:00441B35 8A4508                  mov al, byte ptr [ebp+08]
:00441B38 8BC8                    mov ecx, eax
:00441B3A 8D0440                  lea eax, dword ptr [eax+2*eax]
:00441B3D C1E003                  shl eax, 03
:00441B40 2BC1                    sub eax, ecx
:00441B42 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00441B48 E8D698FEFF              call 0042B423
:00441B4D E900000000              jmp 00441B52

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00441A9A(U), :00441AE9(U), :00441B4D(U)
|
:00441B52 5F                      pop edi
:00441B53 5E                      pop esi
:00441B54 5B                      pop ebx
:00441B55 C9                      leave
:00441B56 C3                      ret



* Referenced by a CALL at Address:
|:004430A8   
|
:00441B57 55                      push ebp
:00441B58 8BEC                    mov ebp, esp
:00441B5A 83EC20                  sub esp, 00000020
:00441B5D 53                      push ebx
:00441B5E 56                      push esi
:00441B5F 57                      push edi
:00441B60 894DE4                  mov dword ptr [ebp-1C], ecx
:00441B63 6A00                    push 00000000
:00441B65 E81E43FEFF              call 00425E88
:00441B6A 83C404                  add esp, 00000004
:00441B6D C605AC35450000          mov byte ptr [004535AC], 00
:00441B74 B900FB4600              mov ecx, 0046FB00
:00441B79 E8D1C9FFFF              call 0043E54F
:00441B7E 6A00                    push 00000000
:00441B80 B994A64600              mov ecx, 0046A694
:00441B85 E89A74FDFF              call 00419024
:00441B8A 813D64F94600729C0000    cmp dword ptr [0046F964], 00009C72
:00441B94 0F8C10000000            jl 00441BAA
:00441B9A 813D64F94600829C0000    cmp dword ptr [0046F964], 00009C82
:00441BA4 0F8C40000000            jl 00441BEA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441B94(C)
|
:00441BAA 813D64F94600839C0000    cmp dword ptr [0046F964], 00009C83
:00441BB4 0F8C10000000            jl 00441BCA
:00441BBA 813D64F94600849C0000    cmp dword ptr [0046F964], 00009C84
:00441BC4 0F8E20000000            jle 00441BEA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441BB4(C)
|
:00441BCA 813D64F94600AE9C0000    cmp dword ptr [0046F964], 00009CAE
:00441BD4 0F8C68030000            jl 00441F42
:00441BDA 813D64F94600AF9C0000    cmp dword ptr [0046F964], 00009CAF
:00441BE4 0F8F58030000            jg 00441F42

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00441BA4(C), :00441BC4(C)
|
:00441BEA A164F94600              mov eax, dword ptr [0046F964]
:00441BEF 8945E0                  mov dword ptr [ebp-20], eax
:00441BF2 E9BD020000              jmp 00441EB4
:00441BF7 8B45E4                  mov eax, dword ptr [ebp-1C]
:00441BFA 83782600                cmp dword ptr [eax+26], 00000000
:00441BFE 0F8414000000            je 00441C18
:00441C04 B900FB4600              mov ecx, 0046FB00
:00441C09 E8788AFFFF              call 0043A686
:00441C0E 8B45E4                  mov eax, dword ptr [ebp-1C]
:00441C11 C7402600000000          mov [eax+26], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441BFE(C)
|

* Possible StringData Ref from Data Obj ->"вӵ"
                                  |
:00441C18 A138364500              mov eax, dword ptr [00453638]
:00441C1D 50                      push eax
:00441C1E 6A01                    push 00000001
:00441C20 E81073FFFF              call 00438F35
:00441C25 83C408                  add esp, 00000008
:00441C28 8B4D08                  mov ecx, dword ptr [ebp+08]
:00441C2B 8901                    mov dword ptr [ecx], eax
:00441C2D 8B4508                  mov eax, dword ptr [ebp+08]
:00441C30 833800                  cmp dword ptr [eax], 00000000
:00441C33 0F851C000000            jne 00441C55
:00441C39 33C0                    xor eax, eax
:00441C3B A0A4354500              mov al, byte ptr [004535A4]
:00441C40 A802                    test al, 02
:00441C42 0F840D000000            je 00441C55
:00441C48 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00441C4B E8B8F5FFFF              call 00441208
:00441C50 8B4D08                  mov ecx, dword ptr [ebp+08]
:00441C53 8901                    mov dword ptr [ecx], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00441C33(C), :00441C42(C)
|
:00441C55 E9E3020000              jmp 00441F3D
:00441C5A B9B0C44600              mov ecx, 0046C4B0
:00441C5F E87C240000              call 004440E0
:00441C64 85C0                    test eax, eax
:00441C66 0F852D000000            jne 00441C99

* Possible StringData Ref from Data Obj ->"ܳˡ

ܳ˼սʼʱ"
                                  |
:00441C6C A13C364500              mov eax, dword ptr [0045363C]
:00441C71 50                      push eax
:00441C72 6A01                    push 00000001
:00441C74 E8BC72FFFF              call 00438F35
:00441C79 83C408                  add esp, 00000008
:00441C7C 8B4D08                  mov ecx, dword ptr [ebp+08]
:00441C7F 8901                    mov dword ptr [ecx], eax
:00441C81 8B4508                  mov eax, dword ptr [ebp+08]
:00441C84 833800                  cmp dword ptr [eax], 00000000
:00441C87 0F8407000000            je 00441C94
:00441C8D 8B45E4                  mov eax, dword ptr [ebp-1C]
:00441C90 C6400101                mov [eax+01], 01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441C87(C)
|
:00441C94 E90F000000              jmp 00441CA8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441C66(C)
|

* Possible StringData Ref from Data Obj ->"²ܳˣ"
                                  |
:00441C99 68003A4500              push 00453A00
:00441C9E 6A00                    push 00000000
:00441CA0 E89072FFFF              call 00438F35
:00441CA5 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441C94(U)
|
:00441CA8 E990020000              jmp 00441F3D
:00441CAD B9D0A64600              mov ecx, 0046A6D0
:00441CB2 E8C974FCFF              call 00409180
:00441CB7 8945FC                  mov dword ptr [ebp-04], eax
:00441CBA C745F000000000          mov [ebp-10], 00000000
:00441CC1 E903000000              jmp 00441CC9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441CDB(U)
|
:00441CC6 FF45F0                  inc [ebp-10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441CC1(U)
|
:00441CC9 837DF003                cmp dword ptr [ebp-10], 00000003
:00441CCD 0F830D000000            jnb 00441CE0
:00441CD3 8B45F0                  mov eax, dword ptr [ebp-10]
:00441CD6 C64405F400              mov [ebp+eax-0C], 00
:00441CDB E9E6FFFFFF              jmp 00441CC6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441CCD(C)
|
:00441CE0 8B45FC                  mov eax, dword ptr [ebp-04]
:00441CE3 25F0000000              and eax, 000000F0
:00441CE8 C1E804                  shr eax, 04
:00441CEB C64405F401              mov [ebp+eax-0C], 01
:00441CF0 813D64F94600759C0000    cmp dword ptr [0046F964], 00009C75
:00441CFA 0F8509000000            jne 00441D09
:00441D00 C645EC00                mov [ebp-14], 00
:00441D04 E914000000              jmp 00441D1D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441CFA(C)
|
:00441D09 813D64F94600769C0000    cmp dword ptr [0046F964], 00009C76
:00441D13 0F8504000000            jne 00441D1D
:00441D19 C645EC01                mov [ebp-14], 01

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00441D04(U), :00441D13(C)
|
:00441D1D 33C0                    xor eax, eax
:00441D1F 8A45EC                  mov al, byte ptr [ebp-14]
:00441D22 3DFF000000              cmp eax, 000000FF
:00441D27 0F841D000000            je 00441D4A
:00441D2D 8165FC0FFFFFFF          and dword ptr [ebp-04], FFFFFF0F
:00441D34 33C0                    xor eax, eax
:00441D36 8A45EC                  mov al, byte ptr [ebp-14]
:00441D39 C1E004                  shl eax, 04
:00441D3C 0B45FC                  or eax, dword ptr [ebp-04]
:00441D3F 50                      push eax
:00441D40 B9D0A64600              mov ecx, 0046A6D0
:00441D45 E8369DFCFF              call 0040BA80

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441D27(C)
|
:00441D4A E9EE010000              jmp 00441F3D
:00441D4F B9D0A64600              mov ecx, 0046A6D0
:00441D54 E82774FCFF              call 00409180
:00441D59 8945FC                  mov dword ptr [ebp-04], eax
:00441D5C C745F000000000          mov [ebp-10], 00000000
:00441D63 E903000000              jmp 00441D6B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441D7D(U)
|
:00441D68 FF45F0                  inc [ebp-10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441D63(U)
|
:00441D6B 837DF005                cmp dword ptr [ebp-10], 00000005
:00441D6F 0F830D000000            jnb 00441D82
:00441D75 8B45F0                  mov eax, dword ptr [ebp-10]
:00441D78 C64405F400              mov [ebp+eax-0C], 00
:00441D7D E9E6FFFFFF              jmp 00441D68

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441D6F(C)
|
:00441D82 8B45FC                  mov eax, dword ptr [ebp-04]
:00441D85 83E00F                  and eax, 0000000F
:00441D88 C64405F401              mov [ebp+eax-0C], 01
:00441D8D 813D64F94600779C0000    cmp dword ptr [0046F964], 00009C77
:00441D97 0F8C1D000000            jl 00441DBA
:00441D9D 813D64F946007B9C0000    cmp dword ptr [0046F964], 00009C7B
:00441DA7 0F8F0D000000            jg 00441DBA
:00441DAD A164F94600              mov eax, dword ptr [0046F964]
:00441DB2 2D779C0000              sub eax, 00009C77
:00441DB7 8845EC                  mov byte ptr [ebp-14], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00441D97(C), :00441DA7(C)
|
:00441DBA 33C0                    xor eax, eax
:00441DBC 8A45EC                  mov al, byte ptr [ebp-14]
:00441DBF 3DFF000000              cmp eax, 000000FF
:00441DC4 0F8428000000            je 00441DF2
:00441DCA 8365FCF0                and dword ptr [ebp-04], FFFFFFF0
:00441DCE 33C0                    xor eax, eax
:00441DD0 8A45EC                  mov al, byte ptr [ebp-14]
:00441DD3 0B45FC                  or eax, dword ptr [ebp-04]
:00441DD6 50                      push eax
:00441DD7 B9D0A64600              mov ecx, 0046A6D0
:00441DDC E89F9CFCFF              call 0040BA80
:00441DE1 33C0                    xor eax, eax
:00441DE3 8A45EC                  mov al, byte ptr [ebp-14]
:00441DE6 8A8040364500            mov al, byte ptr [eax+00453640]
:00441DEC 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00441DEF 884125                  mov byte ptr [ecx+25], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441DC4(C)
|
:00441DF2 E946010000              jmp 00441F3D
:00441DF7 6A05                    push 00000005
:00441DF9 E88B010000              call 00441F89
:00441DFE 83C404                  add esp, 00000004
:00441E01 E937010000              jmp 00441F3D
:00441E06 6A06                    push 00000006
:00441E08 E87C010000              call 00441F89
:00441E0D 83C404                  add esp, 00000004
:00441E10 E928010000              jmp 00441F3D
:00441E15 6A07                    push 00000007
:00441E17 E86D010000              call 00441F89
:00441E1C 83C404                  add esp, 00000004
:00441E1F E919010000              jmp 00441F3D
:00441E24 A164F94600              mov eax, dword ptr [0046F964]
:00441E29 2D839C0000              sub eax, 00009C83
:00441E2E 83F801                  cmp eax, 00000001
:00441E31 1BC0                    sbb eax, eax
:00441E33 F7D8                    neg eax
:00441E35 50                      push eax
:00441E36 E89BE6FCFF              call 004104D6
:00441E3B 83C404                  add esp, 00000004
:00441E3E E9FA000000              jmp 00441F3D
:00441E43 B9D0A64600              mov ecx, 0046A6D0
:00441E48 E83373FCFF              call 00409180
:00441E4D 8945FC                  mov dword ptr [ebp-04], eax
:00441E50 813D64F94600AE9C0000    cmp dword ptr [0046F964], 00009CAE
:00441E5A 0F8509000000            jne 00441E69
:00441E60 C645EC01                mov [ebp-14], 01
:00441E64 E914000000              jmp 00441E7D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441E5A(C)
|
:00441E69 813D64F94600AF9C0000    cmp dword ptr [0046F964], 00009CAF
:00441E73 0F8504000000            jne 00441E7D
:00441E79 C645EC00                mov [ebp-14], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00441E64(U), :00441E73(C)
|
:00441E7D 33C0                    xor eax, eax
:00441E7F 8A45EC                  mov al, byte ptr [ebp-14]
:00441E82 3DFF000000              cmp eax, 000000FF
:00441E87 0F841D000000            je 00441EAA
:00441E8D 8165FCFFFEFFFF          and dword ptr [ebp-04], FFFFFEFF
:00441E94 33C0                    xor eax, eax
:00441E96 8A45EC                  mov al, byte ptr [ebp-14]
:00441E99 C1E008                  shl eax, 08
:00441E9C 0B45FC                  or eax, dword ptr [ebp-04]
:00441E9F 50                      push eax
:00441EA0 B9D0A64600              mov ecx, 0046A6D0
:00441EA5 E8D69BFCFF              call 0040BA80

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441E87(C)
|
:00441EAA E98E000000              jmp 00441F3D
:00441EAF E989000000              jmp 00441F3D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441BF2(U)
|
:00441EB4 816DE0729C0000          sub dword ptr [ebp-20], 00009C72
:00441EBB 837DE03D                cmp dword ptr [ebp-20], 0000003D
:00441EBF 0F8778000000            ja 00441F3D
:00441EC5 8B45E0                  mov eax, dword ptr [ebp-20]
:00441EC8 33C9                    xor ecx, ecx
:00441ECA 8A88FF1E4400            mov cl, byte ptr [eax+00441EFF]
:00441ED0 FF248DD71E4400          jmp dword ptr [4*ecx+00441ED7]

:00441ED7 F71B4400                DWORD 00441BF7
:00441EDB 5A1C4400                DWORD 00441C5A
:00441EDF AD1C4400                DWORD 00441CAD
:00441EE3 4F1D4400                DWORD 00441D4F
:00441EE7 F71D4400                DWORD 00441DF7
:00441EEB 061E4400                DWORD 00441E06
:00441EEF 151E4400                DWORD 00441E15
:00441EF3 241E4400                DWORD 00441E24
:00441EF7 431E4400                DWORD 00441E43
:00441EFB 3D1F4400                DWORD 00441F3D


:00441EFF 0001                    add byte ptr [ecx], al
:00441F01 0902                    or dword ptr [edx], eax
:00441F03 0203                    add al, byte ptr [ebx]
:00441F05 0303                    add eax, dword ptr [ebx]
:00441F07 0303                    add eax, dword ptr [ebx]
:00441F09 0404                    add al, 04
:00441F0B 0505060609              add eax, 09060605
:00441F10 07                      pop es
:00441F11 07                      pop es
:00441F12 0909                    or dword ptr [ecx], ecx
:00441F14 0909                    or dword ptr [ecx], ecx
:00441F16 0909                    or dword ptr [ecx], ecx
:00441F18 0909                    or dword ptr [ecx], ecx
:00441F1A 0909                    or dword ptr [ecx], ecx
:00441F1C 0909                    or dword ptr [ecx], ecx
:00441F1E 0909                    or dword ptr [ecx], ecx
:00441F20 0909                    or dword ptr [ecx], ecx
:00441F22 0909                    or dword ptr [ecx], ecx
:00441F24 0909                    or dword ptr [ecx], ecx
:00441F26 0909                    or dword ptr [ecx], ecx
:00441F28 0909                    or dword ptr [ecx], ecx
:00441F2A 0909                    or dword ptr [ecx], ecx
:00441F2C 0909                    or dword ptr [ecx], ecx
:00441F2E 0909                    or dword ptr [ecx], ecx
:00441F30 0909                    or dword ptr [ecx], ecx
:00441F32 0909                    or dword ptr [ecx], ecx
:00441F34 0909                    or dword ptr [ecx], ecx
:00441F36 0909                    or dword ptr [ecx], ecx
:00441F38 0909                    or dword ptr [ecx], ecx
:00441F3A 0908                    or dword ptr [eax], ecx
:00441F3C 08E9                    or cl, ch
:00441F3E 3B00                    cmp eax, dword ptr [eax]
:00441F40 0000                    add byte ptr [eax], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00441BD4(C), :00441BE4(C)
|
:00441F42 813D64F94600489C0000    cmp dword ptr [0046F964], 00009C48
:00441F4C 0F8C2B000000            jl 00441F7D
:00441F52 813D64F946004B9C0000    cmp dword ptr [0046F964], 00009C4B
:00441F5C 0F8F1B000000            jg 00441F7D
:00441F62 A164F94600              mov eax, dword ptr [0046F964]
:00441F67 2D479C0000              sub eax, 00009C47
:00441F6C 8845E8                  mov byte ptr [ebp-18], al
:00441F6F 8B45E8                  mov eax, dword ptr [ebp-18]
:00441F72 50                      push eax
:00441F73 B9D0A64600              mov ecx, 0046A6D0
:00441F78 E8939BFCFF              call 0040BB10

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00441F4C(C), :00441F5C(C)
|
:00441F7D E900000000              jmp 00441F82

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441F7D(U)
|
:00441F82 5F                      pop edi
:00441F83 5E                      pop esi
:00441F84 5B                      pop ebx
:00441F85 C9                      leave
:00441F86 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00441DF9   , :00441E08   , :00441E17   
|
:00441F89 55                      push ebp
:00441F8A 8BEC                    mov ebp, esp
:00441F8C 83EC14                  sub esp, 00000014
:00441F8F 53                      push ebx
:00441F90 56                      push esi
:00441F91 57                      push edi
:00441F92 33C0                    xor eax, eax
:00441F94 8A4508                  mov al, byte ptr [ebp+08]
:00441F97 83F805                  cmp eax, 00000005
:00441F9A 0F8512000000            jne 00441FB2
:00441FA0 B9D0A64600              mov ecx, 0046A6D0
:00441FA5 E8D671FCFF              call 00409180
:00441FAA 8945F0                  mov dword ptr [ebp-10], eax
:00441FAD E90D000000              jmp 00441FBF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441F9A(C)
|
:00441FB2 B9D0A64600              mov ecx, 0046A6D0
:00441FB7 E8649AFCFF              call 0040BA20
:00441FBC 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441FAD(U)
|
:00441FBF 33C0                    xor eax, eax
:00441FC1 8A4508                  mov al, byte ptr [ebp+08]
:00441FC4 8B04854C364500          mov eax, dword ptr [4*eax+0045364C]
:00441FCB 8945FC                  mov dword ptr [ebp-04], eax
:00441FCE C645F800                mov [ebp-08], 00
:00441FD2 C645F900                mov [ebp-07], 00
:00441FD6 8B45FC                  mov eax, dword ptr [ebp-04]
:00441FD9 8545F0                  test dword ptr [ebp-10], eax
:00441FDC 0F840C000000            je 00441FEE
:00441FE2 C745F400000000          mov [ebp-0C], 00000000
:00441FE9 E907000000              jmp 00441FF5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441FDC(C)
|
:00441FEE C745F401000000          mov [ebp-0C], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441FE9(U)
|
:00441FF5 8B45F4                  mov eax, dword ptr [ebp-0C]
:00441FF8 C64405F801              mov [ebp+eax-08], 01
:00441FFD 813D64F946007C9C0000    cmp dword ptr [0046F964], 00009C7C
:00442007 0F8420000000            je 0044202D
:0044200D 813D64F946007E9C0000    cmp dword ptr [0046F964], 00009C7E
:00442017 0F8410000000            je 0044202D
:0044201D 813D64F94600809C0000    cmp dword ptr [0046F964], 00009C80
:00442027 0F851F000000            jne 0044204C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00442007(C), :00442017(C)
|
:0044202D C645EC00                mov [ebp-14], 00
:00442031 33C0                    xor eax, eax
:00442033 8A45EC                  mov al, byte ptr [ebp-14]
:00442036 33C9                    xor ecx, ecx
:00442038 8A4DF4                  mov cl, byte ptr [ebp-0C]
:0044203B 3BC1                    cmp eax, ecx
:0044203D 0F8504000000            jne 00442047
:00442043 C645ECFF                mov [ebp-14], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044203D(C)
|
:00442047 E94A000000              jmp 00442096

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442027(C)
|
:0044204C 813D64F946007D9C0000    cmp dword ptr [0046F964], 00009C7D
:00442056 0F8420000000            je 0044207C
:0044205C 813D64F946007F9C0000    cmp dword ptr [0046F964], 00009C7F
:00442066 0F8410000000            je 0044207C
:0044206C 813D64F94600819C0000    cmp dword ptr [0046F964], 00009C81
:00442076 0F851A000000            jne 00442096

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00442056(C), :00442066(C)
|
:0044207C C645EC01                mov [ebp-14], 01
:00442080 33C0                    xor eax, eax
:00442082 8A45EC                  mov al, byte ptr [ebp-14]
:00442085 33C9                    xor ecx, ecx
:00442087 8A4DF4                  mov cl, byte ptr [ebp-0C]
:0044208A 3BC1                    cmp eax, ecx
:0044208C 0F8504000000            jne 00442096
:00442092 C645ECFF                mov [ebp-14], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00442047(U), :00442076(C), :0044208C(C)
|
:00442096 33C0                    xor eax, eax
:00442098 8A45EC                  mov al, byte ptr [ebp-14]
:0044209B 3DFF000000              cmp eax, 000000FF
:004420A0 0F8477000000            je 0044211D
:004420A6 33C0                    xor eax, eax
:004420A8 8A4508                  mov al, byte ptr [ebp+08]
:004420AB 83F805                  cmp eax, 00000005
:004420AE 0F8516000000            jne 004420CA
:004420B4 8B45FC                  mov eax, dword ptr [ebp-04]
:004420B7 3345F0                  xor eax, dword ptr [ebp-10]
:004420BA 50                      push eax
:004420BB B9D0A64600              mov ecx, 0046A6D0
:004420C0 E8BB99FCFF              call 0040BA80
:004420C5 E953000000              jmp 0044211D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004420AE(C)
|
:004420CA 8B45FC                  mov eax, dword ptr [ebp-04]
:004420CD 3345F0                  xor eax, dword ptr [ebp-10]
:004420D0 50                      push eax
:004420D1 B9D0A64600              mov ecx, 0046A6D0
:004420D6 E87599FCFF              call 0040BA50
:004420DB 33C0                    xor eax, eax
:004420DD 8A4508                  mov al, byte ptr [ebp+08]
:004420E0 83F806                  cmp eax, 00000006
:004420E3 0F8534000000            jne 0044211D
:004420E9 8B45FC                  mov eax, dword ptr [ebp-04]
:004420EC 8545F0                  test dword ptr [ebp-10], eax
:004420EF 0F840F000000            je 00442104
:004420F5 B990A64600              mov ecx, 0046A690
:004420FA E8F16DFDFF              call 00418EF0
:004420FF E919000000              jmp 0044211D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004420EF(C)
|
:00442104 B9D0A64600              mov ecx, 0046A6D0
:00442109 E8B29AFCFF              call 0040BBC0
:0044210E 33C9                    xor ecx, ecx
:00442110 8AC8                    mov cl, al
:00442112 51                      push ecx
:00442113 B990A64600              mov ecx, 0046A690
:00442118 E8AD6DFDFF              call 00418ECA

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004420A0(C), :004420C5(U), :004420E3(C), :004420FF(U)
|
:0044211D E900000000              jmp 00442122

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044211D(U)
|
:00442122 5F                      pop edi
:00442123 5E                      pop esi
:00442124 5B                      pop ebx
:00442125 C9                      leave
:00442126 C3                      ret



* Referenced by a CALL at Address:
|:004430EA   
|
:00442127 55                      push ebp
:00442128 8BEC                    mov ebp, esp
:0044212A 83EC08                  sub esp, 00000008
:0044212D 53                      push ebx
:0044212E 56                      push esi
:0044212F 57                      push edi
:00442130 894DFC                  mov dword ptr [ebp-04], ecx
:00442133 6A00                    push 00000000
:00442135 E84E3DFEFF              call 00425E88
:0044213A 83C404                  add esp, 00000004
:0044213D C605AC35450000          mov byte ptr [004535AC], 00
:00442144 B900FB4600              mov ecx, 0046FB00
:00442149 E801C4FFFF              call 0043E54F
:0044214E 6A00                    push 00000000
:00442150 B994A64600              mov ecx, 0046A694
:00442155 E8CA6EFDFF              call 00419024
:0044215A A164F94600              mov eax, dword ptr [0046F964]
:0044215F 8945F8                  mov dword ptr [ebp-08], eax
:00442162 E940000000              jmp 004421A7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004421AE(C)
|
:00442167 6A01                    push 00000001
:00442169 E819E5FCFF              call 00410687
:0044216E 83C404                  add esp, 00000004
:00442171 E950000000              jmp 004421C6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004421BB(C)
|

* Possible StringData Ref from Data Obj ->" ˳Ϸ"
                                  |
:00442176 68183A4500              push 00453A18
:0044217B 6A01                    push 00000001
:0044217D E8B36DFFFF              call 00438F35
:00442182 83C408                  add esp, 00000008
:00442185 8B4D08                  mov ecx, dword ptr [ebp+08]
:00442188 8901                    mov dword ptr [ecx], eax
:0044218A 8B4508                  mov eax, dword ptr [ebp+08]
:0044218D 833800                  cmp dword ptr [eax], 00000000
:00442190 0F8407000000            je 0044219D
:00442196 8B45FC                  mov eax, dword ptr [ebp-04]
:00442199 C6400104                mov [eax+01], 04

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442190(C)
|
:0044219D E924000000              jmp 004421C6
:004421A2 E91F000000              jmp 004421C6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442162(U)
|
:004421A7 817DF8469C0000          cmp dword ptr [ebp-08], 00009C46
:004421AE 0F84B3FFFFFF            je 00442167
:004421B4 817DF8DD9C0000          cmp dword ptr [ebp-08], 00009CDD
:004421BB 0F84B5FFFFFF            je 00442176
:004421C1 E900000000              jmp 004421C6

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00442171(U), :0044219D(U), :004421A2(U), :004421C1(U)
|
:004421C6 E900000000              jmp 004421CB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004421C6(U)
|
:004421CB 5F                      pop edi
:004421CC 5E                      pop esi
:004421CD 5B                      pop ebx
:004421CE C9                      leave
:004421CF C20400                  ret 0004



* Referenced by a CALL at Address:
|:00443141   
|
:004421D2 55                      push ebp
:004421D3 8BEC                    mov ebp, esp
:004421D5 83EC08                  sub esp, 00000008
:004421D8 53                      push ebx
:004421D9 56                      push esi
:004421DA 57                      push edi
:004421DB 894DFC                  mov dword ptr [ebp-04], ecx
:004421DE 6A00                    push 00000000
:004421E0 E8A33CFEFF              call 00425E88
:004421E5 83C404                  add esp, 00000004
:004421E8 C605AC35450000          mov byte ptr [004535AC], 00
:004421EF B900FB4600              mov ecx, 0046FB00
:004421F4 E856C3FFFF              call 0043E54F
:004421F9 6A00                    push 00000000
:004421FB B994A64600              mov ecx, 0046A694
:00442200 E81F6EFDFF              call 00419024
:00442205 A164F94600              mov eax, dword ptr [0046F964]
:0044220A 8945F8                  mov dword ptr [ebp-08], eax
:0044220D E996000000              jmp 004422A8
:00442212 6A00                    push 00000000
:00442214 B900FB4600              mov ecx, 0046FB00
:00442219 E8821F0000              call 004441A0
:0044221E B900FB4600              mov ecx, 0046FB00
:00442223 E872A1FFFF              call 0043C39A
:00442228 E9AE000000              jmp 004422DB
:0044222D 6A01                    push 00000001
:0044222F B900FB4600              mov ecx, 0046FB00
:00442234 E8671F0000              call 004441A0
:00442239 B900FB4600              mov ecx, 0046FB00
:0044223E E857A1FFFF              call 0043C39A
:00442243 E993000000              jmp 004422DB
:00442248 6A00                    push 00000000
:0044224A B900FB4600              mov ecx, 0046FB00
:0044224F E8199EFFFF              call 0043C06D
:00442254 6A00                    push 00000000
:00442256 B900FB4600              mov ecx, 0046FB00
:0044225B E8F6A8FFFF              call 0043CB56
:00442260 E976000000              jmp 004422DB
:00442265 6A01                    push 00000001
:00442267 B900FB4600              mov ecx, 0046FB00
:0044226C E8FC9DFFFF              call 0043C06D
:00442271 6A01                    push 00000001
:00442273 B900FB4600              mov ecx, 0046FB00
:00442278 E8D9A8FFFF              call 0043CB56
:0044227D E959000000              jmp 004422DB
:00442282 B900FB4600              mov ecx, 0046FB00
:00442287 E85698FFFF              call 0043BAE2
:0044228C E94A000000              jmp 004422DB
:00442291 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00442294 E8A01A0000              call 00443D39
:00442299 E93D000000              jmp 004422DB
:0044229E E938000000              jmp 004422DB
:004422A3 E933000000              jmp 004422DB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044220D(U)
|
:004422A8 816DF8D69C0000          sub dword ptr [ebp-08], 00009CD6
:004422AF 837DF805                cmp dword ptr [ebp-08], 00000005
:004422B3 0F8722000000            ja 004422DB
:004422B9 8B45F8                  mov eax, dword ptr [ebp-08]
:004422BC FF2485C3224400          jmp dword ptr [4*eax+004422C3]

:004422C3 12224400                DWORD 00442212
:004422C7 2D224400                DWORD 0044222D
:004422CB 48224400                DWORD 00442248
:004422CF 65224400                DWORD 00442265
:004422D3 82224400                DWORD 00442282
:004422D7 91224400                DWORD 00442291



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00442228(U), :00442243(U), :00442260(U), :0044227D(U), :0044228C(U)
|:00442299(U), :0044229E(U), :004422A3(U), :004422B3(C)
|
:004422DB E900000000              jmp 004422E0
:004422E0 5F                      pop edi
:004422E1 5E                      pop esi
:004422E2 5B                      pop ebx
:004422E3 C9                      leave
:004422E4 C3                      ret



* Referenced by a CALL at Address:
|:00442EA8   
|
:004422E5 55                      push ebp
:004422E6 8BEC                    mov ebp, esp
:004422E8 83EC0C                  sub esp, 0000000C
:004422EB 53                      push ebx
:004422EC 56                      push esi
:004422ED 57                      push edi
:004422EE 894DF8                  mov dword ptr [ebp-08], ecx
:004422F1 E8BFDDFFFF              call 004400B5
:004422F6 8845FC                  mov byte ptr [ebp-04], al
:004422F9 33C0                    xor eax, eax
:004422FB 8A45FC                  mov al, byte ptr [ebp-04]
:004422FE 3DFF000000              cmp eax, 000000FF
:00442303 0F8421000000            je 0044232A
:00442309 8B45F8                  mov eax, dword ptr [ebp-08]
:0044230C 83782600                cmp dword ptr [eax+26], 00000000
:00442310 0F8414000000            je 0044232A
:00442316 B900FB4600              mov ecx, 0046FB00
:0044231B E86683FFFF              call 0043A686
:00442320 8B45F8                  mov eax, dword ptr [ebp-08]
:00442323 C7402600000000          mov [eax+26], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00442303(C), :00442310(C)
|
:0044232A 33C0                    xor eax, eax
:0044232C 8A45FC                  mov al, byte ptr [ebp-04]
:0044232F 8945F4                  mov dword ptr [ebp-0C], eax
:00442332 E9C7000000              jmp 004423FE

* Possible Ref to Menu: HEXMENU, Item: "8_"
                                  |
:00442337 C70564F94600DD9C0000    mov dword ptr [0046F964], 00009CDD
:00442341 E9FC000000              jmp 00442442

* Possible Ref to Menu: APPMENU, Item: ""
                                  |
:00442346 C70564F94600469C0000    mov dword ptr [0046F964], 00009C46
:00442350 E9ED000000              jmp 00442442

* Possible Ref to Menu: HEXMENU, Item: ";"
                                  |
:00442355 C70564F94600739C0000    mov dword ptr [0046F964], 00009C73
:0044235F E9DE000000              jmp 00442442

* Possible Ref to Menu: HEXMENU, Item: "   _"
                                  |
:00442364 C70564F94600729C0000    mov dword ptr [0046F964], 00009C72
:0044236E E9CF000000              jmp 00442442
:00442373 6A00                    push 00000000
:00442375 B994A64600              mov ecx, 0046A694
:0044237A E8A56CFDFF              call 00419024
:0044237F 8B4508                  mov eax, dword ptr [ebp+08]
:00442382 50                      push eax
:00442383 E8C9000000              call 00442451
:00442388 83C404                  add esp, 00000004
:0044238B 8B45F8                  mov eax, dword ptr [ebp-08]
:0044238E C7402601000000          mov [eax+26], 00000001
:00442395 E9A8000000              jmp 00442442

* Possible Ref to Menu: HEXMENU, Item: ""
                                  |
:0044239A C70564F94600D69C0000    mov dword ptr [0046F964], 00009CD6
:004423A4 E999000000              jmp 00442442

* Possible Ref to Menu: HEXMENU, Item: ""
                                  |
:004423A9 C70564F94600D89C0000    mov dword ptr [0046F964], 00009CD8
:004423B3 E98A000000              jmp 00442442

* Possible Ref to Menu: HEXMENU, Item: "L"
                                  |
:004423B8 C70564F94600D79C0000    mov dword ptr [0046F964], 00009CD7
:004423C2 E97B000000              jmp 00442442

* Possible Ref to Menu: HEXMENU, Item: "L"
                                  |
:004423C7 C70564F94600D99C0000    mov dword ptr [0046F964], 00009CD9
:004423D1 E96C000000              jmp 00442442

* Possible Ref to Menu: HEXMENU, Item: ":)"
                                  |
:004423D6 C70564F94600DA9C0000    mov dword ptr [0046F964], 00009CDA
:004423E0 E95D000000              jmp 00442442

* Possible Ref to Menu: HEXMENU, Item: ")a"
                                  |
:004423E5 C70564F94600DB9C0000    mov dword ptr [0046F964], 00009CDB
:004423EF E94E000000              jmp 00442442
:004423F4 E949000000              jmp 00442442
:004423F9 E944000000              jmp 00442442

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442332(U)
|
:004423FE 836DF464                sub dword ptr [ebp-0C], 00000064
:00442402 837DF40A                cmp dword ptr [ebp-0C], 0000000A
:00442406 0F8736000000            ja 00442442
:0044240C 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044240F FF248516244400          jmp dword ptr [4*eax+00442416]

:00442416 37234400                DWORD 00442337
:0044241A 46234400                DWORD 00442346
:0044241E 55234400                DWORD 00442355
:00442422 64234400                DWORD 00442364
:00442426 73234400                DWORD 00442373
:0044242A 9A234400                DWORD 0044239A
:0044242E A9234400                DWORD 004423A9
:00442432 B8234400                DWORD 004423B8
:00442436 C7234400                DWORD 004423C7
:0044243A D6234400                DWORD 004423D6
:0044243E E5234400                DWORD 004423E5



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00442341(U), :00442350(U), :0044235F(U), :0044236E(U), :00442395(U)
|:004423A4(U), :004423B3(U), :004423C2(U), :004423D1(U), :004423E0(U)
|:004423EF(U), :004423F4(U), :004423F9(U), :00442406(C)
|
:00442442 8A45FC                  mov al, byte ptr [ebp-04]
:00442445 E900000000              jmp 0044244A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442445(U)
|
:0044244A 5F                      pop edi
:0044244B 5E                      pop esi
:0044244C 5B                      pop ebx
:0044244D C9                      leave
:0044244E C20400                  ret 0004



* Referenced by a CALL at Address:
|:00442383   
|
:00442451 55                      push ebp
:00442452 8BEC                    mov ebp, esp
:00442454 83EC14                  sub esp, 00000014
:00442457 53                      push ebx
:00442458 56                      push esi
:00442459 57                      push edi
:0044245A C745F000000000          mov [ebp-10], 00000000
:00442461 C645EC00                mov [ebp-14], 00
:00442465 C745F400000000          mov [ebp-0C], 00000000
:0044246C E903000000              jmp 00442474

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044255D(U)
|
:00442471 FF45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044246C(U)
|
:00442474 837DF40F                cmp dword ptr [ebp-0C], 0000000F
:00442478 0F83E4000000            jnb 00442562
:0044247E 8B45F4                  mov eax, dword ptr [ebp-0C]
:00442481 8BC8                    mov ecx, eax
:00442483 8D0440                  lea eax, dword ptr [eax+2*eax]
:00442486 C1E003                  shl eax, 03
:00442489 2BC1                    sub eax, ecx
:0044248B 0598C04600              add eax, 0046C098
:00442490 8945F8                  mov dword ptr [ebp-08], eax
:00442493 6880000000              push 00000080
:00442498 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044249B E8C06EFCFF              call 00409360
:004424A0 85C0                    test eax, eax
:004424A2 0F85B5000000            jne 0044255D
:004424A8 6A40                    push 00000040
:004424AA 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004424AD E8AE6EFCFF              call 00409360
:004424B2 85C0                    test eax, eax
:004424B4 0F85A3000000            jne 0044255D
:004424BA 8B45F4                  mov eax, dword ptr [ebp-0C]
:004424BD 8BC8                    mov ecx, eax
:004424BF 8D0440                  lea eax, dword ptr [eax+2*eax]
:004424C2 C1E003                  shl eax, 03
:004424C5 2BC1                    sub eax, ecx
:004424C7 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004424CD E85E73FCFF              call 00409830
:004424D2 33C9                    xor ecx, ecx
:004424D4 8AC8                    mov cl, al
:004424D6 83F902                  cmp ecx, 00000002
:004424D9 0F857E000000            jne 0044255D
:004424DF 8B45F4                  mov eax, dword ptr [ebp-0C]
:004424E2 8BC8                    mov ecx, eax
:004424E4 8D0440                  lea eax, dword ptr [eax+2*eax]
:004424E7 C1E003                  shl eax, 03
:004424EA 2BC1                    sub eax, ecx
:004424EC 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004424F2 E8D96EFCFF              call 004093D0
:004424F7 33C9                    xor ecx, ecx
:004424F9 8AC8                    mov cl, al
:004424FB 83F907                  cmp ecx, 00000007
:004424FE 0F8559000000            jne 0044255D
:00442504 8B45F4                  mov eax, dword ptr [ebp-0C]
:00442507 8BC8                    mov ecx, eax
:00442509 8D0440                  lea eax, dword ptr [eax+2*eax]
:0044250C C1E003                  shl eax, 03
:0044250F 2BC1                    sub eax, ecx
:00442511 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00442517 E818A5FEFF              call 0042CA34
:0044251C 85C0                    test eax, eax
:0044251E 0F8421000000            je 00442545
:00442524 8B45F4                  mov eax, dword ptr [ebp-0C]
:00442527 8BC8                    mov ecx, eax
:00442529 8D0440                  lea eax, dword ptr [eax+2*eax]
:0044252C C1E003                  shl eax, 03
:0044252F 2BC1                    sub eax, ecx
:00442531 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00442537 E8F8A4FEFF              call 0042CA34
:0044253C 83F806                  cmp eax, 00000006
:0044253F 0F8518000000            jne 0044255D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044251E(C)
|
:00442545 8A45F4                  mov al, byte ptr [ebp-0C]
:00442548 33C9                    xor ecx, ecx
:0044254A 8A4DEC                  mov cl, byte ptr [ebp-14]
:0044254D 888108FC4600            mov byte ptr [ecx+0046FC08], al
:00442553 FE45EC                  inc [ebp-14]
:00442556 C745F001000000          mov [ebp-10], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004424A2(C), :004424B4(C), :004424D9(C), :004424FE(C), :0044253F(C)
|
:0044255D E90FFFFFFF              jmp 00442471

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442478(C)
|
:00442562 837DF000                cmp dword ptr [ebp-10], 00000000
:00442566 0F8450000000            je 004425BC
:0044256C 8A45EC                  mov al, byte ptr [ebp-14]
:0044256F 8845FC                  mov byte ptr [ebp-04], al
:00442572 33C0                    xor eax, eax
:00442574 8A45FC                  mov al, byte ptr [ebp-04]
:00442577 48                      dec eax
:00442578 33C9                    xor ecx, ecx
:0044257A 8A0D54364500            mov cl, byte ptr [00453654]
:00442580 3BC1                    cmp eax, ecx
:00442582 0F8D07000000            jnl 0044258F
:00442588 C6055436450000          mov byte ptr [00453654], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442582(C)
|
:0044258F B900FB4600              mov ecx, 0046FB00
:00442594 E8ED80FFFF              call 0043A686
:00442599 33C0                    xor eax, eax
:0044259B A054364500              mov al, byte ptr [00453654]
:004425A0 8A8008FC4600            mov al, byte ptr [eax+0046FC08]
:004425A6 50                      push eax
:004425A7 B900FB4600              mov ecx, 0046FB00
:004425AC E800BFFFFF              call 0043E4B1
:004425B1 FE0554364500            inc byte ptr [00453654]
:004425B7 E91A000000              jmp 004425D6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442566(C)
|

* Possible StringData Ref from Data Obj ->"вӵ"
                                  |
:004425BC A138364500              mov eax, dword ptr [00453638]
:004425C1 50                      push eax

* Possible StringData Ref from Data Obj ->"ûпжĲӡ

%s"
                                  |
:004425C2 68283A4500              push 00453A28
:004425C7 6A02                    push 00000002
:004425C9 E86769FFFF              call 00438F35
:004425CE 83C40C                  add esp, 0000000C
:004425D1 8B4D08                  mov ecx, dword ptr [ebp+08]
:004425D4 8901                    mov dword ptr [ecx], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004425B7(U)
|
:004425D6 E900000000              jmp 004425DB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004425D6(U)
|
:004425DB 5F                      pop edi
:004425DC 5E                      pop esi
:004425DD 5B                      pop ebx
:004425DE C9                      leave
:004425DF C3                      ret



* Referenced by a CALL at Addresses:
|:004428E2   , :00442B25   
|
:004425E0 55                      push ebp
:004425E1 8BEC                    mov ebp, esp
:004425E3 83EC24                  sub esp, 00000024
:004425E6 53                      push ebx
:004425E7 56                      push esi
:004425E8 57                      push edi
:004425E9 894DDC                  mov dword ptr [ebp-24], ecx
:004425EC 837D0800                cmp dword ptr [ebp+08], 00000000
:004425F0 0F840D000000            je 00442603
:004425F6 C645F000                mov [ebp-10], 00
:004425FA C645FC0F                mov [ebp-04], 0F
:004425FE E908000000              jmp 0044260B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004425F0(C)
|
:00442603 C645F00F                mov [ebp-10], 0F
:00442607 C645FC2D                mov [ebp-04], 2D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004425FE(U)
|
:0044260B 8A45F0                  mov al, byte ptr [ebp-10]
:0044260E 8845F8                  mov byte ptr [ebp-08], al
:00442611 E903000000              jmp 00442619

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044264A(U)
|
:00442616 FE45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442611(U)
|
:00442619 33C0                    xor eax, eax
:0044261B 8A45FC                  mov al, byte ptr [ebp-04]
:0044261E 33C9                    xor ecx, ecx
:00442620 8A4DF8                  mov cl, byte ptr [ebp-08]
:00442623 3BC1                    cmp eax, ecx
:00442625 0F8E24000000            jle 0044264F
:0044262B 68FF000000              push 000000FF
:00442630 33C0                    xor eax, eax
:00442632 8A45F8                  mov al, byte ptr [ebp-08]
:00442635 8BC8                    mov ecx, eax
:00442637 8D0440                  lea eax, dword ptr [eax+2*eax]
:0044263A C1E003                  shl eax, 03
:0044263D 2BC1                    sub eax, ecx
:0044263F 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00442645 E8861B0000              call 004441D0
:0044264A E9C7FFFFFF              jmp 00442616

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442625(C)
|
:0044264F C645F400                mov [ebp-0C], 00
:00442653 8A45F0                  mov al, byte ptr [ebp-10]
:00442656 8845F8                  mov byte ptr [ebp-08], al
:00442659 E903000000              jmp 00442661

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004426F9(U)
|
:0044265E FE45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442659(U)
|
:00442661 33C0                    xor eax, eax
:00442663 8A45FC                  mov al, byte ptr [ebp-04]
:00442666 33C9                    xor ecx, ecx
:00442668 8A4DF8                  mov cl, byte ptr [ebp-08]
:0044266B 3BC1                    cmp eax, ecx
:0044266D 0F8E8B000000            jle 004426FE
:00442673 33C0                    xor eax, eax
:00442675 8A45F8                  mov al, byte ptr [ebp-08]
:00442678 8BC8                    mov ecx, eax
:0044267A 8D0440                  lea eax, dword ptr [eax+2*eax]
:0044267D C1E003                  shl eax, 03
:00442680 2BC1                    sub eax, ecx
:00442682 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00442688 E8736BFCFF              call 00409200
:0044268D 668B00                  mov ax, word ptr [eax]
:00442690 668945EC                mov word ptr [ebp-14], ax
:00442694 8D45EC                  lea eax, dword ptr [ebp-14]
:00442697 50                      push eax
:00442698 E8116BFDFF              call 004191AE
:0044269D 83C404                  add esp, 00000004
:004426A0 85C0                    test eax, eax
:004426A2 0F8451000000            je 004426F9
:004426A8 33C0                    xor eax, eax
:004426AA 8A45F8                  mov al, byte ptr [ebp-08]
:004426AD 8BC8                    mov ecx, eax
:004426AF 8D0440                  lea eax, dword ptr [eax+2*eax]
:004426B2 C1E003                  shl eax, 03
:004426B5 2BC1                    sub eax, ecx
:004426B7 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004426BD E83E1B0000              call 00444200
:004426C2 33C9                    xor ecx, ecx
:004426C4 8AC8                    mov cl, al
:004426C6 81F9FF000000            cmp ecx, 000000FF
:004426CC 0F8527000000            jne 004426F9
:004426D2 8A45F4                  mov al, byte ptr [ebp-0C]
:004426D5 8845E8                  mov byte ptr [ebp-18], al
:004426D8 FE45F4                  inc [ebp-0C]
:004426DB 8B45E8                  mov eax, dword ptr [ebp-18]
:004426DE 50                      push eax
:004426DF 33C0                    xor eax, eax
:004426E1 8A45F8                  mov al, byte ptr [ebp-08]
:004426E4 8BC8                    mov ecx, eax
:004426E6 8D0440                  lea eax, dword ptr [eax+2*eax]
:004426E9 C1E003                  shl eax, 03
:004426EC 2BC1                    sub eax, ecx
:004426EE 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004426F4 E8D71A0000              call 004441D0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004426A2(C), :004426CC(C)
|
:004426F9 E960FFFFFF              jmp 0044265E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044266D(C)
|
:004426FE 8A45F0                  mov al, byte ptr [ebp-10]
:00442701 8845F8                  mov byte ptr [ebp-08], al
:00442704 E903000000              jmp 0044270C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442791(U)
|
:00442709 FE45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442704(U)
|
:0044270C 33C0                    xor eax, eax
:0044270E 8A45FC                  mov al, byte ptr [ebp-04]
:00442711 33C9                    xor ecx, ecx
:00442713 8A4DF8                  mov cl, byte ptr [ebp-08]
:00442716 3BC1                    cmp eax, ecx
:00442718 0F8E78000000            jle 00442796
:0044271E 33C0                    xor eax, eax
:00442720 8A45F8                  mov al, byte ptr [ebp-08]
:00442723 8BC8                    mov ecx, eax
:00442725 8D0440                  lea eax, dword ptr [eax+2*eax]
:00442728 C1E003                  shl eax, 03
:0044272B 2BC1                    sub eax, ecx
:0044272D 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00442733 E87577FDFF              call 00419EAD
:00442738 85C0                    test eax, eax
:0044273A 0F8451000000            je 00442791
:00442740 33C0                    xor eax, eax
:00442742 8A45F8                  mov al, byte ptr [ebp-08]
:00442745 8BC8                    mov ecx, eax
:00442747 8D0440                  lea eax, dword ptr [eax+2*eax]
:0044274A C1E003                  shl eax, 03
:0044274D 2BC1                    sub eax, ecx
:0044274F 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00442755 E8A61A0000              call 00444200
:0044275A 33C9                    xor ecx, ecx
:0044275C 8AC8                    mov cl, al
:0044275E 81F9FF000000            cmp ecx, 000000FF
:00442764 0F8527000000            jne 00442791
:0044276A 8A45F4                  mov al, byte ptr [ebp-0C]
:0044276D 8845E4                  mov byte ptr [ebp-1C], al
:00442770 FE45F4                  inc [ebp-0C]
:00442773 8B45E4                  mov eax, dword ptr [ebp-1C]
:00442776 50                      push eax
:00442777 33C0                    xor eax, eax
:00442779 8A45F8                  mov al, byte ptr [ebp-08]
:0044277C 8BC8                    mov ecx, eax
:0044277E 8D0440                  lea eax, dword ptr [eax+2*eax]
:00442781 C1E003                  shl eax, 03
:00442784 2BC1                    sub eax, ecx
:00442786 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0044278C E83F1A0000              call 004441D0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044273A(C), :00442764(C)
|
:00442791 E973FFFFFF              jmp 00442709

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442718(C)
|
:00442796 8A45F0                  mov al, byte ptr [ebp-10]
:00442799 8845F8                  mov byte ptr [ebp-08], al
:0044279C E903000000              jmp 004427A4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442807(U)
|
:004427A1 FE45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044279C(U)
|
:004427A4 33C0                    xor eax, eax
:004427A6 8A45FC                  mov al, byte ptr [ebp-04]
:004427A9 33C9                    xor ecx, ecx
:004427AB 8A4DF8                  mov cl, byte ptr [ebp-08]
:004427AE 3BC1                    cmp eax, ecx
:004427B0 0F8E56000000            jle 0044280C
:004427B6 33C0                    xor eax, eax
:004427B8 8A45F8                  mov al, byte ptr [ebp-08]
:004427BB 8BC8                    mov ecx, eax
:004427BD 8D0440                  lea eax, dword ptr [eax+2*eax]
:004427C0 C1E003                  shl eax, 03
:004427C3 2BC1                    sub eax, ecx
:004427C5 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004427CB E8301A0000              call 00444200
:004427D0 33C9                    xor ecx, ecx
:004427D2 8AC8                    mov cl, al
:004427D4 81F9FF000000            cmp ecx, 000000FF
:004427DA 0F8527000000            jne 00442807
:004427E0 8A45F4                  mov al, byte ptr [ebp-0C]
:004427E3 8845E0                  mov byte ptr [ebp-20], al
:004427E6 FE45F4                  inc [ebp-0C]
:004427E9 8B45E0                  mov eax, dword ptr [ebp-20]
:004427EC 50                      push eax
:004427ED 33C0                    xor eax, eax
:004427EF 8A45F8                  mov al, byte ptr [ebp-08]
:004427F2 8BC8                    mov ecx, eax
:004427F4 8D0440                  lea eax, dword ptr [eax+2*eax]
:004427F7 C1E003                  shl eax, 03
:004427FA 2BC1                    sub eax, ecx
:004427FC 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00442802 E8C9190000              call 004441D0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004427DA(C)
|
:00442807 E995FFFFFF              jmp 004427A1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004427B0(C)
|
:0044280C E900000000              jmp 00442811

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044280C(U)
|
:00442811 5F                      pop edi
:00442812 5E                      pop esi
:00442813 5B                      pop ebx
:00442814 C9                      leave
:00442815 C20400                  ret 0004



* Referenced by a CALL at Address:
|:004434E2   
|
:00442818 55                      push ebp
:00442819 8BEC                    mov ebp, esp
:0044281B 83EC24                  sub esp, 00000024
:0044281E 53                      push ebx
:0044281F 56                      push esi
:00442820 57                      push edi
:00442821 894DDC                  mov dword ptr [ebp-24], ecx
:00442824 E801EFFBFF              call 0040172A
:00442829 E821EFFBFF              call 0040174F
:0044282E 8B45DC                  mov eax, dword ptr [ebp-24]
:00442831 C7402A00000000          mov [eax+2A], 00000000
:00442838 C645F000                mov [ebp-10], 00
:0044283C E903000000              jmp 00442844

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442B3D(U)
|
:00442841 FE45F0                  inc [ebp-10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044283C(U)
|
:00442844 33C0                    xor eax, eax
:00442846 8A45F0                  mov al, byte ptr [ebp-10]
:00442849 83F802                  cmp eax, 00000002
:0044284C 0F8DF0020000            jnl 00442B42
:00442852 8B45DC                  mov eax, dword ptr [ebp-24]
:00442855 33C9                    xor ecx, ecx
:00442857 8A4801                  mov cl, byte ptr [eax+01]
:0044285A 85C9                    test ecx, ecx
:0044285C 0F85E0020000            jne 00442B42
:00442862 33C0                    xor eax, eax
:00442864 8A45F0                  mov al, byte ptr [ebp-10]
:00442867 83F801                  cmp eax, 00000001
:0044286A 0F8562000000            jne 004428D2

* Possible StringData Ref from Data Obj ->"о״̬"
                                  |
:00442870 68443A4500              push 00453A44
:00442875 6A00                    push 00000000
:00442877 E8B966FFFF              call 00438F35
:0044287C 83C408                  add esp, 00000008
:0044287F C645E40F                mov [ebp-1C], 0F
:00442883 E903000000              jmp 0044288B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004428CD(U)
|
:00442888 FE45E4                  inc [ebp-1C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442883(U)
|
:0044288B 33C0                    xor eax, eax
:0044288D 8A45E4                  mov al, byte ptr [ebp-1C]
:00442890 83F82D                  cmp eax, 0000002D
:00442893 0F8D39000000            jnl 004428D2
:00442899 33C0                    xor eax, eax
:0044289B 8A45E4                  mov al, byte ptr [ebp-1C]
:0044289E 8BC8                    mov ecx, eax
:004428A0 8D0440                  lea eax, dword ptr [eax+2*eax]
:004428A3 C1E003                  shl eax, 03
:004428A6 2BC1                    sub eax, ecx
:004428A8 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004428AE E8E87DFEFF              call 0042A69B
:004428B3 33C0                    xor eax, eax
:004428B5 8A45E4                  mov al, byte ptr [ebp-1C]
:004428B8 8BC8                    mov ecx, eax
:004428BA 8D0440                  lea eax, dword ptr [eax+2*eax]
:004428BD C1E003                  shl eax, 03
:004428C0 2BC1                    sub eax, ecx
:004428C2 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004428C8 E86386FEFF              call 0042AF30
:004428CD E9B6FFFFFF              jmp 00442888

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044286A(C), :00442893(C)
|
:004428D2 33C0                    xor eax, eax
:004428D4 8A45F0                  mov al, byte ptr [ebp-10]
:004428D7 83F801                  cmp eax, 00000001
:004428DA 1BC0                    sbb eax, eax
:004428DC F7D8                    neg eax
:004428DE 50                      push eax
:004428DF 8B4DDC                  mov ecx, dword ptr [ebp-24]
:004428E2 E8F9FCFFFF              call 004425E0
:004428E7 C745E800000000          mov [ebp-18], 00000000
:004428EE C645F400                mov [ebp-0C], 00
:004428F2 E903000000              jmp 004428FA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442B38(U)
|
:004428F7 FE45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004428F2(U)
|
:004428FA 8B45DC                  mov eax, dword ptr [ebp-24]
:004428FD 33C9                    xor ecx, ecx
:004428FF 8A4801                  mov cl, byte ptr [eax+01]
:00442902 85C9                    test ecx, ecx
:00442904 0F8533020000            jne 00442B3D
:0044290A 0FBE45F4                movsx eax, byte ptr [ebp-0C]
:0044290E 83F82D                  cmp eax, 0000002D
:00442911 0F8D26020000            jnl 00442B3D
:00442917 33C0                    xor eax, eax
:00442919 A0A4354500              mov al, byte ptr [004535A4]
:0044291E A801                    test al, 01
:00442920 0F846F000000            je 00442995
:00442926 B988534500              mov ecx, 00455388
:0044292B E86CF4FBFF              call 00401D9C
:00442930 85C0                    test eax, eax
:00442932 0F845D000000            je 00442995
:00442938 33C0                    xor eax, eax
:0044293A A0A4354500              mov al, byte ptr [004535A4]
:0044293F 24FE                    and al, FE
:00442941 A2A4354500              mov byte ptr [004535A4], al

* Possible StringData Ref from Data Obj ->"˳Ϸ"
                                  |
:00442946 68503A4500              push 00453A50
:0044294B 6A00                    push 00000000
:0044294D E8E365FFFF              call 00438F35
:00442952 83C408                  add esp, 00000008
:00442955 C645E000                mov [ebp-20], 00
:00442959 E903000000              jmp 00442961

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044298B(U)
|
:0044295E FE45E0                  inc [ebp-20]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442959(U)
|
:00442961 33C0                    xor eax, eax
:00442963 8A45E0                  mov al, byte ptr [ebp-20]
:00442966 83F80F                  cmp eax, 0000000F
:00442969 0F8D21000000            jnl 00442990
:0044296F 6A07                    push 00000007
:00442971 33C0                    xor eax, eax
:00442973 8A45E0                  mov al, byte ptr [ebp-20]
:00442976 8BC8                    mov ecx, eax
:00442978 8D0440                  lea eax, dword ptr [eax+2*eax]
:0044297B C1E003                  shl eax, 03
:0044297E 2BC1                    sub eax, ecx
:00442980 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00442986 E84B9AFEFF              call 0042C3D6
:0044298B E9CEFFFFFF              jmp 0044295E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442969(C)
|
:00442990 E9B2010000              jmp 00442B47

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00442920(C), :00442932(C)
|
:00442995 33C0                    xor eax, eax
:00442997 8A45F0                  mov al, byte ptr [ebp-10]
:0044299A 85C0                    test eax, eax
:0044299C 0F8509000000            jne 004429AB
:004429A2 C645F800                mov [ebp-08], 00
:004429A6 E904000000              jmp 004429AF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044299C(C)
|
:004429AB C645F80F                mov [ebp-08], 0F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004429A6(U)
|
:004429AF 33C0                    xor eax, eax
:004429B1 8A45F0                  mov al, byte ptr [ebp-10]
:004429B4 85C0                    test eax, eax
:004429B6 0F8509000000            jne 004429C5
:004429BC C645FC0F                mov [ebp-04], 0F
:004429C0 E904000000              jmp 004429C9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004429B6(C)
|
:004429C5 C645FC2D                mov [ebp-04], 2D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004429C0(U)
|
:004429C9 8A45F8                  mov al, byte ptr [ebp-08]
:004429CC 8845EC                  mov byte ptr [ebp-14], al
:004429CF E903000000              jmp 004429D7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00442A2A(U), :00442B03(U)
|
:004429D4 FE45EC                  inc [ebp-14]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004429CF(U)
|
:004429D7 33C0                    xor eax, eax
:004429D9 8A45EC                  mov al, byte ptr [ebp-14]
:004429DC 33C9                    xor ecx, ecx
:004429DE 8A4DFC                  mov cl, byte ptr [ebp-04]
:004429E1 3BC1                    cmp eax, ecx
:004429E3 0F8D1F010000            jnl 00442B08
:004429E9 33C0                    xor eax, eax
:004429EB 8A45EC                  mov al, byte ptr [ebp-14]
:004429EE 8BC8                    mov ecx, eax
:004429F0 8D0440                  lea eax, dword ptr [eax+2*eax]
:004429F3 C1E003                  shl eax, 03
:004429F6 2BC1                    sub eax, ecx
:004429F8 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004429FE E883B4FEFF              call 0042DE86
:00442A03 85C0                    test eax, eax
:00442A05 0F8524000000            jne 00442A2F
:00442A0B 6880000000              push 00000080
:00442A10 33C0                    xor eax, eax
:00442A12 8A45EC                  mov al, byte ptr [ebp-14]
:00442A15 8BC8                    mov ecx, eax
:00442A17 8D0440                  lea eax, dword ptr [eax+2*eax]
:00442A1A C1E003                  shl eax, 03
:00442A1D 2BC1                    sub eax, ecx
:00442A1F 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00442A25 E89AB3FEFF              call 0042DDC4
:00442A2A E9A5FFFFFF              jmp 004429D4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442A05(C)
|
:00442A2F 33C0                    xor eax, eax
:00442A31 8A45EC                  mov al, byte ptr [ebp-14]
:00442A34 8BC8                    mov ecx, eax
:00442A36 8D0440                  lea eax, dword ptr [eax+2*eax]
:00442A39 C1E003                  shl eax, 03
:00442A3C 2BC1                    sub eax, ecx
:00442A3E 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00442A44 E8B7170000              call 00444200
:00442A49 33C9                    xor ecx, ecx
:00442A4B 8AC8                    mov cl, al
:00442A4D 0FBE45F4                movsx eax, byte ptr [ebp-0C]
:00442A51 3BC8                    cmp ecx, eax
:00442A53 0F85AA000000            jne 00442B03
:00442A59 33C0                    xor eax, eax
:00442A5B 8A45EC                  mov al, byte ptr [ebp-14]
:00442A5E 8BC8                    mov ecx, eax
:00442A60 8D0440                  lea eax, dword ptr [eax+2*eax]
:00442A63 C1E003                  shl eax, 03
:00442A66 2BC1                    sub eax, ecx
:00442A68 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00442A6E E85D69FCFF              call 004093D0
:00442A73 33C9                    xor ecx, ecx
:00442A75 8AC8                    mov cl, al
:00442A77 83F907                  cmp ecx, 00000007
:00442A7A 0F8483000000            je 00442B03
:00442A80 6A40                    push 00000040
:00442A82 33C0                    xor eax, eax
:00442A84 8A45EC                  mov al, byte ptr [ebp-14]
:00442A87 8BC8                    mov ecx, eax
:00442A89 8D0440                  lea eax, dword ptr [eax+2*eax]
:00442A8C C1E003                  shl eax, 03
:00442A8F 2BC1                    sub eax, ecx
:00442A91 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00442A97 E8C468FCFF              call 00409360
:00442A9C 85C0                    test eax, eax
:00442A9E 0F855F000000            jne 00442B03
:00442AA4 6880000000              push 00000080
:00442AA9 33C0                    xor eax, eax
:00442AAB 8A45EC                  mov al, byte ptr [ebp-14]
:00442AAE 8BC8                    mov ecx, eax
:00442AB0 8D0440                  lea eax, dword ptr [eax+2*eax]
:00442AB3 C1E003                  shl eax, 03
:00442AB6 2BC1                    sub eax, ecx
:00442AB8 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00442ABE E89D68FCFF              call 00409360
:00442AC3 85C0                    test eax, eax
:00442AC5 0F8538000000            jne 00442B03
:00442ACB 33C0                    xor eax, eax
:00442ACD A0A4354500              mov al, byte ptr [004535A4]
:00442AD2 A804                    test al, 04
:00442AD4 0F8524000000            jne 00442AFE
:00442ADA 6A00                    push 00000000
:00442ADC E8A733FEFF              call 00425E88
:00442AE1 83C404                  add esp, 00000004
:00442AE4 33C0                    xor eax, eax
:00442AE6 8A45EC                  mov al, byte ptr [ebp-14]
:00442AE9 8BC8                    mov ecx, eax
:00442AEB 8D0440                  lea eax, dword ptr [eax+2*eax]
:00442AEE C1E003                  shl eax, 03
:00442AF1 2BC1                    sub eax, ecx
:00442AF3 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00442AF9 E8EF8BFDFF              call 0041B6ED

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442AD4(C)
|
:00442AFE E905000000              jmp 00442B08

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00442A53(C), :00442A7A(C), :00442A9E(C), :00442AC5(C)
|
:00442B03 E9CCFEFFFF              jmp 004429D4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004429E3(C), :00442AFE(U)
|
:00442B08 8B45DC                  mov eax, dword ptr [ebp-24]
:00442B0B 83782A00                cmp dword ptr [eax+2A], 00000000
:00442B0F 0F8423000000            je 00442B38
:00442B15 33C0                    xor eax, eax
:00442B17 8A45F0                  mov al, byte ptr [ebp-10]
:00442B1A 83F801                  cmp eax, 00000001
:00442B1D 1BC0                    sbb eax, eax
:00442B1F F7D8                    neg eax
:00442B21 50                      push eax
:00442B22 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00442B25 E8B6FAFFFF              call 004425E0
:00442B2A 8B45DC                  mov eax, dword ptr [ebp-24]
:00442B2D C7402A00000000          mov [eax+2A], 00000000
:00442B34 C645F4FF                mov [ebp-0C], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442B0F(C)
|
:00442B38 E9BAFDFFFF              jmp 004428F7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00442904(C), :00442911(C)
|
:00442B3D E9FFFCFFFF              jmp 00442841

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044284C(C), :0044285C(C)
|
:00442B42 E900000000              jmp 00442B47

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00442990(U), :00442B42(U)
|
:00442B47 5F                      pop edi
:00442B48 5E                      pop esi
:00442B49 5B                      pop ebx
:00442B4A C9                      leave
:00442B4B C3                      ret



* Referenced by a CALL at Address:
|:004434BE   
|
:00442B4C 55                      push ebp
:00442B4D 8BEC                    mov ebp, esp
:00442B4F 83EC34                  sub esp, 00000034
:00442B52 53                      push ebx
:00442B53 56                      push esi
:00442B54 57                      push edi
:00442B55 894DCC                  mov dword ptr [ebp-34], ecx
:00442B58 C645DCFF                mov [ebp-24], FF
:00442B5C C645E8FF                mov [ebp-18], FF
:00442B60 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00442B63 E808EDFBFF              call 00401870
:00442B68 C745FC01000000          mov [ebp-04], 00000001
:00442B6F C745E400000000          mov [ebp-1C], 00000000
:00442B76 8B45CC                  mov eax, dword ptr [ebp-34]
:00442B79 33C9                    xor ecx, ecx
:00442B7B 8A4801                  mov cl, byte ptr [eax+01]
:00442B7E 85C9                    test ecx, ecx
:00442B80 0F8405000000            je 00442B8B
:00442B86 E9D8060000              jmp 00443263

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442B80(C)
|
:00442B8B C745EC00000000          mov [ebp-14], 00000000
:00442B92 E903000000              jmp 00442B9A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442C27(U)
|
:00442B97 FF45EC                  inc [ebp-14]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442B92(U)
|
:00442B9A 837DEC0F                cmp dword ptr [ebp-14], 0000000F
:00442B9E 0F8388000000            jnb 00442C2C
:00442BA4 8B45CC                  mov eax, dword ptr [ebp-34]
:00442BA7 33C9                    xor ecx, ecx
:00442BA9 8A4801                  mov cl, byte ptr [eax+01]
:00442BAC 85C9                    test ecx, ecx
:00442BAE 0F8578000000            jne 00442C2C
:00442BB4 6A04                    push 00000004
:00442BB6 8B45EC                  mov eax, dword ptr [ebp-14]
:00442BB9 8BC8                    mov ecx, eax
:00442BBB 8D0440                  lea eax, dword ptr [eax+2*eax]
:00442BBE C1E003                  shl eax, 03
:00442BC1 2BC1                    sub eax, ecx
:00442BC3 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00442BC9 E89267FCFF              call 00409360
:00442BCE 85C0                    test eax, eax
:00442BD0 0F8551000000            jne 00442C27
:00442BD6 8B45EC                  mov eax, dword ptr [ebp-14]
:00442BD9 8BC8                    mov ecx, eax
:00442BDB 8D0440                  lea eax, dword ptr [eax+2*eax]
:00442BDE C1E003                  shl eax, 03
:00442BE1 2BC1                    sub eax, ecx
:00442BE3 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00442BE9 E8E267FCFF              call 004093D0
:00442BEE 33C9                    xor ecx, ecx
:00442BF0 8AC8                    mov cl, al
:00442BF2 83F907                  cmp ecx, 00000007
:00442BF5 0F852C000000            jne 00442C27
:00442BFB 8B45EC                  mov eax, dword ptr [ebp-14]
:00442BFE 8BC8                    mov ecx, eax
:00442C00 8D0440                  lea eax, dword ptr [eax+2*eax]
:00442C03 C1E003                  shl eax, 03
:00442C06 2BC1                    sub eax, ecx
:00442C08 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00442C0E E81D6CFCFF              call 00409830
:00442C13 33C9                    xor ecx, ecx
:00442C15 8AC8                    mov cl, al
:00442C17 83F902                  cmp ecx, 00000002
:00442C1A 0F8507000000            jne 00442C27
:00442C20 C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00442BD0(C), :00442BF5(C), :00442C1A(C)
|
:00442C27 E96BFFFFFF              jmp 00442B97

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00442B9E(C), :00442BAE(C)
|
:00442C2C 837DFC00                cmp dword ptr [ebp-04], 00000000
:00442C30 0F8423000000            je 00442C59
:00442C36 B998C04600              mov ecx, 0046C098
:00442C3B E8C065FCFF              call 00409200
:00442C40 668B00                  mov ax, word ptr [eax]
:00442C43 668945D8                mov word ptr [ebp-28], ax
:00442C47 8B45D9                  mov eax, dword ptr [ebp-27]
:00442C4A 50                      push eax
:00442C4B 8B45D8                  mov eax, dword ptr [ebp-28]
:00442C4E 50                      push eax
:00442C4F B900FB4600              mov ecx, 0046FB00
:00442C54 E88F85FFFF              call 0043B1E8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442C30(C)
|
:00442C59 8B45CC                  mov eax, dword ptr [ebp-34]
:00442C5C C6400500                mov [eax+05], 00
:00442C60 8B45CC                  mov eax, dword ptr [ebp-34]
:00442C63 33C9                    xor ecx, ecx
:00442C65 8A4802                  mov cl, byte ptr [eax+02]
:00442C68 85C9                    test ecx, ecx
:00442C6A 0F8417000000            je 00442C87
:00442C70 8B45CC                  mov eax, dword ptr [ebp-34]
:00442C73 33C9                    xor ecx, ecx
:00442C75 8A4802                  mov cl, byte ptr [eax+02]
:00442C78 33C0                    xor eax, eax
:00442C7A A0A0FB4600              mov al, byte ptr [0046FBA0]
:00442C7F 3BC8                    cmp ecx, eax
:00442C81 0F8508000000            jne 00442C8F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442C6A(C)
|
:00442C87 8B4DCC                  mov ecx, dword ptr [ebp-34]
:00442C8A E8AA100000              call 00443D39

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442C81(C)
|

* Possible StringData Ref from Data Obj ->"Ҿ״̬"
                                  |
:00442C8F 68603A4500              push 00453A60
:00442C94 6A00                    push 00000000
:00442C96 E89A62FFFF              call 00438F35
:00442C9B 83C408                  add esp, 00000008
:00442C9E C745EC00000000          mov [ebp-14], 00000000
:00442CA5 E903000000              jmp 00442CAD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442CCF(U)
|
:00442CAA FF45EC                  inc [ebp-14]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442CA5(U)
|
:00442CAD 837DEC0F                cmp dword ptr [ebp-14], 0000000F
:00442CB1 0F831D000000            jnb 00442CD4
:00442CB7 8B45EC                  mov eax, dword ptr [ebp-14]
:00442CBA 8BC8                    mov ecx, eax
:00442CBC 8D0440                  lea eax, dword ptr [eax+2*eax]
:00442CBF C1E003                  shl eax, 03
:00442CC2 2BC1                    sub eax, ecx
:00442CC4 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00442CCA E86182FEFF              call 0042AF30
:00442CCF E9D6FFFFFF              jmp 00442CAA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442CB1(C)
|
:00442CD4 C745F800000000          mov [ebp-08], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044324F(U)
|
:00442CDB 837DFC00                cmp dword ptr [ebp-04], 00000000
:00442CDF 0F856F050000            jne 00443254
:00442CE5 6A01                    push 00000001
:00442CE7 E86E47FFFF              call 0043745A
:00442CEC 83C404                  add esp, 00000004
:00442CEF C745EC00000000          mov [ebp-14], 00000000
:00442CF6 E903000000              jmp 00442CFE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044324A(U)
|
:00442CFB FF45EC                  inc [ebp-14]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442CF6(U)
|
:00442CFE 837DFC00                cmp dword ptr [ebp-04], 00000000
:00442D02 0F8547050000            jne 0044324F
:00442D08 837DF800                cmp dword ptr [ebp-08], 00000000
:00442D0C 0F852A000000            jne 00442D3C
:00442D12 C745F801000000          mov [ebp-08], 00000001
:00442D19 C70564F94600FFFFFFFF    mov dword ptr [0046F964], FFFFFFFF
:00442D23 E87F2FFEFF              call 00425CA7
:00442D28 6A01                    push 00000001
:00442D2A E89C2DFEFF              call 00425ACB
:00442D2F 83C404                  add esp, 00000004
:00442D32 6A00                    push 00000000
:00442D34 E84F31FEFF              call 00425E88
:00442D39 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442D0C(C)
|
:00442D3C B900FB4600              mov ecx, 0046FB00
:00442D41 E89E79FFFF              call 0043A6E4
:00442D46 B900FB4600              mov ecx, 0046FB00
:00442D4B E87F86FFFF              call 0043B3CF
:00442D50 8945F4                  mov dword ptr [ebp-0C], eax
:00442D53 B9B0FA4600              mov ecx, 0046FAB0
:00442D58 E85359FDFF              call 004186B0
:00442D5D 85C0                    test eax, eax
:00442D5F 0F842F000000            je 00442D94
:00442D65 837DF400                cmp dword ptr [ebp-0C], 00000000
:00442D69 0F8525000000            jne 00442D94
:00442D6F 6A01                    push 00000001
:00442D71 E8E446FFFF              call 0043745A
:00442D76 83C404                  add esp, 00000004
:00442D79 8B45CC                  mov eax, dword ptr [ebp-34]
:00442D7C 33C9                    xor ecx, ecx
:00442D7E 8A4805                  mov cl, byte ptr [eax+05]
:00442D81 80F101                  xor cl, 01
:00442D84 8B45CC                  mov eax, dword ptr [ebp-34]
:00442D87 884805                  mov byte ptr [eax+05], cl
:00442D8A B900FB4600              mov ecx, 0046FB00
:00442D8F E80C6BFCFF              call 004098A0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00442D5F(C), :00442D69(C)
|
:00442D94 B900FB4600              mov ecx, 0046FB00
:00442D99 E8237BFFFF              call 0043A8C1
:00442D9E 50                      push eax
:00442D9F 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00442DA2 E8E9EAFBFF              call 00401890
:00442DA7 8D45F0                  lea eax, dword ptr [ebp-10]
:00442DAA 50                      push eax
:00442DAB E88D67FDFF              call 0041953D
:00442DB0 83C404                  add esp, 00000004
:00442DB3 8845E0                  mov byte ptr [ebp-20], al
:00442DB6 33C0                    xor eax, eax
:00442DB8 8A45DC                  mov al, byte ptr [ebp-24]
:00442DBB 33C9                    xor ecx, ecx
:00442DBD 8A4DE0                  mov cl, byte ptr [ebp-20]
:00442DC0 3BC1                    cmp eax, ecx
:00442DC2 0F84CC000000            je 00442E94
:00442DC8 B900FB4600              mov ecx, 0046FB00
:00442DCD E8DEBFFFFF              call 0043EDB0
:00442DD2 85C0                    test eax, eax
:00442DD4 0F840E000000            je 00442DE8
:00442DDA B900FB4600              mov ecx, 0046FB00
:00442DDF E8A278FFFF              call 0043A686
:00442DE4 C645DCFF                mov [ebp-24], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442DD4(C)
|
:00442DE8 33C0                    xor eax, eax
:00442DEA 8A45E0                  mov al, byte ptr [ebp-20]
:00442DED 3DFF000000              cmp eax, 000000FF
:00442DF2 0F849C000000            je 00442E94
:00442DF8 33C0                    xor eax, eax
:00442DFA 8A45E0                  mov al, byte ptr [ebp-20]
:00442DFD 8BC8                    mov ecx, eax
:00442DFF 8D0440                  lea eax, dword ptr [eax+2*eax]
:00442E02 C1E003                  shl eax, 03
:00442E05 2BC1                    sub eax, ecx
:00442E07 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00442E0D E81E6AFCFF              call 00409830
:00442E12 33C9                    xor ecx, ecx
:00442E14 8AC8                    mov cl, al
:00442E16 83F902                  cmp ecx, 00000002
:00442E19 0F8575000000            jne 00442E94
:00442E1F 33C0                    xor eax, eax
:00442E21 8A45E0                  mov al, byte ptr [ebp-20]
:00442E24 8BC8                    mov ecx, eax
:00442E26 8D0440                  lea eax, dword ptr [eax+2*eax]
:00442E29 C1E003                  shl eax, 03
:00442E2C 2BC1                    sub eax, ecx
:00442E2E 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00442E34 E8E763FCFF              call 00409220
:00442E39 85C0                    test eax, eax
:00442E3B 0F8524000000            jne 00442E65
:00442E41 6A20                    push 00000020
:00442E43 33C0                    xor eax, eax
:00442E45 8A45E0                  mov al, byte ptr [ebp-20]
:00442E48 8BC8                    mov ecx, eax
:00442E4A 8D0440                  lea eax, dword ptr [eax+2*eax]
:00442E4D C1E003                  shl eax, 03
:00442E50 2BC1                    sub eax, ecx
:00442E52 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00442E58 E80365FCFF              call 00409360
:00442E5D 85C0                    test eax, eax
:00442E5F 0F842F000000            je 00442E94

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442E3B(C)
|
:00442E65 33C0                    xor eax, eax
:00442E67 A0AC354500              mov al, byte ptr [004535AC]
:00442E6C 85C0                    test eax, eax
:00442E6E 0F8520000000            jne 00442E94
:00442E74 8A45E0                  mov al, byte ptr [ebp-20]
:00442E77 8845DC                  mov byte ptr [ebp-24], al
:00442E7A 33C0                    xor eax, eax
:00442E7C 8A45E0                  mov al, byte ptr [ebp-20]
:00442E7F 8BC8                    mov ecx, eax
:00442E81 8D0440                  lea eax, dword ptr [eax+2*eax]
:00442E84 C1E003                  shl eax, 03
:00442E87 2BC1                    sub eax, ecx
:00442E89 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00442E8F E89390FEFF              call 0042BF27

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00442DC2(C), :00442DF2(C), :00442E19(C), :00442E5F(C), :00442E6E(C)
|
:00442E94 E8B7D1FFFF              call 00440050
:00442E99 85C0                    test eax, eax
:00442E9B 0F8411000000            je 00442EB2
:00442EA1 8D45FC                  lea eax, dword ptr [ebp-04]
:00442EA4 50                      push eax
:00442EA5 8B4DCC                  mov ecx, dword ptr [ebp-34]
:00442EA8 E838F4FFFF              call 004422E5
:00442EAD E93D000000              jmp 00442EEF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442E9B(C)
|
:00442EB2 C6057C534500FF          mov byte ptr [0045537C], FF
:00442EB9 8B45CC                  mov eax, dword ptr [ebp-34]
:00442EBC 83782600                cmp dword ptr [eax+26], 00000000
:00442EC0 0F8414000000            je 00442EDA
:00442EC6 B900FB4600              mov ecx, 0046FB00
:00442ECB E8B677FFFF              call 0043A686
:00442ED0 8B45CC                  mov eax, dword ptr [ebp-34]
:00442ED3 C7402600000000          mov [eax+26], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442EC0(C)
|
:00442EDA 33C0                    xor eax, eax
:00442EDC 8A45F1                  mov al, byte ptr [ebp-0F]
:00442EDF 3DFF000000              cmp eax, 000000FF
:00442EE4 0F8505000000            jne 00442EEF
:00442EEA E860E8FBFF              call 0040174F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00442EAD(U), :00442EE4(C)
|
:00442EEF B988534500              mov ecx, 00455388
:00442EF4 E883EEFBFF              call 00401D7C
:00442EF9 85C0                    test eax, eax
:00442EFB 0F84A4000000            je 00442FA5
:00442F01 33C0                    xor eax, eax
:00442F03 A0AC354500              mov al, byte ptr [004535AC]
:00442F08 85C0                    test eax, eax
:00442F0A 0F8595000000            jne 00442FA5
:00442F10 C745F800000000          mov [ebp-08], 00000000
:00442F17 6A00                    push 00000000
:00442F19 E8AD2BFEFF              call 00425ACB
:00442F1E 83C404                  add esp, 00000004
:00442F21 33C0                    xor eax, eax
:00442F23 8A45DC                  mov al, byte ptr [ebp-24]
:00442F26 3DFF000000              cmp eax, 000000FF
:00442F2B 0F8456000000            je 00442F87
:00442F31 33C0                    xor eax, eax
:00442F33 8A45DC                  mov al, byte ptr [ebp-24]
:00442F36 83F82D                  cmp eax, 0000002D
:00442F39 0F8D48000000            jnl 00442F87
:00442F3F 33C0                    xor eax, eax
:00442F41 8A45DC                  mov al, byte ptr [ebp-24]
:00442F44 8BC8                    mov ecx, eax
:00442F46 8D0440                  lea eax, dword ptr [eax+2*eax]
:00442F49 C1E003                  shl eax, 03
:00442F4C 2BC1                    sub eax, ecx
:00442F4E 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00442F54 E82DAFFEFF              call 0042DE86
:00442F59 85C0                    test eax, eax
:00442F5B 0F841D000000            je 00442F7E
:00442F61 33C0                    xor eax, eax
:00442F63 8A45DC                  mov al, byte ptr [ebp-24]
:00442F66 8BC8                    mov ecx, eax
:00442F68 8D0440                  lea eax, dword ptr [eax+2*eax]
:00442F6B C1E003                  shl eax, 03
:00442F6E 2BC1                    sub eax, ecx
:00442F70 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00442F76 E8FDF5FBFF              call 00402578
:00442F7B 8945E4                  mov dword ptr [ebp-1C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442F5B(C)
|
:00442F7E C645DCFF                mov [ebp-24], FF
:00442F82 E91E000000              jmp 00442FA5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00442F2B(C), :00442F39(C)
|
:00442F87 33C0                    xor eax, eax
:00442F89 8A45DC                  mov al, byte ptr [ebp-24]
:00442F8C 3DFF000000              cmp eax, 000000FF
:00442F91 0F850E000000            jne 00442FA5
:00442F97 8D45F0                  lea eax, dword ptr [ebp-10]
:00442F9A 50                      push eax
:00442F9B B900FB4600              mov ecx, 0046FB00
:00442FA0 E8F4AFFFFF              call 0043DF99

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00442EFB(C), :00442F0A(C), :00442F82(U), :00442F91(C)
|
:00442FA5 B988534500              mov ecx, 00455388
:00442FAA E8EDEDFBFF              call 00401D9C
:00442FAF 85C0                    test eax, eax
:00442FB1 0F840A000000            je 00442FC1

* Possible Ref to Menu: HEXMENU, Item: "   _"
                                  |
:00442FB7 C70564F94600729C0000    mov dword ptr [0046F964], 00009C72

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442FB1(C)
|
:00442FC1 813D64F94600729C0000    cmp dword ptr [0046F964], 00009C72
:00442FCB 0F8C10000000            jl 00442FE1
:00442FD1 813D64F94600829C0000    cmp dword ptr [0046F964], 00009C82
:00442FDB 0F8C91000000            jl 00443072

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442FCB(C)
|
:00442FE1 813D64F94600839C0000    cmp dword ptr [0046F964], 00009C83
:00442FEB 0F8C10000000            jl 00443001
:00442FF1 813D64F94600849C0000    cmp dword ptr [0046F964], 00009C84
:00442FFB 0F8E71000000            jle 00443072

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442FEB(C)
|
:00443001 813D64F94600489C0000    cmp dword ptr [0046F964], 00009C48
:0044300B 0F8C10000000            jl 00443021
:00443011 813D64F946004B9C0000    cmp dword ptr [0046F964], 00009C4B
:0044301B 0F8E51000000            jle 00443072

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044300B(C)
|
:00443021 813D64F94600AE9C0000    cmp dword ptr [0046F964], 00009CAE
:0044302B 0F8C10000000            jl 00443041
:00443031 813D64F94600AF9C0000    cmp dword ptr [0046F964], 00009CAF
:0044303B 0F8E31000000            jle 00443072

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044302B(C)
|
:00443041 B988534500              mov ecx, 00455388
:00443046 E851EDFBFF              call 00401D9C
:0044304B 85C0                    test eax, eax
:0044304D 0F845F000000            je 004430B2
:00443053 8B45CC                  mov eax, dword ptr [ebp-34]
:00443056 33C9                    xor ecx, ecx
:00443058 8A4801                  mov cl, byte ptr [eax+01]
:0044305B 85C9                    test ecx, ecx
:0044305D 0F854F000000            jne 004430B2
:00443063 33C0                    xor eax, eax
:00443065 A0A4354500              mov al, byte ptr [004535A4]
:0044306A A802                    test al, 02
:0044306C 0F8440000000            je 004430B2

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00442FDB(C), :00442FFB(C), :0044301B(C), :0044303B(C)
|
:00443072 33C0                    xor eax, eax
:00443074 8A45DC                  mov al, byte ptr [ebp-24]
:00443077 3DFF000000              cmp eax, 000000FF
:0044307C 0F840E000000            je 00443090
:00443082 B900FB4600              mov ecx, 0046FB00
:00443087 E8FA75FFFF              call 0043A686
:0044308C C645DCFF                mov [ebp-24], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044307C(C)
|
:00443090 C745F800000000          mov [ebp-08], 00000000
:00443097 6A00                    push 00000000
:00443099 E82D2AFEFF              call 00425ACB
:0044309E 83C404                  add esp, 00000004
:004430A1 8D45FC                  lea eax, dword ptr [ebp-04]
:004430A4 50                      push eax
:004430A5 8B4DCC                  mov ecx, dword ptr [ebp-34]
:004430A8 E8AAEAFFFF              call 00441B57
:004430AD E994000000              jmp 00443146

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044304D(C), :0044305D(C), :0044306C(C)
|
:004430B2 813D64F94600469C0000    cmp dword ptr [0046F964], 00009C46
:004430BC 0F8410000000            je 004430D2
:004430C2 813D64F94600DD9C0000    cmp dword ptr [0046F964], 00009CDD
:004430CC 0F853B000000            jne 0044310D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004430BC(C)
|
:004430D2 C745F800000000          mov [ebp-08], 00000000
:004430D9 6A00                    push 00000000
:004430DB E8EB29FEFF              call 00425ACB
:004430E0 83C404                  add esp, 00000004
:004430E3 8D45FC                  lea eax, dword ptr [ebp-04]
:004430E6 50                      push eax
:004430E7 8B4DCC                  mov ecx, dword ptr [ebp-34]
:004430EA E838F0FFFF              call 00442127
:004430EF 833D64F94600FE          cmp dword ptr [0046F964], FFFFFFFE
:004430F6 0F850C000000            jne 00443108
:004430FC 8B45CC                  mov eax, dword ptr [ebp-34]
:004430FF C6400105                mov [eax+01], 05
:00443103 E95B010000              jmp 00443263

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004430F6(C)
|
:00443108 E939000000              jmp 00443146

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004430CC(C)
|
:0044310D 813D64F94600D69C0000    cmp dword ptr [0046F964], 00009CD6
:00443117 0F8C29000000            jl 00443146
:0044311D 813D64F94600DB9C0000    cmp dword ptr [0046F964], 00009CDB
:00443127 0F8F19000000            jg 00443146
:0044312D C745F800000000          mov [ebp-08], 00000000
:00443134 6A00                    push 00000000
:00443136 E89029FEFF              call 00425ACB
:0044313B 83C404                  add esp, 00000004
:0044313E 8B4DCC                  mov ecx, dword ptr [ebp-34]
:00443141 E88CF0FFFF              call 004421D2

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004430AD(U), :00443108(U), :00443117(C), :00443127(C)
|
:00443146 837DE400                cmp dword ptr [ebp-1C], 00000000
:0044314A 0F84FA000000            je 0044324A
:00443150 8B4DCC                  mov ecx, dword ptr [ebp-34]
:00443153 E8EF070000              call 00443947
:00443158 8B45CC                  mov eax, dword ptr [ebp-34]
:0044315B 33C9                    xor ecx, ecx
:0044315D 8A4801                  mov cl, byte ptr [eax+01]
:00443160 85C9                    test ecx, ecx
:00443162 0F8405000000            je 0044316D
:00443168 E9F6000000              jmp 00443263

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443162(C)
|
:0044316D C645D000                mov [ebp-30], 00
:00443171 C745D400000000          mov [ebp-2C], 00000000
:00443178 E903000000              jmp 00443180

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044321E(U)
|
:0044317D FF45D4                  inc [ebp-2C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443178(U)
|
:00443180 837DD40F                cmp dword ptr [ebp-2C], 0000000F
:00443184 0F8399000000            jnb 00443223
:0044318A 6880000000              push 00000080
:0044318F 8B45D4                  mov eax, dword ptr [ebp-2C]
:00443192 8BC8                    mov ecx, eax
:00443194 8D0440                  lea eax, dword ptr [eax+2*eax]
:00443197 C1E003                  shl eax, 03
:0044319A 2BC1                    sub eax, ecx
:0044319C 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004431A2 E8B961FCFF              call 00409360
:004431A7 85C0                    test eax, eax
:004431A9 0F856F000000            jne 0044321E
:004431AF 6A10                    push 00000010
:004431B1 8B45D4                  mov eax, dword ptr [ebp-2C]
:004431B4 8BC8                    mov ecx, eax
:004431B6 8D0440                  lea eax, dword ptr [eax+2*eax]
:004431B9 C1E003                  shl eax, 03
:004431BC 2BC1                    sub eax, ecx
:004431BE 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004431C4 E8875FFCFF              call 00409150
:004431C9 85C0                    test eax, eax
:004431CB 0F854D000000            jne 0044321E
:004431D1 8B45D4                  mov eax, dword ptr [ebp-2C]
:004431D4 8BC8                    mov ecx, eax
:004431D6 8D0440                  lea eax, dword ptr [eax+2*eax]
:004431D9 C1E003                  shl eax, 03
:004431DC 2BC1                    sub eax, ecx
:004431DE 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004431E4 E84766FCFF              call 00409830
:004431E9 33C9                    xor ecx, ecx
:004431EB 8AC8                    mov cl, al
:004431ED 83F902                  cmp ecx, 00000002
:004431F0 0F8528000000            jne 0044321E
:004431F6 8B45D4                  mov eax, dword ptr [ebp-2C]
:004431F9 8BC8                    mov ecx, eax
:004431FB 8D0440                  lea eax, dword ptr [eax+2*eax]
:004431FE C1E003                  shl eax, 03
:00443201 2BC1                    sub eax, ecx
:00443203 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00443209 E8C261FCFF              call 004093D0
:0044320E 33C9                    xor ecx, ecx
:00443210 8AC8                    mov cl, al
:00443212 83F907                  cmp ecx, 00000007
:00443215 0F8503000000            jne 0044321E
:0044321B FE45D0                  inc [ebp-30]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004431A9(C), :004431CB(C), :004431F0(C), :00443215(C)
|
:0044321E E95AFFFFFF              jmp 0044317D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443184(C)
|
:00443223 33C0                    xor eax, eax
:00443225 8A45D0                  mov al, byte ptr [ebp-30]
:00443228 85C0                    test eax, eax
:0044322A 0F8513000000            jne 00443243

* Possible StringData Ref from Data Obj ->"вӵ"
                                  |
:00443230 A138364500              mov eax, dword ptr [00453638]
:00443235 50                      push eax
:00443236 6A01                    push 00000001
:00443238 E8F85CFFFF              call 00438F35
:0044323D 83C408                  add esp, 00000008
:00443240 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044322A(C)
|
:00443243 C745E400000000          mov [ebp-1C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044314A(C)
|
:0044324A E9ACFAFFFF              jmp 00442CFB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442D02(C)
|
:0044324F E987FAFFFF              jmp 00442CDB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442CDF(C)
|
:00443254 B900FB4600              mov ecx, 0046FB00
:00443259 E8120F0000              call 00444170
:0044325E E900000000              jmp 00443263

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00442B86(U), :00443103(U), :00443168(U), :0044325E(U)
|
:00443263 5F                      pop edi
:00443264 5E                      pop esi
:00443265 5B                      pop ebx
:00443266 C9                      leave
:00443267 C3                      ret



* Referenced by a CALL at Addresses:
|:004434B6   , :004434DA   
|
:00443268 55                      push ebp
:00443269 8BEC                    mov ebp, esp
:0044326B 83EC14                  sub esp, 00000014
:0044326E 53                      push ebx
:0044326F 56                      push esi
:00443270 57                      push edi
:00443271 894DEC                  mov dword ptr [ebp-14], ecx
:00443274 837D0800                cmp dword ptr [ebp+08], 00000000
:00443278 0F840C000000            je 0044328A
:0044327E C745F80F000000          mov [ebp-08], 0000000F
:00443285 E907000000              jmp 00443291

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443278(C)
|
:0044328A C745F800000000          mov [ebp-08], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443285(U)
|
:00443291 837D0800                cmp dword ptr [ebp+08], 00000000
:00443295 0F840C000000            je 004432A7
:0044329B C745FC2D000000          mov [ebp-04], 0000002D
:004432A2 E907000000              jmp 004432AE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443295(C)
|
:004432A7 C745FC0F000000          mov [ebp-04], 0000000F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004432A2(U)
|
:004432AE 8B45F8                  mov eax, dword ptr [ebp-08]
:004432B1 8945F4                  mov dword ptr [ebp-0C], eax
:004432B4 E903000000              jmp 004432BC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044341F(U)
|
:004432B9 FF45F4                  inc [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004432B4(U)
|
:004432BC 8B45FC                  mov eax, dword ptr [ebp-04]
:004432BF 3945F4                  cmp dword ptr [ebp-0C], eax
:004432C2 0F835C010000            jnb 00443424
:004432C8 6A20                    push 00000020
:004432CA 8B45F4                  mov eax, dword ptr [ebp-0C]
:004432CD 8BC8                    mov ecx, eax
:004432CF 8D0440                  lea eax, dword ptr [eax+2*eax]
:004432D2 C1E003                  shl eax, 03
:004432D5 2BC1                    sub eax, ecx
:004432D7 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004432DD E86E5EFCFF              call 00409150
:004432E2 85C0                    test eax, eax
:004432E4 0F8435010000            je 0044341F
:004432EA 8B45F4                  mov eax, dword ptr [ebp-0C]
:004432ED 8BC8                    mov ecx, eax
:004432EF 8D0440                  lea eax, dword ptr [eax+2*eax]
:004432F2 C1E003                  shl eax, 03
:004432F5 2BC1                    sub eax, ecx
:004432F7 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004432FD E884ABFEFF              call 0042DE86
:00443302 85C0                    test eax, eax
:00443304 0F8415010000            je 0044341F
:0044330A 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044330D 8BC8                    mov ecx, eax
:0044330F 8D0440                  lea eax, dword ptr [eax+2*eax]
:00443312 C1E003                  shl eax, 03
:00443315 2BC1                    sub eax, ecx
:00443317 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0044331D E80E5EFCFF              call 00409130
:00443322 8D0440                  lea eax, dword ptr [eax+2*eax]
:00443325 03C0                    add eax, eax
:00443327 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:0044332E E85D64FCFF              call 00409790
:00443333 B90A000000              mov ecx, 0000000A
:00443338 2BD2                    sub edx, edx
:0044333A F7F1                    div ecx
:0044333C 8BD8                    mov ebx, eax
:0044333E 8B45F4                  mov eax, dword ptr [ebp-0C]
:00443341 8BC8                    mov ecx, eax
:00443343 8D0440                  lea eax, dword ptr [eax+2*eax]
:00443346 C1E003                  shl eax, 03
:00443349 2BC1                    sub eax, ecx
:0044334B 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00443351 E85A64FCFF              call 004097B0
:00443356 3BD8                    cmp ebx, eax
:00443358 0F8F3A000000            jg 00443398
:0044335E 8B45F4                  mov eax, dword ptr [ebp-0C]
:00443361 8BC8                    mov ecx, eax
:00443363 8D0440                  lea eax, dword ptr [eax+2*eax]
:00443366 C1E003                  shl eax, 03
:00443369 2BC1                    sub eax, ecx
:0044336B 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00443371 E8BA5DFCFF              call 00409130
:00443376 8D0440                  lea eax, dword ptr [eax+2*eax]
:00443379 03C0                    add eax, eax
:0044337B 8D8CC0E8564500          lea ecx, dword ptr [eax+8*eax+004556E8]
:00443382 E80964FCFF              call 00409790
:00443387 B90A000000              mov ecx, 0000000A
:0044338C 2BD2                    sub edx, edx
:0044338E F7F1                    div ecx
:00443390 8945F0                  mov dword ptr [ebp-10], eax
:00443393 E91B000000              jmp 004433B3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443358(C)
|
:00443398 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044339B 8BC8                    mov ecx, eax
:0044339D 8D0440                  lea eax, dword ptr [eax+2*eax]
:004433A0 C1E003                  shl eax, 03
:004433A3 2BC1                    sub eax, ecx
:004433A5 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004433AB E80064FCFF              call 004097B0
:004433B0 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443393(U)
|
:004433B3 8B45F4                  mov eax, dword ptr [ebp-0C]
:004433B6 8BC8                    mov ecx, eax
:004433B8 8D0440                  lea eax, dword ptr [eax+2*eax]
:004433BB C1E003                  shl eax, 03
:004433BE 2BC1                    sub eax, ecx
:004433C0 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004433C6 E8E563FCFF              call 004097B0
:004433CB 2B45F0                  sub eax, dword ptr [ebp-10]
:004433CE 50                      push eax
:004433CF 8B45F4                  mov eax, dword ptr [ebp-0C]
:004433D2 8BC8                    mov ecx, eax
:004433D4 8D0440                  lea eax, dword ptr [eax+2*eax]
:004433D7 C1E003                  shl eax, 03
:004433DA 2BC1                    sub eax, ecx
:004433DC 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004433E2 E8FA6FFEFF              call 0042A3E1
:004433E7 8B45F4                  mov eax, dword ptr [ebp-0C]
:004433EA 8BC8                    mov ecx, eax
:004433EC 8D0440                  lea eax, dword ptr [eax+2*eax]
:004433EF C1E003                  shl eax, 03
:004433F2 2BC1                    sub eax, ecx
:004433F4 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004433FA E8C3AAFEFF              call 0042DEC2
:004433FF 85C0                    test eax, eax
:00443401 0F8418000000            je 0044341F
:00443407 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044340A 8BC8                    mov ecx, eax
:0044340C 8D0440                  lea eax, dword ptr [eax+2*eax]
:0044340F C1E003                  shl eax, 03
:00443412 2BC1                    sub eax, ecx
:00443414 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0044341A E83E86FEFF              call 0042BA5D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004432E4(C), :00443304(C), :00443401(C)
|
:0044341F E995FEFFFF              jmp 004432B9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004432C2(C)
|
:00443424 E900000000              jmp 00443429

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443424(U)
|
:00443429 5F                      pop edi
:0044342A 5E                      pop esi
:0044342B 5B                      pop ebx
:0044342C C9                      leave
:0044342D C20400                  ret 0004



* Referenced by a CALL at Address:
|:00443713   
|
:00443430 55                      push ebp
:00443431 8BEC                    mov ebp, esp
:00443433 83EC08                  sub esp, 00000008
:00443436 53                      push ebx
:00443437 56                      push esi
:00443438 57                      push edi
:00443439 894DF8                  mov dword ptr [ebp-08], ecx
:0044343C C645FC00                mov [ebp-04], 00
:00443440 E903000000              jmp 00443448

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044349D(U)
|
:00443445 FE45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443440(U)
|
:00443448 33C0                    xor eax, eax
:0044344A 8A45FC                  mov al, byte ptr [ebp-04]
:0044344D 83F82D                  cmp eax, 0000002D
:00443450 0F8D4C000000            jnl 004434A2
:00443456 68C0000000              push 000000C0
:0044345B 33C0                    xor eax, eax
:0044345D 8A45FC                  mov al, byte ptr [ebp-04]
:00443460 8BC8                    mov ecx, eax
:00443462 8D0440                  lea eax, dword ptr [eax+2*eax]
:00443465 C1E003                  shl eax, 03
:00443468 2BC1                    sub eax, ecx
:0044346A 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00443470 E8BB5EFCFF              call 00409330
:00443475 33C0                    xor eax, eax
:00443477 8A45FC                  mov al, byte ptr [ebp-04]
:0044347A 83F80F                  cmp eax, 0000000F
:0044347D 0F8D1A000000            jnl 0044349D
:00443483 33C0                    xor eax, eax
:00443485 8A45FC                  mov al, byte ptr [ebp-04]
:00443488 8BC8                    mov ecx, eax
:0044348A 8D0440                  lea eax, dword ptr [eax+2*eax]
:0044348D C1E003                  shl eax, 03
:00443490 2BC1                    sub eax, ecx
:00443492 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00443498 E8FE71FEFF              call 0042A69B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044347D(C)
|
:0044349D E9A3FFFFFF              jmp 00443445

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443450(C)
|
:004434A2 E8E7CDFFFF              call 0044028E
:004434A7 B900FB4600              mov ecx, 0046FB00
:004434AC E86F0D0000              call 00444220
:004434B1 6A00                    push 00000000
:004434B3 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004434B6 E8ADFDFFFF              call 00443268
:004434BB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004434BE E889F6FFFF              call 00442B4C
:004434C3 833D64F94600FE          cmp dword ptr [0046F964], FFFFFFFE
:004434CA 0F8505000000            jne 004434D5
:004434D0 E917000000              jmp 004434EC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004434CA(C)
|
:004434D5 6A01                    push 00000001
:004434D7 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004434DA E889FDFFFF              call 00443268
:004434DF 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004434E2 E831F3FFFF              call 00442818
:004434E7 E900000000              jmp 004434EC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004434D0(U), :004434E7(U)
|
:004434EC 5F                      pop edi
:004434ED 5E                      pop esi
:004434EE 5B                      pop ebx
:004434EF C9                      leave
:004434F0 C3                      ret



* Referenced by a CALL at Address:
|:004256B4   
|
:004434F1 55                      push ebp
:004434F2 8BEC                    mov ebp, esp
:004434F4 83EC14                  sub esp, 00000014
:004434F7 53                      push ebx
:004434F8 56                      push esi
:004434F9 57                      push edi
:004434FA 894DEC                  mov dword ptr [ebp-14], ecx
:004434FD 6A72                    push 00000072
:004434FF E88429FEFF              call 00425E88
:00443504 83C404                  add esp, 00000004
:00443507 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0044350A E859D2FFFF              call 00440768
:0044350F 6A00                    push 00000000
:00443511 E87229FEFF              call 00425E88
:00443516 83C404                  add esp, 00000004
:00443519 B9D0A64600              mov ecx, 0046A6D0
:0044351E E85DBEFDFF              call 0041F380
:00443523 85C0                    test eax, eax
:00443525 0F8416000000            je 00443541
:0044352B B9D0A64600              mov ecx, 0046A6D0
:00443530 E84BBEFDFF              call 0041F380
:00443535 48                      dec eax
:00443536 50                      push eax
:00443537 B9D0A64600              mov ecx, 0046A6D0
:0044353C E85F84FCFF              call 0040B9A0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443525(C)
|
:00443541 E906000000              jmp 0044354C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443718(U)
|
:00443546 8B45EC                  mov eax, dword ptr [ebp-14]
:00443549 FE4002                  inc [eax+02]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443541(U)
|
:0044354C 8B45EC                  mov eax, dword ptr [ebp-14]
:0044354F 33C9                    xor ecx, ecx
:00443551 8A4801                  mov cl, byte ptr [eax+01]
:00443554 85C9                    test ecx, ecx
:00443556 0F85C1010000            jne 0044371D
:0044355C 8B45EC                  mov eax, dword ptr [ebp-14]
:0044355F 33C9                    xor ecx, ecx
:00443561 8A4802                  mov cl, byte ptr [eax+02]
:00443564 8B45EC                  mov eax, dword ptr [ebp-14]
:00443567 33D2                    xor edx, edx
:00443569 8A5003                  mov dl, byte ptr [eax+03]
:0044356C 3BCA                    cmp ecx, edx
:0044356E 0F8CAF000000            jl 00443623

* Possible StringData Ref from Data Obj ->"˹涨սʱ䣬ֻгˡ
"
                                  |
:00443574 686C3A4500              push 00453A6C
:00443579 6A00                    push 00000000
:0044357B E8B559FFFF              call 00438F35
:00443580 83C408                  add esp, 00000008
:00443583 C745F401000000          mov [ebp-0C], 00000001
:0044358A C645F800                mov [ebp-08], 00
:0044358E E903000000              jmp 00443596

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004435E7(U)
|
:00443593 FE45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044358E(U)
|
:00443596 33C0                    xor eax, eax
:00443598 8A45F8                  mov al, byte ptr [ebp-08]
:0044359B 83F80F                  cmp eax, 0000000F
:0044359E 0F8D48000000            jnl 004435EC
:004435A4 33C0                    xor eax, eax
:004435A6 8A45F8                  mov al, byte ptr [ebp-08]
:004435A9 8BC8                    mov ecx, eax
:004435AB 8D0440                  lea eax, dword ptr [eax+2*eax]
:004435AE C1E003                  shl eax, 03
:004435B1 2BC1                    sub eax, ecx
:004435B3 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004435B9 E8725BFCFF              call 00409130
:004435BE 85C0                    test eax, eax
:004435C0 0F8521000000            jne 004435E7
:004435C6 33C0                    xor eax, eax
:004435C8 8A45F8                  mov al, byte ptr [ebp-08]
:004435CB 8BC8                    mov ecx, eax
:004435CD 8D0440                  lea eax, dword ptr [eax+2*eax]
:004435D0 C1E003                  shl eax, 03
:004435D3 2BC1                    sub eax, ecx
:004435D5 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004435DB E87D84FEFF              call 0042BA5D
:004435E0 C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004435C0(C)
|
:004435E7 E9A7FFFFFF              jmp 00443593

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044359E(C)
|
:004435EC 837DF400                cmp dword ptr [ebp-0C], 00000000
:004435F0 0F8421000000            je 00443617
:004435F6 B998C04600              mov ecx, 0046C098
:004435FB E83062FCFF              call 00409830
:00443600 33C9                    xor ecx, ecx
:00443602 8AC8                    mov cl, al
:00443604 83F902                  cmp ecx, 00000002
:00443607 0F850A000000            jne 00443617
:0044360D B998C04600              mov ecx, 0046C098
:00443612 E84684FEFF              call 0042BA5D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004435F0(C), :00443607(C)
|
:00443617 8B45EC                  mov eax, dword ptr [ebp-14]
:0044361A C6400101                mov [eax+01], 01
:0044361E E9FA000000              jmp 0044371D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044356E(C)
|
:00443623 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00443626 E853060000              call 00443C7E
:0044362B 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0044362E E8E2060000              call 00443D15
:00443633 33C9                    xor ecx, ecx
:00443635 8AC8                    mov cl, al
:00443637 8B048DB0354500          mov eax, dword ptr [4*ecx+004535B0]
:0044363E 50                      push eax
:0044363F 8B45EC                  mov eax, dword ptr [ebp-14]
:00443642 33C9                    xor ecx, ecx
:00443644 8A4802                  mov cl, byte ptr [eax+02]
:00443647 41                      inc ecx
:00443648 51                      push ecx

* Possible StringData Ref from Data Obj ->"%wغ%s"
                                  |
:00443649 68903A4500              push 00453A90
:0044364E 6A00                    push 00000000
:00443650 E8E058FFFF              call 00438F35
:00443655 83C410                  add esp, 00000010
:00443658 C745FC05000000          mov [ebp-04], 00000005

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004436FB(U)
|
:0044365F 837DFC05                cmp dword ptr [ebp-04], 00000005
:00443663 0F840A000000            je 00443673
:00443669 837DFC06                cmp dword ptr [ebp-04], 00000006
:0044366D 0F858D000000            jne 00443700

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443663(C)
|
:00443673 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00443676 E865A9FEFF              call 0042DFE0
:0044367B 33C9                    xor ecx, ecx
:0044367D 8AC8                    mov cl, al
:0044367F 85C9                    test ecx, ecx
:00443681 0F8405000000            je 0044368C
:00443687 E974000000              jmp 00443700

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443681(C)
|
:0044368C 8B45EC                  mov eax, dword ptr [ebp-14]
:0044368F 33C9                    xor ecx, ecx
:00443691 8A4802                  mov cl, byte ptr [eax+02]
:00443694 41                      inc ecx
:00443695 51                      push ecx
:00443696 B9B0C44600              mov ecx, 0046C4B0
:0044369B E8B1BFFEFF              call 0042F651
:004436A0 8945F0                  mov dword ptr [ebp-10], eax
:004436A3 817DF0FFFF0000          cmp dword ptr [ebp-10], 0000FFFF
:004436AA 0F8416000000            je 004436C6
:004436B0 8B45F0                  mov eax, dword ptr [ebp-10]
:004436B3 50                      push eax
:004436B4 B9B0C44600              mov ecx, 0046C4B0
:004436B9 E8CAC4FEFF              call 0042FB88
:004436BE 8945FC                  mov dword ptr [ebp-04], eax
:004436C1 E935000000              jmp 004436FB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004436AA(C)
|
:004436C6 B9B0C44600              mov ecx, 0046C4B0
:004436CB E8A9B9FEFF              call 0042F079
:004436D0 8945F0                  mov dword ptr [ebp-10], eax
:004436D3 817DF0FFFF0000          cmp dword ptr [ebp-10], 0000FFFF
:004436DA 0F8416000000            je 004436F6
:004436E0 8B45F0                  mov eax, dword ptr [ebp-10]
:004436E3 50                      push eax
:004436E4 B9B0C44600              mov ecx, 0046C4B0
:004436E9 E89AC4FEFF              call 0042FB88
:004436EE 8945FC                  mov dword ptr [ebp-04], eax
:004436F1 E905000000              jmp 004436FB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004436DA(C)
|
:004436F6 E905000000              jmp 00443700

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004436C1(U), :004436F1(U)
|
:004436FB E95FFFFFFF              jmp 0044365F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044366D(C), :00443687(U), :004436F6(U)
|
:00443700 8B45EC                  mov eax, dword ptr [ebp-14]
:00443703 33C9                    xor ecx, ecx
:00443705 8A4801                  mov cl, byte ptr [eax+01]
:00443708 85C9                    test ecx, ecx
:0044370A 0F8508000000            jne 00443718
:00443710 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00443713 E818FDFFFF              call 00443430

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044370A(C)
|
:00443718 E929FEFFFF              jmp 00443546

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00443556(C), :0044361E(U)
|
:0044371D 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00443720 E824000000              call 00443749
:00443725 6A00                    push 00000000
:00443727 E82D23FEFF              call 00425A59
:0044372C 83C404                  add esp, 00000004
:0044372F 6A00                    push 00000000
:00443731 E89523FEFF              call 00425ACB
:00443736 83C404                  add esp, 00000004
:00443739 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0044373C 8A4101                  mov al, byte ptr [ecx+01]
:0044373F E900000000              jmp 00443744

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044373F(U)
|
:00443744 5F                      pop edi
:00443745 5E                      pop esi
:00443746 5B                      pop ebx
:00443747 C9                      leave
:00443748 C3                      ret



* Referenced by a CALL at Address:
|:00443720   
|
:00443749 55                      push ebp
:0044374A 8BEC                    mov ebp, esp
:0044374C 83EC0C                  sub esp, 0000000C
:0044374F 53                      push ebx
:00443750 56                      push esi
:00443751 57                      push edi
:00443752 894DF4                  mov dword ptr [ebp-0C], ecx
:00443755 8B45F4                  mov eax, dword ptr [ebp-0C]
:00443758 33C9                    xor ecx, ecx
:0044375A 8A4801                  mov cl, byte ptr [eax+01]
:0044375D 83F902                  cmp ecx, 00000002
:00443760 0F85F8000000            jne 0044385E
:00443766 8B45F4                  mov eax, dword ptr [ebp-0C]
:00443769 33C9                    xor ecx, ecx
:0044376B 8A4824                  mov cl, byte ptr [eax+24]
:0044376E 85C9                    test ecx, ecx
:00443770 0F8E18000000            jle 0044378E
:00443776 8B45F4                  mov eax, dword ptr [ebp-0C]
:00443779 33C9                    xor ecx, ecx
:0044377B 8A4824                  mov cl, byte ptr [eax+24]
:0044377E 51                      push ecx

* Possible StringData Ref from Data Obj ->"ҴĲ
õC6%wC7㾭ֵ"
                                  |
:0044377F 689C3A4500              push 00453A9C
:00443784 6A00                    push 00000000
:00443786 E8AA57FFFF              call 00438F35
:0044378B 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443770(C)
|
:0044378E C645F800                mov [ebp-08], 00
:00443792 E903000000              jmp 0044379A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443854(U)
|
:00443797 FE45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443792(U)
|
:0044379A 33C0                    xor eax, eax
:0044379C 8A45F8                  mov al, byte ptr [ebp-08]
:0044379F 83F82D                  cmp eax, 0000002D
:004437A2 0F8DB1000000            jnl 00443859
:004437A8 33C0                    xor eax, eax
:004437AA 8A45F8                  mov al, byte ptr [ebp-08]
:004437AD 8BC8                    mov ecx, eax
:004437AF 8D0440                  lea eax, dword ptr [eax+2*eax]
:004437B2 C1E003                  shl eax, 03
:004437B5 2BC1                    sub eax, ecx
:004437B7 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004437BD E86E60FCFF              call 00409830
:004437C2 33C9                    xor ecx, ecx
:004437C4 8AC8                    mov cl, al
:004437C6 83F902                  cmp ecx, 00000002
:004437C9 0F8585000000            jne 00443854
:004437CF 33C0                    xor eax, eax
:004437D1 8A45F8                  mov al, byte ptr [ebp-08]
:004437D4 8BC8                    mov ecx, eax
:004437D6 8D0440                  lea eax, dword ptr [eax+2*eax]
:004437D9 C1E003                  shl eax, 03
:004437DC 2BC1                    sub eax, ecx
:004437DE 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004437E4 E84759FCFF              call 00409130
:004437E9 8D0440                  lea eax, dword ptr [eax+2*eax]
:004437EC 03C0                    add eax, eax
:004437EE 8D04C0                  lea eax, dword ptr [eax+8*eax]
:004437F1 05E8564500              add eax, 004556E8
:004437F6 8945FC                  mov dword ptr [ebp-04], eax
:004437F9 33C0                    xor eax, eax
:004437FB 8A45F8                  mov al, byte ptr [ebp-08]
:004437FE 83F80F                  cmp eax, 0000000F
:00443801 0F8D31000000            jnl 00443838
:00443807 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044380A 33C9                    xor ecx, ecx
:0044380C 8A4824                  mov cl, byte ptr [eax+24]
:0044380F 85C9                    test ecx, ecx
:00443811 0F8E21000000            jle 00443838
:00443817 6A01                    push 00000001
:00443819 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044381C E8BF5DFCFF              call 004095E0
:00443821 33C9                    xor ecx, ecx
:00443823 8AC8                    mov cl, al
:00443825 8B45F4                  mov eax, dword ptr [ebp-0C]
:00443828 33D2                    xor edx, edx
:0044382A 8A5024                  mov dl, byte ptr [eax+24]
:0044382D 03CA                    add ecx, edx
:0044382F 51                      push ecx
:00443830 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00443833 E89499FCFF              call 0040D1CC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00443801(C), :00443811(C)
|
:00443838 6A01                    push 00000001
:0044383A 33C0                    xor eax, eax
:0044383C 8A45F8                  mov al, byte ptr [ebp-08]
:0044383F 8BC8                    mov ecx, eax
:00443841 8D0440                  lea eax, dword ptr [eax+2*eax]
:00443844 C1E003                  shl eax, 03
:00443847 2BC1                    sub eax, ecx
:00443849 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:0044384F E8CC56FEFF              call 00428F20

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004437C9(C)
|
:00443854 E93EFFFFFF              jmp 00443797

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004437A2(C)
|
:00443859 E9DF000000              jmp 0044393D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443760(C)
|
:0044385E C645F800                mov [ebp-08], 00
:00443862 E903000000              jmp 0044386A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443938(U)
|
:00443867 FE45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443862(U)
|
:0044386A 33C0                    xor eax, eax
:0044386C 8A45F8                  mov al, byte ptr [ebp-08]
:0044386F 83F82D                  cmp eax, 0000002D
:00443872 0F8DC5000000            jnl 0044393D
:00443878 33C0                    xor eax, eax
:0044387A 8A45F8                  mov al, byte ptr [ebp-08]
:0044387D 8D0440                  lea eax, dword ptr [eax+2*eax]
:00443880 33C9                    xor ecx, ecx
:00443882 8A0C45A8FB4600          mov cl, byte ptr [2*eax+0046FBA8]
:00443889 81F9FF000000            cmp ecx, 000000FF
:0044388F 0F8522000000            jne 004438B7
:00443895 33C0                    xor eax, eax
:00443897 8A45F8                  mov al, byte ptr [ebp-08]
:0044389A 8BC8                    mov ecx, eax
:0044389C 8D0440                  lea eax, dword ptr [eax+2*eax]
:0044389F C1E003                  shl eax, 03
:004438A2 2BC1                    sub eax, ecx
:004438A4 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004438AA E88158FCFF              call 00409130
:004438AF 85C0                    test eax, eax
:004438B1 0F851C000000            jne 004438D3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044388F(C)
|
:004438B7 6A01                    push 00000001
:004438B9 33C0                    xor eax, eax
:004438BB 8A45F8                  mov al, byte ptr [ebp-08]
:004438BE 8BC8                    mov ecx, eax
:004438C0 8D0440                  lea eax, dword ptr [eax+2*eax]
:004438C3 C1E003                  shl eax, 03
:004438C6 2BC1                    sub eax, ecx
:004438C8 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004438CE E84D56FEFF              call 00428F20

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004438B1(C)
|
:004438D3 33C0                    xor eax, eax
:004438D5 A0A0FB4600              mov al, byte ptr [0046FBA0]
:004438DA 85C0                    test eax, eax
:004438DC 0F8456000000            je 00443938
:004438E2 33C0                    xor eax, eax
:004438E4 8A45F8                  mov al, byte ptr [ebp-08]
:004438E7 8D0440                  lea eax, dword ptr [eax+2*eax]
:004438EA 8B0445A9FB4600          mov eax, dword ptr [2*eax+0046FBA9]
:004438F1 50                      push eax
:004438F2 33C0                    xor eax, eax
:004438F4 8A45F8                  mov al, byte ptr [ebp-08]
:004438F7 8BC8                    mov ecx, eax
:004438F9 8D0440                  lea eax, dword ptr [eax+2*eax]
:004438FC C1E003                  shl eax, 03
:004438FF 2BC1                    sub eax, ecx
:00443901 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00443907 E8D56AFEFF              call 0042A3E1
:0044390C 33C0                    xor eax, eax
:0044390E 8A45F8                  mov al, byte ptr [ebp-08]
:00443911 8D0440                  lea eax, dword ptr [eax+2*eax]
:00443914 33C9                    xor ecx, ecx
:00443916 8A0C45ADFB4600          mov cl, byte ptr [2*eax+0046FBAD]
:0044391D 51                      push ecx
:0044391E 33C0                    xor eax, eax
:00443920 8A45F8                  mov al, byte ptr [ebp-08]
:00443923 8BC8                    mov ecx, eax
:00443925 8D0440                  lea eax, dword ptr [eax+2*eax]
:00443928 C1E003                  shl eax, 03
:0044392B 2BC1                    sub eax, ecx
:0044392D 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:00443933 E80D6BFEFF              call 0042A445

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004438DC(C)
|
:00443938 E92AFFFFFF              jmp 00443867

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00443859(U), :00443872(C)
|
:0044393D E900000000              jmp 00443942

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044393D(U)
|
:00443942 5F                      pop edi
:00443943 5E                      pop esi
:00443944 5B                      pop ebx
:00443945 C9                      leave
:00443946 C3                      ret



* Referenced by a CALL at Addresses:
|:0041BE12   , :00443153   
|
:00443947 55                      push ebp
:00443948 8BEC                    mov ebp, esp
:0044394A 83EC14                  sub esp, 00000014
:0044394D 53                      push ebx
:0044394E 56                      push esi
:0044394F 57                      push edi
:00443950 894DEC                  mov dword ptr [ebp-14], ecx
:00443953 8B45EC                  mov eax, dword ptr [ebp-14]
:00443956 33C9                    xor ecx, ecx
:00443958 8A4801                  mov cl, byte ptr [eax+01]
:0044395B 85C9                    test ecx, ecx
:0044395D 0F840A000000            je 0044396D
:00443963 B801000000              mov eax, 00000001
:00443968 E904010000              jmp 00443A71

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044395D(C)
|
:0044396D C645FC00                mov [ebp-04], 00
:00443971 C645F80F                mov [ebp-08], 0F
:00443975 E903000000              jmp 0044397D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004439B5(U)
|
:0044397A FE45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443975(U)
|
:0044397D 33C0                    xor eax, eax
:0044397F 8A45F8                  mov al, byte ptr [ebp-08]
:00443982 83F82D                  cmp eax, 0000002D
:00443985 0F8D2F000000            jnl 004439BA
:0044398B 33C0                    xor eax, eax
:0044398D 8A45F8                  mov al, byte ptr [ebp-08]
:00443990 8BC8                    mov ecx, eax
:00443992 8D0440                  lea eax, dword ptr [eax+2*eax]
:00443995 C1E003                  shl eax, 03
:00443998 2BC1                    sub eax, ecx
:0044399A 8D8898C04600            lea ecx, dword ptr [eax+0046C098]
:004439A0 E88B5EFCFF              call 00409830
:004439A5 33C9                    xor ecx, ecx
:004439A7 8AC8                    mov cl, al
:004439A9 83F902                  cmp ecx, 00000002
:004439AC 0F8503000000            jne 004439B5
:004439B2 FE45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004439AC(C)
|
:004439B5 E9C0FFFFFF              jmp 0044397A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443985(C)
|
:004439BA 33C0                    xor eax, eax
:004439BC 8A45FC                  mov al, byte ptr [ebp-04]
:004439BF 85C0                    test eax, eax
:004439C1 0F85A3000000            jne 00443A6A
:004439C7 C745F405000000          mov [ebp-0C], 00000005

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443A5B(U)
|
:004439CE 837DF405                cmp dword ptr [ebp-0C], 00000005
:004439D2 0F840A000000            je 004439E2
:004439D8 837DF406                cmp dword ptr [ebp-0C], 00000006
:004439DC 0F857E000000            jne 00443A60

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004439D2(C)
|
:004439E2 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004439E5 E8F6A5FEFF              call 0042DFE0
:004439EA 33C9                    xor ecx, ecx
:004439EC 8AC8                    mov cl, al
:004439EE 85C9                    test ecx, ecx
:004439F0 0F8405000000            je 004439FB
:004439F6 E965000000              jmp 00443A60

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004439F0(C)
|
:004439FB B9B0C44600              mov ecx, 0046C4B0
:00443A00 E8ACBAFEFF              call 0042F4B1
:00443A05 8945F0                  mov dword ptr [ebp-10], eax
:00443A08 817DF0FFFF0000          cmp dword ptr [ebp-10], 0000FFFF
:00443A0F 0F8416000000            je 00443A2B
:00443A15 8B45F0                  mov eax, dword ptr [ebp-10]
:00443A18 50                      push eax
:00443A19 B9B0C44600              mov ecx, 0046C4B0
:00443A1E E865C1FEFF              call 0042FB88
:00443A23 8945F4                  mov dword ptr [ebp-0C], eax
:00443A26 E930000000              jmp 00443A5B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443A0F(C)
|
:00443A2B B9B0C44600              mov ecx, 0046C4B0
:00443A30 E844B6FEFF              call 0042F079
:00443A35 8945F0                  mov dword ptr [ebp-10], eax
:00443A38 817DF0FFFF0000          cmp dword ptr [ebp-10], 0000FFFF
:00443A3F 0F8411000000            je 00443A56
:00443A45 8B45F0                  mov eax, dword ptr [ebp-10]
:00443A48 50                      push eax
:00443A49 B9B0C44600              mov ecx, 0046C4B0
:00443A4E E835C1FEFF              call 0042FB88
:00443A53 8945F4                  mov dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443A3F(C)
|
:00443A56 E905000000              jmp 00443A60

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443A26(U)
|
:00443A5B E96EFFFFFF              jmp 004439CE

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004439DC(C), :004439F6(U), :00443A56(U)
|
:00443A60 B801000000              mov eax, 00000001
:00443A65 E907000000              jmp 00443A71

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004439C1(C)
|
:00443A6A 33C0                    xor eax, eax
:00443A6C E900000000              jmp 00443A71

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00443968(U), :00443A65(U), :00443A6C(U)
|
:00443A71 5F                      pop edi
:00443A72 5E                      pop esi
:00443A73 5B                      pop ebx
:00443A74 C9                      leave
:00443A75 C3                      ret



* Referenced by a CALL at Address:
|:0044079A   
|
:00443A76 55                      push ebp
:00443A77 8BEC                    mov ebp, esp
:00443A79 83EC1C                  sub esp, 0000001C
:00443A7C 53                      push ebx
:00443A7D 56                      push esi
:00443A7E 57                      push edi
:00443A7F 894DE4                  mov dword ptr [ebp-1C], ecx
:00443A82 8D45E8                  lea eax, dword ptr [ebp-18]
:00443A85 50                      push eax
:00443A86 B9B0C44600              mov ecx, 0046C4B0
:00443A8B E8B0DFFBFF              call 00401A40
:00443A90 8A45F8                  mov al, byte ptr [ebp-08]
:00443A93 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00443A96 8801                    mov byte ptr [ecx], al
:00443A98 E900000000              jmp 00443A9D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443A98(U)
|
:00443A9D 5F                      pop edi
:00443A9E 5E                      pop esi
:00443A9F 5B                      pop ebx
:00443AA0 C9                      leave
:00443AA1 C3                      ret



* Referenced by a CALL at Address:
|:004407CF   
|
:00443AA2 55                      push ebp
:00443AA3 8BEC                    mov ebp, esp
:00443AA5 81EC18010000            sub esp, 00000118
:00443AAB 53                      push ebx
:00443AAC 56                      push esi
:00443AAD 57                      push edi
:00443AAE 898DE8FEFFFF            mov dword ptr [ebp+FFFFFEE8], ecx
:00443AB4 B968F94600              mov ecx, 0046F968
:00443AB9 E82256FCFF              call 004090E0
:00443ABE 8945F4                  mov dword ptr [ebp-0C], eax
:00443AC1 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00443AC7 E8A45BFCFF              call 00409670
:00443ACC C645F000                mov [ebp-10], 00
:00443AD0 E903000000              jmp 00443AD8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443AF0(U)
|
:00443AD5 FE45F0                  inc [ebp-10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443AD0(U)
|
:00443AD8 33C0                    xor eax, eax
:00443ADA 8A45F0                  mov al, byte ptr [ebp-10]
:00443ADD 83F803                  cmp eax, 00000003
:00443AE0 0F8D0F000000            jnl 00443AF5
:00443AE6 33C0                    xor eax, eax
:00443AE8 8A45F0                  mov al, byte ptr [ebp-10]
:00443AEB C64405F800              mov [ebp+eax-08], 00
:00443AF0 E9E0FFFFFF              jmp 00443AD5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443AE0(C)
|

* Possible StringData Ref from Data Obj ->"B:HEXZMAP.E2"
                                  |
:00443AF5 6828354500              push 00453528
:00443AFA 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00443B00 E80A3AFEFF              call 0042750F
:00443B05 B968F94600              mov ecx, 0046F968
:00443B0A E8D155FCFF              call 004090E0
:00443B0F 50                      push eax
:00443B10 6A37                    push 00000037
:00443B12 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00443B18 E8643BFEFF              call 00427681
:00443B1D 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00443B23 E8F858FCFF              call 00409420
:00443B28 C645F000                mov [ebp-10], 00
:00443B2C E903000000              jmp 00443B34

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443B6A(U)
|
:00443B31 FE45F0                  inc [ebp-10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443B2C(U)
|
:00443B34 B900AA4600              mov ecx, 0046AA00
:00443B39 E842C2FCFF              call 0040FD80
:00443B3E 33C9                    xor ecx, ecx
:00443B40 8AC8                    mov cl, al
:00443B42 33C0                    xor eax, eax
:00443B44 8A45F0                  mov al, byte ptr [ebp-10]
:00443B47 3BC8                    cmp ecx, eax
:00443B49 0F8E20000000            jle 00443B6F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443B62(U)
|
:00443B4F 8B45F4                  mov eax, dword ptr [ebp-0C]
:00443B52 33C9                    xor ecx, ecx
:00443B54 8A08                    mov cl, byte ptr [eax]
:00443B56 83F90A                  cmp ecx, 0000000A
:00443B59 0F8408000000            je 00443B67
:00443B5F FF45F4                  inc [ebp-0C]
:00443B62 E9E8FFFFFF              jmp 00443B4F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443B59(C)
|
:00443B67 FF45F4                  inc [ebp-0C]
:00443B6A E9C2FFFFFF              jmp 00443B31

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443B49(C)
|
:00443B6F 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:00443B75 83C006                  add eax, 00000006
:00443B78 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443BFE(U)
|
:00443B7B 8B45F4                  mov eax, dword ptr [ebp-0C]
:00443B7E 33C9                    xor ecx, ecx
:00443B80 8A08                    mov cl, byte ptr [eax]
:00443B82 81F980000000            cmp ecx, 00000080
:00443B88 0F8C75000000            jl 00443C03
:00443B8E 8B45F4                  mov eax, dword ptr [ebp-0C]
:00443B91 33C9                    xor ecx, ecx
:00443B93 8A08                    mov cl, byte ptr [eax]
:00443B95 81F987000000            cmp ecx, 00000087
:00443B9B 0F853D000000            jne 00443BDE
:00443BA1 8B45F4                  mov eax, dword ptr [ebp-0C]
:00443BA4 33C9                    xor ecx, ecx
:00443BA6 8A4801                  mov cl, byte ptr [eax+01]
:00443BA9 83F954                  cmp ecx, 00000054
:00443BAC 0F8C2C000000            jl 00443BDE
:00443BB2 8B45F4                  mov eax, dword ptr [ebp-0C]
:00443BB5 33C9                    xor ecx, ecx
:00443BB7 8A4801                  mov cl, byte ptr [eax+01]
:00443BBA 83F957                  cmp ecx, 00000057
:00443BBD 0F8D1B000000            jnl 00443BDE
:00443BC3 8B45F4                  mov eax, dword ptr [ebp-0C]
:00443BC6 8A00                    mov al, byte ptr [eax]
:00443BC8 8845F8                  mov byte ptr [ebp-08], al
:00443BCB FF45F4                  inc [ebp-0C]
:00443BCE 8B45F4                  mov eax, dword ptr [ebp-0C]
:00443BD1 8A00                    mov al, byte ptr [eax]
:00443BD3 8845F9                  mov byte ptr [ebp-07], al
:00443BD6 FF45F4                  inc [ebp-0C]
:00443BD9 E920000000              jmp 00443BFE

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00443B9B(C), :00443BAC(C), :00443BBD(C)
|
:00443BDE 8B45F4                  mov eax, dword ptr [ebp-0C]
:00443BE1 8A00                    mov al, byte ptr [eax]
:00443BE3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00443BE6 8801                    mov byte ptr [ecx], al
:00443BE8 FF45F4                  inc [ebp-0C]
:00443BEB FF45FC                  inc [ebp-04]
:00443BEE 8B45F4                  mov eax, dword ptr [ebp-0C]
:00443BF1 8A00                    mov al, byte ptr [eax]
:00443BF3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00443BF6 8801                    mov byte ptr [ecx], al
:00443BF8 FF45F4                  inc [ebp-0C]
:00443BFB FF45FC                  inc [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443BD9(U)
|
:00443BFE E978FFFFFF              jmp 00443B7B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443B88(C)
|
:00443C03 8B45FC                  mov eax, dword ptr [ebp-04]
:00443C06 C60000                  mov byte ptr [eax], 00
:00443C09 E900000000              jmp 00443C0E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443C09(U)
|
:00443C0E 5F                      pop edi
:00443C0F 5E                      pop esi
:00443C10 5B                      pop ebx
:00443C11 C9                      leave
:00443C12 C3                      ret



* Referenced by a CALL at Addresses:
|:0040385B   , :00439753   , :00440A3D   
|
:00443C13 55                      push ebp
:00443C14 8BEC                    mov ebp, esp
:00443C16 83EC04                  sub esp, 00000004
:00443C19 53                      push ebx
:00443C1A 56                      push esi
:00443C1B 57                      push edi
:00443C1C 894DFC                  mov dword ptr [ebp-04], ecx
:00443C1F E87333FEFF              call 00426F97
:00443C24 E8D9DAFBFF              call 00401702
:00443C29 6A0C                    push 0000000C
:00443C2B BB16000000              mov ebx, 00000016
:00443C30 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00443C33 E888040000              call 004440C0
:00443C38 50                      push eax
:00443C39 E86C370000              call 004473AA
:00443C3E 83C404                  add esp, 00000004
:00443C41 2BD8                    sub ebx, eax
:00443C43 C1EB01                  shr ebx, 01
:00443C46 83C324                  add ebx, 00000024
:00443C49 53                      push ebx
:00443C4A B910BC4600              mov ecx, 0046BC10
:00443C4F E8B3BFFDFF              call 0041FC07
:00443C54 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00443C57 E864040000              call 004440C0
:00443C5C 50                      push eax

* Possible StringData Ref from Data Obj ->"M4C7%s"
                                  |
:00443C5D 68C83A4500              push 00453AC8
:00443C62 6810BC4600              push 0046BC10
:00443C67 E8B7CEFDFF              call 00420B23
:00443C6C 83C40C                  add esp, 0000000C
:00443C6F E84333FEFF              call 00426FB7
:00443C74 E900000000              jmp 00443C79

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443C74(U)
|
:00443C79 5F                      pop edi
:00443C7A 5E                      pop esi
:00443C7B 5B                      pop ebx
:00443C7C C9                      leave
:00443C7D C3                      ret



* Referenced by a CALL at Address:
|:00443626   
|
:00443C7E 55                      push ebp
:00443C7F 8BEC                    mov ebp, esp
:00443C81 83EC0C                  sub esp, 0000000C
:00443C84 53                      push ebx
:00443C85 56                      push esi
:00443C86 57                      push edi
:00443C87 894DF4                  mov dword ptr [ebp-0C], ecx
:00443C8A 6A06                    push 00000006
:00443C8C E897360000              call 00447328
:00443C91 83C404                  add esp, 00000004
:00443C94 8845FC                  mov byte ptr [ebp-04], al
:00443C97 8B45F4                  mov eax, dword ptr [ebp-0C]
:00443C9A 8A4004                  mov al, byte ptr [eax+04]
:00443C9D 8845F8                  mov byte ptr [ebp-08], al
:00443CA0 33C0                    xor eax, eax
:00443CA2 8A45F8                  mov al, byte ptr [ebp-08]
:00443CA5 33C9                    xor ecx, ecx
:00443CA7 8A4DFC                  mov cl, byte ptr [ebp-04]
:00443CAA 3BC1                    cmp eax, ecx
:00443CAC 0F8E08000000            jle 00443CBA
:00443CB2 FE4DF8                  dec [ebp-08]
:00443CB5 E915000000              jmp 00443CCF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443CAC(C)
|
:00443CBA 33C0                    xor eax, eax
:00443CBC 8A45F8                  mov al, byte ptr [ebp-08]
:00443CBF 33C9                    xor ecx, ecx
:00443CC1 8A4DFC                  mov cl, byte ptr [ebp-04]
:00443CC4 3BC1                    cmp eax, ecx
:00443CC6 0F8D03000000            jnl 00443CCF
:00443CCC FE45F8                  inc [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00443CB5(U), :00443CC6(C)
|
:00443CCF 33C0                    xor eax, eax
:00443CD1 8A45F8                  mov al, byte ptr [ebp-08]
:00443CD4 85C0                    test eax, eax
:00443CD6 0F850C000000            jne 00443CE8
:00443CDC 8B45F4                  mov eax, dword ptr [ebp-0C]
:00443CDF C6400405                mov [eax+04], 05
:00443CE3 E923000000              jmp 00443D0B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443CD6(C)
|
:00443CE8 33C0                    xor eax, eax
:00443CEA 8A45F8                  mov al, byte ptr [ebp-08]
:00443CED 83F805                  cmp eax, 00000005
:00443CF0 0F850C000000            jne 00443D02
:00443CF6 8B45F4                  mov eax, dword ptr [ebp-0C]
:00443CF9 C6400400                mov [eax+04], 00
:00443CFD E909000000              jmp 00443D0B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443CF0(C)
|
:00443D02 8A45F8                  mov al, byte ptr [ebp-08]
:00443D05 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00443D08 884104                  mov byte ptr [ecx+04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00443CE3(U), :00443CFD(U)
|
:00443D0B E900000000              jmp 00443D10

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443D0B(U)
|
:00443D10 5F                      pop edi
:00443D11 5E                      pop esi
:00443D12 5B                      pop ebx
:00443D13 C9                      leave
:00443D14 C3                      ret



* Referenced by a CALL at Addresses:
|:00402B49   , :00404403   , :0041C1C4   , :0044362E   , :00443F5F   
|
:00443D15 55                      push ebp
:00443D16 8BEC                    mov ebp, esp
:00443D18 83EC04                  sub esp, 00000004
:00443D1B 53                      push ebx
:00443D1C 56                      push esi
:00443D1D 57                      push edi
:00443D1E 894DFC                  mov dword ptr [ebp-04], ecx
:00443D21 8B45FC                  mov eax, dword ptr [ebp-04]
:00443D24 33C9                    xor ecx, ecx
:00443D26 8A4804                  mov cl, byte ptr [eax+04]
:00443D29 8A8148364500            mov al, byte ptr [ecx+00453648]
:00443D2F E900000000              jmp 00443D34

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443D2F(U)
|
:00443D34 5F                      pop edi
:00443D35 5E                      pop esi
:00443D36 5B                      pop ebx
:00443D37 C9                      leave
:00443D38 C3                      ret



* Referenced by a CALL at Addresses:
|:00442294   , :00442C8A   
|
:00443D39 55                      push ebp
:00443D3A 8BEC                    mov ebp, esp
:00443D3C 6AFF                    push FFFFFFFF
:00443D3E 683E404400              push 0044403E
:00443D43 64A100000000            mov eax, dword ptr fs:[00000000]
:00443D49 50                      push eax
:00443D4A 64892500000000          mov dword ptr fs:[00000000], esp
:00443D51 83EC2C                  sub esp, 0000002C
:00443D54 53                      push ebx
:00443D55 56                      push esi
:00443D56 57                      push edi
:00443D57 894DC8                  mov dword ptr [ebp-38], ecx
:00443D5A E83832FEFF              call 00426F97
:00443D5F 6A00                    push 00000000
:00443D61 6A04                    push 00000004
:00443D63 6A00                    push 00000000
:00443D65 6800090100              push 00010900
:00443D6A B9E8E44600              mov ecx, 0046E4E8
:00443D6F E8AC390000              call 00447720
:00443D74 50                      push eax
:00443D75 68B8000000              push 000000B8
:00443D7A 6840010000              push 00000140

* Possible Reference to Dialog: DialogID_009C 
                                  |
:00443D7F 689C000000              push 0000009C
:00443D84 6898000000              push 00000098
:00443D89 E82795FFFF              call 0043D2B5
:00443D8E 83C418                  add esp, 00000018
:00443D91 6A04                    push 00000004
:00443D93 B910BC4600              mov ecx, 0046BC10
:00443D98 E8E4C0FDFF              call 0041FE81
:00443D9D 6A07                    push 00000007
:00443D9F B910BC4600              mov ecx, 0046BC10
:00443DA4 E82ABFFDFF              call 0041FCD3
:00443DA9 6A00                    push 00000000
:00443DAB B910BC4600              mov ecx, 0046BC10
:00443DB0 E81BC0FDFF              call 0041FDD0
:00443DB5 68B3000000              push 000000B3
:00443DBA 6A16                    push 00000016
:00443DBC B910BC4600              mov ecx, 0046BC10
:00443DC1 E841BEFDFF              call 0041FC07
:00443DC6 8B4DC8                  mov ecx, dword ptr [ebp-38]
:00443DC9 E8F2020000              call 004440C0
:00443DCE 50                      push eax

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:00443DCF 68D43A4500              push 00453AD4
:00443DD4 6810BC4600              push 0046BC10
:00443DD9 E845CDFDFF              call 00420B23
:00443DDE 83C40C                  add esp, 0000000C
:00443DE1 E8D131FEFF              call 00426FB7
:00443DE6 B9B0C44600              mov ecx, 0046C4B0
:00443DEB E890D0FCFF              call 00410E80
:00443DF0 8945D0                  mov dword ptr [ebp-30], eax
:00443DF3 C745EC00000000          mov [ebp-14], 00000000
:00443DFA E903000000              jmp 00443E02

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443E3F(U)
|
:00443DFF FF45EC                  inc [ebp-14]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443DFA(U)
|
:00443E02 837DEC02                cmp dword ptr [ebp-14], 00000002
:00443E06 0F8338000000            jnb 00443E44
:00443E0C 8B45D0                  mov eax, dword ptr [ebp-30]
:00443E0F 33C9                    xor ecx, ecx
:00443E11 8A08                    mov cl, byte ptr [eax]
:00443E13 85C9                    test ecx, ecx
:00443E15 0F8429000000            je 00443E44
:00443E1B 6A00                    push 00000000
:00443E1D 6A30                    push 00000030
:00443E1F 8B45D0                  mov eax, dword ptr [ebp-30]
:00443E22 50                      push eax
:00443E23 8B45EC                  mov eax, dword ptr [ebp-14]
:00443E26 8D0440                  lea eax, dword ptr [eax+2*eax]
:00443E29 C1E003                  shl eax, 03
:00443E2C 05F2000000              add eax, 000000F2
:00443E31 50                      push eax
:00443E32 6A16                    push 00000016
:00443E34 E81A39FFFF              call 00437753
:00443E39 83C414                  add esp, 00000014
:00443E3C 0145D0                  add dword ptr [ebp-30], eax
:00443E3F E9BBFFFFFF              jmp 00443DFF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00443E06(C), :00443E15(C)
|
:00443E44 C745CC60A90000          mov [ebp-34], 0000A960
:00443E4B 8B45C8                  mov eax, dword ptr [ebp-38]
:00443E4E 33C9                    xor ecx, ecx
:00443E50 8A4802                  mov cl, byte ptr [eax+02]
:00443E53 41                      inc ecx
:00443E54 8B45C8                  mov eax, dword ptr [ebp-38]
:00443E57 33DB                    xor ebx, ebx
:00443E59 8A5803                  mov bl, byte ptr [eax+03]
:00443E5C B890000000              mov eax, 00000090
:00443E61 99                      cdq
:00443E62 F7FB                    idiv ebx
:00443E64 0FAFC8                  imul ecx, eax
:00443E67 8D04CD00000000          lea eax, dword ptr [8*ecx+00000000]
:00443E6E 99                      cdq
:00443E6F 83E207                  and edx, 00000007
:00443E72 03C2                    add eax, edx
:00443E74 C1F803                  sar eax, 03
:00443E77 8945F0                  mov dword ptr [ebp-10], eax
:00443E7A 6A04                    push 00000004
:00443E7C 6A00                    push 00000000
:00443E7E 8B45CC                  mov eax, dword ptr [ebp-34]
:00443E81 50                      push eax
:00443E82 B940CF4600              mov ecx, 0046CF40
:00443E87 E894380000              call 00447720
:00443E8C 50                      push eax
:00443E8D 6A08                    push 00000008
:00443E8F 6A01                    push 00000001
:00443E91 E814100000              call 00444EAA
:00443E96 83C40C                  add esp, 0000000C
:00443E99 837DF000                cmp dword ptr [ebp-10], 00000000
:00443E9D 0F8422000000            je 00443EC5
:00443EA3 6A02                    push 00000002
:00443EA5 6840010000              push 00000140
:00443EAA 8B45F0                  mov eax, dword ptr [ebp-10]
:00443EAD 05E0000000              add eax, 000000E0
:00443EB2 50                      push eax
:00443EB3 6838010000              push 00000138
:00443EB8 68E0000000              push 000000E0
:00443EBD E8CF130000              call 00445291
:00443EC2 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443E9D(C)
|
:00443EC5 6A01                    push 00000001
:00443EC7 B910BC4600              mov ecx, 0046BC10
:00443ECC E88FBFFDFF              call 0041FE60
:00443ED1 6A00                    push 00000000
:00443ED3 B910BC4600              mov ecx, 0046BC10
:00443ED8 E855BFFDFF              call 0041FE32
:00443EDD 6A00                    push 00000000
:00443EDF B910BC4600              mov ecx, 0046BC10
:00443EE4 E8E7BEFDFF              call 0041FDD0
:00443EE9 6A07                    push 00000007
:00443EEB B910BC4600              mov ecx, 0046BC10
:00443EF0 E8DEBDFDFF              call 0041FCD3
:00443EF5 6834010000              push 00000134
:00443EFA 6A20                    push 00000020
:00443EFC B910BC4600              mov ecx, 0046BC10
:00443F01 E801BDFDFF              call 0041FC07
:00443F06 8B45C8                  mov eax, dword ptr [ebp-38]
:00443F09 33C9                    xor ecx, ecx
:00443F0B 8A4803                  mov cl, byte ptr [eax+03]
:00443F0E 51                      push ecx
:00443F0F 8B45C8                  mov eax, dword ptr [ebp-38]
:00443F12 33C9                    xor ecx, ecx
:00443F14 8A4802                  mov cl, byte ptr [eax+02]
:00443F17 41                      inc ecx
:00443F18 51                      push ecx

* Possible StringData Ref from Data Obj ->"%2w%2w"
                                  |
:00443F19 68D83A4500              push 00453AD8
:00443F1E E8294FFFFF              call 00438E4C
:00443F23 83C40C                  add esp, 0000000C
:00443F26 6A00                    push 00000000
:00443F28 B910BC4600              mov ecx, 0046BC10
:00443F2D E82EBFFDFF              call 0041FE60
:00443F32 68B0F94600              push 0046F9B0

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:00443F37 68E43A4500              push 00453AE4
:00443F3C 6810BC4600              push 0046BC10
:00443F41 E8DDCBFDFF              call 00420B23
:00443F46 83C40C                  add esp, 0000000C
:00443F49 6834010000              push 00000134
:00443F4E 6A36                    push 00000036
:00443F50 B910BC4600              mov ecx, 0046BC10
:00443F55 E8ADBCFDFF              call 0041FC07
:00443F5A B998FC4600              mov ecx, 0046FC98
:00443F5F E8B1FDFFFF              call 00443D15
:00443F64 33C9                    xor ecx, ecx
:00443F66 8AC8                    mov cl, al
:00443F68 8B048DB0354500          mov eax, dword ptr [4*ecx+004535B0]
:00443F6F 50                      push eax

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:00443F70 68E83A4500              push 00453AE8
:00443F75 6810BC4600              push 0046BC10
:00443F7A E8A4CBFDFF              call 00420B23
:00443F7F 83C40C                  add esp, 0000000C
:00443F82 6A00                    push 00000000
:00443F84 6A00                    push 00000000
:00443F86 6A00                    push 00000000
:00443F88 6A00                    push 00000000
:00443F8A 6A00                    push 00000000
:00443F8C 6A00                    push 00000000
:00443F8E 6A00                    push 00000000
:00443F90 8D4DD4                  lea ecx, dword ptr [ebp-2C]
:00443F93 E8887DFCFF              call 0040BD20
:00443F98 C745FC00000000          mov [ebp-04], 00000000
:00443F9F 6A00                    push 00000000
:00443FA1 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->"ȷ"
                                  |
:00443FA3 68EC3A4500              push 00453AEC
:00443FA8 6A10                    push 00000010
:00443FAA 6A06                    push 00000006
:00443FAC 68AA000000              push 000000AA
:00443FB1 6A33                    push 00000033
:00443FB3 8D4DD4                  lea ecx, dword ptr [ebp-2C]
:00443FB6 E8757CFCFF              call 0040BC30
:00443FBB 8D4DD4                  lea ecx, dword ptr [ebp-2C]
:00443FBE E8C3D6FDFF              call 00421686

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044400D(U)
|
:00443FC3 8D4DD4                  lea ecx, dword ptr [ebp-2C]
:00443FC6 E8EFD8FDFF              call 004218BA
:00443FCB 33C9                    xor ecx, ecx
:00443FCD 8AC8                    mov cl, al
:00443FCF 81F9FF000000            cmp ecx, 000000FF
:00443FD5 0F8537000000            jne 00444012
:00443FDB B988534500              mov ecx, 00455388
:00443FE0 E8B7DDFBFF              call 00401D9C
:00443FE5 85C0                    test eax, eax
:00443FE7 0F8416000000            je 00444003
:00443FED E8F534FFFF              call 004374E7
:00443FF2 6A01                    push 00000001
:00443FF4 B994A64600              mov ecx, 0046A694
:00443FF9 E82650FDFF              call 00419024
:00443FFE E90F000000              jmp 00444012

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443FE7(C)
|
:00444003 6A00                    push 00000000
:00444005 E87E1EFEFF              call 00425E88
:0044400A 83C404                  add esp, 00000004
:0044400D E9B1FFFFFF              jmp 00443FC3

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00443FD5(C), :00443FFE(U)
|
:00444012 6A18                    push 00000018
:00444014 6A27                    push 00000027
:00444016 6A00                    push 00000000
:00444018 6A00                    push 00000000
:0044401A B900FB4600              mov ecx, 0046FB00
:0044401F E8096BFFFF              call 0043AB2D
:00444024 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0044402B E805000000              call 00444035
:00444030 E913000000              jmp 00444048

* Referenced by a CALL at Address:
|:0044402B   
|
:00444035 8D4DD4                  lea ecx, dword ptr [ebp-2C]
:00444038 E8337CFCFF              call 0040BC70
:0044403D C3                      ret


:0044403E B820C34400              mov eax, 0044C320
:00444043 E978400000              jmp 004480C0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444030(U)
|
:00444048 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044404B 64A300000000            mov dword ptr fs:[00000000], eax
:00444051 5F                      pop edi
:00444052 5E                      pop esi
:00444053 5B                      pop ebx
:00444054 C9                      leave
:00444055 C3                      ret


:00444056 CC                      int 03
:00444057 CC                      int 03
:00444058 CC                      int 03
:00444059 CC                      int 03
:0044405A CC                      int 03
:0044405B CC                      int 03
:0044405C CC                      int 03
:0044405D CC                      int 03
:0044405E CC                      int 03
:0044405F CC                      int 03

* Referenced by a CALL at Address:
|:0043EE55   
|
:00444060 55                      push ebp
:00444061 8BEC                    mov ebp, esp
:00444063 83EC04                  sub esp, 00000004
:00444066 53                      push ebx
:00444067 56                      push esi
:00444068 57                      push edi
:00444069 894DFC                  mov dword ptr [ebp-04], ecx
:0044406C E900000000              jmp 00444071

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044406C(U)
|
:00444071 8B45FC                  mov eax, dword ptr [ebp-04]
:00444074 5F                      pop edi
:00444075 5E                      pop esi
:00444076 5B                      pop ebx
:00444077 C9                      leave
:00444078 C3                      ret


:00444079 CC                      int 03
:0044407A CC                      int 03
:0044407B CC                      int 03
:0044407C CC                      int 03
:0044407D CC                      int 03
:0044407E CC                      int 03
:0044407F CC                      int 03

* Referenced by a CALL at Address:
|:0043EE8C   
|
:00444080 55                      push ebp
:00444081 8BEC                    mov ebp, esp
:00444083 83EC04                  sub esp, 00000004
:00444086 53                      push ebx
:00444087 56                      push esi
:00444088 57                      push edi
:00444089 894DFC                  mov dword ptr [ebp-04], ecx
:0044408C E900000000              jmp 00444091

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044408C(U)
|
:00444091 5F                      pop edi
:00444092 5E                      pop esi
:00444093 5B                      pop ebx
:00444094 C9                      leave
:00444095 C3                      ret


:00444096 CC                      int 03
:00444097 CC                      int 03
:00444098 CC                      int 03
:00444099 CC                      int 03
:0044409A CC                      int 03
:0044409B CC                      int 03
:0044409C CC                      int 03
:0044409D CC                      int 03
:0044409E CC                      int 03
:0044409F CC                      int 03

* Referenced by a CALL at Address:
|:0043F314   
|
:004440A0 55                      push ebp
:004440A1 8BEC                    mov ebp, esp
:004440A3 83EC04                  sub esp, 00000004
:004440A6 53                      push ebx
:004440A7 56                      push esi
:004440A8 57                      push edi
:004440A9 894DFC                  mov dword ptr [ebp-04], ecx
:004440AC 8B45FC                  mov eax, dword ptr [ebp-04]
:004440AF 83C00D                  add eax, 0000000D
:004440B2 E900000000              jmp 004440B7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004440B2(U)
|
:004440B7 5F                      pop edi
:004440B8 5E                      pop esi
:004440B9 5B                      pop ebx
:004440BA C9                      leave
:004440BB C3                      ret


:004440BC CC                      int 03
:004440BD CC                      int 03
:004440BE CC                      int 03
:004440BF CC                      int 03

* Referenced by a CALL at Addresses:
|:004405B9   , :0044061D   , :00443C33   , :00443C57   , :00443DC9   
|
:004440C0 55                      push ebp
:004440C1 8BEC                    mov ebp, esp
:004440C3 83EC04                  sub esp, 00000004
:004440C6 53                      push ebx
:004440C7 56                      push esi
:004440C8 57                      push edi
:004440C9 894DFC                  mov dword ptr [ebp-04], ecx
:004440CC 8B45FC                  mov eax, dword ptr [ebp-04]
:004440CF 83C006                  add eax, 00000006
:004440D2 E900000000              jmp 004440D7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004440D2(U)
|
:004440D7 5F                      pop edi
:004440D8 5E                      pop esi
:004440D9 5B                      pop ebx
:004440DA C9                      leave
:004440DB C3                      ret


:004440DC CC                      int 03
:004440DD CC                      int 03
:004440DE CC                      int 03
:004440DF CC                      int 03

* Referenced by a CALL at Addresses:
|:0044081F   , :004409C9   , :00440F0A   , :00441C5F   
|
:004440E0 55                      push ebp
:004440E1 8BEC                    mov ebp, esp
:004440E3 83EC04                  sub esp, 00000004
:004440E6 53                      push ebx
:004440E7 56                      push esi
:004440E8 57                      push edi
:004440E9 894DFC                  mov dword ptr [ebp-04], ecx
:004440EC 8B45FC                  mov eax, dword ptr [ebp-04]
:004440EF 33C9                    xor ecx, ecx
:004440F1 668B887F030000          mov cx, word ptr [eax+0000037F]
:004440F8 83E101                  and ecx, 00000001
:004440FB 8BC1                    mov eax, ecx
:004440FD E900000000              jmp 00444102

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004440FD(U)
|
:00444102 5F                      pop edi
:00444103 5E                      pop esi
:00444104 5B                      pop ebx
:00444105 C9                      leave
:00444106 C3                      ret


:00444107 CC                      int 03
:00444108 CC                      int 03
:00444109 CC                      int 03
:0044410A CC                      int 03
:0044410B CC                      int 03
:0044410C CC                      int 03
:0044410D CC                      int 03
:0044410E CC                      int 03
:0044410F CC                      int 03

* Referenced by a CALL at Address:
|:004408D7   
|
:00444110 55                      push ebp
:00444111 8BEC                    mov ebp, esp
:00444113 83EC04                  sub esp, 00000004
:00444116 53                      push ebx
:00444117 56                      push esi
:00444118 57                      push edi
:00444119 894DFC                  mov dword ptr [ebp-04], ecx
:0044411C 8B45FC                  mov eax, dword ptr [ebp-04]
:0044411F 33C9                    xor ecx, ecx
:00444121 8A8896070000            mov cl, byte ptr [eax+00000796]
:00444127 8BC1                    mov eax, ecx
:00444129 E900000000              jmp 0044412E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444129(U)
|
:0044412E 5F                      pop edi
:0044412F 5E                      pop esi
:00444130 5B                      pop ebx
:00444131 C9                      leave
:00444132 C3                      ret


:00444133 CC                      int 03
:00444134 CC                      int 03
:00444135 CC                      int 03
:00444136 CC                      int 03
:00444137 CC                      int 03
:00444138 CC                      int 03
:00444139 CC                      int 03
:0044413A CC                      int 03
:0044413B CC                      int 03
:0044413C CC                      int 03
:0044413D CC                      int 03
:0044413E CC                      int 03
:0044413F CC                      int 03

* Referenced by a CALL at Address:
|:00440888   
|
:00444140 55                      push ebp
:00444141 8BEC                    mov ebp, esp
:00444143 83EC04                  sub esp, 00000004
:00444146 53                      push ebx
:00444147 56                      push esi
:00444148 57                      push edi
:00444149 894DFC                  mov dword ptr [ebp-04], ecx
:0044414C 8B45FC                  mov eax, dword ptr [ebp-04]
:0044414F 33C9                    xor ecx, ecx
:00444151 8A8897070000            mov cl, byte ptr [eax+00000797]
:00444157 8BC1                    mov eax, ecx
:00444159 E900000000              jmp 0044415E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444159(U)
|
:0044415E 5F                      pop edi
:0044415F 5E                      pop esi
:00444160 5B                      pop ebx
:00444161 C9                      leave
:00444162 C3                      ret


:00444163 CC                      int 03
:00444164 CC                      int 03
:00444165 CC                      int 03
:00444166 CC                      int 03
:00444167 CC                      int 03
:00444168 CC                      int 03
:00444169 CC                      int 03
:0044416A CC                      int 03
:0044416B CC                      int 03
:0044416C CC                      int 03
:0044416D CC                      int 03
:0044416E CC                      int 03
:0044416F CC                      int 03

* Referenced by a CALL at Addresses:
|:00440A0F   , :00443259   
|
:00444170 55                      push ebp
:00444171 8BEC                    mov ebp, esp
:00444173 83EC04                  sub esp, 00000004
:00444176 53                      push ebx
:00444177 56                      push esi
:00444178 57                      push edi
:00444179 894DFC                  mov dword ptr [ebp-04], ecx
:0044417C 8B45FC                  mov eax, dword ptr [ebp-04]
:0044417F 8B4010                  mov eax, dword ptr [eax+10]
:00444182 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00444185 89412D                  mov dword ptr [ecx+2D], eax
:00444188 8B45FC                  mov eax, dword ptr [ebp-04]
:0044418B 8B4014                  mov eax, dword ptr [eax+14]
:0044418E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00444191 894131                  mov dword ptr [ecx+31], eax
:00444194 E900000000              jmp 00444199

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444194(U)
|
:00444199 5F                      pop edi
:0044419A 5E                      pop esi
:0044419B 5B                      pop ebx
:0044419C C9                      leave
:0044419D C3                      ret


:0044419E CC                      int 03
:0044419F CC                      int 03

* Referenced by a CALL at Addresses:
|:00442219   , :00442234   
|
:004441A0 55                      push ebp
:004441A1 8BEC                    mov ebp, esp
:004441A3 83EC04                  sub esp, 00000004
:004441A6 53                      push ebx
:004441A7 56                      push esi
:004441A8 57                      push edi
:004441A9 894DFC                  mov dword ptr [ebp-04], ecx
:004441AC 8A4508                  mov al, byte ptr [ebp+08]
:004441AF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004441B2 88412C                  mov byte ptr [ecx+2C], al
:004441B5 E900000000              jmp 004441BA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004441B5(U)
|
:004441BA 5F                      pop edi
:004441BB 5E                      pop esi
:004441BC 5B                      pop ebx
:004441BD C9                      leave
:004441BE C20400                  ret 0004


:004441C1 CC                      int 03
:004441C2 CC                      int 03
:004441C3 CC                      int 03
:004441C4 CC                      int 03
:004441C5 CC                      int 03
:004441C6 CC                      int 03
:004441C7 CC                      int 03
:004441C8 CC                      int 03
:004441C9 CC                      int 03
:004441CA CC                      int 03
:004441CB CC                      int 03
:004441CC CC                      int 03
:004441CD CC                      int 03
:004441CE CC                      int 03
:004441CF CC                      int 03

* Referenced by a CALL at Addresses:
|:00442645   , :004426F4   , :0044278C   , :00442802   
|
:004441D0 55                      push ebp
:004441D1 8BEC                    mov ebp, esp
:004441D3 83EC04                  sub esp, 00000004
:004441D6 53                      push ebx
:004441D7 56                      push esi
:004441D8 57                      push edi
:004441D9 894DFC                  mov dword ptr [ebp-04], ecx
:004441DC 8A4508                  mov al, byte ptr [ebp+08]
:004441DF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004441E2 88410A                  mov byte ptr [ecx+0A], al
:004441E5 E900000000              jmp 004441EA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004441E5(U)
|
:004441EA 5F                      pop edi
:004441EB 5E                      pop esi
:004441EC 5B                      pop ebx
:004441ED C9                      leave
:004441EE C20400                  ret 0004


:004441F1 CC                      int 03
:004441F2 CC                      int 03
:004441F3 CC                      int 03
:004441F4 CC                      int 03
:004441F5 CC                      int 03
:004441F6 CC                      int 03
:004441F7 CC                      int 03
:004441F8 CC                      int 03
:004441F9 CC                      int 03
:004441FA CC                      int 03
:004441FB CC                      int 03
:004441FC CC                      int 03
:004441FD CC                      int 03
:004441FE CC                      int 03
:004441FF CC                      int 03

* Referenced by a CALL at Addresses:
|:004426BD   , :00442755   , :004427CB   , :00442A44   
|
:00444200 55                      push ebp
:00444201 8BEC                    mov ebp, esp
:00444203 83EC04                  sub esp, 00000004
:00444206 53                      push ebx
:00444207 56                      push esi
:00444208 57                      push edi
:00444209 894DFC                  mov dword ptr [ebp-04], ecx
:0044420C 8B45FC                  mov eax, dword ptr [ebp-04]
:0044420F 8A400A                  mov al, byte ptr [eax+0A]
:00444212 E900000000              jmp 00444217

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444212(U)
|
:00444217 5F                      pop edi
:00444218 5E                      pop esi
:00444219 5B                      pop ebx
:0044421A C9                      leave
:0044421B C3                      ret


:0044421C CC                      int 03
:0044421D CC                      int 03
:0044421E CC                      int 03
:0044421F CC                      int 03

* Referenced by a CALL at Address:
|:004434AC   
|
:00444220 55                      push ebp
:00444221 8BEC                    mov ebp, esp
:00444223 83EC04                  sub esp, 00000004
:00444226 53                      push ebx
:00444227 56                      push esi
:00444228 57                      push edi
:00444229 894DFC                  mov dword ptr [ebp-04], ecx
:0044422C 8B45FC                  mov eax, dword ptr [ebp-04]
:0044422F 8B400C                  mov eax, dword ptr [eax+0C]
:00444232 99                      cdq
:00444233 83E20F                  and edx, 0000000F
:00444236 03C2                    add eax, edx
:00444238 C1F804                  sar eax, 04
:0044423B B903000000              mov ecx, 00000003
:00444240 99                      cdq
:00444241 F7F9                    idiv ecx
:00444243 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00444246 8B4931                  mov ecx, dword ptr [ecx+31]
:00444249 03C8                    add ecx, eax
:0044424B 41                      inc ecx
:0044424C 33C0                    xor eax, eax
:0044424E 8AC1                    mov al, cl
:00444250 B903000000              mov ecx, 00000003
:00444255 99                      cdq
:00444256 F7F9                    idiv ecx
:00444258 50                      push eax
:00444259 8B45FC                  mov eax, dword ptr [ebp-04]
:0044425C 8B4008                  mov eax, dword ptr [eax+08]
:0044425F 99                      cdq
:00444260 83E20F                  and edx, 0000000F
:00444263 03C2                    add eax, edx
:00444265 C1F804                  sar eax, 04
:00444268 B903000000              mov ecx, 00000003
:0044426D 99                      cdq
:0044426E F7F9                    idiv ecx
:00444270 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00444273 8B492D                  mov ecx, dword ptr [ecx+2D]
:00444276 03C8                    add ecx, eax
:00444278 41                      inc ecx
:00444279 33C0                    xor eax, eax
:0044427B 8AC1                    mov al, cl
:0044427D B903000000              mov ecx, 00000003
:00444282 99                      cdq
:00444283 F7F9                    idiv ecx
:00444285 50                      push eax
:00444286 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00444289 E85A6FFFFF              call 0043B1E8
:0044428E E900000000              jmp 00444293

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044428E(U)
|
:00444293 5F                      pop edi
:00444294 5E                      pop esi
:00444295 5B                      pop ebx
:00444296 C9                      leave
:00444297 C3                      ret



* Referenced by a CALL at Address:
|:0040E0C1   
|

* Reference To: comdlg32.GetOpenFileNameA, Ord:0009h
                                  |
:00444298 FF25CC744700            Jmp dword ptr [004774CC]

* Referenced by a CALL at Address:
|:0040E0FD   
|

* Reference To: comdlg32.GetSaveFileNameA, Ord:000Bh
                                  |
:0044429E FF25D0744700            Jmp dword ptr [004774D0]

* Referenced by a CALL at Addresses:
|:004269D4   , :00426A2A   , :00426B35   , :00446A73   
|
:004442A4 55                      push ebp
:004442A5 A1D0454700              mov eax, dword ptr [004745D0]
:004442AA 8BEC                    mov ebp, esp
:004442AC 85C0                    test eax, eax
:004442AE 56                      push esi
:004442AF 57                      push edi
:004442B0 0F8419010000            je 004443CF
:004442B6 50                      push eax

* Reference To: GDI32.DeleteObject, Ord:0046h
                                  |
:004442B7 FF15BC724700            Call dword ptr [004772BC]
:004442BD E8FF2B0000              call 00446EC1
:004442C2 68480F4700              push 00470F48
:004442C7 FF750C                  push [ebp+0C]
:004442CA FF7508                  push [ebp+08]
:004442CD E8C82A0000              call 00446D9A
:004442D2 83C40C                  add esp, 0000000C
:004442D5 A3D0454700              mov dword ptr [004745D0], eax
:004442DA 6898014700              push 00470198
:004442DF 6800010000              push 00000100
:004442E4 6A00                    push 00000000
:004442E6 50                      push eax

* Reference To: GDI32.GetPaletteEntries, Ord:00E3h
                                  |
:004442E7 FF15E4724700            Call dword ptr [004772E4]
:004442ED 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044431B(C)
|
:004442EF 8A889A014700            mov cl, byte ptr [eax+0047019A]
:004442F5 8A9098014700            mov dl, byte ptr [eax+00470198]
:004442FB 8888480F4700            mov byte ptr [eax+00470F48], cl
:00444301 83C004                  add eax, 00000004
:00444304 3D00040000              cmp eax, 00000400
:00444309 8A8895014700            mov cl, byte ptr [eax+00470195]
:0044430F 8890460F4700            mov byte ptr [eax+00470F46], dl
:00444315 8888450F4700            mov byte ptr [eax+00470F45], cl
:0044431B 7CD2                    jl 004442EF
:0044431D 33FF                    xor edi, edi
:0044431F 393D28444700            cmp dword ptr [00474428], edi
:00444325 742C                    je 00444353
:00444327 393D0C3B4500            cmp dword ptr [00453B0C], edi
:0044432D 7E24                    jle 00444353
:0044432F BE70164700              mov esi, 00471670

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444351(C)
|
:00444334 68480F4700              push 00470F48
:00444339 47                      inc edi
:0044433A 6800010000              push 00000100
:0044433F 6A00                    push 00000000
:00444341 FF36                    push dword ptr [esi]
:00444343 E80F2A0000              call 00446D57
:00444348 83C604                  add esi, 00000004
:0044434B 3B3D0C3B4500            cmp edi, dword ptr [00453B0C]
:00444351 7CE1                    jl 00444334

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00444325(C), :0044432D(C)
|
:00444353 A18C544700              mov eax, dword ptr [0047548C]
:00444358 FF348548134700          push dword ptr [4*eax+00471348]

* Reference To: USER32.GetDC, Ord:00E6h
                                  |
:0044435F FF15A0744700            Call dword ptr [004774A0]
:00444365 8BF0                    mov esi, eax
:00444367 6A00                    push 00000000
:00444369 FF35D0454700            push dword ptr [004745D0]
:0044436F 56                      push esi

* Reference To: GDI32.SelectPalette, Ord:013Dh
                                  |
:00444370 FF15B8724700            Call dword ptr [004772B8]
:00444376 56                      push esi

* Reference To: GDI32.RealizePalette, Ord:0129h
                                  |
:00444377 FF15B4724700            Call dword ptr [004772B4]
:0044437D 85C0                    test eax, eax
:0044437F 7429                    je 004443AA
:00444381 6A01                    push 00000001
:00444383 A18C544700              mov eax, dword ptr [0047548C]
:00444388 6A00                    push 00000000
:0044438A FF348548134700          push dword ptr [4*eax+00471348]

* Reference To: USER32.InvalidateRect, Ord:0148h
                                  |
:00444391 FF15FC734700            Call dword ptr [004773FC]
:00444397 8B0D8C544700            mov ecx, dword ptr [0047548C]
:0044439D FF348D48134700          push dword ptr [4*ecx+00471348]

* Reference To: USER32.UpdateWindow, Ord:0237h
                                  |
:004443A4 FF1500744700            Call dword ptr [00477400]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044437F(C)
|
:004443AA 56                      push esi
:004443AB A18C544700              mov eax, dword ptr [0047548C]
:004443B0 FF348548134700          push dword ptr [4*eax+00471348]

* Reference To: USER32.ReleaseDC, Ord:01B9h
                                  |
:004443B7 FF15A4744700            Call dword ptr [004774A4]
:004443BD 8B4D08                  mov ecx, dword ptr [ebp+08]
:004443C0 8B550C                  mov edx, dword ptr [ebp+0C]
:004443C3 890DC8454700            mov dword ptr [004745C8], ecx
:004443C9 8915B83D4700            mov dword ptr [00473DB8], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004442B0(C)
|
:004443CF 5F                      pop edi
:004443D0 5E                      pop esi
:004443D1 5D                      pop ebp
:004443D2 C3                      ret



* Referenced by a CALL at Addresses:
|:00444EA1   , :00445465   , :00445662   , :004456DD   , :00445713   
|:00445750   , :00445790   , :0044594C   , :00445D3E   
|
:004443D3 55                      push ebp
:004443D4 8B4C2410                mov ecx, dword ptr [esp+10]
:004443D8 8BEC                    mov ebp, esp
:004443DA 83EC04                  sub esp, 00000004
:004443DD 85C9                    test ecx, ecx
:004443DF 53                      push ebx
:004443E0 56                      push esi
:004443E1 57                      push edi
:004443E2 0F84C4000000            je 004444AC
:004443E8 837D1400                cmp dword ptr [ebp+14], 00000000
:004443EC 0F84BA000000            je 004444AC
:004443F2 833DFC3A450000          cmp dword ptr [00453AFC], 00000000
:004443F9 751D                    jne 00444418
:004443FB FF7514                  push [ebp+14]
:004443FE 51                      push ecx
:004443FF FF750C                  push [ebp+0C]
:00444402 FF7508                  push [ebp+08]
:00444405 FF358C544700            push dword ptr [0047548C]
:0044440B E8A3000000              call 004444B3
:00444410 83C414                  add esp, 00000014
:00444413 E994000000              jmp 004444AC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004443F9(C)
|
:00444418 8B158C544700            mov edx, dword ptr [0047548C]
:0044441E C1E202                  shl edx, 02
:00444421 8DB2580A4700            lea esi, dword ptr [edx+00470A58]
:00444427 8B06                    mov eax, dword ptr [esi]
:00444429 85C0                    test eax, eax
:0044442B 750D                    jne 0044443A
:0044442D 8B4508                  mov eax, dword ptr [ebp+08]
:00444430 890E                    mov dword ptr [esi], ecx
:00444432 8982A0054700            mov dword ptr [edx+004705A0], eax
:00444438 EB2B                    jmp 00444465

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044442B(C)
|
:0044443A 8BBAA0054700            mov edi, dword ptr [edx+004705A0]
:00444440 8B5D08                  mov ebx, dword ptr [ebp+08]
:00444443 03D9                    add ebx, ecx
:00444445 03C7                    add eax, edi
:00444447 3BD8                    cmp ebx, eax
:00444449 7E07                    jle 00444452
:0044444B 2BCF                    sub ecx, edi
:0044444D 034D08                  add ecx, dword ptr [ebp+08]
:00444450 890E                    mov dword ptr [esi], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444449(C)
|
:00444452 397D08                  cmp dword ptr [ebp+08], edi
:00444455 7D0E                    jge 00444465
:00444457 2B7D08                  sub edi, dword ptr [ebp+08]
:0044445A 8B4508                  mov eax, dword ptr [ebp+08]
:0044445D 013E                    add dword ptr [esi], edi
:0044445F 8982A0054700            mov dword ptr [edx+004705A0], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00444438(U), :00444455(C)
|
:00444465 8DB2E80B4700            lea esi, dword ptr [edx+00470BE8]
:0044446B 8B06                    mov eax, dword ptr [esi]
:0044446D 85C0                    test eax, eax
:0044446F 7510                    jne 00444481
:00444471 8B7D0C                  mov edi, dword ptr [ebp+0C]
:00444474 8B4514                  mov eax, dword ptr [ebp+14]
:00444477 89BA30074700            mov dword ptr [edx+00470730], edi
:0044447D 8906                    mov dword ptr [esi], eax
:0044447F EB2B                    jmp 004444AC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044446F(C)
|
:00444481 8B8A30074700            mov ecx, dword ptr [edx+00470730]
:00444487 8B7D0C                  mov edi, dword ptr [ebp+0C]
:0044448A 8B5D14                  mov ebx, dword ptr [ebp+14]
:0044448D 03C1                    add eax, ecx
:0044448F 03DF                    add ebx, edi
:00444491 3BD8                    cmp ebx, eax
:00444493 7E09                    jle 0044449E
:00444495 8BC7                    mov eax, edi
:00444497 2BC1                    sub eax, ecx
:00444499 034514                  add eax, dword ptr [ebp+14]
:0044449C 8906                    mov dword ptr [esi], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444493(C)
|
:0044449E 3BF9                    cmp edi, ecx
:004444A0 7D0A                    jge 004444AC
:004444A2 2BCF                    sub ecx, edi
:004444A4 89BA30074700            mov dword ptr [edx+00470730], edi
:004444AA 010E                    add dword ptr [esi], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004443E2(C), :004443EC(C), :00444413(U), :0044447F(U), :004444A0(C)
|
:004444AC 5F                      pop edi
:004444AD 5E                      pop esi
:004444AE 5B                      pop ebx
:004444AF 8BE5                    mov esp, ebp
:004444B1 5D                      pop ebp
:004444B2 C3                      ret



* Referenced by a CALL at Addresses:
|:0044440B   , :004460FA   , :004464BE   , :00446A24   
|
:004444B3 55                      push ebp
:004444B4 8BEC                    mov ebp, esp
:004444B6 81EC00080000            sub esp, 00000800
:004444BC 53                      push ebx
:004444BD 56                      push esi
:004444BE 57                      push edi
:004444BF 33FF                    xor edi, edi
:004444C1 393D103B4500            cmp dword ptr [00453B10], edi
:004444C7 0F85FF000000            jne 004445CC
:004444CD 397D14                  cmp dword ptr [ebp+14], edi
:004444D0 0F84F6000000            je 004445CC
:004444D6 397D18                  cmp dword ptr [ebp+18], edi
:004444D9 0F84ED000000            je 004445CC
:004444DF 8B5D08                  mov ebx, dword ptr [ebp+08]
:004444E2 C1E302                  shl ebx, 02
:004444E5 8DB370164700            lea esi, dword ptr [ebx+00471670]
:004444EB 393E                    cmp dword ptr [esi], edi
:004444ED 0F84D9000000            je 004445CC
:004444F3 393D28444700            cmp dword ptr [00474428], edi
:004444F9 756C                    jne 00444567
:004444FB 8D8500F8FFFF            lea eax, dword ptr [ebp+FFFFF800]
:00444501 50                      push eax
:00444502 6800010000              push 00000100
:00444507 57                      push edi
:00444508 FF35D0454700            push dword ptr [004745D0]

* Reference To: GDI32.GetPaletteEntries, Ord:00E3h
                                  |
:0044450E FF15E4724700            Call dword ptr [004772E4]
:00444514 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444550(C)
|
:00444516 8A8C0502F8FFFF          mov cl, byte ptr [ebp+eax-000007FE]
:0044451D 8A940500F8FFFF          mov dl, byte ptr [ebp+eax-00000800]
:00444524 888C0500FCFFFF          mov byte ptr [ebp+eax-00000400], cl
:0044452B 83C004                  add eax, 00000004
:0044452E 3D00040000              cmp eax, 00000400
:00444533 8A8C05FDF7FFFF          mov cl, byte ptr [ebp+eax-00000803]
:0044453A 889405FEFBFFFF          mov byte ptr [ebp+eax-00000402], dl
:00444541 888C05FDFBFFFF          mov byte ptr [ebp+eax-00000403], cl
:00444548 C68405FFFBFFFF00        mov byte ptr [ebp+eax-00000401], 00
:00444550 7CC4                    jl 00444516
:00444552 8D8500FCFFFF            lea eax, dword ptr [ebp+FFFFFC00]
:00444558 50                      push eax
:00444559 6800010000              push 00000100
:0044455E 6A00                    push 00000000
:00444560 FF36                    push dword ptr [esi]
:00444562 E8F0270000              call 00446D57

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004444F9(C)
|
:00444567 8B83E0144700            mov eax, dword ptr [ebx+004714E0]
:0044456D 394514                  cmp dword ptr [ebp+14], eax
:00444570 7E03                    jle 00444575
:00444572 894514                  mov dword ptr [ebp+14], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444570(C)
|
:00444575 8B83E8FC4600            mov eax, dword ptr [ebx+0046FCE8]
:0044457B 394518                  cmp dword ptr [ebp+18], eax
:0044457E 7E03                    jle 00444583
:00444580 894518                  mov dword ptr [ebp+18], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044457E(C)
|
:00444583 8DBB48134700            lea edi, dword ptr [ebx+00471348]
:00444589 FF37                    push dword ptr [edi]

* Reference To: USER32.GetDC, Ord:00E6h
                                  |
:0044458B FF15A0744700            Call dword ptr [004774A0]
:00444591 8BD8                    mov ebx, eax
:00444593 6A00                    push 00000000
:00444595 A1D0454700              mov eax, dword ptr [004745D0]
:0044459A 50                      push eax
:0044459B 53                      push ebx

* Reference To: GDI32.SelectPalette, Ord:013Dh
                                  |
:0044459C FF15B8724700            Call dword ptr [004772B8]
:004445A2 53                      push ebx

* Reference To: GDI32.RealizePalette, Ord:0129h
                                  |
:004445A3 FF15B4724700            Call dword ptr [004772B4]
:004445A9 FF7510                  push [ebp+10]
:004445AC FF750C                  push [ebp+0C]
:004445AF FF36                    push dword ptr [esi]
:004445B1 FF7518                  push [ebp+18]
:004445B4 FF7514                  push [ebp+14]
:004445B7 FF7510                  push [ebp+10]
:004445BA FF750C                  push [ebp+0C]
:004445BD 53                      push ebx
:004445BE E8AD270000              call 00446D70
:004445C3 53                      push ebx
:004445C4 FF37                    push dword ptr [edi]

* Reference To: USER32.ReleaseDC, Ord:01B9h
                                  |
:004445C6 FF15A4744700            Call dword ptr [004774A4]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004444C7(C), :004444D0(C), :004444D9(C), :004444ED(C)
|
:004445CC 5F                      pop edi
:004445CD 5E                      pop esi
:004445CE 5B                      pop ebx
:004445CF 8BE5                    mov esp, ebp
:004445D1 5D                      pop ebp
:004445D2 C3                      ret



* Referenced by a CALL at Address:
|:0040E8F2   
|
:004445D3 55                      push ebp
:004445D4 8B0D0C3B4500            mov ecx, dword ptr [00453B0C]
:004445DA 8BEC                    mov ebp, esp
:004445DC 890D8C544700            mov dword ptr [0047548C], ecx
:004445E2 C7048DE0144700FFFFFFFF  mov dword ptr [4*ecx+004714E0], FFFFFFFF
:004445ED FF7510                  push [ebp+10]
:004445F0 FF750C                  push [ebp+0C]
:004445F3 8B4508                  mov eax, dword ptr [ebp+08]
:004445F6 89048D48134700          mov dword ptr [4*ecx+00471348], eax
:004445FD E8FB200000              call 004466FD
:00444602 83C408                  add esp, 00000008
:00444605 837D1401                cmp dword ptr [ebp+14], 00000001
:00444609 1BC0                    sbb eax, eax
:0044460B 25FF7F0000              and eax, 00007FFF
:00444610 40                      inc eax
:00444611 50                      push eax
:00444612 FF7510                  push [ebp+10]
:00444615 FF750C                  push [ebp+0C]
:00444618 E8541F0000              call 00446571
:0044461D 83C40C                  add esp, 0000000C
:00444620 A10C3B4500              mov eax, dword ptr [00453B0C]
:00444625 FF050C3B4500            inc dword ptr [00453B0C]
:0044462B 5D                      pop ebp
:0044462C C3                      ret



* Referenced by a CALL at Addresses:
|:00444BD7   , :00444BEE   , :00446746   
|
:0044462D 8B442404                mov eax, dword ptr [esp+04]
:00444631 81EC28040000            sub esp, 00000428
:00444637 3B050C3B4500            cmp eax, dword ptr [00453B0C]
:0044463D 7D1B                    jge 0044465A
:0044463F 8D4C2400                lea ecx, dword ptr [esp]
:00444643 A38C544700              mov dword ptr [0047548C], eax
:00444648 51                      push ecx
:00444649 FF348500184700          push dword ptr [4*eax+00471800]
:00444650 E8E6260000              call 00446D3B
:00444655 A3B01C4700              mov dword ptr [00471CB0], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044463D(C)
|
:0044465A 81C428040000            add esp, 00000428
:00444660 C3                      ret



* Referenced by a CALL at Addresses:
|:0044672F   , :0044791A   , :00447944   
|
:00444661 81ECFC040000            sub esp, 000004FC
:00444667 833D7016470000          cmp dword ptr [00471670], 00000000
:0044466E 53                      push ebx
:0044466F 56                      push esi
:00444670 57                      push edi
:00444671 55                      push ebp
:00444672 0F8506020000            jne 0044487E
:00444678 33FF                    xor edi, edi
:0044467A 393D0C3B4500            cmp dword ptr [00453B0C], edi
:00444680 7E49                    jle 004446CB
:00444682 33DB                    xor ebx, ebx
:00444684 33F6                    xor esi, esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004446C9(C)
|
:00444686 8DAB70164700            lea ebp, dword ptr [ebx+00471670]
:0044468C 89B308004700            mov dword ptr [ebx+00470008], esi
:00444692 FFB3E8FC4600            push dword ptr [ebx+0046FCE8]
:00444698 FFB3E0144700            push dword ptr [ebx+004714E0]
:0044469E 57                      push edi
:0044469F E8B1200000              call 00446755
:004446A4 83C40C                  add esp, 0000000C
:004446A7 894500                  mov dword ptr [ebp+00], eax
:004446AA 85C0                    test eax, eax
:004446AC 0F84D9010000            je 0044488B
:004446B2 FFB300184700            push dword ptr [ebx+00471800]
:004446B8 83C304                  add ebx, 00000004
:004446BB 47                      inc edi
:004446BC 50                      push eax

* Reference To: GDI32.SelectObject, Ord:013Ch
                                  |
:004446BD FF1508734700            Call dword ptr [00477308]
:004446C3 3B3D0C3B4500            cmp edi, dword ptr [00453B0C]
:004446C9 7CBB                    jl 00444686

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444680(C)
|
:004446CB 8D8424E4000000          lea eax, dword ptr [esp+000000E4]
:004446D2 33F6                    xor esi, esi
:004446D4 50                      push eax
:004446D5 FF3500184700            push dword ptr [00471800]
:004446DB E85B260000              call 00446D3B
:004446E0 A3B01C4700              mov dword ptr [00471CB0], eax
:004446E5 E8A8010000              call 00444892
:004446EA 39350C3B4500            cmp dword ptr [00453B0C], esi
:004446F0 7E24                    jle 00444716
:004446F2 BF70164700              mov edi, 00471670

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444714(C)
|
:004446F7 68480F4700              push 00470F48
:004446FC 46                      inc esi
:004446FD 6800010000              push 00000100
:00444702 6A00                    push 00000000
:00444704 FF37                    push dword ptr [edi]
:00444706 E84C260000              call 00446D57
:0044470B 83C704                  add edi, 00000004
:0044470E 3B350C3B4500            cmp esi, dword ptr [00453B0C]
:00444714 7CE1                    jl 004446F7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004446F0(C)
|

* Possible StringData Ref from Data Obj ->""
                                  |
:00444716 68183B4500              push 00453B18
:0044471B 33DB                    xor ebx, ebx
:0044471D 53                      push ebx
:0044471E 53                      push ebx
:0044471F 53                      push ebx
:00444720 53                      push ebx
:00444721 6886000000              push 00000086
:00444726 53                      push ebx
:00444727 53                      push ebx
:00444728 53                      push ebx
:00444729 53                      push ebx
:0044472A 53                      push ebx
:0044472B 53                      push ebx
:0044472C 6A08                    push 00000008
:0044472E 6AF0                    push FFFFFFF0
:00444730 BE01000000              mov esi, 00000001

* Reference To: GDI32.CreateFontA, Ord:002Bh
                                  |
:00444735 FF15F8724700            Call dword ptr [004772F8]
:0044473B 668935140F4700          mov word ptr [00470F14], si
:00444742 A330444700              mov dword ptr [00474430], eax
:00444747 668935160F4700          mov word ptr [00470F16], si
:0044474E 891D180F4700            mov dword ptr [00470F18], ebx
:00444754 891D1C0F4700            mov dword ptr [00470F1C], ebx
:0044475A 891D200F4700            mov dword ptr [00470F20], ebx
:00444760 891D240F4700            mov dword ptr [00470F24], ebx
:00444766 891D280F4700            mov dword ptr [00470F28], ebx
:0044476C 891D2C0F4700            mov dword ptr [00470F2C], ebx
:00444772 881D320F4700            mov byte ptr [00470F32], bl
:00444778 881D300F4700            mov byte ptr [00470F30], bl
:0044477E 881D310F4700            mov byte ptr [00470F31], bl
:00444784 C705080F470028000000    mov dword ptr [00470F08], 00000028
:0044478E C7050C0F470020000000    mov dword ptr [00470F0C], 00000020
:00444798 C705100F470010000000    mov dword ptr [00470F10], 00000010
:004447A2 8D442410                lea eax, dword ptr [esp+10]
:004447A6 6A40                    push 00000040
:004447A8 C605360F4700FF          mov byte ptr [00470F36], FF
:004447AF C605340F4700FF          mov byte ptr [00470F34], FF
:004447B6 C605350F4700FF          mov byte ptr [00470F35], FF
:004447BD 53                      push ebx
:004447BE 50                      push eax
:004447BF E86C3E0000              call 00448630
:004447C4 83C40C                  add esp, 0000000C
:004447C7 A148134700              mov eax, dword ptr [00471348]
:004447CC 50                      push eax

* Reference To: USER32.GetDC, Ord:00E6h
                                  |
:004447CD FF15A0744700            Call dword ptr [004774A0]
:004447D3 50                      push eax
:004447D4 8BF8                    mov edi, eax

* Reference To: GDI32.CreateCompatibleDC, Ord:001Fh
                                  |
:004447D6 FF15FC724700            Call dword ptr [004772FC]
:004447DC 8D4C2410                lea ecx, dword ptr [esp+10]
:004447E0 53                      push ebx
:004447E1 A374374700              mov dword ptr [00473774], eax
:004447E6 B8080F4700              mov eax, 00470F08
:004447EB 50                      push eax
:004447EC 51                      push ecx
:004447ED 6A04                    push 00000004
:004447EF 50                      push eax
:004447F0 57                      push edi

* Reference To: GDI32.CreateDIBitmap, Ord:0025h
                                  |
:004447F1 FF1500734700            Call dword ptr [00477300]
:004447F7 50                      push eax
:004447F8 A398054700              mov dword ptr [00470598], eax
:004447FD FF3574374700            push dword ptr [00473774]

* Reference To: GDI32.SelectObject, Ord:013Ch
                                  |
:00444803 FF1508734700            Call dword ptr [00477308]
:00444809 56                      push esi
:0044480A A3E0FC4600              mov dword ptr [0046FCE0], eax
:0044480F FF3574374700            push dword ptr [00473774]

* Reference To: GDI32.SetMapMode, Ord:0152h
                                  |
:00444815 FF1504734700            Call dword ptr [00477304]
:0044481B FF3530444700            push dword ptr [00474430]
:00444821 FF3574374700            push dword ptr [00473774]
:00444827 A3E4FC4600              mov dword ptr [0046FCE4], eax

* Reference To: GDI32.SelectObject, Ord:013Ch
                                  |
:0044482C FF1508734700            Call dword ptr [00477308]
:00444832 6890544700              push 00475490
:00444837 A3500A4700              mov dword ptr [00470A50], eax
:0044483C FF3574374700            push dword ptr [00473774]

* Reference To: GDI32.GetTextMetricsA, Ord:00FFh
                                  |
:00444842 FF15E0724700            Call dword ptr [004772E0]
:00444848 57                      push edi
:00444849 FF3548134700            push dword ptr [00471348]

* Reference To: USER32.ReleaseDC, Ord:01B9h
                                  |
:0044484F FF15A4744700            Call dword ptr [004774A4]
:00444855 C744245094000000        mov [esp+50], 00000094
:0044485D 8D442450                lea eax, dword ptr [esp+50]
:00444861 50                      push eax

* Reference To: KERNEL32.GetVersionExA, Ord:0138h
                                  |
:00444862 FF156C734700            Call dword ptr [0047736C]
:00444868 8B442460                mov eax, dword ptr [esp+60]
:0044486C 891D8C544700            mov dword ptr [0047548C], ebx
:00444872 48                      dec eax
:00444873 3BC6                    cmp eax, esi
:00444875 1BC0                    sbb eax, eax
:00444877 F7D8                    neg eax
:00444879 A328444700              mov dword ptr [00474428], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444672(C)
|
:0044487E 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444890(U)
|
:00444880 5D                      pop ebp
:00444881 5F                      pop edi
:00444882 5E                      pop esi
:00444883 5B                      pop ebx
:00444884 81C4FC040000            add esp, 000004FC
:0044488A C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004446AC(C)
|
:0044488B B8FFFFFFFF              mov eax, FFFFFFFF
:00444890 EBEE                    jmp 00444880

* Referenced by a CALL at Address:
|:004446E5   
|
:00444892 53                      push ebx
:00444893 33D2                    xor edx, edx
:00444895 56                      push esi
:00444896 B8480F4700              mov eax, 00470F48
:0044489B 33DB                    xor ebx, ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004448F4(C)
|
:0044489D 8810                    mov byte ptr [eax], dl
:0044489F 8ACA                    mov cl, dl
:004448A1 884802                  mov byte ptr [eax+02], cl
:004448A4 83C020                  add eax, 00000020
:004448A7 83C208                  add edx, 00000008
:004448AA 8848E1                  mov byte ptr [eax-1F], cl
:004448AD 3D48134700              cmp eax, 00471348
:004448B2 8D4AFF                  lea ecx, dword ptr [edx-01]
:004448B5 8848E4                  mov byte ptr [eax-1C], cl
:004448B8 8858E6                  mov byte ptr [eax-1A], bl
:004448BB 8858E5                  mov byte ptr [eax-1B], bl
:004448BE 8858E8                  mov byte ptr [eax-18], bl
:004448C1 8848EA                  mov byte ptr [eax-16], cl
:004448C4 8858E9                  mov byte ptr [eax-17], bl
:004448C7 8848EC                  mov byte ptr [eax-14], cl
:004448CA 8848EE                  mov byte ptr [eax-12], cl
:004448CD 8858ED                  mov byte ptr [eax-13], bl
:004448D0 8858F0                  mov byte ptr [eax-10], bl
:004448D3 8858F2                  mov byte ptr [eax-0E], bl
:004448D6 8848F1                  mov byte ptr [eax-0F], cl
:004448D9 8848F4                  mov byte ptr [eax-0C], cl
:004448DC 8858F6                  mov byte ptr [eax-0A], bl
:004448DF 8848F5                  mov byte ptr [eax-0B], cl
:004448E2 8858F8                  mov byte ptr [eax-08], bl
:004448E5 8848FA                  mov byte ptr [eax-06], cl
:004448E8 8848F9                  mov byte ptr [eax-07], cl
:004448EB 8848FC                  mov byte ptr [eax-04], cl
:004448EE 8848FE                  mov byte ptr [eax-02], cl
:004448F1 8848FD                  mov byte ptr [eax-03], cl
:004448F4 72A7                    jb 0044489D
:004448F6 33DB                    xor ebx, ebx
:004448F8 B8A0000000              mov eax, 000000A0
:004448FD 881D880F4700            mov byte ptr [00470F88], bl
:00444903 881D8A0F4700            mov byte ptr [00470F8A], bl
:00444909 881D890F4700            mov byte ptr [00470F89], bl
:0044490F A28C0F4700              mov byte ptr [00470F8C], al
:00444914 881D8E0F4700            mov byte ptr [00470F8E], bl
:0044491A 881D8D0F4700            mov byte ptr [00470F8D], bl
:00444920 881D900F4700            mov byte ptr [00470F90], bl
:00444926 A2920F4700              mov byte ptr [00470F92], al
:0044492B 881D910F4700            mov byte ptr [00470F91], bl
:00444931 A2940F4700              mov byte ptr [00470F94], al
:00444936 A2960F4700              mov byte ptr [00470F96], al
:0044493B 881D950F4700            mov byte ptr [00470F95], bl
:00444941 881D980F4700            mov byte ptr [00470F98], bl
:00444947 881D9A0F4700            mov byte ptr [00470F9A], bl
:0044494D A2990F4700              mov byte ptr [00470F99], al
:00444952 A29C0F4700              mov byte ptr [00470F9C], al
:00444957 881D9E0F4700            mov byte ptr [00470F9E], bl
:0044495D A29D0F4700              mov byte ptr [00470F9D], al
:00444962 881DA00F4700            mov byte ptr [00470FA0], bl
:00444968 A2A20F4700              mov byte ptr [00470FA2], al
:0044496D A2A10F4700              mov byte ptr [00470FA1], al
:00444972 A2A40F4700              mov byte ptr [00470FA4], al
:00444977 A2A60F4700              mov byte ptr [00470FA6], al
:0044497C A2A50F4700              mov byte ptr [00470FA5], al
:00444981 B8FF000000              mov eax, 000000FF
:00444986 C605A80F470080          mov byte ptr [00470FA8], 80
:0044498D C605AA0F470080          mov byte ptr [00470FAA], 80
:00444994 C605A90F470080          mov byte ptr [00470FA9], 80
:0044499B A2AC0F4700              mov byte ptr [00470FAC], al
:004449A0 881DAE0F4700            mov byte ptr [00470FAE], bl
:004449A6 881DAD0F4700            mov byte ptr [00470FAD], bl
:004449AC 881DB00F4700            mov byte ptr [00470FB0], bl
:004449B2 A2B20F4700              mov byte ptr [00470FB2], al
:004449B7 881DB10F4700            mov byte ptr [00470FB1], bl
:004449BD A2B40F4700              mov byte ptr [00470FB4], al
:004449C2 A2B60F4700              mov byte ptr [00470FB6], al
:004449C7 881DB50F4700            mov byte ptr [00470FB5], bl
:004449CD 881DB80F4700            mov byte ptr [00470FB8], bl
:004449D3 881DBA0F4700            mov byte ptr [00470FBA], bl
:004449D9 A2B90F4700              mov byte ptr [00470FB9], al
:004449DE A2BC0F4700              mov byte ptr [00470FBC], al
:004449E3 881DBE0F4700            mov byte ptr [00470FBE], bl
:004449E9 A2BD0F4700              mov byte ptr [00470FBD], al
:004449EE 881DC00F4700            mov byte ptr [00470FC0], bl
:004449F4 A2C20F4700              mov byte ptr [00470FC2], al
:004449F9 BE00010000              mov esi, 00000100
:004449FE A2C10F4700              mov byte ptr [00470FC1], al
:00444A03 A2C40F4700              mov byte ptr [00470FC4], al
:00444A08 A2C60F4700              mov byte ptr [00470FC6], al
:00444A0D A2C50F4700              mov byte ptr [00470FC5], al
:00444A12 E8AA240000              call 00446EC1
:00444A17 68480F4700              push 00470F48
:00444A1C 56                      push esi
:00444A1D 53                      push ebx
:00444A1E E877230000              call 00446D9A
:00444A23 83C40C                  add esp, 0000000C
:00444A26 A3D0454700              mov dword ptr [004745D0], eax
:00444A2B 6898014700              push 00470198
:00444A30 56                      push esi
:00444A31 53                      push ebx
:00444A32 50                      push eax

* Reference To: GDI32.GetPaletteEntries, Ord:00E3h
                                  |
:00444A33 FF15E4724700            Call dword ptr [004772E4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444A6D(C)
|
:00444A39 8A839A014700            mov al, byte ptr [ebx+0047019A]
:00444A3F 8A8B98014700            mov cl, byte ptr [ebx+00470198]
:00444A45 8A9399014700            mov dl, byte ptr [ebx+00470199]
:00444A4B 8883480F4700            mov byte ptr [ebx+00470F48], al
:00444A51 888B4A0F4700            mov byte ptr [ebx+00470F4A], cl
:00444A57 83C304                  add ebx, 00000004
:00444A5A 81FB00040000            cmp ebx, 00000400
:00444A60 8893450F4700            mov byte ptr [ebx+00470F45], dl
:00444A66 C683470F470000          mov byte ptr [ebx+00470F47], 00
:00444A6D 7CCA                    jl 00444A39
:00444A6F C705C845470000000000    mov dword ptr [004745C8], 00000000
:00444A79 C705B83D470000010000    mov dword ptr [00473DB8], 00000100
:00444A83 5E                      pop esi
:00444A84 5B                      pop ebx
:00444A85 C3                      ret



* Referenced by a CALL at Address:
|:00447A8E   
|
:00444A86 83EC04                  sub esp, 00000004
:00444A89 833D0C3B450000          cmp dword ptr [00453B0C], 00000000
:00444A90 53                      push ebx
:00444A91 56                      push esi
:00444A92 57                      push edi
:00444A93 55                      push ebp
:00444A94 0F8E0E010000            jle 00444BA8
:00444A9A 33ED                    xor ebp, ebp
:00444A9C 33DB                    xor ebx, ebx
:00444A9E 8B150C3B4500            mov edx, dword ptr [00453B0C]
:00444AA4 BFD8454700              mov edi, 004745D8
:00444AA9 B80F000000              mov eax, 0000000F
:00444AAE 8BCA                    mov ecx, edx
:00444AB0 C744241090194700        mov [esp+10], 00471990
:00444AB8 F3                      repz
:00444AB9 AB                      stosd
:00444ABA BF983A4700              mov edi, 00473A98
:00444ABF B810000000              mov eax, 00000010
:00444AC4 8BCA                    mov ecx, edx
:00444AC6 F3                      repz
:00444AC7 AB                      stosd
:00444AC8 BF283C4700              mov edi, 00473C28
:00444ACD BE1F000000              mov esi, 0000001F
:00444AD2 8BC6                    mov eax, esi
:00444AD4 8BCA                    mov ecx, edx
:00444AD6 F3                      repz
:00444AD7 AB                      stosd
:00444AD8 BF48344700              mov edi, 00473448
:00444ADD B810000000              mov eax, 00000010
:00444AE2 8BCA                    mov ecx, edx
:00444AE4 F3                      repz
:00444AE5 AB                      stosd
:00444AE6 BFD8354700              mov edi, 004735D8
:00444AEB 8BC6                    mov eax, esi
:00444AED 8BCA                    mov ecx, edx
:00444AEF F3                      repz
:00444AF0 AB                      stosd
:00444AF1 BFC0084700              mov edi, 004708C0
:00444AF6 33C0                    xor eax, eax
:00444AF8 8BCA                    mov ecx, edx
:00444AFA F3                      repz
:00444AFB AB                      stosd
:00444AFC BF780D4700              mov edi, 00470D78
:00444B01 8BCA                    mov ecx, edx
:00444B03 F3                      repz
:00444B04 AB                      stosd
:00444B05 BF78374700              mov edi, 00473778
:00444B0A B804000000              mov eax, 00000004
:00444B0F 8BCA                    mov ecx, edx
:00444B11 F3                      repz
:00444B12 AB                      stosd
:00444B13 BF78FE4600              mov edi, 0046FE78
:00444B18 B803000000              mov eax, 00000003
:00444B1D 8BCA                    mov ecx, edx
:00444B1F F3                      repz
:00444B20 AB                      stosd
:00444B21 BF580A4700              mov edi, 00470A58
:00444B26 33C0                    xor eax, eax
:00444B28 8BCA                    mov ecx, edx
:00444B2A F3                      repz
:00444B2B AB                      stosd
:00444B2C BFE80B4700              mov edi, 00470BE8
:00444B31 8BCA                    mov ecx, edx
:00444B33 F3                      repz
:00444B34 AB                      stosd
:00444B35 BEE8FC4600              mov esi, 0046FCE8
:00444B3A BF30074700              mov edi, 00470730
:00444B3F 8BCA                    mov ecx, edx
:00444B41 F3                      repz
:00444B42 A5                      movsd
:00444B43 BEE0144700              mov esi, 004714E0
:00444B48 BFA0054700              mov edi, 004705A0
:00444B4D 8BCA                    mov ecx, edx
:00444B4F F3                      repz
:00444B50 A5                      movsd
:00444B51 33F6                    xor esi, esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444BA6(C)
|
:00444B53 8B8DE8FC4600            mov ecx, dword ptr [ebp+0046FCE8]
:00444B59 8B85E0144700            mov eax, dword ptr [ebp+004714E0]
:00444B5F 89B3EC3D4700            mov dword ptr [ebx+00473DEC], esi
:00444B65 89B3D4544700            mov dword ptr [ebx+004754D4], esi
:00444B6B 89B3E83D4700            mov dword ptr [ebx+00473DE8], esi
:00444B71 89B3D0544700            mov dword ptr [ebx+004754D0], esi
:00444B77 49                      dec ecx
:00444B78 48                      dec eax
:00444B79 898BF43D4700            mov dword ptr [ebx+00473DF4], ecx
:00444B7F 898BDC544700            mov dword ptr [ebx+004754DC], ecx
:00444B85 8983F03D4700            mov dword ptr [ebx+00473DF0], eax
:00444B8B 8983D8544700            mov dword ptr [ebx+004754D8], eax
:00444B91 8B4C2410                mov ecx, dword ptr [esp+10]
:00444B95 83C504                  add ebp, 00000004
:00444B98 8344241008              add dword ptr [esp+10], 00000008
:00444B9D 83C310                  add ebx, 00000010
:00444BA0 8931                    mov dword ptr [ecx], esi
:00444BA2 4A                      dec edx
:00444BA3 897104                  mov dword ptr [ecx+04], esi
:00444BA6 75AB                    jne 00444B53

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444A94(C)
|
:00444BA8 33F6                    xor esi, esi
:00444BAA 8B3D8C544700            mov edi, dword ptr [0047548C]
:00444BB0 8935CC454700            mov dword ptr [004745CC], esi
:00444BB6 8935D8144700            mov dword ptr [004714D8], esi
:00444BBC 8935003B4500            mov dword ptr [00453B00], esi
:00444BC2 8935043B4500            mov dword ptr [00453B04], esi
:00444BC8 8935083B4500            mov dword ptr [00453B08], esi
:00444BCE 39350C3B4500            cmp dword ptr [00453B0C], esi
:00444BD4 7E17                    jle 00444BED

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444BEB(C)
|
:00444BD6 56                      push esi
:00444BD7 E851FAFFFF              call 0044462D
:00444BDC 83C404                  add esp, 00000004
:00444BDF 46                      inc esi
:00444BE0 E878020000              call 00444E5D
:00444BE5 3B350C3B4500            cmp esi, dword ptr [00453B0C]
:00444BEB 7CE9                    jl 00444BD6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444BD4(C)
|
:00444BED 57                      push edi
:00444BEE E83AFAFFFF              call 0044462D
:00444BF3 83C404                  add esp, 00000004
:00444BF6 A148134700              mov eax, dword ptr [00471348]
:00444BFB 6A05                    push 00000005
:00444BFD 50                      push eax

* Reference To: USER32.ShowWindow, Ord:0216h
                                  |
:00444BFE FF152C744700            Call dword ptr [0047742C]
:00444C04 5D                      pop ebp
:00444C05 5F                      pop edi
:00444C06 5E                      pop esi
:00444C07 5B                      pop ebx
:00444C08 83C404                  add esp, 00000004
:00444C0B C3                      ret



* Referenced by a CALL at Addresses:
|:0044672A   , :0044692E   , :00447A40   
|
:00444C0C 56                      push esi
:00444C0D 57                      push edi
:00444C0E 33F6                    xor esi, esi
:00444C10 393570164700            cmp dword ptr [00471670], esi
:00444C16 747D                    je 00444C95
:00444C18 39350C3B4500            cmp dword ptr [00453B0C], esi
:00444C1E 7E1B                    jle 00444C3B
:00444C20 33FF                    xor edi, edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444C39(C)
|
:00444C22 56                      push esi
:00444C23 E8F11B0000              call 00446819
:00444C28 893CB570164700          mov dword ptr [4*esi+00471670], edi
:00444C2F 83C404                  add esp, 00000004
:00444C32 46                      inc esi
:00444C33 3B350C3B4500            cmp esi, dword ptr [00453B0C]
:00444C39 7CE7                    jl 00444C22

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444C1E(C)
|
:00444C3B A1E4FC4600              mov eax, dword ptr [0046FCE4]
:00444C40 50                      push eax
:00444C41 FF3574374700            push dword ptr [00473774]

* Reference To: GDI32.SetMapMode, Ord:0152h
                                  |
:00444C47 FF1504734700            Call dword ptr [00477304]
:00444C4D FF35500A4700            push dword ptr [00470A50]
:00444C53 FF3574374700            push dword ptr [00473774]

* Reference To: GDI32.SelectObject, Ord:013Ch
                                  |
:00444C59 FF1508734700            Call dword ptr [00477308]
:00444C5F FF35E0FC4600            push dword ptr [0046FCE0]
:00444C65 FF3574374700            push dword ptr [00473774]

* Reference To: GDI32.SelectObject, Ord:013Ch
                                  |
:00444C6B FF1508734700            Call dword ptr [00477308]
:00444C71 FF3598054700            push dword ptr [00470598]

* Reference To: GDI32.DeleteObject, Ord:0046h
                                  |
:00444C77 FF15BC724700            Call dword ptr [004772BC]
:00444C7D FF3574374700            push dword ptr [00473774]

* Reference To: GDI32.DeleteDC, Ord:0043h
                                  |
:00444C83 FF15F4724700            Call dword ptr [004772F4]
:00444C89 FF3530444700            push dword ptr [00474430]

* Reference To: GDI32.DeleteObject, Ord:0046h
                                  |
:00444C8F FF15BC724700            Call dword ptr [004772BC]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444C16(C)
|
:00444C95 A1D0454700              mov eax, dword ptr [004745D0]
:00444C9A 33F6                    xor esi, esi
:00444C9C 85C0                    test eax, eax
:00444C9E 740D                    je 00444CAD
:00444CA0 50                      push eax

* Reference To: GDI32.DeleteObject, Ord:0046h
                                  |
:00444CA1 FF15BC724700            Call dword ptr [004772BC]
:00444CA7 8935D0454700            mov dword ptr [004745D0], esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444C9E(C)
|
:00444CAD 5F                      pop edi
:00444CAE 5E                      pop esi
:00444CAF C3                      ret



* Referenced by a CALL at Address:
|:00447A9F   
|
:00444CB0 A18C544700              mov eax, dword ptr [0047548C]
:00444CB5 8B542404                mov edx, dword ptr [esp+04]
:00444CB9 8B0C85E0144700          mov ecx, dword ptr [4*eax+004714E0]
:00444CC0 890A                    mov dword ptr [edx], ecx
:00444CC2 8B542408                mov edx, dword ptr [esp+08]
:00444CC6 A18C544700              mov eax, dword ptr [0047548C]
:00444CCB 8B0C85E8FC4600          mov ecx, dword ptr [4*eax+0046FCE8]
:00444CD2 890A                    mov dword ptr [edx], ecx
:00444CD4 C3                      ret



* Referenced by a CALL at Addresses:
|:0040F2D5   , :00426D2B   , :00426DD2   , :00426F25   , :00426FEE   
|:00427024   , :00427218   , :00436CDD   , :0043F462   , :0043F4C8   
|:00447B00   
|
:00444CD5 53                      push ebx
:00444CD6 A18C544700              mov eax, dword ptr [0047548C]
:00444CDB 8B5C2408                mov ebx, dword ptr [esp+08]
:00444CDF 891C8578FE4600          mov dword ptr [4*eax+0046FE78], ebx
:00444CE6 83FB03                  cmp ebx, 00000003
:00444CE9 7F12                    jg 00444CFD
:00444CEB BA0F000000              mov edx, 0000000F
:00444CF0 B103                    mov cl, 03
:00444CF2 2ACB                    sub cl, bl
:00444CF4 D3FA                    sar edx, cl
:00444CF6 891485D8454700          mov dword ptr [4*eax+004745D8], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444CE9(C)
|
:00444CFD 5B                      pop ebx
:00444CFE C3                      ret



* Referenced by a CALL at Addresses:
|:0040EFF1   , :00412B72   , :00412DCD   , :00412E56   , :00412F2C   
|:004133F6   , :00427034   , :00427085   , :0043404C   , :004348EB   
|:00434949   , :00435BC0   , :00435CAE   , :00435CE7   , :0043B96D   
|:0043D2D9   , :0043D303   , :0043F4D6   , :00440311   
|
:00444CFF 55                      push ebp
:00444D00 8B0D8C544700            mov ecx, dword ptr [0047548C]
:00444D06 C1E102                  shl ecx, 02
:00444D09 8BEC                    mov ebp, esp
:00444D0B 8B5508                  mov edx, dword ptr [ebp+08]
:00444D0E 8B450C                  mov eax, dword ptr [ebp+0C]
:00444D11 83B978FE460003          cmp dword ptr [ecx+0046FE78], 00000003
:00444D18 8991780D4700            mov dword ptr [ecx+00470D78], edx
:00444D1E 7F1D                    jg 00444D3D
:00444D20 83E00F                  and eax, 0000000F
:00444D23 83C010                  add eax, 00000010
:00444D26 8981D8354700            mov dword ptr [ecx+004735D8], eax
:00444D2C 8B4510                  mov eax, dword ptr [ebp+10]
:00444D2F 83E00F                  and eax, 0000000F
:00444D32 83C010                  add eax, 00000010
:00444D35 898148344700            mov dword ptr [ecx+00473448], eax
:00444D3B EB0F                    jmp 00444D4C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444D1E(C)
|
:00444D3D 8B5510                  mov edx, dword ptr [ebp+10]
:00444D40 8981D8354700            mov dword ptr [ecx+004735D8], eax
:00444D46 899148344700            mov dword ptr [ecx+00473448], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444D3B(U)
|
:00444D4C 5D                      pop ebp
:00444D4D C3                      ret



* Referenced by a CALL at Addresses:
|:0041FD0B   , :0041FE1E   , :0041FEAF   , :00420711   , :00420876   
|:004208CF   , :0042091B   , :0042096B   , :00447BC2   
|
:00444D4E 55                      push ebp
:00444D4F 8B0D8C544700            mov ecx, dword ptr [0047548C]
:00444D55 C1E102                  shl ecx, 02
:00444D58 8BEC                    mov ebp, esp
:00444D5A 8B5508                  mov edx, dword ptr [ebp+08]
:00444D5D 8B450C                  mov eax, dword ptr [ebp+0C]
:00444D60 83B978FE460003          cmp dword ptr [ecx+0046FE78], 00000003
:00444D67 8991C0084700            mov dword ptr [ecx+004708C0], edx
:00444D6D 7F1D                    jg 00444D8C
:00444D6F 83E00F                  and eax, 0000000F
:00444D72 83C010                  add eax, 00000010
:00444D75 8981283C4700            mov dword ptr [ecx+00473C28], eax
:00444D7B 8B4510                  mov eax, dword ptr [ebp+10]
:00444D7E 83E00F                  and eax, 0000000F
:00444D81 83C010                  add eax, 00000010
:00444D84 8981983A4700            mov dword ptr [ecx+00473A98], eax
:00444D8A EB0F                    jmp 00444D9B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444D6D(C)
|
:00444D8C 8B5510                  mov edx, dword ptr [ebp+10]
:00444D8F 8981283C4700            mov dword ptr [ecx+00473C28], eax
:00444D95 8991983A4700            mov dword ptr [ecx+00473A98], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444D8A(U)
|
:00444D9B 5D                      pop ebp
:00444D9C C3                      ret



* Referenced by a CALL at Addresses:
|:004136B6   , :004137CA   , :00422061   , :0042213E   , :0043D2C9   
|:0043D319   
|
:00444D9D 53                      push ebx
:00444D9E 8B0D8C544700            mov ecx, dword ptr [0047548C]
:00444DA4 56                      push esi
:00444DA5 8BD1                    mov edx, ecx
:00444DA7 C1E204                  shl edx, 04
:00444DAA 57                      push edi
:00444DAB 8B3CCD90194700          mov edi, dword ptr [8*ecx+00471990]
:00444DB2 8B442410                mov eax, dword ptr [esp+10]
:00444DB6 8D9AD0544700            lea ebx, dword ptr [edx+004754D0]
:00444DBC 03C7                    add eax, edi
:00444DBE BE00000000              mov esi, 00000000
:00444DC3 8903                    mov dword ptr [ebx], eax
:00444DC5 7902                    jns 00444DC9
:00444DC7 8933                    mov dword ptr [ebx], esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444DC5(C)
|
:00444DC9 8D9AD8544700            lea ebx, dword ptr [edx+004754D8]
:00444DCF 8B442418                mov eax, dword ptr [esp+18]
:00444DD3 03C7                    add eax, edi
:00444DD5 8B348DE0144700          mov esi, dword ptr [4*ecx+004714E0]
:00444DDC 4E                      dec esi
:00444DDD 8903                    mov dword ptr [ebx], eax
:00444DDF 3BF0                    cmp esi, eax
:00444DE1 7D02                    jge 00444DE5
:00444DE3 8933                    mov dword ptr [ebx], esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444DE1(C)
|
:00444DE5 8D9AD4544700            lea ebx, dword ptr [edx+004754D4]
:00444DEB 8B3CCD94194700          mov edi, dword ptr [8*ecx+00471994]
:00444DF2 8B442414                mov eax, dword ptr [esp+14]
:00444DF6 BE00000000              mov esi, 00000000
:00444DFB 03C7                    add eax, edi
:00444DFD 8903                    mov dword ptr [ebx], eax
:00444DFF 7902                    jns 00444E03
:00444E01 8933                    mov dword ptr [ebx], esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444DFF(C)
|
:00444E03 8DB2DC544700            lea esi, dword ptr [edx+004754DC]
:00444E09 8B048DE8FC4600          mov eax, dword ptr [4*ecx+0046FCE8]
:00444E10 8B54241C                mov edx, dword ptr [esp+1C]
:00444E14 48                      dec eax
:00444E15 03D7                    add edx, edi
:00444E17 8916                    mov dword ptr [esi], edx
:00444E19 3BC2                    cmp eax, edx
:00444E1B 7D02                    jge 00444E1F
:00444E1D 8906                    mov dword ptr [esi], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444E1B(C)
|
:00444E1F 5F                      pop edi
:00444E20 5E                      pop esi
:00444E21 5B                      pop ebx
:00444E22 C3                      ret



* Referenced by a CALL at Addresses:
|:00445009   , :00445132   , :00445375   , :004454BC   , :00445847   
|:004459C8   , :00445B5B   
|
:00444E23 A18C544700              mov eax, dword ptr [0047548C]
:00444E28 C1E002                  shl eax, 02
:00444E2B 83B83844470000          cmp dword ptr [eax+00474438], 00000000
:00444E32 7C0F                    jl 00444E43
:00444E34 8B88E8FC4600            mov ecx, dword ptr [eax+0046FCE8]
:00444E3A 2B4C2408                sub ecx, dword ptr [esp+08]
:00444E3E 83C10F                  add ecx, 0000000F
:00444E41 EB04                    jmp 00444E47

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444E32(C)
|
:00444E43 8B4C2408                mov ecx, dword ptr [esp+08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444E41(U)
|
:00444E47 8B90E0144700            mov edx, dword ptr [eax+004714E0]
:00444E4D 8B442404                mov eax, dword ptr [esp+04]
:00444E51 0FAFD1                  imul edx, ecx
:00444E54 0315B01C4700            add edx, dword ptr [00471CB0]
:00444E5A 03C2                    add eax, edx
:00444E5C C3                      ret



* Referenced by a CALL at Addresses:
|:00427068   , :00444BE0   , :00447A35   
|
:00444E5D 8B0D8C544700            mov ecx, dword ptr [0047548C]
:00444E63 A1B01C4700              mov eax, dword ptr [00471CB0]
:00444E68 C1E102                  shl ecx, 02
:00444E6B FFB178FE4600            push dword ptr [ecx+0046FE78]
:00444E71 50                      push eax
:00444E72 8B81E8FC4600            mov eax, dword ptr [ecx+0046FCE8]
:00444E78 83C010                  add eax, 00000010
:00444E7B 50                      push eax
:00444E7C FFB1E0144700            push dword ptr [ecx+004714E0]
:00444E82 E8C7200000              call 00446F4E
:00444E87 83C410                  add esp, 00000010
:00444E8A A18C544700              mov eax, dword ptr [0047548C]
:00444E8F FF3485E8FC4600          push dword ptr [4*eax+0046FCE8]
:00444E96 FF3485E0144700          push dword ptr [4*eax+004714E0]
:00444E9D 6A00                    push 00000000
:00444E9F 6A00                    push 00000000
:00444EA1 E82DF5FFFF              call 004443D3
:00444EA6 83C410                  add esp, 00000010
:00444EA9 C3                      ret



* Referenced by a CALL at Addresses:
|:0041089F   , :00427269   , :00427296   , :004272AC   , :00443E91   
|
:00444EAA 8B4C2408                mov ecx, dword ptr [esp+08]
:00444EAE 56                      push esi
:00444EAF 8B742410                mov esi, dword ptr [esp+10]
:00444EB3 A18C544700              mov eax, dword ptr [0047548C]
:00444EB8 890D88544700            mov dword ptr [00475488], ecx
:00444EBE 833C8578FE460007        cmp dword ptr [4*eax+0046FE78], 00000007
:00444EC6 7517                    jne 00444EDF
:00444EC8 C1E103                  shl ecx, 03
:00444ECB 51                      push ecx
:00444ECC FF742414                push [esp+14]
:00444ED0 68105B4700              push 00475B10
:00444ED5 E8B6370000              call 00448690
:00444EDA 83C40C                  add esp, 0000000C
:00444EDD EB2A                    jmp 00444F09

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444EC6(C)
|
:00444EDF BA105B4700              mov edx, 00475B10
:00444EE4 8D048D00000000          lea eax, dword ptr [4*ecx+00000000]
:00444EEB 85C0                    test eax, eax
:00444EED 7E1A                    jle 00444F09

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444F07(C)
|
:00444EEF 8A0E                    mov cl, byte ptr [esi]
:00444EF1 C0E904                  shr cl, 04
:00444EF4 80C110                  add cl, 10
:00444EF7 880A                    mov byte ptr [edx], cl
:00444EF9 42                      inc edx
:00444EFA 8A0E                    mov cl, byte ptr [esi]
:00444EFC 46                      inc esi
:00444EFD 80E10F                  and cl, 0F
:00444F00 80C110                  add cl, 10
:00444F03 880A                    mov byte ptr [edx], cl
:00444F05 42                      inc edx
:00444F06 48                      dec eax
:00444F07 75E6                    jne 00444EEF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00444EDD(U), :00444EED(C)
|
:00444F09 5E                      pop esi
:00444F0A C3                      ret



* Referenced by a CALL at Addresses:
|:00445353   , :00445492   , :00445690   , :004457F2   , :004459B2   
|:00445AEC   
|
:00444F0B 8B4C2408                mov ecx, dword ptr [esp+08]
:00444F0F 83EC04                  sub esp, 00000004
:00444F12 53                      push ebx
:00444F13 8B5104                  mov edx, dword ptr [ecx+04]
:00444F16 56                      push esi
:00444F17 57                      push edi
:00444F18 8B74241C                mov esi, dword ptr [esp+1C]
:00444F1C 55                      push ebp
:00444F1D 8B4604                  mov eax, dword ptr [esi+04]
:00444F20 3BC2                    cmp eax, edx
:00444F22 7F02                    jg 00444F26
:00444F24 8BC2                    mov eax, edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444F22(C)
|
:00444F26 8B542418                mov edx, dword ptr [esp+18]
:00444F2A 89442410                mov dword ptr [esp+10], eax
:00444F2E 894204                  mov dword ptr [edx+04], eax
:00444F31 8B01                    mov eax, dword ptr [ecx]
:00444F33 8B3E                    mov edi, dword ptr [esi]
:00444F35 3BF8                    cmp edi, eax
:00444F37 7F02                    jg 00444F3B
:00444F39 8BF8                    mov edi, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444F37(C)
|
:00444F3B 893A                    mov dword ptr [edx], edi
:00444F3D 8B6E08                  mov ebp, dword ptr [esi+08]
:00444F40 8B4108                  mov eax, dword ptr [ecx+08]
:00444F43 3BE8                    cmp ebp, eax
:00444F45 7C02                    jl 00444F49
:00444F47 8BE8                    mov ebp, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444F45(C)
|
:00444F49 896A08                  mov dword ptr [edx+08], ebp
:00444F4C 8B5E0C                  mov ebx, dword ptr [esi+0C]
:00444F4F 8B410C                  mov eax, dword ptr [ecx+0C]
:00444F52 3BD8                    cmp ebx, eax
:00444F54 7C02                    jl 00444F58
:00444F56 8BD8                    mov ebx, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444F54(C)
|
:00444F58 8D042F                  lea eax, dword ptr [edi+ebp]
:00444F5B 895A0C                  mov dword ptr [edx+0C], ebx
:00444F5E 99                      cdq
:00444F5F 2BC2                    sub eax, edx
:00444F61 D1F8                    sar eax, 1
:00444F63 8BF8                    mov edi, eax
:00444F65 8B442410                mov eax, dword ptr [esp+10]
:00444F69 03C3                    add eax, ebx
:00444F6B 99                      cdq
:00444F6C 2BC2                    sub eax, edx
:00444F6E D1F8                    sar eax, 1
:00444F70 3939                    cmp dword ptr [ecx], edi
:00444F72 7F27                    jg 00444F9B
:00444F74 397908                  cmp dword ptr [ecx+08], edi
:00444F77 7C22                    jl 00444F9B
:00444F79 394104                  cmp dword ptr [ecx+04], eax
:00444F7C 7F1D                    jg 00444F9B
:00444F7E 39410C                  cmp dword ptr [ecx+0C], eax
:00444F81 7C18                    jl 00444F9B
:00444F83 393E                    cmp dword ptr [esi], edi
:00444F85 7F14                    jg 00444F9B
:00444F87 397E08                  cmp dword ptr [esi+08], edi
:00444F8A 7C0F                    jl 00444F9B
:00444F8C 394604                  cmp dword ptr [esi+04], eax
:00444F8F 7F0A                    jg 00444F9B
:00444F91 39460C                  cmp dword ptr [esi+0C], eax
:00444F94 B801000000              mov eax, 00000001
:00444F99 7D02                    jge 00444F9D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00444F72(C), :00444F77(C), :00444F7C(C), :00444F81(C), :00444F85(C)
|:00444F8A(C), :00444F8F(C)
|
:00444F9B 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444F99(C)
|
:00444F9D 5D                      pop ebp
:00444F9E 5F                      pop edi
:00444F9F 5E                      pop esi
:00444FA0 5B                      pop ebx
:00444FA1 83C404                  add esp, 00000004
:00444FA4 C3                      ret



* Referenced by a CALL at Address:
|:00445315   
|
:00444FA5 53                      push ebx
:00444FA6 8B0D8C544700            mov ecx, dword ptr [0047548C]
:00444FAC C1E102                  shl ecx, 02
:00444FAF 8B81780D4700            mov eax, dword ptr [ecx+00470D78]
:00444FB5 83F805                  cmp eax, 00000005
:00444FB8 7417                    je 00444FD1
:00444FBA 8B91D8354700            mov edx, dword ptr [ecx+004735D8]
:00444FC0 83F804                  cmp eax, 00000004
:00444FC3 7504                    jne 00444FC9
:00444FC5 33DB                    xor ebx, ebx
:00444FC7 EB14                    jmp 00444FDD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444FC3(C)
|
:00444FC9 8B9948344700            mov ebx, dword ptr [ecx+00473448]
:00444FCF EB0C                    jmp 00444FDD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444FB8(C)
|
:00444FD1 8B9148344700            mov edx, dword ptr [ecx+00473448]
:00444FD7 8B99D8354700            mov ebx, dword ptr [ecx+004735D8]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00444FC7(U), :00444FCF(U)
|
:00444FDD 33C9                    xor ecx, ecx
:00444FDF 8B442408                mov eax, dword ptr [esp+08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444FFA(C)
|
:00444FE3 F6C480                  test ah, 80
:00444FE6 8891B81C4700            mov byte ptr [ecx+00471CB8], dl
:00444FEC 7506                    jne 00444FF4
:00444FEE 8899B81C4700            mov byte ptr [ecx+00471CB8], bl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444FEC(C)
|
:00444FF4 03C0                    add eax, eax
:00444FF6 41                      inc ecx
:00444FF7 83F910                  cmp ecx, 00000010
:00444FFA 7CE7                    jl 00444FE3
:00444FFC 5B                      pop ebx
:00444FFD C3                      ret



* Referenced by a CALL at Addresses:
|:004456CC   , :0044573F   
|
:00444FFE 56                      push esi
:00444FFF 57                      push edi
:00445000 8B74240C                mov esi, dword ptr [esp+0C]
:00445004 FF7604                  push [esi+04]
:00445007 FF36                    push dword ptr [esi]
:00445009 E815FEFFFF              call 00444E23
:0044500E 83C408                  add esp, 00000008
:00445011 8B0D8C544700            mov ecx, dword ptr [0047548C]
:00445017 8B0C8D780D4700          mov ecx, dword ptr [4*ecx+00470D78]
:0044501E 85C9                    test ecx, ecx
:00445020 7429                    je 0044504B
:00445022 83F901                  cmp ecx, 00000001
:00445025 744E                    je 00445075
:00445027 83F902                  cmp ecx, 00000002
:0044502A 0F8486000000            je 004450B6
:00445030 83F903                  cmp ecx, 00000003
:00445033 0F84A0000000            je 004450D9
:00445039 83F904                  cmp ecx, 00000004
:0044503C 0F84BA000000            je 004450FC
:00445042 83F905                  cmp ecx, 00000005
:00445045 0F85D6000000            jne 00445121

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445020(C)
|
:0044504B 33D2                    xor edx, edx
:0044504D 8B4E08                  mov ecx, dword ptr [esi+08]
:00445050 2B0E                    sub ecx, dword ptr [esi]
:00445052 0F88C9000000            js 00445121

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044506E(C)
|
:00445058 8BCA                    mov ecx, edx
:0044505A 42                      inc edx
:0044505B 83E10F                  and ecx, 0000000F
:0044505E 8A89B81C4700            mov cl, byte ptr [ecx+00471CB8]
:00445064 8808                    mov byte ptr [eax], cl
:00445066 40                      inc eax
:00445067 8B4E08                  mov ecx, dword ptr [esi+08]
:0044506A 2B0E                    sub ecx, dword ptr [esi]
:0044506C 3BCA                    cmp ecx, edx
:0044506E 7DE8                    jge 00445058
:00445070 E9AC000000              jmp 00445121

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445025(C)
|
:00445075 33D2                    xor edx, edx
:00445077 8B4E08                  mov ecx, dword ptr [esi+08]
:0044507A 2B0E                    sub ecx, dword ptr [esi]
:0044507C 0F889F000000            js 00445121

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004450B2(C)
|
:00445082 8BCA                    mov ecx, edx
:00445084 83E10F                  and ecx, 0000000F
:00445087 8A89B81C4700            mov cl, byte ptr [ecx+00471CB8]
:0044508D 3208                    xor cl, byte ptr [eax]
:0044508F 8808                    mov byte ptr [eax], cl
:00445091 8B3D8C544700            mov edi, dword ptr [0047548C]
:00445097 833CBD78FE460007        cmp dword ptr [4*edi+0046FE78], 00000007
:0044509F 7408                    je 004450A9
:004450A1 80E10F                  and cl, 0F
:004450A4 80C910                  or cl, 10
:004450A7 8808                    mov byte ptr [eax], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044509F(C)
|
:004450A9 40                      inc eax
:004450AA 42                      inc edx
:004450AB 8B4E08                  mov ecx, dword ptr [esi+08]
:004450AE 2B0E                    sub ecx, dword ptr [esi]
:004450B0 3BCA                    cmp ecx, edx
:004450B2 7DCE                    jge 00445082
:004450B4 EB6B                    jmp 00445121

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044502A(C)
|
:004450B6 33D2                    xor edx, edx
:004450B8 8B4E08                  mov ecx, dword ptr [esi+08]
:004450BB 2B0E                    sub ecx, dword ptr [esi]
:004450BD 7862                    js 00445121

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004450D5(C)
|
:004450BF 8BCA                    mov ecx, edx
:004450C1 42                      inc edx
:004450C2 83E10F                  and ecx, 0000000F
:004450C5 8A89B81C4700            mov cl, byte ptr [ecx+00471CB8]
:004450CB 2008                    and byte ptr [eax], cl
:004450CD 40                      inc eax
:004450CE 8B4E08                  mov ecx, dword ptr [esi+08]
:004450D1 2B0E                    sub ecx, dword ptr [esi]
:004450D3 3BCA                    cmp ecx, edx
:004450D5 7DE8                    jge 004450BF
:004450D7 EB48                    jmp 00445121

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445033(C)
|
:004450D9 33D2                    xor edx, edx
:004450DB 8B4E08                  mov ecx, dword ptr [esi+08]
:004450DE 2B0E                    sub ecx, dword ptr [esi]
:004450E0 783F                    js 00445121

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004450F8(C)
|
:004450E2 8BCA                    mov ecx, edx
:004450E4 42                      inc edx
:004450E5 83E10F                  and ecx, 0000000F
:004450E8 8A89B81C4700            mov cl, byte ptr [ecx+00471CB8]
:004450EE 0808                    or byte ptr [eax], cl
:004450F0 40                      inc eax
:004450F1 8B4E08                  mov ecx, dword ptr [esi+08]
:004450F4 2B0E                    sub ecx, dword ptr [esi]
:004450F6 3BCA                    cmp ecx, edx
:004450F8 7DE8                    jge 004450E2
:004450FA EB25                    jmp 00445121

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044503C(C)
|
:004450FC 33D2                    xor edx, edx
:004450FE 8B4E08                  mov ecx, dword ptr [esi+08]
:00445101 2B0E                    sub ecx, dword ptr [esi]
:00445103 781C                    js 00445121

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044511F(C)
|
:00445105 8BCA                    mov ecx, edx
:00445107 83E10F                  and ecx, 0000000F
:0044510A 8A89B81C4700            mov cl, byte ptr [ecx+00471CB8]
:00445110 84C9                    test cl, cl
:00445112 7402                    je 00445116
:00445114 8808                    mov byte ptr [eax], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445112(C)
|
:00445116 40                      inc eax
:00445117 42                      inc edx
:00445118 8B4E08                  mov ecx, dword ptr [esi+08]
:0044511B 2B0E                    sub ecx, dword ptr [esi]
:0044511D 3BCA                    cmp ecx, edx
:0044511F 7DE4                    jge 00445105

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00445045(C), :00445052(C), :00445070(U), :0044507C(C), :004450B4(U)
|:004450BD(C), :004450D7(U), :004450E0(C), :004450FA(U), :00445103(C)
|
:00445121 5F                      pop edi
:00445122 5E                      pop esi
:00445123 C3                      ret



* Referenced by a CALL at Addresses:
|:00445700   , :0044577D   
|
:00445124 53                      push ebx
:00445125 56                      push esi
:00445126 57                      push edi
:00445127 8B7C2410                mov edi, dword ptr [esp+10]
:0044512B 8D7704                  lea esi, dword ptr [edi+04]
:0044512E FF36                    push dword ptr [esi]
:00445130 FF37                    push dword ptr [edi]
:00445132 E8ECFCFFFF              call 00444E23
:00445137 83C408                  add esp, 00000008
:0044513A 8B0D8C544700            mov ecx, dword ptr [0047548C]
:00445140 8B0C8D780D4700          mov ecx, dword ptr [4*ecx+00470D78]
:00445147 85C9                    test ecx, ecx
:00445149 7429                    je 00445174
:0044514B 83F901                  cmp ecx, 00000001
:0044514E 745A                    je 004451AA
:00445150 83F902                  cmp ecx, 00000002
:00445153 0F84A1000000            je 004451FA
:00445159 83F903                  cmp ecx, 00000003
:0044515C 0F84CB000000            je 0044522D
:00445162 83F904                  cmp ecx, 00000004
:00445165 0F84F1000000            je 0044525C
:0044516B 83F905                  cmp ecx, 00000005
:0044516E 0F8519010000            jne 0044528D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445149(C)
|
:00445174 33D2                    xor edx, edx
:00445176 8B4F0C                  mov ecx, dword ptr [edi+0C]
:00445179 2B0E                    sub ecx, dword ptr [esi]
:0044517B 0F880C010000            js 0044528D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004451A3(C)
|
:00445181 8BCA                    mov ecx, edx
:00445183 42                      inc edx
:00445184 83E10F                  and ecx, 0000000F
:00445187 8A89B81C4700            mov cl, byte ptr [ecx+00471CB8]
:0044518D 8808                    mov byte ptr [eax], cl
:0044518F 8B4F0C                  mov ecx, dword ptr [edi+0C]
:00445192 8B1D8C544700            mov ebx, dword ptr [0047548C]
:00445198 2B0E                    sub ecx, dword ptr [esi]
:0044519A 03049D08394700          add eax, dword ptr [4*ebx+00473908]
:004451A1 3BCA                    cmp ecx, edx
:004451A3 7DDC                    jge 00445181
:004451A5 E9E3000000              jmp 0044528D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044514E(C)
|
:004451AA 33D2                    xor edx, edx
:004451AC 8B4F0C                  mov ecx, dword ptr [edi+0C]
:004451AF 2B0E                    sub ecx, dword ptr [esi]
:004451B1 0F88D6000000            js 0044528D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004451F3(C)
|
:004451B7 8BCA                    mov ecx, edx
:004451B9 83E10F                  and ecx, 0000000F
:004451BC 8A89B81C4700            mov cl, byte ptr [ecx+00471CB8]
:004451C2 3208                    xor cl, byte ptr [eax]
:004451C4 8808                    mov byte ptr [eax], cl
:004451C6 8B1D8C544700            mov ebx, dword ptr [0047548C]
:004451CC 833C9D78FE460007        cmp dword ptr [4*ebx+0046FE78], 00000007
:004451D4 7408                    je 004451DE
:004451D6 80E10F                  and cl, 0F
:004451D9 80C910                  or cl, 10
:004451DC 8808                    mov byte ptr [eax], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004451D4(C)
|
:004451DE 8B0D8C544700            mov ecx, dword ptr [0047548C]
:004451E4 42                      inc edx
:004451E5 03048D08394700          add eax, dword ptr [4*ecx+00473908]
:004451EC 8B4F0C                  mov ecx, dword ptr [edi+0C]
:004451EF 2B0E                    sub ecx, dword ptr [esi]
:004451F1 3BCA                    cmp ecx, edx
:004451F3 7DC2                    jge 004451B7
:004451F5 E993000000              jmp 0044528D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445153(C)
|
:004451FA 33D2                    xor edx, edx
:004451FC 8B4F0C                  mov ecx, dword ptr [edi+0C]
:004451FF 2B0E                    sub ecx, dword ptr [esi]
:00445201 0F8886000000            js 0044528D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445229(C)
|
:00445207 8BCA                    mov ecx, edx
:00445209 42                      inc edx
:0044520A 83E10F                  and ecx, 0000000F
:0044520D 8A89B81C4700            mov cl, byte ptr [ecx+00471CB8]
:00445213 2008                    and byte ptr [eax], cl
:00445215 8B4F0C                  mov ecx, dword ptr [edi+0C]
:00445218 8B1D8C544700            mov ebx, dword ptr [0047548C]
:0044521E 2B0E                    sub ecx, dword ptr [esi]
:00445220 03049D08394700          add eax, dword ptr [4*ebx+00473908]
:00445227 3BCA                    cmp ecx, edx
:00445229 7DDC                    jge 00445207
:0044522B EB60                    jmp 0044528D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044515C(C)
|
:0044522D 33D2                    xor edx, edx
:0044522F 8B4F0C                  mov ecx, dword ptr [edi+0C]
:00445232 2B0E                    sub ecx, dword ptr [esi]
:00445234 7857                    js 0044528D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445258(C)
|
:00445236 8BCA                    mov ecx, edx
:00445238 42                      inc edx
:00445239 83E10F                  and ecx, 0000000F
:0044523C 8A89B81C4700            mov cl, byte ptr [ecx+00471CB8]
:00445242 0808                    or byte ptr [eax], cl
:00445244 8B4F0C                  mov ecx, dword ptr [edi+0C]
:00445247 8B1D8C544700            mov ebx, dword ptr [0047548C]
:0044524D 2B0E                    sub ecx, dword ptr [esi]
:0044524F 03049D08394700          add eax, dword ptr [4*ebx+00473908]
:00445256 3BCA                    cmp ecx, edx
:00445258 7DDC                    jge 00445236
:0044525A EB31                    jmp 0044528D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445165(C)
|
:0044525C 33D2                    xor edx, edx
:0044525E 8B4F0C                  mov ecx, dword ptr [edi+0C]
:00445261 2B0E                    sub ecx, dword ptr [esi]
:00445263 7828                    js 0044528D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044528B(C)
|
:00445265 8BCA                    mov ecx, edx
:00445267 83E10F                  and ecx, 0000000F
:0044526A 8A89B81C4700            mov cl, byte ptr [ecx+00471CB8]
:00445270 84C9                    test cl, cl
:00445272 7402                    je 00445276
:00445274 8808                    mov byte ptr [eax], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445272(C)
|
:00445276 8B0D8C544700            mov ecx, dword ptr [0047548C]
:0044527C 42                      inc edx
:0044527D 03048D08394700          add eax, dword ptr [4*ecx+00473908]
:00445284 8B4F0C                  mov ecx, dword ptr [edi+0C]
:00445287 2B0E                    sub ecx, dword ptr [esi]
:00445289 3BCA                    cmp ecx, edx
:0044528B 7DD8                    jge 00445265

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044516E(C), :0044517B(C), :004451A5(U), :004451B1(C), :004451F5(U)
|:00445201(C), :0044522B(U), :00445234(C), :0044525A(U), :00445263(C)
|
:0044528D 5F                      pop edi
:0044528E 5E                      pop esi
:0044528F 5B                      pop ebx
:00445290 C3                      ret



* Referenced by a CALL at Addresses:
|:004108E6   , :004270A9   , :00427309   , :00443EBD   
|
:00445291 55                      push ebp
:00445292 8B0D8C544700            mov ecx, dword ptr [0047548C]
:00445298 8BEC                    mov ebp, esp
:0044529A 83EC10                  sub esp, 00000010
:0044529D 8B14CD90194700          mov edx, dword ptr [8*ecx+00471990]
:004452A4 8B4508                  mov eax, dword ptr [ebp+08]
:004452A7 03C2                    add eax, edx
:004452A9 8B0CCD94194700          mov ecx, dword ptr [8*ecx+00471994]
:004452B0 8945F0                  mov dword ptr [ebp-10], eax
:004452B3 8B450C                  mov eax, dword ptr [ebp+0C]
:004452B6 03C1                    add eax, ecx
:004452B8 8945F4                  mov dword ptr [ebp-0C], eax
:004452BB 8B4510                  mov eax, dword ptr [ebp+10]
:004452BE 03C2                    add eax, edx
:004452C0 8945F8                  mov dword ptr [ebp-08], eax
:004452C3 8B4514                  mov eax, dword ptr [ebp+14]
:004452C6 03C1                    add eax, ecx
:004452C8 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004452CB 8945FC                  mov dword ptr [ebp-04], eax
:004452CE 394DF8                  cmp dword ptr [ebp-08], ecx
:004452D1 7D0B                    jge 004452DE
:004452D3 8BC1                    mov eax, ecx
:004452D5 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004452D8 894DF0                  mov dword ptr [ebp-10], ecx
:004452DB 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004452D1(C)
|
:004452DE 8B45FC                  mov eax, dword ptr [ebp-04]
:004452E1 3945F4                  cmp dword ptr [ebp-0C], eax
:004452E4 7E0C                    jle 004452F2
:004452E6 8B45F4                  mov eax, dword ptr [ebp-0C]
:004452E9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004452EC 894DF4                  mov dword ptr [ebp-0C], ecx
:004452EF 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004452E4(C)
|
:004452F2 8B4518                  mov eax, dword ptr [ebp+18]
:004452F5 85C0                    test eax, eax
:004452F7 740C                    je 00445305
:004452F9 83F801                  cmp eax, 00000001
:004452FC 7412                    je 00445310
:004452FE 83F802                  cmp eax, 00000002
:00445301 7425                    je 00445328
:00445303 EB2C                    jmp 00445331

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004452F7(C)
|
:00445305 8D45F0                  lea eax, dword ptr [ebp-10]
:00445308 50                      push eax
:00445309 E827000000              call 00445335
:0044530E EB21                    jmp 00445331

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004452FC(C)
|
:00445310 68FFFF0000              push 0000FFFF
:00445315 E88BFCFFFF              call 00444FA5
:0044531A 83C404                  add esp, 00000004
:0044531D 8D45F0                  lea eax, dword ptr [ebp-10]
:00445320 50                      push eax
:00445321 E84B030000              call 00445671
:00445326 EB09                    jmp 00445331

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445301(C)
|
:00445328 8D45F0                  lea eax, dword ptr [ebp-10]
:0044532B 50                      push eax
:0044532C E843010000              call 00445474

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00445303(U), :0044530E(U), :00445326(U)
|
:00445331 8BE5                    mov esp, ebp
:00445333 5D                      pop ebp
:00445334 C3                      ret



* Referenced by a CALL at Address:
|:00445309   
|
:00445335 55                      push ebp
:00445336 A18C544700              mov eax, dword ptr [0047548C]
:0044533B C1E004                  shl eax, 04
:0044533E 8BEC                    mov ebp, esp
:00445340 83EC1C                  sub esp, 0000001C
:00445343 05D0544700              add eax, 004754D0
:00445348 8D55E8                  lea edx, dword ptr [ebp-18]
:0044534B 53                      push ebx
:0044534C 56                      push esi
:0044534D 57                      push edi
:0044534E 50                      push eax
:0044534F FF7508                  push [ebp+08]
:00445352 52                      push edx
:00445353 E8B3FBFFFF              call 00444F0B
:00445358 83C40C                  add esp, 0000000C
:0044535B 85C0                    test eax, eax
:0044535D 0F840A010000            je 0044546D
:00445363 8B75F0                  mov esi, dword ptr [ebp-10]
:00445366 8B7DF4                  mov edi, dword ptr [ebp-0C]
:00445369 2B75E8                  sub esi, dword ptr [ebp-18]
:0044536C 2B7DEC                  sub edi, dword ptr [ebp-14]
:0044536F FF75EC                  push [ebp-14]
:00445372 FF75E8                  push [ebp-18]
:00445375 E8A9FAFFFF              call 00444E23
:0044537A 83C408                  add esp, 00000008
:0044537D 8B158C544700            mov edx, dword ptr [0047548C]
:00445383 C1E202                  shl edx, 02
:00445386 46                      inc esi
:00445387 47                      inc edi
:00445388 8B9A08394700            mov ebx, dword ptr [edx+00473908]
:0044538E 8BCB                    mov ecx, ebx
:00445390 895DFC                  mov dword ptr [ebp-04], ebx
:00445393 2BCE                    sub ecx, esi
:00445395 8B9A780D4700            mov ebx, dword ptr [edx+00470D78]
:0044539B 894DF8                  mov dword ptr [ebp-08], ecx
:0044539E 85DB                    test ebx, ebx
:004453A0 8A8AD8354700            mov cl, byte ptr [edx+004735D8]
:004453A6 0F849F000000            je 0044544B
:004453AC 83FB01                  cmp ebx, 00000001
:004453AF 741D                    je 004453CE
:004453B1 83FB02                  cmp ebx, 00000002
:004453B4 745B                    je 00445411
:004453B6 83FB03                  cmp ebx, 00000003
:004453B9 7470                    je 0044542B
:004453BB 83FB04                  cmp ebx, 00000004
:004453BE 0F8487000000            je 0044544B
:004453C4 83FB05                  cmp ebx, 00000005
:004453C7 747C                    je 00445445
:004453C9 E98F000000              jmp 0044545D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004453AF(C)
|
:004453CE 85FF                    test edi, edi
:004453D0 0F8E87000000            jle 0044545D
:004453D6 8BDF                    mov ebx, edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044540D(C)
|
:004453D8 85F6                    test esi, esi
:004453DA 7E2D                    jle 00445409
:004453DC 8975E4                  mov dword ptr [ebp-1C], esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445407(C)
|
:004453DF 8A10                    mov dl, byte ptr [eax]
:004453E1 32D1                    xor dl, cl
:004453E3 8855FC                  mov byte ptr [ebp-04], dl
:004453E6 8810                    mov byte ptr [eax], dl
:004453E8 8B158C544700            mov edx, dword ptr [0047548C]
:004453EE 833C9578FE460007        cmp dword ptr [4*edx+0046FE78], 00000007
:004453F6 740B                    je 00445403
:004453F8 8A55FC                  mov dl, byte ptr [ebp-04]
:004453FB 80E20F                  and dl, 0F
:004453FE 80CA10                  or dl, 10
:00445401 8810                    mov byte ptr [eax], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004453F6(C)
|
:00445403 40                      inc eax
:00445404 FF4DE4                  dec [ebp-1C]
:00445407 75D6                    jne 004453DF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004453DA(C)
|
:00445409 0345F8                  add eax, dword ptr [ebp-08]
:0044540C 4B                      dec ebx
:0044540D 75C9                    jne 004453D8
:0044540F EB4C                    jmp 0044545D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004453B4(C)
|
:00445411 85FF                    test edi, edi
:00445413 7E48                    jle 0044545D
:00445415 8BD7                    mov edx, edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445427(C)
|
:00445417 85F6                    test esi, esi
:00445419 7E08                    jle 00445423
:0044541B 8BDE                    mov ebx, esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445421(C)
|
:0044541D 2008                    and byte ptr [eax], cl
:0044541F 40                      inc eax
:00445420 4B                      dec ebx
:00445421 75FA                    jne 0044541D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445419(C)
|
:00445423 0345F8                  add eax, dword ptr [ebp-08]
:00445426 4A                      dec edx
:00445427 75EE                    jne 00445417
:00445429 EB32                    jmp 0044545D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004453B9(C)
|
:0044542B 85FF                    test edi, edi
:0044542D 7E2E                    jle 0044545D
:0044542F 8BDF                    mov ebx, edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445441(C)
|
:00445431 85F6                    test esi, esi
:00445433 7E08                    jle 0044543D
:00445435 8BD6                    mov edx, esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044543B(C)
|
:00445437 0808                    or byte ptr [eax], cl
:00445439 40                      inc eax
:0044543A 4A                      dec edx
:0044543B 75FA                    jne 00445437

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445433(C)
|
:0044543D 0345F8                  add eax, dword ptr [ebp-08]
:00445440 4B                      dec ebx
:00445441 75EE                    jne 00445431
:00445443 EB18                    jmp 0044545D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004453C7(C)
|
:00445445 8A8A48344700            mov cl, byte ptr [edx+00473448]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004453A6(C), :004453BE(C)
|
:0044544B 0FB6C9                  movzx ecx, cl
:0044544E 50                      push eax
:0044544F 51                      push ecx
:00445450 FF75FC                  push [ebp-04]
:00445453 57                      push edi
:00445454 56                      push esi
:00445455 E8181B0000              call 00446F72
:0044545A 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004453C9(U), :004453D0(C), :0044540F(U), :00445413(C), :00445429(U)
|:0044542D(C), :00445443(U)
|
:0044545D 57                      push edi
:0044545E 56                      push esi
:0044545F FF75EC                  push [ebp-14]
:00445462 FF75E8                  push [ebp-18]
:00445465 E869EFFFFF              call 004443D3
:0044546A 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044535D(C)
|
:0044546D 5F                      pop edi
:0044546E 5E                      pop esi
:0044546F 5B                      pop ebx
:00445470 8BE5                    mov esp, ebp
:00445472 5D                      pop ebp
:00445473 C3                      ret



* Referenced by a CALL at Address:
|:0044532C   
|
:00445474 55                      push ebp
:00445475 A18C544700              mov eax, dword ptr [0047548C]
:0044547A C1E004                  shl eax, 04
:0044547D 8BEC                    mov ebp, esp
:0044547F 83EC1C                  sub esp, 0000001C
:00445482 05D0544700              add eax, 004754D0
:00445487 8D55F0                  lea edx, dword ptr [ebp-10]
:0044548A 53                      push ebx
:0044548B 56                      push esi
:0044548C 57                      push edi
:0044548D 50                      push eax
:0044548E FF7508                  push [ebp+08]
:00445491 52                      push edx
:00445492 E874FAFFFF              call 00444F0B
:00445497 83C40C                  add esp, 0000000C
:0044549A 85C0                    test eax, eax
:0044549C 0F84C8010000            je 0044566A
:004454A2 8B45F8                  mov eax, dword ptr [ebp-08]
:004454A5 2B45F0                  sub eax, dword ptr [ebp-10]
:004454A8 FF75F4                  push [ebp-0C]
:004454AB FF75F0                  push [ebp-10]
:004454AE 40                      inc eax
:004454AF 8945EC                  mov dword ptr [ebp-14], eax
:004454B2 8B45FC                  mov eax, dword ptr [ebp-04]
:004454B5 2B45F4                  sub eax, dword ptr [ebp-0C]
:004454B8 40                      inc eax
:004454B9 8945E4                  mov dword ptr [ebp-1C], eax
:004454BC E862F9FFFF              call 00444E23
:004454C1 83C408                  add esp, 00000008
:004454C4 8BC8                    mov ecx, eax
:004454C6 A18C544700              mov eax, dword ptr [0047548C]
:004454CB C1E002                  shl eax, 02
:004454CE 8BB808394700            mov edi, dword ptr [eax+00473908]
:004454D4 8B80780D4700            mov eax, dword ptr [eax+00470D78]
:004454DA 2B7DEC                  sub edi, dword ptr [ebp-14]
:004454DD 85C0                    test eax, eax
:004454DF 7429                    je 0044550A
:004454E1 83F801                  cmp eax, 00000001
:004454E4 7463                    je 00445549
:004454E6 83F802                  cmp eax, 00000002
:004454E9 0F84B9000000            je 004455A8
:004454EF 83F803                  cmp eax, 00000003
:004454F2 0F84EC000000            je 004455E4
:004454F8 83F804                  cmp eax, 00000004
:004454FB 0F841B010000            je 0044561C
:00445501 83F805                  cmp eax, 00000005
:00445504 0F854C010000            jne 00445656

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004454DF(C)
|
:0044550A 8B75F4                  mov esi, dword ptr [ebp-0C]
:0044550D 3B75FC                  cmp esi, dword ptr [ebp-04]
:00445510 0F8F40010000            jg 00445656

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445542(C)
|
:00445516 8BC6                    mov eax, esi
:00445518 8B5DF0                  mov ebx, dword ptr [ebp-10]
:0044551B 99                      cdq
:0044551C F73D88544700            idiv dword ptr [00475488]
:00445522 3B5DF8                  cmp ebx, dword ptr [ebp-08]
:00445525 7F15                    jg 0044553C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044553A(C)
|
:00445527 8BC3                    mov eax, ebx
:00445529 43                      inc ebx
:0044552A 83E007                  and eax, 00000007
:0044552D 8A84D0105B4700          mov al, byte ptr [eax+8*edx+00475B10]
:00445534 8801                    mov byte ptr [ecx], al
:00445536 41                      inc ecx
:00445537 3B5DF8                  cmp ebx, dword ptr [ebp-08]
:0044553A 7EEB                    jle 00445527

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445525(C)
|
:0044553C 03CF                    add ecx, edi
:0044553E 46                      inc esi
:0044553F 3B75FC                  cmp esi, dword ptr [ebp-04]
:00445542 7ED2                    jle 00445516
:00445544 E90D010000              jmp 00445656

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004454E4(C)
|
:00445549 8B75F4                  mov esi, dword ptr [ebp-0C]
:0044554C 3B75FC                  cmp esi, dword ptr [ebp-04]
:0044554F 0F8F01010000            jg 00445656

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004455A1(C)
|
:00445555 8BC6                    mov eax, esi
:00445557 99                      cdq
:00445558 F73D88544700            idiv dword ptr [00475488]
:0044555E 8B45F0                  mov eax, dword ptr [ebp-10]
:00445561 3B45F8                  cmp eax, dword ptr [ebp-08]
:00445564 7F35                    jg 0044559B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445599(C)
|
:00445566 8BD8                    mov ebx, eax
:00445568 83E307                  and ebx, 00000007
:0044556B 8A9CD3105B4700          mov bl, byte ptr [ebx+8*edx+00475B10]
:00445572 3219                    xor bl, byte ptr [ecx]
:00445574 885DE8                  mov byte ptr [ebp-18], bl
:00445577 8819                    mov byte ptr [ecx], bl
:00445579 8B1D8C544700            mov ebx, dword ptr [0047548C]
:0044557F 833C9D78FE460007        cmp dword ptr [4*ebx+0046FE78], 00000007
:00445587 740B                    je 00445594
:00445589 8A5DE8                  mov bl, byte ptr [ebp-18]
:0044558C 80E30F                  and bl, 0F
:0044558F 80CB10                  or bl, 10
:00445592 8819                    mov byte ptr [ecx], bl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445587(C)
|
:00445594 41                      inc ecx
:00445595 40                      inc eax
:00445596 3B45F8                  cmp eax, dword ptr [ebp-08]
:00445599 7ECB                    jle 00445566

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445564(C)
|
:0044559B 03CF                    add ecx, edi
:0044559D 46                      inc esi
:0044559E 3B75FC                  cmp esi, dword ptr [ebp-04]
:004455A1 7EB2                    jle 00445555
:004455A3 E9AE000000              jmp 00445656

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004454E9(C)
|
:004455A8 8B75F4                  mov esi, dword ptr [ebp-0C]
:004455AB 3B75FC                  cmp esi, dword ptr [ebp-04]
:004455AE 0F8FA2000000            jg 00445656

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004455E0(C)
|
:004455B4 8BC6                    mov eax, esi
:004455B6 8B5DF0                  mov ebx, dword ptr [ebp-10]
:004455B9 99                      cdq
:004455BA F73D88544700            idiv dword ptr [00475488]
:004455C0 3B5DF8                  cmp ebx, dword ptr [ebp-08]
:004455C3 7F15                    jg 004455DA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004455D8(C)
|
:004455C5 8BC3                    mov eax, ebx
:004455C7 43                      inc ebx
:004455C8 83E007                  and eax, 00000007
:004455CB 8A84D0105B4700          mov al, byte ptr [eax+8*edx+00475B10]
:004455D2 2001                    and byte ptr [ecx], al
:004455D4 41                      inc ecx
:004455D5 3B5DF8                  cmp ebx, dword ptr [ebp-08]
:004455D8 7EEB                    jle 004455C5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004455C3(C)
|
:004455DA 03CF                    add ecx, edi
:004455DC 46                      inc esi
:004455DD 3B75FC                  cmp esi, dword ptr [ebp-04]
:004455E0 7ED2                    jle 004455B4
:004455E2 EB72                    jmp 00445656

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004454F2(C)
|
:004455E4 8B75F4                  mov esi, dword ptr [ebp-0C]
:004455E7 3B75FC                  cmp esi, dword ptr [ebp-04]
:004455EA 7F6A                    jg 00445656

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445618(C)
|
:004455EC 8BC6                    mov eax, esi
:004455EE 8B5DF0                  mov ebx, dword ptr [ebp-10]
:004455F1 99                      cdq
:004455F2 F73D88544700            idiv dword ptr [00475488]
:004455F8 3B5DF8                  cmp ebx, dword ptr [ebp-08]
:004455FB 7F15                    jg 00445612

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445610(C)
|
:004455FD 8BC3                    mov eax, ebx
:004455FF 43                      inc ebx
:00445600 83E007                  and eax, 00000007
:00445603 8A84D0105B4700          mov al, byte ptr [eax+8*edx+00475B10]
:0044560A 0801                    or byte ptr [ecx], al
:0044560C 41                      inc ecx
:0044560D 3B5DF8                  cmp ebx, dword ptr [ebp-08]
:00445610 7EEB                    jle 004455FD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004455FB(C)
|
:00445612 03CF                    add ecx, edi
:00445614 46                      inc esi
:00445615 3B75FC                  cmp esi, dword ptr [ebp-04]
:00445618 7ED2                    jle 004455EC
:0044561A EB3A                    jmp 00445656

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004454FB(C)
|
:0044561C 8B75F4                  mov esi, dword ptr [ebp-0C]
:0044561F 3B75FC                  cmp esi, dword ptr [ebp-04]
:00445622 7F32                    jg 00445656

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445654(C)
|
:00445624 8BC6                    mov eax, esi
:00445626 8B5DF0                  mov ebx, dword ptr [ebp-10]
:00445629 99                      cdq
:0044562A F73D88544700            idiv dword ptr [00475488]
:00445630 3B5DF8                  cmp ebx, dword ptr [ebp-08]
:00445633 7F19                    jg 0044564E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044564C(C)
|
:00445635 8BC3                    mov eax, ebx
:00445637 83E007                  and eax, 00000007
:0044563A 8A84D0105B4700          mov al, byte ptr [eax+8*edx+00475B10]
:00445641 84C0                    test al, al
:00445643 7402                    je 00445647
:00445645 8801                    mov byte ptr [ecx], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445643(C)
|
:00445647 41                      inc ecx
:00445648 43                      inc ebx
:00445649 3B5DF8                  cmp ebx, dword ptr [ebp-08]
:0044564C 7EE7                    jle 00445635

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445633(C)
|
:0044564E 03CF                    add ecx, edi
:00445650 46                      inc esi
:00445651 3B75FC                  cmp esi, dword ptr [ebp-04]
:00445654 7ECE                    jle 00445624

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00445504(C), :00445510(C), :00445544(U), :0044554F(C), :004455A3(U)
|:004455AE(C), :004455E2(U), :004455EA(C), :0044561A(U), :00445622(C)
|
:00445656 FF75E4                  push [ebp-1C]
:00445659 FF75EC                  push [ebp-14]
:0044565C FF75F4                  push [ebp-0C]
:0044565F FF75F0                  push [ebp-10]
:00445662 E86CEDFFFF              call 004443D3
:00445667 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044549C(C)
|
:0044566A 5F                      pop edi
:0044566B 5E                      pop esi
:0044566C 5B                      pop ebx
:0044566D 8BE5                    mov esp, ebp
:0044566F 5D                      pop ebp
:00445670 C3                      ret



* Referenced by a CALL at Address:
|:00445321   
|
:00445671 55                      push ebp
:00445672 A18C544700              mov eax, dword ptr [0047548C]
:00445677 C1E004                  shl eax, 04
:0044567A 8BEC                    mov ebp, esp
:0044567C 83EC14                  sub esp, 00000014
:0044567F 05D0544700              add eax, 004754D0
:00445684 53                      push ebx
:00445685 56                      push esi
:00445686 57                      push edi
:00445687 8B7508                  mov esi, dword ptr [ebp+08]
:0044568A 50                      push eax
:0044568B 56                      push esi
:0044568C 8D45F0                  lea eax, dword ptr [ebp-10]
:0044568F 50                      push eax
:00445690 E876F8FFFF              call 00444F0B
:00445695 83C40C                  add esp, 0000000C
:00445698 85C0                    test eax, eax
:0044569A 0F84F8000000            je 00445798
:004456A0 8B7DF8                  mov edi, dword ptr [ebp-08]
:004456A3 8B45FC                  mov eax, dword ptr [ebp-04]
:004456A6 2B7DF0                  sub edi, dword ptr [ebp-10]
:004456A9 2B45F4                  sub eax, dword ptr [ebp-0C]
:004456AC 47                      inc edi
:004456AD 40                      inc eax
:004456AE 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004456B1 8945EC                  mov dword ptr [ebp-14], eax
:004456B4 394E04                  cmp dword ptr [esi+04], ecx
:004456B7 752C                    jne 004456E5
:004456B9 8B45F0                  mov eax, dword ptr [ebp-10]
:004456BC 3906                    cmp dword ptr [esi], eax
:004456BE 7F25                    jg 004456E5
:004456C0 8B45F8                  mov eax, dword ptr [ebp-08]
:004456C3 394608                  cmp dword ptr [esi+08], eax
:004456C6 7C1D                    jl 004456E5
:004456C8 8D45F0                  lea eax, dword ptr [ebp-10]
:004456CB 50                      push eax
:004456CC E82DF9FFFF              call 00444FFE
:004456D1 83C404                  add esp, 00000004
:004456D4 6A01                    push 00000001
:004456D6 57                      push edi
:004456D7 FF75F4                  push [ebp-0C]
:004456DA FF75F0                  push [ebp-10]
:004456DD E8F1ECFFFF              call 004443D3
:004456E2 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004456B7(C), :004456BE(C), :004456C6(C)
|
:004456E5 8B45F0                  mov eax, dword ptr [ebp-10]
:004456E8 3906                    cmp dword ptr [esi], eax
:004456EA 752F                    jne 0044571B
:004456EC 8B45F4                  mov eax, dword ptr [ebp-0C]
:004456EF 394604                  cmp dword ptr [esi+04], eax
:004456F2 7F27                    jg 0044571B
:004456F4 8B45FC                  mov eax, dword ptr [ebp-04]
:004456F7 39460C                  cmp dword ptr [esi+0C], eax
:004456FA 7C1F                    jl 0044571B
:004456FC 8D45F0                  lea eax, dword ptr [ebp-10]
:004456FF 50                      push eax
:00445700 E81FFAFFFF              call 00445124
:00445705 83C404                  add esp, 00000004
:00445708 FF75EC                  push [ebp-14]
:0044570B 6A01                    push 00000001
:0044570D FF75F4                  push [ebp-0C]
:00445710 FF75F0                  push [ebp-10]
:00445713 E8BBECFFFF              call 004443D3
:00445718 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004456EA(C), :004456F2(C), :004456FA(C)
|
:0044571B 8B45FC                  mov eax, dword ptr [ebp-04]
:0044571E 39460C                  cmp dword ptr [esi+0C], eax
:00445721 7538                    jne 0044575B
:00445723 8B45F0                  mov eax, dword ptr [ebp-10]
:00445726 3906                    cmp dword ptr [esi], eax
:00445728 7F31                    jg 0044575B
:0044572A 8B45F8                  mov eax, dword ptr [ebp-08]
:0044572D 394608                  cmp dword ptr [esi+08], eax
:00445730 7C29                    jl 0044575B
:00445732 8B5DF4                  mov ebx, dword ptr [ebp-0C]
:00445735 8B45FC                  mov eax, dword ptr [ebp-04]
:00445738 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0044573B 8945F4                  mov dword ptr [ebp-0C], eax
:0044573E 51                      push ecx
:0044573F E8BAF8FFFF              call 00444FFE
:00445744 83C404                  add esp, 00000004
:00445747 6A01                    push 00000001
:00445749 57                      push edi
:0044574A FF75F4                  push [ebp-0C]
:0044574D FF75F0                  push [ebp-10]
:00445750 E87EECFFFF              call 004443D3
:00445755 83C410                  add esp, 00000010
:00445758 895DF4                  mov dword ptr [ebp-0C], ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00445721(C), :00445728(C), :00445730(C)
|
:0044575B 8B45F8                  mov eax, dword ptr [ebp-08]
:0044575E 394608                  cmp dword ptr [esi+08], eax
:00445761 7535                    jne 00445798
:00445763 8B45F4                  mov eax, dword ptr [ebp-0C]
:00445766 394604                  cmp dword ptr [esi+04], eax
:00445769 7F2D                    jg 00445798
:0044576B 8B45FC                  mov eax, dword ptr [ebp-04]
:0044576E 39460C                  cmp dword ptr [esi+0C], eax
:00445771 7C25                    jl 00445798
:00445773 8B45F8                  mov eax, dword ptr [ebp-08]
:00445776 8945F0                  mov dword ptr [ebp-10], eax
:00445779 8D45F0                  lea eax, dword ptr [ebp-10]
:0044577C 50                      push eax
:0044577D E8A2F9FFFF              call 00445124
:00445782 83C404                  add esp, 00000004
:00445785 FF75EC                  push [ebp-14]
:00445788 6A01                    push 00000001
:0044578A FF75F4                  push [ebp-0C]
:0044578D FF75F0                  push [ebp-10]
:00445790 E83EECFFFF              call 004443D3
:00445795 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044569A(C), :00445761(C), :00445769(C), :00445771(C)
|
:00445798 5F                      pop edi
:00445799 5E                      pop esi
:0044579A 5B                      pop ebx
:0044579B 8BE5                    mov esp, ebp
:0044579D 5D                      pop ebp
:0044579E C3                      ret



* Referenced by a CALL at Addresses:
|:0040EF81   , :0040F020   , :0040F2EF   , :00412BC2   , :00412E1D   
|:00413424   , :00420CC8   , :00420D16   , :00420D51   , :004214D7   
|:0042159E   , :00421622   , :0042166F   , :00421759   , :004217AB   
|:004217E6   , :0042181D   , :0042184F   , :004219E3   , :00421A41   
|:00421A7C   , :00421AAE   , :00421B37   , :0042517C   , :0042542C   
|:004254BA   , :00426BCF   , :00426C43   , :00427050   , :004271F8   
|:00434064   , :0043489A   , :004349C3   , :00435339   , :0043537C   
|:004353A8   , :00435B93   , :00435C32   , :00435D04   , :0043866A   
|:0043D2F5   , :0043F47C   , :0043F56C   
|
:0044579F 55                      push ebp
:004457A0 8B0D8C544700            mov ecx, dword ptr [0047548C]
:004457A6 8BEC                    mov ebp, esp
:004457A8 83EC24                  sub esp, 00000024
:004457AB 53                      push ebx
:004457AC 8B5508                  mov edx, dword ptr [ebp+08]
:004457AF 56                      push esi
:004457B0 57                      push edi
:004457B1 8B34CD90194700          mov esi, dword ptr [8*ecx+00471990]
:004457B8 8B3CCD94194700          mov edi, dword ptr [8*ecx+00471994]
:004457BF 037D0C                  add edi, dword ptr [ebp+0C]
:004457C2 8D0416                  lea eax, dword ptr [esi+edx]
:004457C5 8945DC                  mov dword ptr [ebp-24], eax
:004457C8 897DE0                  mov dword ptr [ebp-20], edi
:004457CB 8B4510                  mov eax, dword ptr [ebp+10]
:004457CE 03C2                    add eax, edx
:004457D0 03C6                    add eax, esi
:004457D2 8B7514                  mov esi, dword ptr [ebp+14]
:004457D5 C1E104                  shl ecx, 04
:004457D8 48                      dec eax
:004457D9 81C1D0544700            add ecx, 004754D0
:004457DF 8945E4                  mov dword ptr [ebp-1C], eax
:004457E2 8D043E                  lea eax, dword ptr [esi+edi]
:004457E5 51                      push ecx
:004457E6 48                      dec eax
:004457E7 8D55EC                  lea edx, dword ptr [ebp-14]
:004457EA 8945E8                  mov dword ptr [ebp-18], eax
:004457ED 8D45DC                  lea eax, dword ptr [ebp-24]
:004457F0 50                      push eax
:004457F1 52                      push edx
:004457F2 E814F7FFFF              call 00444F0B
:004457F7 83C40C                  add esp, 0000000C
:004457FA 85C0                    test eax, eax
:004457FC 0F8452010000            je 00445954
:00445802 A18C544700              mov eax, dword ptr [0047548C]
:00445807 833C8578FE460007        cmp dword ptr [4*eax+0046FE78], 00000007
:0044580F 7505                    jne 00445816
:00445811 8B7D18                  mov edi, dword ptr [ebp+18]
:00445814 EB2B                    jmp 00445841

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044580F(C)
|
:00445816 8B4510                  mov eax, dword ptr [ebp+10]
:00445819 0FAFC6                  imul eax, esi
:0044581C 50                      push eax
:0044581D 6A00                    push 00000000

* Reference To: KERNEL32.GlobalAlloc, Ord:0140h
                                  |
:0044581F FF157C734700            Call dword ptr [0047737C]
:00445825 50                      push eax
:00445826 8945FC                  mov dword ptr [ebp-04], eax

* Reference To: KERNEL32.GlobalLock, Ord:014Bh
                                  |
:00445829 FF1578734700            Call dword ptr [00477378]
:0044582F 50                      push eax
:00445830 8BF8                    mov edi, eax
:00445832 FF7518                  push [ebp+18]
:00445835 56                      push esi
:00445836 FF7510                  push [ebp+10]
:00445839 E81C1A0000              call 0044725A
:0044583E 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445814(U)
|
:00445841 FF75F0                  push [ebp-10]
:00445844 FF75EC                  push [ebp-14]
:00445847 E8D7F5FFFF              call 00444E23
:0044584C 83C408                  add esp, 00000008
:0044584F 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00445852 2B4DE0                  sub ecx, dword ptr [ebp-20]
:00445855 8B75F4                  mov esi, dword ptr [ebp-0C]
:00445858 0FAF4D10                imul ecx, dword ptr [ebp+10]
:0044585C 2B4DDC                  sub ecx, dword ptr [ebp-24]
:0044585F 2B75EC                  sub esi, dword ptr [ebp-14]
:00445862 034DEC                  add ecx, dword ptr [ebp-14]
:00445865 46                      inc esi
:00445866 03F9                    add edi, ecx
:00445868 8B5DF8                  mov ebx, dword ptr [ebp-08]
:0044586B 2B5DF0                  sub ebx, dword ptr [ebp-10]
:0044586E 8B0D8C544700            mov ecx, dword ptr [0047548C]
:00445874 C1E102                  shl ecx, 02
:00445877 43                      inc ebx
:00445878 8B91780D4700            mov edx, dword ptr [ecx+00470D78]
:0044587E 85D2                    test edx, edx
:00445880 741D                    je 0044589F
:00445882 83FA01                  cmp edx, 00000001
:00445885 7432                    je 004458B9
:00445887 83FA02                  cmp edx, 00000002
:0044588A 7447                    je 004458D3
:0044588C 83FA03                  cmp edx, 00000003
:0044588F 745C                    je 004458ED
:00445891 83FA04                  cmp edx, 00000004
:00445894 7471                    je 00445907
:00445896 83FA05                  cmp edx, 00000005
:00445899 0F8583000000            jne 00445922

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445880(C)
|
:0044589F FFB178FE4600            push dword ptr [ecx+0046FE78]
:004458A5 50                      push eax
:004458A6 57                      push edi
:004458A7 FF7510                  push [ebp+10]
:004458AA FFB108394700            push dword ptr [ecx+00473908]
:004458B0 53                      push ebx
:004458B1 56                      push esi
:004458B2 E8E7160000              call 00446F9E
:004458B7 EB66                    jmp 0044591F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445885(C)
|
:004458B9 FFB178FE4600            push dword ptr [ecx+0046FE78]
:004458BF 50                      push eax
:004458C0 57                      push edi
:004458C1 FF7510                  push [ebp+10]
:004458C4 FFB108394700            push dword ptr [ecx+00473908]
:004458CA 53                      push ebx
:004458CB 56                      push esi
:004458CC E87B170000              call 0044704C
:004458D1 EB4C                    jmp 0044591F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044588A(C)
|
:004458D3 FFB178FE4600            push dword ptr [ecx+0046FE78]
:004458D9 50                      push eax
:004458DA 57                      push edi
:004458DB FF7510                  push [ebp+10]
:004458DE FFB108394700            push dword ptr [ecx+00473908]
:004458E4 53                      push ebx
:004458E5 56                      push esi
:004458E6 E8E1160000              call 00446FCC
:004458EB EB32                    jmp 0044591F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044588F(C)
|
:004458ED FFB178FE4600            push dword ptr [ecx+0046FE78]
:004458F3 50                      push eax
:004458F4 57                      push edi
:004458F5 FF7510                  push [ebp+10]
:004458F8 FFB108394700            push dword ptr [ecx+00473908]
:004458FE 53                      push ebx
:004458FF 56                      push esi
:00445900 E807170000              call 0044700C
:00445905 EB18                    jmp 0044591F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445894(C)
|
:00445907 FFB178FE4600            push dword ptr [ecx+0046FE78]
:0044590D 50                      push eax
:0044590E 57                      push edi
:0044590F FF7510                  push [ebp+10]
:00445912 FFB108394700            push dword ptr [ecx+00473908]
:00445918 53                      push ebx
:00445919 56                      push esi
:0044591A E876170000              call 00447095

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004458B7(U), :004458D1(U), :004458EB(U), :00445905(U)
|
:0044591F 83C41C                  add esp, 0000001C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445899(C)
|
:00445922 8B0D8C544700            mov ecx, dword ptr [0047548C]
:00445928 833C8D78FE460007        cmp dword ptr [4*ecx+0046FE78], 00000007
:00445930 7412                    je 00445944
:00445932 FF75FC                  push [ebp-04]

* Reference To: KERNEL32.GlobalUnlock, Ord:0151h
                                  |
:00445935 FF1574734700            Call dword ptr [00477374]
:0044593B FF75FC                  push [ebp-04]

* Reference To: KERNEL32.GlobalFree, Ord:0147h
                                  |
:0044593E FF1570734700            Call dword ptr [00477370]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445930(C)
|
:00445944 53                      push ebx
:00445945 56                      push esi
:00445946 FF75F0                  push [ebp-10]
:00445949 FF75EC                  push [ebp-14]
:0044594C E882EAFFFF              call 004443D3
:00445951 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004457FC(C)
|
:00445954 5F                      pop edi
:00445955 5E                      pop esi
:00445956 5B                      pop ebx
:00445957 8BE5                    mov esp, ebp
:00445959 5D                      pop ebp
:0044595A C3                      ret



* Referenced by a CALL at Addresses:
|:0040EF29   , :004219B6   , :00421B08   , :0042700A   , :00435B7B   
|:00435CA0   , :00435D6E   , :004386C7   , :0043D345   , :0043E1C6   
|
:0044595B 55                      push ebp
:0044595C 8B158C544700            mov edx, dword ptr [0047548C]
:00445962 8BEC                    mov ebp, esp
:00445964 83EC2C                  sub esp, 0000002C
:00445967 53                      push ebx
:00445968 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044596B 56                      push esi
:0044596C 8B1CD594194700          mov ebx, dword ptr [8*edx+00471994]
:00445973 57                      push edi
:00445974 8B3CD590194700          mov edi, dword ptr [8*edx+00471990]
:0044597B 8D040F                  lea eax, dword ptr [edi+ecx]
:0044597E 8945D4                  mov dword ptr [ebp-2C], eax
:00445981 8B450C                  mov eax, dword ptr [ebp+0C]
:00445984 8D3403                  lea esi, dword ptr [ebx+eax]
:00445987 8975D8                  mov dword ptr [ebp-28], esi
:0044598A 8B7510                  mov esi, dword ptr [ebp+10]
:0044598D 03CE                    add ecx, esi
:0044598F 03CF                    add ecx, edi
:00445991 49                      dec ecx
:00445992 C1E204                  shl edx, 04
:00445995 894DDC                  mov dword ptr [ebp-24], ecx
:00445998 8B4D14                  mov ecx, dword ptr [ebp+14]
:0044599B 81C2E83D4700            add edx, 00473DE8
:004459A1 03C8                    add ecx, eax
:004459A3 52                      push edx
:004459A4 03CB                    add ecx, ebx
:004459A6 8D45D4                  lea eax, dword ptr [ebp-2C]
:004459A9 49                      dec ecx
:004459AA 50                      push eax
:004459AB 894DE0                  mov dword ptr [ebp-20], ecx
:004459AE 8D4DE4                  lea ecx, dword ptr [ebp-1C]
:004459B1 51                      push ecx
:004459B2 E854F5FFFF              call 00444F0B
:004459B7 83C40C                  add esp, 0000000C
:004459BA 85C0                    test eax, eax
:004459BC 0F84C9000000            je 00445A8B
:004459C2 FF75E8                  push [ebp-18]
:004459C5 FF75E4                  push [ebp-1C]
:004459C8 E856F4FFFF              call 00444E23
:004459CD 83C408                  add esp, 00000008
:004459D0 8B7DEC                  mov edi, dword ptr [ebp-14]
:004459D3 2B7DE4                  sub edi, dword ptr [ebp-1C]
:004459D6 8B5DF0                  mov ebx, dword ptr [ebp-10]
:004459D9 47                      inc edi
:004459DA 2B5DE8                  sub ebx, dword ptr [ebp-18]
:004459DD 43                      inc ebx
:004459DE 8B0D8C544700            mov ecx, dword ptr [0047548C]
:004459E4 C1E102                  shl ecx, 02
:004459E7 8945F8                  mov dword ptr [ebp-08], eax
:004459EA 83B978FE460003          cmp dword ptr [ecx+0046FE78], 00000003
:004459F1 7F6F                    jg 00445A62
:004459F3 8B4514                  mov eax, dword ptr [ebp+14]
:004459F6 0FAFC6                  imul eax, esi
:004459F9 40                      inc eax
:004459FA 50                      push eax
:004459FB 6A00                    push 00000000

* Reference To: KERNEL32.GlobalAlloc, Ord:0140h
                                  |
:004459FD FF157C734700            Call dword ptr [0047737C]
:00445A03 50                      push eax
:00445A04 8945FC                  mov dword ptr [ebp-04], eax

* Reference To: KERNEL32.GlobalLock, Ord:014Bh
                                  |
:00445A07 FF1578734700            Call dword ptr [00477378]
:00445A0D 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00445A10 8945F4                  mov dword ptr [ebp-0C], eax
:00445A13 2B4DD8                  sub ecx, dword ptr [ebp-28]
:00445A16 0FAFCE                  imul ecx, esi
:00445A19 2B4DD4                  sub ecx, dword ptr [ebp-2C]
:00445A1C 034DE4                  add ecx, dword ptr [ebp-1C]
:00445A1F 03C1                    add eax, ecx
:00445A21 50                      push eax
:00445A22 A18C544700              mov eax, dword ptr [0047548C]
:00445A27 FF75F8                  push [ebp-08]
:00445A2A 56                      push esi
:00445A2B FF348508394700          push dword ptr [4*eax+00473908]
:00445A32 53                      push ebx
:00445A33 57                      push edi
:00445A34 E8B0160000              call 004470E9
:00445A39 83C418                  add esp, 00000018
:00445A3C FF7518                  push [ebp+18]
:00445A3F FF75F4                  push [ebp-0C]
:00445A42 FF7514                  push [ebp+14]
:00445A45 56                      push esi
:00445A46 E8B6170000              call 00447201
:00445A4B 83C410                  add esp, 00000010
:00445A4E FF75FC                  push [ebp-04]

* Reference To: KERNEL32.GlobalUnlock, Ord:0151h
                                  |
:00445A51 FF1574734700            Call dword ptr [00477374]
:00445A57 FF75FC                  push [ebp-04]

* Reference To: KERNEL32.GlobalFree, Ord:0147h
                                  |
:00445A5A FF1570734700            Call dword ptr [00477370]
:00445A60 EB29                    jmp 00445A8B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004459F1(C)
|
:00445A62 8B55E8                  mov edx, dword ptr [ebp-18]
:00445A65 8B4518                  mov eax, dword ptr [ebp+18]
:00445A68 2B55D8                  sub edx, dword ptr [ebp-28]
:00445A6B 0FAFD6                  imul edx, esi
:00445A6E 2B55D4                  sub edx, dword ptr [ebp-2C]
:00445A71 0355E4                  add edx, dword ptr [ebp-1C]
:00445A74 03C2                    add eax, edx
:00445A76 50                      push eax
:00445A77 FF75F8                  push [ebp-08]
:00445A7A 56                      push esi
:00445A7B FFB108394700            push dword ptr [ecx+00473908]
:00445A81 53                      push ebx
:00445A82 57                      push edi
:00445A83 E861160000              call 004470E9
:00445A88 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004459BC(C), :00445A60(U)
|
:00445A8B 5F                      pop edi
:00445A8C 5E                      pop esi
:00445A8D 5B                      pop ebx
:00445A8E 8BE5                    mov esp, ebp
:00445A90 5D                      pop ebp
:00445A91 C3                      ret



* Referenced by a CALL at Addresses:
|:00420733   , :0042089B   , :004208F4   , :00420940   , :00447B37   
|
:00445A92 55                      push ebp
:00445A93 A18C544700              mov eax, dword ptr [0047548C]
:00445A98 C1E003                  shl eax, 03
:00445A9B 8BEC                    mov ebp, esp
:00445A9D 83EC34                  sub esp, 00000034
:00445AA0 8B9090194700            mov edx, dword ptr [eax+00471990]
:00445AA6 53                      push ebx
:00445AA7 56                      push esi
:00445AA8 57                      push edi
:00445AA9 8B5D0C                  mov ebx, dword ptr [ebp+0C]
:00445AAC 8B7D08                  mov edi, dword ptr [ebp+08]
:00445AAF 8B7510                  mov esi, dword ptr [ebp+10]
:00445AB2 8D0C17                  lea ecx, dword ptr [edi+edx]
:00445AB5 894DCC                  mov dword ptr [ebp-34], ecx
:00445AB8 8B8894194700            mov ecx, dword ptr [eax+00471994]
:00445ABE 8D040B                  lea eax, dword ptr [ebx+ecx]
:00445AC1 034D14                  add ecx, dword ptr [ebp+14]
:00445AC4 03CB                    add ecx, ebx
:00445AC6 8945D0                  mov dword ptr [ebp-30], eax
:00445AC9 8D0416                  lea eax, dword ptr [esi+edx]
:00445ACC 49                      dec ecx
:00445ACD 03C7                    add eax, edi
:00445ACF 894DD8                  mov dword ptr [ebp-28], ecx
:00445AD2 48                      dec eax
:00445AD3 8D4DCC                  lea ecx, dword ptr [ebp-34]
:00445AD6 8D55E0                  lea edx, dword ptr [ebp-20]
:00445AD9 8945D4                  mov dword ptr [ebp-2C], eax
:00445ADC A18C544700              mov eax, dword ptr [0047548C]
:00445AE1 C1E004                  shl eax, 04
:00445AE4 05D0544700              add eax, 004754D0
:00445AE9 50                      push eax
:00445AEA 51                      push ecx
:00445AEB 52                      push edx
:00445AEC E81AF4FFFF              call 00444F0B
:00445AF1 83C40C                  add esp, 0000000C
:00445AF4 85C0                    test eax, eax
:00445AF6 0F844A020000            je 00445D46
:00445AFC 8B0D8C544700            mov ecx, dword ptr [0047548C]
:00445B02 C1E102                  shl ecx, 02
:00445B05 8B81C0084700            mov eax, dword ptr [ecx+004708C0]
:00445B0B 85C0                    test eax, eax
:00445B0D 7C46                    jl 00445B55
:00445B0F 83F803                  cmp eax, 00000003
:00445B12 7E0C                    jle 00445B20
:00445B14 83F804                  cmp eax, 00000004
:00445B17 7418                    je 00445B31
:00445B19 83F805                  cmp eax, 00000005
:00445B1C 7425                    je 00445B43
:00445B1E EB35                    jmp 00445B55

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445B12(C)
|
:00445B20 8B81283C4700            mov eax, dword ptr [ecx+00473C28]
:00445B26 8B89983A4700            mov ecx, dword ptr [ecx+00473A98]
:00445B2C 8945F4                  mov dword ptr [ebp-0C], eax
:00445B2F EB21                    jmp 00445B52

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445B17(C)
|
:00445B31 C745F000000000          mov [ebp-10], 00000000
:00445B38 8B81283C4700            mov eax, dword ptr [ecx+00473C28]
:00445B3E 8945F4                  mov dword ptr [ebp-0C], eax
:00445B41 EB12                    jmp 00445B55

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445B1C(C)
|
:00445B43 8B81983A4700            mov eax, dword ptr [ecx+00473A98]
:00445B49 8B89283C4700            mov ecx, dword ptr [ecx+00473C28]
:00445B4F 8945F4                  mov dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445B2F(U)
|
:00445B52 894DF0                  mov dword ptr [ebp-10], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00445B0D(C), :00445B1E(U), :00445B41(U)
|
:00445B55 FF75E4                  push [ebp-1C]
:00445B58 FF75E0                  push [ebp-20]
:00445B5B E8C3F2FFFF              call 00444E23
:00445B60 83C408                  add esp, 00000008
:00445B63 8B7DE8                  mov edi, dword ptr [ebp-18]
:00445B66 2B7DE0                  sub edi, dword ptr [ebp-20]
:00445B69 8B5DEC                  mov ebx, dword ptr [ebp-14]
:00445B6C 47                      inc edi
:00445B6D 2B5DE4                  sub ebx, dword ptr [ebp-1C]
:00445B70 43                      inc ebx
:00445B71 8945F8                  mov dword ptr [ebp-08], eax
:00445B74 8B45D0                  mov eax, dword ptr [ebp-30]
:00445B77 3945E4                  cmp dword ptr [ebp-1C], eax
:00445B7A 7571                    jne 00445BED
:00445B7C 8B45CC                  mov eax, dword ptr [ebp-34]
:00445B7F 3945E0                  cmp dword ptr [ebp-20], eax
:00445B82 7569                    jne 00445BED
:00445B84 8B45D8                  mov eax, dword ptr [ebp-28]
:00445B87 3945EC                  cmp dword ptr [ebp-14], eax
:00445B8A 7561                    jne 00445BED
:00445B8C 8B45D4                  mov eax, dword ptr [ebp-2C]
:00445B8F 3945E8                  cmp dword ptr [ebp-18], eax
:00445B92 7559                    jne 00445BED
:00445B94 8B0D8C544700            mov ecx, dword ptr [0047548C]
:00445B9A C1E102                  shl ecx, 02
:00445B9D 8B81C0084700            mov eax, dword ptr [ecx+004708C0]
:00445BA3 85C0                    test eax, eax
:00445BA5 740A                    je 00445BB1
:00445BA7 83F804                  cmp eax, 00000004
:00445BAA 7420                    je 00445BCC
:00445BAC 83F805                  cmp eax, 00000005
:00445BAF 753C                    jne 00445BED

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445BA5(C)
|
:00445BB1 FF75F8                  push [ebp-08]
:00445BB4 FF7518                  push [ebp+18]
:00445BB7 FF75F0                  push [ebp-10]
:00445BBA FF75F4                  push [ebp-0C]
:00445BBD FFB108394700            push dword ptr [ecx+00473908]
:00445BC3 53                      push ebx
:00445BC4 57                      push edi
:00445BC5 E84D150000              call 00447117
:00445BCA EB19                    jmp 00445BE5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445BAA(C)
|
:00445BCC FF75F8                  push [ebp-08]
:00445BCF FF7518                  push [ebp+18]
:00445BD2 FF75F0                  push [ebp-10]
:00445BD5 FF75F4                  push [ebp-0C]
:00445BD8 FFB108394700            push dword ptr [ecx+00473908]
:00445BDE 53                      push ebx
:00445BDF 57                      push edi
:00445BE0 E8AB150000              call 00447190

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445BCA(U)
|
:00445BE5 83C41C                  add esp, 0000001C
:00445BE8 E949010000              jmp 00445D36

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00445B7A(C), :00445B82(C), :00445B8A(C), :00445B92(C), :00445BAF(C)
|
:00445BED 8D4607                  lea eax, dword ptr [esi+07]
:00445BF0 0FAF4514                imul eax, dword ptr [ebp+14]
:00445BF4 50                      push eax
:00445BF5 6A00                    push 00000000

* Reference To: KERNEL32.GlobalAlloc, Ord:0140h
                                  |
:00445BF7 FF157C734700            Call dword ptr [0047737C]
:00445BFD 50                      push eax
:00445BFE 8945DC                  mov dword ptr [ebp-24], eax

* Reference To: KERNEL32.GlobalLock, Ord:014Bh
                                  |
:00445C01 FF1578734700            Call dword ptr [00477378]
:00445C07 FF75F0                  push [ebp-10]
:00445C0A FF75F4                  push [ebp-0C]
:00445C0D 50                      push eax
:00445C0E FF7518                  push [ebp+18]
:00445C11 FF7514                  push [ebp+14]
:00445C14 56                      push esi
:00445C15 8945FC                  mov dword ptr [ebp-04], eax
:00445C18 E830010000              call 00445D4D
:00445C1D 83C418                  add esp, 00000018
:00445C20 8B45E4                  mov eax, dword ptr [ebp-1C]
:00445C23 2B45D0                  sub eax, dword ptr [ebp-30]
:00445C26 8B0D8C544700            mov ecx, dword ptr [0047548C]
:00445C2C 0FAFC6                  imul eax, esi
:00445C2F C1E102                  shl ecx, 02
:00445C32 2B45CC                  sub eax, dword ptr [ebp-34]
:00445C35 0345E0                  add eax, dword ptr [ebp-20]
:00445C38 0145FC                  add dword ptr [ebp-04], eax
:00445C3B 8B81C0084700            mov eax, dword ptr [ecx+004708C0]
:00445C41 85C0                    test eax, eax
:00445C43 7421                    je 00445C66
:00445C45 83F801                  cmp eax, 00000001
:00445C48 743E                    je 00445C88
:00445C4A 83F802                  cmp eax, 00000002
:00445C4D 7458                    je 00445CA7
:00445C4F 83F803                  cmp eax, 00000003
:00445C52 7472                    je 00445CC6
:00445C54 83F804                  cmp eax, 00000004
:00445C57 0F8488000000            je 00445CE5
:00445C5D 83F805                  cmp eax, 00000005
:00445C60 0F85BE000000            jne 00445D24

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445C43(C)
|
:00445C66 FFB178FE4600            push dword ptr [ecx+0046FE78]
:00445C6C FF75F8                  push [ebp-08]
:00445C6F FF75FC                  push [ebp-04]
:00445C72 56                      push esi
:00445C73 FFB108394700            push dword ptr [ecx+00473908]
:00445C79 53                      push ebx
:00445C7A 57                      push edi
:00445C7B E81E130000              call 00446F9E
:00445C80 83C41C                  add esp, 0000001C
:00445C83 E99C000000              jmp 00445D24

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445C48(C)
|
:00445C88 FFB178FE4600            push dword ptr [ecx+0046FE78]
:00445C8E FF75F8                  push [ebp-08]
:00445C91 FF75FC                  push [ebp-04]
:00445C94 56                      push esi
:00445C95 FFB108394700            push dword ptr [ecx+00473908]
:00445C9B 53                      push ebx
:00445C9C 57                      push edi
:00445C9D E8AA130000              call 0044704C
:00445CA2 83C41C                  add esp, 0000001C
:00445CA5 EB7D                    jmp 00445D24

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445C4D(C)
|
:00445CA7 FFB178FE4600            push dword ptr [ecx+0046FE78]
:00445CAD FF75F8                  push [ebp-08]
:00445CB0 FF75FC                  push [ebp-04]
:00445CB3 56                      push esi
:00445CB4 FFB108394700            push dword ptr [ecx+00473908]
:00445CBA 53                      push ebx
:00445CBB 57                      push edi
:00445CBC E80B130000              call 00446FCC
:00445CC1 83C41C                  add esp, 0000001C
:00445CC4 EB5E                    jmp 00445D24

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445C52(C)
|
:00445CC6 FFB178FE4600            push dword ptr [ecx+0046FE78]
:00445CCC FF75F8                  push [ebp-08]
:00445CCF FF75FC                  push [ebp-04]
:00445CD2 56                      push esi
:00445CD3 FFB108394700            push dword ptr [ecx+00473908]
:00445CD9 53                      push ebx
:00445CDA 57                      push edi
:00445CDB E82C130000              call 0044700C
:00445CE0 83C41C                  add esp, 0000001C
:00445CE3 EB3F                    jmp 00445D24

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445C57(C)
|
:00445CE5 8B8108394700            mov eax, dword ptr [ecx+00473908]
:00445CEB 2BF7                    sub esi, edi
:00445CED 2BC7                    sub eax, edi
:00445CEF 85DB                    test ebx, ebx
:00445CF1 8945F4                  mov dword ptr [ebp-0C], eax
:00445CF4 7E2E                    jle 00445D24
:00445CF6 8BCB                    mov ecx, ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445D22(C)
|
:00445CF8 85FF                    test edi, edi
:00445CFA 7E1C                    jle 00445D18
:00445CFC 897DF0                  mov dword ptr [ebp-10], edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445D16(C)
|
:00445CFF 8B45FC                  mov eax, dword ptr [ebp-04]
:00445D02 8A00                    mov al, byte ptr [eax]
:00445D04 84C0                    test al, al
:00445D06 7405                    je 00445D0D
:00445D08 8B55F8                  mov edx, dword ptr [ebp-08]
:00445D0B 8802                    mov byte ptr [edx], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445D06(C)
|
:00445D0D FF45F8                  inc [ebp-08]
:00445D10 FF45FC                  inc [ebp-04]
:00445D13 FF4DF0                  dec [ebp-10]
:00445D16 75E7                    jne 00445CFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445CFA(C)
|
:00445D18 8B55F4                  mov edx, dword ptr [ebp-0C]
:00445D1B 0175FC                  add dword ptr [ebp-04], esi
:00445D1E 0155F8                  add dword ptr [ebp-08], edx
:00445D21 49                      dec ecx
:00445D22 75D4                    jne 00445CF8

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00445C60(C), :00445C83(U), :00445CA5(U), :00445CC4(U), :00445CE3(U)
|:00445CF4(C)
|
:00445D24 FF75DC                  push [ebp-24]

* Reference To: KERNEL32.GlobalUnlock, Ord:0151h
                                  |
:00445D27 FF1574734700            Call dword ptr [00477374]
:00445D2D FF75DC                  push [ebp-24]

* Reference To: KERNEL32.GlobalFree, Ord:0147h
                                  |
:00445D30 FF1570734700            Call dword ptr [00477370]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445BE8(U)
|
:00445D36 53                      push ebx
:00445D37 57                      push edi
:00445D38 FF75E4                  push [ebp-1C]
:00445D3B FF75E0                  push [ebp-20]
:00445D3E E890E6FFFF              call 004443D3
:00445D43 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445AF6(C)
|
:00445D46 5F                      pop edi
:00445D47 5E                      pop esi
:00445D48 5B                      pop ebx
:00445D49 8BE5                    mov esp, ebp
:00445D4B 5D                      pop ebp
:00445D4C C3                      ret



* Referenced by a CALL at Address:
|:00445C18   
|
:00445D4D 55                      push ebp
:00445D4E 8BEC                    mov ebp, esp
:00445D50 83EC0C                  sub esp, 0000000C
:00445D53 53                      push ebx
:00445D54 56                      push esi
:00445D55 57                      push edi
:00445D56 8B7508                  mov esi, dword ptr [ebp+08]
:00445D59 8B7D08                  mov edi, dword ptr [ebp+08]
:00445D5C 83E607                  and esi, 00000007
:00445D5F C1FF03                  sar edi, 03
:00445D62 8B450C                  mov eax, dword ptr [ebp+0C]
:00445D65 85C0                    test eax, eax
:00445D67 7E68                    jle 00445DD1
:00445D69 8B5D10                  mov ebx, dword ptr [ebp+10]
:00445D6C 8945F8                  mov dword ptr [ebp-08], eax
:00445D6F 8B4514                  mov eax, dword ptr [ebp+14]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445DCF(C)
|
:00445D72 8D4FFF                  lea ecx, dword ptr [edi-01]
:00445D75 85FF                    test edi, edi
:00445D77 894DFC                  mov dword ptr [ebp-04], ecx
:00445D7A 742B                    je 00445DA7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445DA5(C)
|
:00445D7C C745F408000000          mov [ebp-0C], 00000008
:00445D83 8A13                    mov dl, byte ptr [ebx]
:00445D85 43                      inc ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445D9B(C)
|
:00445D86 F6C280                  test dl, 80
:00445D89 7405                    je 00445D90
:00445D8B 8A4D18                  mov cl, byte ptr [ebp+18]
:00445D8E EB03                    jmp 00445D93

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445D89(C)
|
:00445D90 8A4D1C                  mov cl, byte ptr [ebp+1C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445D8E(U)
|
:00445D93 02D2                    add dl, dl
:00445D95 8808                    mov byte ptr [eax], cl
:00445D97 40                      inc eax
:00445D98 FF4DF4                  dec [ebp-0C]
:00445D9B 75E9                    jne 00445D86
:00445D9D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00445DA0 FF4DFC                  dec [ebp-04]
:00445DA3 85C9                    test ecx, ecx
:00445DA5 75D5                    jne 00445D7C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445D7A(C)
|
:00445DA7 85F6                    test esi, esi
:00445DA9 7421                    je 00445DCC
:00445DAB 8A13                    mov dl, byte ptr [ebx]
:00445DAD 43                      inc ebx
:00445DAE 85F6                    test esi, esi
:00445DB0 7E1A                    jle 00445DCC
:00445DB2 8975FC                  mov dword ptr [ebp-04], esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445DCA(C)
|
:00445DB5 F6C280                  test dl, 80
:00445DB8 7405                    je 00445DBF
:00445DBA 8A4D18                  mov cl, byte ptr [ebp+18]
:00445DBD EB03                    jmp 00445DC2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445DB8(C)
|
:00445DBF 8A4D1C                  mov cl, byte ptr [ebp+1C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445DBD(U)
|
:00445DC2 02D2                    add dl, dl
:00445DC4 8808                    mov byte ptr [eax], cl
:00445DC6 40                      inc eax
:00445DC7 FF4DFC                  dec [ebp-04]
:00445DCA 75E9                    jne 00445DB5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00445DA9(C), :00445DB0(C)
|
:00445DCC FF4DF8                  dec [ebp-08]
:00445DCF 75A1                    jne 00445D72

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445D67(C)
|
:00445DD1 5F                      pop edi
:00445DD2 5E                      pop esi
:00445DD3 5B                      pop ebx
:00445DD4 8BE5                    mov esp, ebp
:00445DD6 5D                      pop ebp
:00445DD7 C3                      ret



* Referenced by a CALL at Addresses:
|:0042080F   , :0042504C   , :00447B6F   
|
:00445DD8 FF742408                push [esp+08]
:00445DDC FF742408                push [esp+08]
:00445DE0 E804000000              call 00445DE9
:00445DE5 83C408                  add esp, 00000008
:00445DE8 C3                      ret



* Referenced by a CALL at Address:
|:00445DE0   
|
:00445DE9 55                      push ebp
:00445DEA 8BEC                    mov ebp, esp
:00445DEC 83EC44                  sub esp, 00000044
:00445DEF 56                      push esi
:00445DF0 57                      push edi
:00445DF1 8B750C                  mov esi, dword ptr [ebp+0C]
:00445DF4 6A20                    push 00000020
:00445DF6 33FF                    xor edi, edi
:00445DF8 57                      push edi
:00445DF9 56                      push esi
:00445DFA E831280000              call 00448630
:00445DFF 83C40C                  add esp, 0000000C
:00445E02 8B4508                  mov eax, dword ptr [ebp+08]
:00445E05 8865FE                  mov byte ptr [ebp-02], ah
:00445E08 8845FF                  mov byte ptr [ebp-01], al
:00445E0B 6A42                    push 00000042
:00445E0D 6A10                    push 00000010
:00445E0F 6A10                    push 00000010
:00445E11 57                      push edi
:00445E12 57                      push edi
:00445E13 FF3574374700            push dword ptr [00473774]

* Reference To: GDI32.PatBlt, Ord:0115h
                                  |
:00445E19 FF15DC724700            Call dword ptr [004772DC]
:00445E1F 6A01                    push 00000001
:00445E21 FF3574374700            push dword ptr [00473774]

* Reference To: GDI32.SetBkMode, Ord:0143h
                                  |
:00445E27 FF15A8724700            Call dword ptr [004772A8]
:00445E2D 68FFFFFF00              push 00FFFFFF
:00445E32 FF3574374700            push dword ptr [00473774]

* Reference To: GDI32.SetTextColor, Ord:0163h
                                  |
:00445E38 FF15B0724700            Call dword ptr [004772B0]
:00445E3E 6A02                    push 00000002
:00445E40 8D4DFE                  lea ecx, dword ptr [ebp-02]
:00445E43 51                      push ecx
:00445E44 57                      push edi
:00445E45 57                      push edi
:00445E46 FF3574374700            push dword ptr [00473774]

* Reference To: GDI32.TextOutA, Ord:0174h
                                  |
:00445E4C FF15E8724700            Call dword ptr [004772E8]
:00445E52 57                      push edi
:00445E53 8D4DBC                  lea ecx, dword ptr [ebp-44]
:00445E56 68080F4700              push 00470F08
:00445E5B A174374700              mov eax, dword ptr [00473774]
:00445E60 51                      push ecx
:00445E61 6A10                    push 00000010
:00445E63 57                      push edi
:00445E64 FF3598054700            push dword ptr [00470598]
:00445E6A 50                      push eax

* Reference To: GDI32.GetDIBits, Ord:00BBh
                                  |
:00445E6B FF15EC724700            Call dword ptr [004772EC]
:00445E71 A198544700              mov eax, dword ptr [00475498]
:00445E76 8B0DA0544700            mov ecx, dword ptr [004754A0]
:00445E7C 3BC1                    cmp eax, ecx
:00445E7E 7C02                    jl 00445E82
:00445E80 8BC1                    mov eax, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445E7E(C)
|
:00445E82 8D4DF8                  lea ecx, dword ptr [ebp-08]
:00445E85 B810000000              mov eax, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445E96(C)
|
:00445E8A 8B11                    mov edx, dword ptr [ecx]
:00445E8C 83E904                  sub ecx, 00000004
:00445E8F 668916                  mov word ptr [esi], dx
:00445E92 83C602                  add esi, 00000002
:00445E95 48                      dec eax
:00445E96 75F2                    jne 00445E8A
:00445E98 5F                      pop edi
:00445E99 5E                      pop esi
:00445E9A 8BE5                    mov esp, ebp
:00445E9C 5D                      pop ebp
:00445E9D C3                      ret



* Referenced by a CALL at Addresses:
|:00424F7F   , :00424FF3   
|
:00445E9E 8B4C2404                mov ecx, dword ptr [esp+04]
:00445EA2 81F921760000            cmp ecx, 00007621
:00445EA8 7C19                    jl 00445EC3
:00445EAA 81F97E760000            cmp ecx, 0000767E
:00445EB0 7F11                    jg 00445EC3
:00445EB2 C1E105                  shl ecx, 05
:00445EB5 6A20                    push 00000020
:00445EB7 FF74240C                push [esp+0C]
:00445EBB 81C1A8583800            add ecx, 003858A8
:00445EC1 EB1F                    jmp 00445EE2

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00445EA8(C), :00445EB0(C)
|
:00445EC3 81F921770000            cmp ecx, 00007721
:00445EC9 7C20                    jl 00445EEB
:00445ECB 81F97E770000            cmp ecx, 0000777E
:00445ED1 7F18                    jg 00445EEB
:00445ED3 C1E105                  shl ecx, 05
:00445ED6 6A20                    push 00000020
:00445ED8 FF74240C                push [esp+0C]
:00445EDC 81C168443800            add ecx, 00384468

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445EC1(U)
|
:00445EE2 51                      push ecx
:00445EE3 E8A8270000              call 00448690
:00445EE8 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00445EC9(C), :00445ED1(C)
|
:00445EEB C3                      ret

* Referenced by a CALL at Addresses:
|:004207F0   , :00447B96   
|
:00445EEC 55                      push ebp
:00445EED 8BEC                    mov ebp, esp
:00445EEF 83EC40                  sub esp, 00000040
:00445EF2 56                      push esi
:00445EF3 57                      push edi
:00445EF4 8B750C                  mov esi, dword ptr [ebp+0C]
:00445EF7 6A10                    push 00000010
:00445EF9 33FF                    xor edi, edi
:00445EFB 57                      push edi
:00445EFC 56                      push esi
:00445EFD E82E270000              call 00448630
:00445F02 83C40C                  add esp, 0000000C
:00445F05 837D0820                cmp dword ptr [ebp+08], 00000020
:00445F09 0F848A000000            je 00445F99
:00445F0F 6A42                    push 00000042
:00445F11 A174374700              mov eax, dword ptr [00473774]
:00445F16 6A10                    push 00000010
:00445F18 6A10                    push 00000010
:00445F1A 57                      push edi
:00445F1B 57                      push edi
:00445F1C 50                      push eax

* Reference To: GDI32.PatBlt, Ord:0115h
                                  |
:00445F1D FF15DC724700            Call dword ptr [004772DC]
:00445F23 6A01                    push 00000001
:00445F25 A174374700              mov eax, dword ptr [00473774]
:00445F2A 50                      push eax

* Reference To: GDI32.SetBkMode, Ord:0143h
                                  |
:00445F2B FF15A8724700            Call dword ptr [004772A8]
:00445F31 68FFFFFF00              push 00FFFFFF
:00445F36 A174374700              mov eax, dword ptr [00473774]
:00445F3B 50                      push eax

* Reference To: GDI32.SetTextColor, Ord:0163h
                                  |
:00445F3C FF15B0724700            Call dword ptr [004772B0]
:00445F42 6A01                    push 00000001
:00445F44 8D4508                  lea eax, dword ptr [ebp+08]
:00445F47 50                      push eax
:00445F48 57                      push edi
:00445F49 57                      push edi
:00445F4A FF3574374700            push dword ptr [00473774]

* Reference To: GDI32.TextOutA, Ord:0174h
                                  |
:00445F50 FF15E8724700            Call dword ptr [004772E8]
:00445F56 57                      push edi
:00445F57 8D4DC0                  lea ecx, dword ptr [ebp-40]
:00445F5A 68080F4700              push 00470F08
:00445F5F A174374700              mov eax, dword ptr [00473774]
:00445F64 51                      push ecx
:00445F65 6A10                    push 00000010
:00445F67 57                      push edi
:00445F68 FF3598054700            push dword ptr [00470598]
:00445F6E 50                      push eax

* Reference To: GDI32.GetDIBits, Ord:00BBh
                                  |
:00445F6F FF15EC724700            Call dword ptr [004772EC]
:00445F75 A198544700              mov eax, dword ptr [00475498]
:00445F7A 8B0DA0544700            mov ecx, dword ptr [004754A0]
:00445F80 3BC1                    cmp eax, ecx
:00445F82 7C02                    jl 00445F86
:00445F84 8BC1                    mov eax, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445F82(C)
|
:00445F86 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00445F89 B810000000              mov eax, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445F97(C)
|
:00445F8E 8A11                    mov dl, byte ptr [ecx]
:00445F90 83E904                  sub ecx, 00000004
:00445F93 8816                    mov byte ptr [esi], dl
:00445F95 46                      inc esi
:00445F96 48                      dec eax
:00445F97 75F5                    jne 00445F8E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445F09(C)
|
:00445F99 5F                      pop edi
:00445F9A 5E                      pop esi
:00445F9B 8BE5                    mov esp, ebp
:00445F9D 5D                      pop ebp
:00445F9E C3                      ret



* Referenced by a CALL at Addresses:
|:00426CD1   , :00426CEC   , :00426EEE   , :00426F6B   , :00446213   
|
:00445F9F 55                      push ebp
:00445FA0 8BEC                    mov ebp, esp
:00445FA2 83EC04                  sub esp, 00000004
:00445FA5 53                      push ebx
:00445FA6 56                      push esi
:00445FA7 57                      push edi
:00445FA8 8B1D8C544700            mov ebx, dword ptr [0047548C]
:00445FAE C1E302                  shl ebx, 02
:00445FB1 8B7D10                  mov edi, dword ptr [ebp+10]
:00445FB4 8B7508                  mov esi, dword ptr [ebp+08]
:00445FB7 83BB78FE460007          cmp dword ptr [ebx+0046FE78], 00000007
:00445FBE 7403                    je 00445FC3
:00445FC0 83C610                  add esi, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445FBE(C)
|
:00445FC3 83FE0A                  cmp esi, 0000000A
:00445FC6 7D17                    jge 00445FDF
:00445FC8 8B7D10                  mov edi, dword ptr [ebp+10]
:00445FCB 8B550C                  mov edx, dword ptr [ebp+0C]
:00445FCE 2BFE                    sub edi, esi
:00445FD0 8D4416F6                lea eax, dword ptr [esi+edx-0A]
:00445FD4 83C70A                  add edi, 0000000A
:00445FD7 BE0A000000              mov esi, 0000000A
:00445FDC 89450C                  mov dword ptr [ebp+0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445FC6(C)
|
:00445FDF 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00445FE2 B8F6000000              mov eax, 000000F6
:00445FE7 03CE                    add ecx, esi
:00445FE9 3BC8                    cmp ecx, eax
:00445FEB 7C05                    jl 00445FF2
:00445FED 2BC6                    sub eax, esi
:00445FEF 89450C                  mov dword ptr [ebp+0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445FEB(C)
|
:00445FF2 8B550C                  mov edx, dword ptr [ebp+0C]
:00445FF5 03D6                    add edx, esi
:00445FF7 3BF2                    cmp esi, edx
:00445FF9 7D4E                    jge 00446049
:00445FFB 8D04B500000000          lea eax, dword ptr [4*esi+00000000]
:00446002 8A8B78374700            mov cl, byte ptr [ebx+00473778]
:00446008 8B550C                  mov edx, dword ptr [ebp+0C]
:0044600B 8955FC                  mov dword ptr [ebp-04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446047(C)
|
:0044600E 8A17                    mov dl, byte ptr [edi]
:00446010 83C004                  add eax, 00000004
:00446013 D2E2                    shl dl, cl
:00446015 47                      inc edi
:00446016 8890440F4700            mov byte ptr [eax+00470F44], dl
:0044601C 889096014700            mov byte ptr [eax+00470196], dl
:00446022 8A17                    mov dl, byte ptr [edi]
:00446024 D2E2                    shl dl, cl
:00446026 47                      inc edi
:00446027 8890460F4700            mov byte ptr [eax+00470F46], dl
:0044602D 889094014700            mov byte ptr [eax+00470194], dl
:00446033 8A17                    mov dl, byte ptr [edi]
:00446035 D2E2                    shl dl, cl
:00446037 47                      inc edi
:00446038 8890450F4700            mov byte ptr [eax+00470F45], dl
:0044603E 889095014700            mov byte ptr [eax+00470195], dl
:00446044 FF4DFC                  dec [ebp-04]
:00446047 75C5                    jne 0044600E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445FF9(C)
|
:00446049 833D2844470000          cmp dword ptr [00474428], 00000000
:00446050 7430                    je 00446082
:00446052 33DB                    xor ebx, ebx
:00446054 391D0C3B4500            cmp dword ptr [00453B0C], ebx
:0044605A 7E4D                    jle 004460A9
:0044605C BF70164700              mov edi, 00471670

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044607E(C)
|
:00446061 68480F4700              push 00470F48
:00446066 43                      inc ebx
:00446067 6800010000              push 00000100
:0044606C 6A00                    push 00000000
:0044606E FF37                    push dword ptr [edi]
:00446070 E8E20C0000              call 00446D57
:00446075 83C704                  add edi, 00000004
:00446078 3B1D0C3B4500            cmp ebx, dword ptr [00453B0C]
:0044607E 7CE1                    jl 00446061
:00446080 EB27                    jmp 004460A9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446050(C)
|
:00446082 6A00                    push 00000000
:00446084 A1D0454700              mov eax, dword ptr [004745D0]
:00446089 50                      push eax
:0044608A FFB370164700            push dword ptr [ebx+00471670]

* Reference To: GDI32.SelectPalette, Ord:013Dh
                                  |
:00446090 FF15B8724700            Call dword ptr [004772B8]
:00446096 8B0D8C544700            mov ecx, dword ptr [0047548C]
:0044609C FF348D70164700          push dword ptr [4*ecx+00471670]

* Reference To: GDI32.RealizePalette, Ord:0129h
                                  |
:004460A3 FF15B4724700            Call dword ptr [004772B4]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044605A(C), :00446080(U)
|
:004460A9 8D04B598014700          lea eax, dword ptr [4*esi+00470198]
:004460B0 33FF                    xor edi, edi
:004460B2 50                      push eax
:004460B3 A1D0454700              mov eax, dword ptr [004745D0]
:004460B8 FF750C                  push [ebp+0C]
:004460BB 56                      push esi
:004460BC 50                      push eax

* Reference To: GDI32.AnimatePalette, Ord:0006h
                                  |
:004460BD FF15D8724700            Call dword ptr [004772D8]
:004460C3 57                      push edi

* Reference To: USER32.GetDC, Ord:00E6h
                                  |
:004460C4 FF15A0744700            Call dword ptr [004774A0]
:004460CA 8BF0                    mov esi, eax
:004460CC 85F6                    test esi, esi
:004460CE 743B                    je 0044610B
:004460D0 6A0C                    push 0000000C
:004460D2 56                      push esi

* Reference To: GDI32.GetDeviceCaps, Ord:00BCh
                                  |
:004460D3 FF15AC724700            Call dword ptr [004772AC]
:004460D9 83F808                  cmp eax, 00000008
:004460DC 7E24                    jle 00446102
:004460DE A18C544700              mov eax, dword ptr [0047548C]
:004460E3 C1E002                  shl eax, 02
:004460E6 FFB0E8FC4600            push dword ptr [eax+0046FCE8]
:004460EC FFB0E0144700            push dword ptr [eax+004714E0]
:004460F2 57                      push edi
:004460F3 57                      push edi
:004460F4 A18C544700              mov eax, dword ptr [0047548C]
:004460F9 50                      push eax
:004460FA E8B4E3FFFF              call 004444B3
:004460FF 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004460DC(C)
|
:00446102 56                      push esi
:00446103 6A00                    push 00000000

* Reference To: USER32.ReleaseDC, Ord:01B9h
                                  |
:00446105 FF15A4744700            Call dword ptr [004774A4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004460CE(C)
|
:0044610B 5F                      pop edi
:0044610C 5E                      pop esi
:0044610D 5B                      pop ebx
:0044610E 8BE5                    mov esp, ebp
:00446110 5D                      pop ebp
:00446111 C3                      ret



* Referenced by a CALL at Address:
|:00426F50   
|
:00446112 55                      push ebp
:00446113 8B0D8C544700            mov ecx, dword ptr [0047548C]
:00446119 C1E102                  shl ecx, 02
:0044611C 8BEC                    mov ebp, esp
:0044611E 81EC04060000            sub esp, 00000604
:00446124 53                      push ebx
:00446125 56                      push esi
:00446126 57                      push edi
:00446127 8BB178FE4600            mov esi, dword ptr [ecx+0046FE78]
:0044612D 83FE07                  cmp esi, 00000007
:00446130 7404                    je 00446136
:00446132 83450810                add dword ptr [ebp+08], 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446130(C)
|
:00446136 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0044613A 7E38                    jle 00446174
:0044613C 8B4508                  mov eax, dword ptr [ebp+08]
:0044613F 8A8978374700            mov cl, byte ptr [ecx+00473778]
:00446145 8B7D0C                  mov edi, dword ptr [ebp+0C]
:00446148 8D1485480F4700          lea edx, dword ptr [4*eax+00470F48]
:0044614F 8D85FCF9FFFF            lea eax, dword ptr [ebp+FFFFF9FC]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446172(C)
|
:00446155 8A1A                    mov bl, byte ptr [edx]
:00446157 83C204                  add edx, 00000004
:0044615A D2EB                    shr bl, cl
:0044615C 8818                    mov byte ptr [eax], bl
:0044615E 8A5AFE                  mov bl, byte ptr [edx-02]
:00446161 D2EB                    shr bl, cl
:00446163 885801                  mov byte ptr [eax+01], bl
:00446166 83C003                  add eax, 00000003
:00446169 8A5AFD                  mov bl, byte ptr [edx-03]
:0044616C D2EB                    shr bl, cl
:0044616E 4F                      dec edi
:0044616F 8858FF                  mov byte ptr [eax-01], bl
:00446172 75E1                    jne 00446155

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044613A(C)
|
:00446174 83FE07                  cmp esi, 00000007
:00446177 7404                    je 0044617D
:00446179 836D0810                sub dword ptr [ebp+08], 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446177(C)
|
:0044617D BE01000000              mov esi, 00000001
:00446182 397514                  cmp dword ptr [ebp+14], esi
:00446185 0F8CA5000000            jl 00446230

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044622A(C)
|
:0044618B 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0044618F 8B7D10                  mov edi, dword ptr [ebp+10]
:00446192 7E72                    jle 00446206
:00446194 33C9                    xor ecx, ecx
:00446196 8B5D14                  mov ebx, dword ptr [ebp+14]
:00446199 2BDE                    sub ebx, esi
:0044619B 8B450C                  mov eax, dword ptr [ebp+0C]
:0044619E 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446204(C)
|
:004461A1 0FB6840DFCF9FFFF        movzx eax, byte ptr [ebp+ecx-00000604]
:004461A9 0FAFC3                  imul eax, ebx
:004461AC 0FB617                  movzx edx, byte ptr [edi]
:004461AF 0FAFD6                  imul edx, esi
:004461B2 03C2                    add eax, edx
:004461B4 47                      inc edi
:004461B5 99                      cdq
:004461B6 F77D14                  idiv [ebp+14]
:004461B9 88840DFCFCFFFF          mov byte ptr [ebp+ecx-00000304], al
:004461C0 83C103                  add ecx, 00000003
:004461C3 0FB6840DFAF9FFFF        movzx eax, byte ptr [ebp+ecx-00000606]
:004461CB 0FAFC3                  imul eax, ebx
:004461CE 0FB617                  movzx edx, byte ptr [edi]
:004461D1 0FAFD6                  imul edx, esi
:004461D4 03C2                    add eax, edx
:004461D6 47                      inc edi
:004461D7 99                      cdq
:004461D8 F77D14                  idiv [ebp+14]
:004461DB 88840DFAFCFFFF          mov byte ptr [ebp+ecx-00000306], al
:004461E2 0FB6840DFBF9FFFF        movzx eax, byte ptr [ebp+ecx-00000605]
:004461EA 0FAFC3                  imul eax, ebx
:004461ED 0FB617                  movzx edx, byte ptr [edi]
:004461F0 0FAFD6                  imul edx, esi
:004461F3 03C2                    add eax, edx
:004461F5 47                      inc edi
:004461F6 99                      cdq
:004461F7 F77D14                  idiv [ebp+14]
:004461FA 88840DFBFCFFFF          mov byte ptr [ebp+ecx-00000305], al
:00446201 FF4DFC                  dec [ebp-04]
:00446204 759B                    jne 004461A1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446192(C)
|
:00446206 8D85FCFCFFFF            lea eax, dword ptr [ebp+FFFFFCFC]
:0044620C 50                      push eax
:0044620D FF750C                  push [ebp+0C]
:00446210 FF7508                  push [ebp+08]
:00446213 E887FDFFFF              call 00445F9F
:00446218 83C40C                  add esp, 0000000C
:0044621B 46                      inc esi
:0044621C FF7518                  push [ebp+18]
:0044621F E86C000000              call 00446290
:00446224 83C404                  add esp, 00000004
:00446227 3B7514                  cmp esi, dword ptr [ebp+14]
:0044622A 0F8E5BFFFFFF            jle 0044618B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446185(C)
|
:00446230 5F                      pop edi
:00446231 5E                      pop esi
:00446232 5B                      pop ebx
:00446233 8BE5                    mov esp, ebp
:00446235 5D                      pop ebp
:00446236 C3                      ret



* Referenced by a CALL at Addresses:
|:00446319   , :00446336   
|
:00446237 E890000000              call 004462CC
:0044623C 833D003B450001          cmp dword ptr [00453B00], 00000001
:00446243 1BC0                    sbb eax, eax
:00446245 40                      inc eax
:00446246 C3                      ret



* Referenced by a CALL at Address:
|:0044632E   
|
:00446247 833D003B450000          cmp dword ptr [00453B00], 00000000
:0044624E 750E                    jne 0044625E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044625C(C)
|
:00446250 E877000000              call 004462CC
:00446255 833D003B450000          cmp dword ptr [00453B00], 00000000
:0044625C 74F2                    je 00446250

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044624E(C)
|
:0044625E A1083B4500              mov eax, dword ptr [00453B08]
:00446263 8B542404                mov edx, dword ptr [esp+04]
:00446267 0FB70C45C03D4700        movzx ecx, word ptr [2*eax+00473DC0]
:0044626F 8B442408                mov eax, dword ptr [esp+08]
:00446273 890A                    mov dword ptr [edx], ecx
:00446275 C70000000000            mov dword ptr [eax], 00000000
:0044627B A1083B4500              mov eax, dword ptr [00453B08]
:00446280 40                      inc eax
:00446281 FF0D003B4500            dec dword ptr [00453B00]
:00446287 83E00F                  and eax, 0000000F
:0044628A A3083B4500              mov dword ptr [00453B08], eax
:0044628F C3                      ret



* Referenced by a CALL at Address:
|:0044621F   
|
:00446290 56                      push esi
:00446291 57                      push edi

* Reference To: WINMM.timeGetTime, Ord:0094h
                                  |
:00446292 8B3DC4744700            mov edi, dword ptr [004774C4]
:00446298 BE03000000              mov esi, 00000003
:0044629D FFD7                    call edi
:0044629F 8BC8                    mov ecx, eax
:004462A1 8B44240C                mov eax, dword ptr [esp+0C]
:004462A5 6BC032                  imul eax, 00000032
:004462A8 99                      cdq
:004462A9 F7FE                    idiv esi
:004462AB 8D3401                  lea esi, dword ptr [ecx+eax]
:004462AE FFD7                    call edi
:004462B0 3BC6                    cmp eax, esi
:004462B2 730B                    jnb 004462BF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004462BD(C)
|
:004462B4 E813000000              call 004462CC
:004462B9 FFD7                    call edi
:004462BB 3BC6                    cmp eax, esi
:004462BD 72F5                    jb 004462B4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004462B2(C)
|
:004462BF 5F                      pop edi
:004462C0 5E                      pop esi
:004462C1 C3                      ret



* Referenced by a CALL at Address:
|:0040EAFC   
|
:004462C2 8B442404                mov eax, dword ptr [esp+04]
:004462C6 A3F83A4500              mov dword ptr [00453AF8], eax
:004462CB C3                      ret



* Referenced by a CALL at Addresses:
|:00426A72   , :00446237   , :00446250   , :004462B4   , :004463D1   
|
:004462CC 83EC1C                  sub esp, 0000001C
:004462CF 33C0                    xor eax, eax
:004462D1 8D4C2400                lea ecx, dword ptr [esp]
:004462D5 6A01                    push 00000001
:004462D7 50                      push eax
:004462D8 50                      push eax
:004462D9 50                      push eax
:004462DA 51                      push ecx

* Reference To: USER32.PeekMessageA, Ord:01A1h
                                  |
:004462DB FF1538744700            Call dword ptr [00477438]
:004462E1 85C0                    test eax, eax
:004462E3 7416                    je 004462FB
:004462E5 8D442400                lea eax, dword ptr [esp]
:004462E9 50                      push eax

* Reference To: USER32.TranslateMessage, Ord:022Ch
                                  |
:004462EA FF1534744700            Call dword ptr [00477434]
:004462F0 8D442400                lea eax, dword ptr [esp]
:004462F4 50                      push eax

* Reference To: USER32.DispatchMessageA, Ord:008Ch
                                  |
:004462F5 FF1530744700            Call dword ptr [00477430]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004462E3(C)
|
:004462FB 83C41C                  add esp, 0000001C
:004462FE C3                      ret



* Referenced by a CALL at Addresses:
|:0043739C   , :004373B6   
|
:004462FF 55                      push ebp
:00446300 8B442408                mov eax, dword ptr [esp+08]
:00446304 8BEC                    mov ebp, esp
:00446306 83EC24                  sub esp, 00000024
:00446309 83F801                  cmp eax, 00000001
:0044630C 56                      push esi
:0044630D 740A                    je 00446319
:0044630F 83F802                  cmp eax, 00000002
:00446312 7430                    je 00446344
:00446314 E9AD000000              jmp 004463C6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044630D(C)
|
:00446319 E819FFFFFF              call 00446237
:0044631E 85C0                    test eax, eax
:00446320 0F84A0000000            je 004463C6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044633D(C)
|
:00446326 8D45FC                  lea eax, dword ptr [ebp-04]
:00446329 8D4DF8                  lea ecx, dword ptr [ebp-08]
:0044632C 50                      push eax
:0044632D 51                      push ecx
:0044632E E814FFFFFF              call 00446247
:00446333 83C408                  add esp, 00000008
:00446336 E8FCFEFFFF              call 00446237
:0044633B 85C0                    test eax, eax
:0044633D 75E7                    jne 00446326
:0044633F E982000000              jmp 004463C6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446312(C)
|
:00446344 6A01                    push 00000001
:00446346 33F6                    xor esi, esi
:00446348 56                      push esi
:00446349 8D45DC                  lea eax, dword ptr [ebp-24]
:0044634C 56                      push esi
:0044634D 56                      push esi
:0044634E 50                      push eax

* Reference To: USER32.PeekMessageA, Ord:01A1h
                                  |
:0044634F FF1538744700            Call dword ptr [00477438]
:00446355 85C0                    test eax, eax
:00446357 746D                    je 004463C6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004463C4(C)
|
:00446359 8B45E0                  mov eax, dword ptr [ebp-20]
:0044635C 3D01020000              cmp eax, 00000201
:00446361 7417                    je 0044637A
:00446363 3D02020000              cmp eax, 00000202
:00446368 7419                    je 00446383
:0044636A 3D04020000              cmp eax, 00000204
:0044636F 741B                    je 0044638C
:00446371 3D05020000              cmp eax, 00000205
:00446376 741D                    je 00446395
:00446378 EB25                    jmp 0044639F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446361(C)
|
:0044637A 800DCC45470001          or byte ptr [004745CC], 01
:00446381 EB19                    jmp 0044639C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446368(C)
|
:00446383 8025CC454700FE          and byte ptr [004745CC], FE
:0044638A EB10                    jmp 0044639C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044636F(C)
|
:0044638C 800DCC45470002          or byte ptr [004745CC], 02
:00446393 EB07                    jmp 0044639C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446376(C)
|
:00446395 8025CC454700FD          and byte ptr [004745CC], FD

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00446381(U), :0044638A(U), :00446393(U)
|
:0044639C 8975E0                  mov dword ptr [ebp-20], esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446378(U)
|
:0044639F 8D45DC                  lea eax, dword ptr [ebp-24]
:004463A2 50                      push eax

* Reference To: USER32.TranslateMessage, Ord:022Ch
                                  |
:004463A3 FF1534744700            Call dword ptr [00477434]
:004463A9 8D45DC                  lea eax, dword ptr [ebp-24]
:004463AC 50                      push eax

* Reference To: USER32.DispatchMessageA, Ord:008Ch
                                  |
:004463AD FF1530744700            Call dword ptr [00477430]
:004463B3 6A01                    push 00000001
:004463B5 8D45DC                  lea eax, dword ptr [ebp-24]
:004463B8 56                      push esi
:004463B9 56                      push esi
:004463BA 56                      push esi
:004463BB 50                      push eax

* Reference To: USER32.PeekMessageA, Ord:01A1h
                                  |
:004463BC FF1538744700            Call dword ptr [00477438]
:004463C2 85C0                    test eax, eax
:004463C4 7593                    jne 00446359

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00446314(U), :00446320(C), :0044633F(U), :00446357(C)
|
:004463C6 5E                      pop esi
:004463C7 8BE5                    mov esp, ebp
:004463C9 5D                      pop ebp
:004463CA C3                      ret



* Referenced by a CALL at Address:
|:0044758E   
|
:004463CB 55                      push ebp
:004463CC 8BEC                    mov ebp, esp
:004463CE 83EC08                  sub esp, 00000008
:004463D1 E8F6FEFFFF              call 004462CC
:004463D6 8D45F8                  lea eax, dword ptr [ebp-08]
:004463D9 50                      push eax

* Reference To: USER32.GetCursorPos, Ord:00E5h
                                  |
:004463DA FF1540744700            Call dword ptr [00477440]
:004463E0 8D45F8                  lea eax, dword ptr [ebp-08]
:004463E3 8B0D8C544700            mov ecx, dword ptr [0047548C]
:004463E9 50                      push eax
:004463EA FF348D48134700          push dword ptr [4*ecx+00471348]

* Reference To: USER32.ScreenToClient, Ord:01BFh
                                  |
:004463F1 FF153C744700            Call dword ptr [0047743C]
:004463F7 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004463FA 8B5508                  mov edx, dword ptr [ebp+08]
:004463FD 8B45FC                  mov eax, dword ptr [ebp-04]
:00446400 890A                    mov dword ptr [edx], ecx
:00446402 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00446405 8901                    mov dword ptr [ecx], eax
:00446407 33C0                    xor eax, eax
:00446409 3902                    cmp dword ptr [edx], eax
:0044640B 7D07                    jge 00446414
:0044640D 8902                    mov dword ptr [edx], eax
:0044640F A3CC454700              mov dword ptr [004745CC], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044640B(C)
|
:00446414 A18C544700              mov eax, dword ptr [0047548C]
:00446419 8B0485E0144700          mov eax, dword ptr [4*eax+004714E0]
:00446420 48                      dec eax
:00446421 3902                    cmp dword ptr [edx], eax
:00446423 7E0C                    jle 00446431
:00446425 8902                    mov dword ptr [edx], eax
:00446427 C705CC45470000000000    mov dword ptr [004745CC], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446423(C)
|
:00446431 33C0                    xor eax, eax
:00446433 3901                    cmp dword ptr [ecx], eax
:00446435 7D07                    jge 0044643E
:00446437 8901                    mov dword ptr [ecx], eax
:00446439 A3CC454700              mov dword ptr [004745CC], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446435(C)
|
:0044643E A18C544700              mov eax, dword ptr [0047548C]
:00446443 8B0485E8FC4600          mov eax, dword ptr [4*eax+0046FCE8]
:0044644A 48                      dec eax
:0044644B 3901                    cmp dword ptr [ecx], eax
:0044644D 7E0C                    jle 0044645B
:0044644F 8901                    mov dword ptr [ecx], eax
:00446451 C705CC45470000000000    mov dword ptr [004745CC], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044644D(C)
|
:0044645B 8B0DCC454700            mov ecx, dword ptr [004745CC]
:00446461 8B4510                  mov eax, dword ptr [ebp+10]
:00446464 8908                    mov dword ptr [eax], ecx
:00446466 8BE5                    mov esp, ebp
:00446468 5D                      pop ebp
:00446469 C3                      ret



* Referenced by a CALL at Addresses:
|:00416804   , :00437301   , :00437328   , :00437345   , :00437365   
|:00437380   
|

* Reference To: KERNEL32.GetTickCount, Ord:0130h
                                  |
:0044646A FF1580734700            Call dword ptr [00477380]
:00446470 B932000000              mov ecx, 00000032
:00446475 2BD2                    sub edx, edx
:00446477 F7F1                    div ecx
:00446479 C3                      ret



* Referenced by a CALL at Addresses:
|:00426FA5   , :00426FCE   
|
:0044647A 837C240401              cmp dword ptr [esp+04], 00000001
:0044647F 56                      push esi
:00446480 7573                    jne 004464F5
:00446482 33F6                    xor esi, esi
:00446484 3935FC3A4500            cmp dword ptr [00453AFC], esi
:0044648A 7E6F                    jle 004464FB
:0044648C FF0DFC3A4500            dec dword ptr [00453AFC]
:00446492 7567                    jne 004464FB
:00446494 8B158C544700            mov edx, dword ptr [0047548C]
:0044649A FF3495E80B4700          push dword ptr [4*edx+00470BE8]
:004464A1 FF3495580A4700          push dword ptr [4*edx+00470A58]
:004464A8 FF349530074700          push dword ptr [4*edx+00470730]
:004464AF FF3495A0054700          push dword ptr [4*edx+004705A0]
:004464B6 52                      push edx
:004464B7 8D0C9500000000          lea ecx, dword ptr [4*edx+00000000]
:004464BE E8F0DFFFFF              call 004444B3
:004464C3 83C414                  add esp, 00000014
:004464C6 8B0D8C544700            mov ecx, dword ptr [0047548C]
:004464CC C1E102                  shl ecx, 02
:004464CF 8B81E0144700            mov eax, dword ptr [ecx+004714E0]
:004464D5 8B91E8FC4600            mov edx, dword ptr [ecx+0046FCE8]
:004464DB 8981A0054700            mov dword ptr [ecx+004705A0], eax
:004464E1 899130074700            mov dword ptr [ecx+00470730], edx
:004464E7 89B1E80B4700            mov dword ptr [ecx+00470BE8], esi
:004464ED 89B1580A4700            mov dword ptr [ecx+00470A58], esi
:004464F3 EB06                    jmp 004464FB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446480(C)
|
:004464F5 FF05FC3A4500            inc dword ptr [00453AFC]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044648A(C), :00446492(C), :004464F3(U)
|
:004464FB 833DFC3A450000          cmp dword ptr [00453AFC], 00000000
:00446502 B801000000              mov eax, 00000001
:00446507 7F02                    jg 0044650B
:00446509 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446507(C)
|
:0044650B 5E                      pop esi
:0044650C C3                      ret



* Referenced by a CALL at Address:
|:0040E7E1   
|
:0044650D 55                      push ebp
:0044650E 8BEC                    mov ebp, esp
:00446510 83EC10                  sub esp, 00000010
:00446513 56                      push esi
:00446514 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00446517 57                      push edi
:00446518 6A00                    push 00000000
:0044651A 51                      push ecx
:0044651B 6A00                    push 00000000
:0044651D 6A30                    push 00000030

* Reference To: USER32.SystemParametersInfoA, Ord:021Ch
                                  |
:0044651F FF1548744700            Call dword ptr [00477448]
:00446525 85C0                    test eax, eax
:00446527 7412                    je 0044653B
:00446529 8B45F8                  mov eax, dword ptr [ebp-08]
:0044652C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044652F 8B55FC                  mov edx, dword ptr [ebp-04]
:00446532 8B7D0C                  mov edi, dword ptr [ebp+0C]
:00446535 8901                    mov dword ptr [ecx], eax
:00446537 8917                    mov dword ptr [edi], edx
:00446539 EB1A                    jmp 00446555

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446527(C)
|
:0044653B 6A00                    push 00000000

* Reference To: USER32.GetSystemMetrics, Ord:0123h
                                  |
:0044653D FF1544744700            Call dword ptr [00477444]
:00446543 8B4D08                  mov ecx, dword ptr [ebp+08]
:00446546 6A01                    push 00000001
:00446548 8901                    mov dword ptr [ecx], eax

* Reference To: USER32.GetSystemMetrics, Ord:0123h
                                  |
:0044654A FF1544744700            Call dword ptr [00477444]
:00446550 8B7D0C                  mov edi, dword ptr [ebp+0C]
:00446553 8907                    mov dword ptr [edi], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446539(U)
|
:00446555 6A04                    push 00000004

* Reference To: USER32.GetSystemMetrics, Ord:0123h
                                  |
:00446557 FF1544744700            Call dword ptr [00477444]
:0044655D 8BF0                    mov esi, eax
:0044655F 6A0F                    push 0000000F

* Reference To: USER32.GetSystemMetrics, Ord:0123h
                                  |
:00446561 FF1544744700            Call dword ptr [00477444]
:00446567 03F0                    add esi, eax
:00446569 2937                    sub dword ptr [edi], esi
:0044656B 5F                      pop edi
:0044656C 5E                      pop esi
:0044656D 8BE5                    mov esp, ebp
:0044656F 5D                      pop ebp
:00446570 C3                      ret



* Referenced by a CALL at Addresses:
|:004258FA   , :00444618   , :00446989   
|
:00446571 55                      push ebp
:00446572 8BEC                    mov ebp, esp
:00446574 83EC1C                  sub esp, 0000001C
:00446577 53                      push ebx
:00446578 56                      push esi
:00446579 57                      push edi
:0044657A BEFFFFFFFF              mov esi, FFFFFFFF
:0044657F 8B7D08                  mov edi, dword ptr [ebp+08]
:00446582 8B5D0C                  mov ebx, dword ptr [ebp+0C]
:00446585 8B4510                  mov eax, dword ptr [ebp+10]
:00446588 8975E4                  mov dword ptr [ebp-1C], esi
:0044658B 893DE03D4700            mov dword ptr [00473DE0], edi
:00446591 891D2C444700            mov dword ptr [0047442C], ebx
:00446597 A370374700              mov dword ptr [00473770], eax
:0044659C 33C0                    xor eax, eax
:0044659E 3905103B4500            cmp dword ptr [00453B10], eax
:004465A4 0F854C010000            jne 004466F6
:004465AA 50                      push eax
:004465AB 8D4DF0                  lea ecx, dword ptr [ebp-10]
:004465AE 51                      push ecx
:004465AF 50                      push eax
:004465B0 6A30                    push 00000030

* Reference To: USER32.SystemParametersInfoA, Ord:021Ch
                                  |
:004465B2 FF1548744700            Call dword ptr [00477448]
:004465B8 85C0                    test eax, eax
:004465BA 740E                    je 004465CA
:004465BC 8B45F8                  mov eax, dword ptr [ebp-08]
:004465BF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004465C2 8945E8                  mov dword ptr [ebp-18], eax
:004465C5 894DEC                  mov dword ptr [ebp-14], ecx
:004465C8 EB16                    jmp 004465E0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004465BA(C)
|
:004465CA 6A00                    push 00000000

* Reference To: USER32.GetSystemMetrics, Ord:0123h
                                  |
:004465CC FF1544744700            Call dword ptr [00477444]
:004465D2 6A01                    push 00000001
:004465D4 8945E8                  mov dword ptr [ebp-18], eax

* Reference To: USER32.GetSystemMetrics, Ord:0123h
                                  |
:004465D7 FF1544744700            Call dword ptr [00477444]
:004465DD 8945EC                  mov dword ptr [ebp-14], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004465C8(U)
|
:004465E0 8B0D8C544700            mov ecx, dword ptr [0047548C]
:004465E6 8B048DE0144700          mov eax, dword ptr [4*ecx+004714E0]
:004465ED 3BC7                    cmp eax, edi
:004465EF 7D02                    jge 004465F3
:004465F1 8BF8                    mov edi, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004465EF(C)
|
:004465F3 8B048DE8FC4600          mov eax, dword ptr [4*ecx+0046FCE8]
:004465FA 3BC3                    cmp eax, ebx
:004465FC 7D02                    jge 00446600
:004465FE 8BD8                    mov ebx, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004465FC(C), :00446670(C), :0044667B(C)
|
:00446600 6A06                    push 00000006
:00446602 53                      push ebx
:00446603 57                      push edi
:00446604 6A00                    push 00000000
:00446606 6A00                    push 00000000
:00446608 6A00                    push 00000000
:0044660A FF348D48134700          push dword ptr [4*ecx+00471348]

* Reference To: USER32.SetWindowPos, Ord:0207h
                                  |
:00446611 FF150C744700            Call dword ptr [0047740C]
:00446617 8D45F0                  lea eax, dword ptr [ebp-10]
:0044661A 8B0D8C544700            mov ecx, dword ptr [0047548C]
:00446620 50                      push eax
:00446621 FF348D48134700          push dword ptr [4*ecx+00471348]

* Reference To: USER32.GetClientRect, Ord:00DCh
                                  |
:00446628 FF15F8734700            Call dword ptr [004773F8]
:0044662E A1E03D4700              mov eax, dword ptr [00473DE0]
:00446633 8B0D8C544700            mov ecx, dword ptr [0047548C]
:00446639 3945F8                  cmp dword ptr [ebp-08], eax
:0044663C 750B                    jne 00446649
:0044663E 8B152C444700            mov edx, dword ptr [0047442C]
:00446644 3B55FC                  cmp edx, dword ptr [ebp-04]
:00446647 7424                    je 0044666D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044663C(C)
|
:00446649 3B75F8                  cmp esi, dword ptr [ebp-08]
:0044664C 7508                    jne 00446656
:0044664E 8B55E4                  mov edx, dword ptr [ebp-1C]
:00446651 3B55FC                  cmp edx, dword ptr [ebp-04]
:00446654 7427                    je 0044667D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044664C(C)
|
:00446656 2B7DF8                  sub edi, dword ptr [ebp-08]
:00446659 2B5DFC                  sub ebx, dword ptr [ebp-04]
:0044665C 03F8                    add edi, eax
:0044665E 031D2C444700            add ebx, dword ptr [0047442C]
:00446664 8B75F8                  mov esi, dword ptr [ebp-08]
:00446667 8B55FC                  mov edx, dword ptr [ebp-04]
:0044666A 8955E4                  mov dword ptr [ebp-1C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446647(C)
|
:0044666D 3945F8                  cmp dword ptr [ebp-08], eax
:00446670 758E                    jne 00446600
:00446672 8B152C444700            mov edx, dword ptr [0047442C]
:00446678 3B55FC                  cmp edx, dword ptr [ebp-04]
:0044667B 7583                    jne 00446600

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446654(C)
|
:0044667D 8D45F0                  lea eax, dword ptr [ebp-10]
:00446680 50                      push eax
:00446681 FF348D48134700          push dword ptr [4*ecx+00471348]

* Reference To: USER32.GetWindowRect, Ord:0133h
                                  |
:00446688 FF1550744700            Call dword ptr [00477450]
:0044668E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00446691 8B75FC                  mov esi, dword ptr [ebp-04]
:00446694 2B4DF0                  sub ecx, dword ptr [ebp-10]
:00446697 2B75F4                  sub esi, dword ptr [ebp-0C]
:0044669A F6451001                test [ebp+10], 01
:0044669E 7419                    je 004466B9
:004466A0 8B45E8                  mov eax, dword ptr [ebp-18]
:004466A3 2BC1                    sub eax, ecx
:004466A5 99                      cdq
:004466A6 2BC2                    sub eax, edx
:004466A8 D1F8                    sar eax, 1
:004466AA 8945F0                  mov dword ptr [ebp-10], eax
:004466AD 8B45EC                  mov eax, dword ptr [ebp-14]
:004466B0 2BC6                    sub eax, esi
:004466B2 99                      cdq
:004466B3 2BC2                    sub eax, edx
:004466B5 D1F8                    sar eax, 1
:004466B7 EB1D                    jmp 004466D6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044669E(C)
|
:004466B9 F6451180                test [ebp+11], 80
:004466BD 741A                    je 004466D9
:004466BF 8B45E8                  mov eax, dword ptr [ebp-18]
:004466C2 3945F8                  cmp dword ptr [ebp-08], eax
:004466C5 7E05                    jle 004466CC
:004466C7 2BC1                    sub eax, ecx
:004466C9 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004466C5(C)
|
:004466CC 8B45EC                  mov eax, dword ptr [ebp-14]
:004466CF 3B45FC                  cmp eax, dword ptr [ebp-04]
:004466D2 7D05                    jge 004466D9
:004466D4 2BC6                    sub eax, esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004466B7(U)
|
:004466D6 8945F4                  mov dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004466BD(C), :004466D2(C)
|
:004466D9 6A01                    push 00000001
:004466DB 56                      push esi
:004466DC 51                      push ecx
:004466DD 8B0D8C544700            mov ecx, dword ptr [0047548C]
:004466E3 FF75F4                  push [ebp-0C]
:004466E6 FF75F0                  push [ebp-10]
:004466E9 FF348D48134700          push dword ptr [4*ecx+00471348]

* Reference To: USER32.MoveWindow, Ord:0190h
                                  |
:004466F0 FF154C744700            Call dword ptr [0047744C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004465A4(C)
|
:004466F6 5F                      pop edi
:004466F7 5E                      pop esi
:004466F8 5B                      pop ebx
:004466F9 8BE5                    mov esp, ebp
:004466FB 5D                      pop ebp
:004466FC C3                      ret



* Referenced by a CALL at Address:
|:004445FD   
|
:004466FD 56                      push esi
:004466FE 8B358C544700            mov esi, dword ptr [0047548C]
:00446704 8D0CB5E0144700          lea ecx, dword ptr [4*esi+004714E0]
:0044670B 8B01                    mov eax, dword ptr [ecx]
:0044670D 40                      inc eax
:0044670E 83F801                  cmp eax, 00000001
:00446711 8B442408                mov eax, dword ptr [esp+08]
:00446715 1BD2                    sbb edx, edx
:00446717 8901                    mov dword ptr [ecx], eax
:00446719 F7DA                    neg edx
:0044671B 8B4C240C                mov ecx, dword ptr [esp+0C]
:0044671F 85D2                    test edx, edx
:00446721 890CB5E8FC4600          mov dword ptr [4*esi+0046FCE8], ecx
:00446728 7524                    jne 0044674E
:0044672A E8DDE4FFFF              call 00444C0C
:0044672F E82DDFFFFF              call 00444661
:00446734 85C0                    test eax, eax
:00446736 7404                    je 0044673C
:00446738 33C0                    xor eax, eax
:0044673A EB17                    jmp 00446753

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446736(C)
|
:0044673C A18C544700              mov eax, dword ptr [0047548C]
:00446741 85C0                    test eax, eax
:00446743 7409                    je 0044674E
:00446745 50                      push eax
:00446746 E8E2DEFFFF              call 0044462D
:0044674B 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00446728(C), :00446743(C)
|
:0044674E B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044673A(U)
|
:00446753 5E                      pop esi
:00446754 C3                      ret



* Referenced by a CALL at Address:
|:0044469F   
|
:00446755 55                      push ebp
:00446756 8BEC                    mov ebp, esp
:00446758 81EC2C040000            sub esp, 0000042C
:0044675E 53                      push ebx
:0044675F 8D85D4FBFFFF            lea eax, dword ptr [ebp+FFFFFBD4]
:00446765 56                      push esi
:00446766 57                      push edi
:00446767 50                      push eax
:00446768 E856050000              call 00446CC3
:0044676D 85C0                    test eax, eax
:0044676F 7507                    jne 00446778
:00446771 33C0                    xor eax, eax
:00446773 E99A000000              jmp 00446812

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044676F(C)
|
:00446778 83BDDCFBFFFF00          cmp dword ptr [ebp+FFFFFBDC], 00000000
:0044677F 8B7508                  mov esi, dword ptr [ebp+08]
:00446782 7D17                    jge 0044679B
:00446784 C704B538444700FFFFFFFF  mov dword ptr [4*esi+00474438], FFFFFFFF
:0044678F 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00446792 890CB508394700          mov dword ptr [4*esi+00473908], ecx
:00446799 EB19                    jmp 004467B4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446782(C)
|
:0044679B C704B53844470001000000  mov dword ptr [4*esi+00474438], 00000001
:004467A6 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004467A9 8BC1                    mov eax, ecx
:004467AB F7D8                    neg eax
:004467AD 8904B508394700          mov dword ptr [4*esi+00473908], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446799(U)
|
:004467B4 8B4510                  mov eax, dword ptr [ebp+10]
:004467B7 898DD8FBFFFF            mov dword ptr [ebp+FFFFFBD8], ecx
:004467BD 83C010                  add eax, 00000010
:004467C0 0FAF85DCFBFFFF          imul eax, dword ptr [ebp+FFFFFBDC]
:004467C7 8985DCFBFFFF            mov dword ptr [ebp+FFFFFBDC], eax
:004467CD E8C1040000              call 00446C93
:004467D2 8BF8                    mov edi, eax
:004467D4 85FF                    test edi, edi
:004467D6 7438                    je 00446810
:004467D8 8D45FC                  lea eax, dword ptr [ebp-04]
:004467DB 8D8DD4FBFFFF            lea ecx, dword ptr [ebp+FFFFFBD4]
:004467E1 50                      push eax
:004467E2 51                      push ecx
:004467E3 57                      push edi
:004467E4 E838050000              call 00446D21
:004467E9 8BD8                    mov ebx, eax
:004467EB 85DB                    test ebx, ebx
:004467ED 7418                    je 00446807
:004467EF 53                      push ebx
:004467F0 57                      push edi

* Reference To: GDI32.SelectObject, Ord:013Ch
                                  |
:004467F1 FF1508734700            Call dword ptr [00477308]
:004467F7 8904B508004700          mov dword ptr [4*esi+00470008], eax
:004467FE 891CB500184700          mov dword ptr [4*esi+00471800], ebx
:00446805 EB09                    jmp 00446810

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004467ED(C)
|
:00446807 57                      push edi

* Reference To: GDI32.DeleteDC, Ord:0043h
                                  |
:00446808 FF15F4724700            Call dword ptr [004772F4]
:0044680E 33FF                    xor edi, edi

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004467D6(C), :00446805(U)
|
:00446810 8BC7                    mov eax, edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446773(U)
|
:00446812 5F                      pop edi
:00446813 5E                      pop esi
:00446814 5B                      pop ebx
:00446815 8BE5                    mov esp, ebp
:00446817 5D                      pop ebp
:00446818 C3                      ret



* Referenced by a CALL at Address:
|:00444C23   
|
:00446819 56                      push esi
:0044681A 57                      push edi
:0044681B 8B7C240C                mov edi, dword ptr [esp+0C]
:0044681F C1E702                  shl edi, 02
:00446822 8DB770164700            lea esi, dword ptr [edi+00471670]
:00446828 8B0E                    mov ecx, dword ptr [esi]
:0044682A 85C9                    test ecx, ecx
:0044682C 7426                    je 00446854
:0044682E 8B8708004700            mov eax, dword ptr [edi+00470008]
:00446834 85C0                    test eax, eax
:00446836 741C                    je 00446854
:00446838 50                      push eax
:00446839 51                      push ecx

* Reference To: GDI32.SelectObject, Ord:013Ch
                                  |
:0044683A FF1508734700            Call dword ptr [00477308]
:00446840 FFB700184700            push dword ptr [edi+00471800]

* Reference To: GDI32.DeleteObject, Ord:0046h
                                  |
:00446846 FF15BC724700            Call dword ptr [004772BC]
:0044684C FF36                    push dword ptr [esi]

* Reference To: GDI32.DeleteDC, Ord:0043h
                                  |
:0044684E FF15F4724700            Call dword ptr [004772F4]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044682C(C), :00446836(C)
|
:00446854 5F                      pop edi
:00446855 5E                      pop esi
:00446856 C3                      ret



* Referenced by a CALL at Address:
|:0040E6C2   
|
:00446857 55                      push ebp
:00446858 8B44240C                mov eax, dword ptr [esp+0C]
:0044685C 8BEC                    mov ebp, esp
:0044685E 83EC40                  sub esp, 00000040
:00446861 83F805                  cmp eax, 00000005
:00446864 56                      push esi
:00446865 57                      push edi
:00446866 7727                    ja 0044688F
:00446868 0F84D8000000            je 00446946
:0044686E 83F802                  cmp eax, 00000002
:00446871 0F84B7000000            je 0044692E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004468AC(U), :004468C2(U), :004468DA(U), :00446929(U), :00446956(U)
|:00446960(C), :0044696C(C), :00446991(U), :0044699D(C), :004469B0(U)
|:00446A7B(U), :00446AB1(U), :00446ABD(U), :00446AC9(U), :00446AD5(U)
|:00446AE0(C)
|
:00446877 FF7514                  push [ebp+14]
:0044687A FF7510                  push [ebp+10]
:0044687D FF750C                  push [ebp+0C]
:00446880 FF7508                  push [ebp+08]

* Reference To: USER32.DefWindowProcA, Ord:007Dh
                                  |
:00446883 FF1560744700            Call dword ptr [00477460]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00446941(U), :004469C4(U), :00446A3B(U), :00446A5B(U), :00446A62(U)
|:00446A90(U), :00446AA5(U), :00446B60(U)
|
:00446889 5F                      pop edi
:0044688A 5E                      pop esi
:0044688B 8BE5                    mov esp, ebp
:0044688D 5D                      pop ebp
:0044688E C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446866(C)
|
:0044688F 83F80F                  cmp eax, 0000000F
:00446892 771A                    ja 004468AE
:00446894 0F842F010000            je 004469C9
:0044689A 83F806                  cmp eax, 00000006
:0044689D 0F84F3000000            je 00446996
:004468A3 83F807                  cmp eax, 00000007
:004468A6 0F8409010000            je 004469B5
:004468AC EBC9                    jmp 00446877

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446892(C)
|
:004468AE 83F814                  cmp eax, 00000014
:004468B1 7711                    ja 004468C4
:004468B3 0F84A7010000            je 00446A60
:004468B9 83F810                  cmp eax, 00000010
:004468BC 0F847E010000            je 00446A40
:004468C2 EBB3                    jmp 00446877

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004468B1(C)
|
:004468C4 3D00010000              cmp eax, 00000100
:004468C9 7711                    ja 004468DC
:004468CB 0F84AF010000            je 00446A80
:004468D1 83F87E                  cmp eax, 0000007E
:004468D4 0F848D010000            je 00446A67
:004468DA EB9B                    jmp 00446877

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004468C9(C)
|
:004468DC 3D02010000              cmp eax, 00000102
:004468E1 0F84AE010000            je 00446A95
:004468E7 3D01020000              cmp eax, 00000201
:004468EC 0F84B8010000            je 00446AAA
:004468F2 3D02020000              cmp eax, 00000202
:004468F7 0F84B9010000            je 00446AB6
:004468FD 3D04020000              cmp eax, 00000204
:00446902 0F84BA010000            je 00446AC2
:00446908 3D05020000              cmp eax, 00000205
:0044690D 0F84BB010000            je 00446ACE
:00446913 3D0F030000              cmp eax, 0000030F
:00446918 0F84C8010000            je 00446AE6
:0044691E 3D11030000              cmp eax, 00000311
:00446923 0F84B1010000            je 00446ADA
:00446929 E949FFFFFF              jmp 00446877

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446871(C)
|
:0044692E E8D9E2FFFF              call 00444C0C
:00446933 A168374700              mov eax, dword ptr [00473768]
:00446938 50                      push eax

* Reference To: USER32.PostQuitMessage, Ord:01A5h
                                  |
:00446939 FF155C744700            Call dword ptr [0047745C]
:0044693F 33C0                    xor eax, eax
:00446941 E943FFFFFF              jmp 00446889

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446868(C)
|
:00446946 837D1001                cmp dword ptr [ebp+10], 00000001
:0044694A 750F                    jne 0044695B
:0044694C C705103B450001000000    mov dword ptr [00453B10], 00000001
:00446956 E91CFFFFFF              jmp 00446877

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044694A(C)
|
:0044695B 33C0                    xor eax, eax
:0044695D 394510                  cmp dword ptr [ebp+10], eax
:00446960 0F8511FFFFFF            jne 00446877
:00446966 3905103B4500            cmp dword ptr [00453B10], eax
:0044696C 0F8405FFFFFF            je 00446877
:00446972 A3103B4500              mov dword ptr [00453B10], eax
:00446977 A170374700              mov eax, dword ptr [00473770]
:0044697C 50                      push eax
:0044697D FF352C444700            push dword ptr [0047442C]
:00446983 FF35E03D4700            push dword ptr [00473DE0]
:00446989 E8E3FBFFFF              call 00446571
:0044698E 83C40C                  add esp, 0000000C
:00446991 E9E1FEFFFF              jmp 00446877

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044689D(C)
|
:00446996 A1F43A4500              mov eax, dword ptr [00453AF4]
:0044699B 85C0                    test eax, eax
:0044699D 0F84D4FEFFFF            je 00446877
:004469A3 837D1001                cmp dword ptr [ebp+10], 00000001
:004469A7 1BC9                    sbb ecx, ecx
:004469A9 41                      inc ecx
:004469AA 51                      push ecx
:004469AB FFD0                    call eax
:004469AD 83C404                  add esp, 00000004
:004469B0 E9C2FEFFFF              jmp 00446877

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004468A6(C)
|
:004469B5 6A01                    push 00000001
:004469B7 6A00                    push 00000000
:004469B9 FF7508                  push [ebp+08]

* Reference To: USER32.InvalidateRect, Ord:0148h
                                  |
:004469BC FF15FC734700            Call dword ptr [004773FC]
:004469C2 33C0                    xor eax, eax
:004469C4 E9C0FEFFFF              jmp 00446889

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446894(C)
|
:004469C9 8D45C0                  lea eax, dword ptr [ebp-40]
:004469CC 50                      push eax
:004469CD FF7508                  push [ebp+08]

* Reference To: USER32.BeginPaint, Ord:0009h
                                  |
:004469D0 FF1558744700            Call dword ptr [00477458]
:004469D6 8BF0                    mov esi, eax
:004469D8 A1D0454700              mov eax, dword ptr [004745D0]
:004469DD 85C0                    test eax, eax
:004469DF 7411                    je 004469F2
:004469E1 6A00                    push 00000000
:004469E3 50                      push eax
:004469E4 56                      push esi

* Reference To: GDI32.SelectPalette, Ord:013Dh
                                  |
:004469E5 FF15B8724700            Call dword ptr [004772B8]
:004469EB 56                      push esi

* Reference To: GDI32.RealizePalette, Ord:0129h
                                  |
:004469EC FF15B4724700            Call dword ptr [004772B4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004469DF(C)
|
:004469F2 33D2                    xor edx, edx
:004469F4 A10C3B4500              mov eax, dword ptr [00453B0C]
:004469F9 3BC2                    cmp eax, edx
:004469FB 7E14                    jle 00446A11
:004469FD B948134700              mov ecx, 00471348

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446A0F(C)
|
:00446A02 8B7508                  mov esi, dword ptr [ebp+08]
:00446A05 3931                    cmp dword ptr [ecx], esi
:00446A07 7408                    je 00446A11
:00446A09 83C104                  add ecx, 00000004
:00446A0C 42                      inc edx
:00446A0D 3BD0                    cmp edx, eax
:00446A0F 7CF1                    jl 00446A02

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004469FB(C), :00446A07(C)
|
:00446A11 FF3495E8FC4600          push dword ptr [4*edx+0046FCE8]
:00446A18 FF3495E0144700          push dword ptr [4*edx+004714E0]
:00446A1F 6A00                    push 00000000
:00446A21 6A00                    push 00000000
:00446A23 52                      push edx
:00446A24 E88ADAFFFF              call 004444B3
:00446A29 83C414                  add esp, 00000014
:00446A2C 8D4DC0                  lea ecx, dword ptr [ebp-40]
:00446A2F 51                      push ecx
:00446A30 FF7508                  push [ebp+08]

* Reference To: USER32.EndPaint, Ord:00AFh
                                  |
:00446A33 FF1554744700            Call dword ptr [00477454]
:00446A39 33C0                    xor eax, eax
:00446A3B E949FEFFFF              jmp 00446889

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004468BC(C)
|
:00446A40 8B35F83A4500            mov esi, dword ptr [00453AF8]
:00446A46 33C0                    xor eax, eax
:00446A48 85F6                    test esi, esi
:00446A4A 740D                    je 00446A59
:00446A4C A3F83A4500              mov dword ptr [00453AF8], eax
:00446A51 FFD6                    call esi
:00446A53 8935F83A4500            mov dword ptr [00453AF8], esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446A4A(C)
|
:00446A59 33C0                    xor eax, eax
:00446A5B E929FEFFFF              jmp 00446889

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004468B3(C)
|
:00446A60 33C0                    xor eax, eax
:00446A62 E922FEFFFF              jmp 00446889

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004468D4(C)
|
:00446A67 A1B83D4700              mov eax, dword ptr [00473DB8]
:00446A6C 50                      push eax
:00446A6D FF35C8454700            push dword ptr [004745C8]
:00446A73 E82CD8FFFF              call 004442A4
:00446A78 83C408                  add esp, 00000008
:00446A7B E9F7FDFFFF              jmp 00446877

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004468CB(C)
|
:00446A80 FF7514                  push [ebp+14]
:00446A83 FF7510                  push [ebp+10]
:00446A86 E819010000              call 00446BA4
:00446A8B 83C408                  add esp, 00000008
:00446A8E 33C0                    xor eax, eax
:00446A90 E9F4FDFFFF              jmp 00446889

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004468E1(C)
|
:00446A95 FF7514                  push [ebp+14]
:00446A98 FF7510                  push [ebp+10]
:00446A9B E8C5000000              call 00446B65
:00446AA0 83C408                  add esp, 00000008
:00446AA3 33C0                    xor eax, eax
:00446AA5 E9DFFDFFFF              jmp 00446889

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004468EC(C)
|
:00446AAA 800DCC45470001          or byte ptr [004745CC], 01
:00446AB1 E9C1FDFFFF              jmp 00446877

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004468F7(C)
|
:00446AB6 8025CC454700FE          and byte ptr [004745CC], FE
:00446ABD E9B5FDFFFF              jmp 00446877

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446902(C)
|
:00446AC2 800DCC45470002          or byte ptr [004745CC], 02
:00446AC9 E9A9FDFFFF              jmp 00446877

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044690D(C)
|
:00446ACE 8025CC454700FD          and byte ptr [004745CC], FD
:00446AD5 E99DFDFFFF              jmp 00446877

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446923(C)
|
:00446ADA 8B7508                  mov esi, dword ptr [ebp+08]
:00446ADD 3B7510                  cmp esi, dword ptr [ebp+10]
:00446AE0 0F8491FDFFFF            je 00446877

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446918(C)
|
:00446AE6 33FF                    xor edi, edi
:00446AE8 393D28444700            cmp dword ptr [00474428], edi
:00446AEE 742C                    je 00446B1C
:00446AF0 393D0C3B4500            cmp dword ptr [00453B0C], edi
:00446AF6 7E24                    jle 00446B1C
:00446AF8 BE70164700              mov esi, 00471670

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446B1A(C)
|
:00446AFD 68480F4700              push 00470F48
:00446B02 47                      inc edi
:00446B03 6800010000              push 00000100
:00446B08 6A00                    push 00000000
:00446B0A FF36                    push dword ptr [esi]
:00446B0C E846020000              call 00446D57
:00446B11 83C604                  add esi, 00000004
:00446B14 3B3D0C3B4500            cmp edi, dword ptr [00453B0C]
:00446B1A 7CE1                    jl 00446AFD

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00446AEE(C), :00446AF6(C)
|
:00446B1C FF7508                  push [ebp+08]

* Reference To: USER32.GetDC, Ord:00E6h
                                  |
:00446B1F FF15A0744700            Call dword ptr [004774A0]
:00446B25 8BF8                    mov edi, eax
:00446B27 A1D0454700              mov eax, dword ptr [004745D0]
:00446B2C 85C0                    test eax, eax
:00446B2E 740A                    je 00446B3A
:00446B30 6A00                    push 00000000
:00446B32 50                      push eax
:00446B33 57                      push edi

* Reference To: GDI32.SelectPalette, Ord:013Dh
                                  |
:00446B34 FF15B8724700            Call dword ptr [004772B8]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446B2E(C)
|
:00446B3A 57                      push edi

* Reference To: GDI32.RealizePalette, Ord:0129h
                                  |
:00446B3B FF15B4724700            Call dword ptr [004772B4]
:00446B41 8BF0                    mov esi, eax
:00446B43 57                      push edi
:00446B44 FF7508                  push [ebp+08]

* Reference To: USER32.ReleaseDC, Ord:01B9h
                                  |
:00446B47 FF15A4744700            Call dword ptr [004774A4]
:00446B4D 85F6                    test esi, esi
:00446B4F 740D                    je 00446B5E
:00446B51 6A01                    push 00000001
:00446B53 6A00                    push 00000000
:00446B55 FF7508                  push [ebp+08]

* Reference To: USER32.InvalidateRect, Ord:0148h
                                  |
:00446B58 FF15FC734700            Call dword ptr [004773FC]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446B4F(C)
|
:00446B5E 8BC6                    mov eax, esi
:00446B60 E924FDFFFF              jmp 00446889

* Referenced by a CALL at Address:
|:00446A9B   
|
:00446B65 8B442404                mov eax, dword ptr [esp+04]
:00446B69 6625FF00                and ax, 00FF
:00446B6D 50                      push eax
:00446B6E E804000000              call 00446B77
:00446B73 83C404                  add esp, 00000004
:00446B76 C3                      ret



* Referenced by a CALL at Addresses:
|:00446B6E   , :00446C17   
|
:00446B77 833D003B450010          cmp dword ptr [00453B00], 00000010
:00446B7E 7D23                    jge 00446BA3
:00446B80 668B442404              mov ax, word ptr [esp+04]
:00446B85 8B0D043B4500            mov ecx, dword ptr [00453B04]
:00446B8B 6689044DC03D4700        mov word ptr [2*ecx+00473DC0], ax
:00446B93 41                      inc ecx
:00446B94 83E10F                  and ecx, 0000000F
:00446B97 FF05003B4500            inc dword ptr [00453B00]
:00446B9D 890D043B4500            mov dword ptr [00453B04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446B7E(C)
|
:00446BA3 C3                      ret

* Referenced by a CALL at Address:
|:00446A86   
|
:00446BA4 6633C9                  xor cx, cx
:00446BA7 668B442404              mov ax, word ptr [esp+04]
:00446BAC 663D7000                cmp ax, 0070
:00446BB0 7213                    jb 00446BC5
:00446BB2 663D7900                cmp ax, 0079
:00446BB6 770D                    ja 00446BC5
:00446BB8 66250F00                and ax, 000F
:00446BBC 6605003B                add ax, 3B00
:00446BC0 668BC8                  mov cx, ax
:00446BC3 EB4C                    jmp 00446C11

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00446BB0(C), :00446BB6(C)
|
:00446BC5 0FB7C0                  movzx eax, ax
:00446BC8 83E821                  sub eax, 00000021
:00446BCB 83F80D                  cmp eax, 0000000D
:00446BCE 7741                    ja 00446C11
:00446BD0 FF2485206C4400          jmp dword ptr [4*eax+00446C20]
:00446BD7 66B90049                mov cx, 4900
:00446BDB EB34                    jmp 00446C11
:00446BDD 66B90051                mov cx, 5100
:00446BE1 EB2E                    jmp 00446C11
:00446BE3 66B9004F                mov cx, 4F00
:00446BE7 EB28                    jmp 00446C11
:00446BE9 66B90047                mov cx, 4700
:00446BED EB22                    jmp 00446C11
:00446BEF 66B9004B                mov cx, 4B00
:00446BF3 EB1C                    jmp 00446C11
:00446BF5 66B90048                mov cx, 4800
:00446BF9 EB16                    jmp 00446C11
:00446BFB 66B9004D                mov cx, 4D00
:00446BFF EB10                    jmp 00446C11
:00446C01 66B90050                mov cx, 5000
:00446C05 EB0A                    jmp 00446C11
:00446C07 66B90052                mov cx, 5200
:00446C0B EB04                    jmp 00446C11
:00446C0D 66B90053                mov cx, 5300

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00446BC3(U), :00446BCE(C), :00446BDB(U), :00446BE1(U), :00446BE7(U)
|:00446BED(U), :00446BF3(U), :00446BF9(U), :00446BFF(U), :00446C05(U)
|:00446C0B(U)
|
:00446C11 6685C9                  test cx, cx
:00446C14 7409                    je 00446C1F
:00446C16 51                      push ecx
:00446C17 E85BFFFFFF              call 00446B77
:00446C1C 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446C14(C)
|
:00446C1F C3                      ret

:00446C20 D76B4400                DWORD 00446BD7
:00446C24 DD6B4400                DWORD 00446BDD
:00446C28 E36B4400                DWORD 00446BE3
:00446C2C E96B4400                DWORD 00446BE9
:00446C30 EF6B4400                DWORD 00446BEF
:00446C34 F56B4400                DWORD 00446BF5
:00446C38 FB6B4400                DWORD 00446BFB
:00446C3C 016C4400                DWORD 00446C01
:00446C40 116C4400                DWORD 00446C11
:00446C44 116C4400                DWORD 00446C11
:00446C48 116C4400                DWORD 00446C11
:00446C4C 116C4400                DWORD 00446C11
:00446C50 076C4400                DWORD 00446C07
:00446C54 0D6C4400                DWORD 00446C0D



* Referenced by a CALL at Address:
|:00447A48   
|
:00446C58 55                      push ebp
:00446C59 33C0                    xor eax, eax
:00446C5B 8BEC                    mov ebp, esp
:00446C5D 3905143B4500            cmp dword ptr [00453B14], eax
:00446C63 752C                    jne 00446C91
:00446C65 FF3548134700            push dword ptr [00471348]
:00446C6B C705143B450001000000    mov dword ptr [00453B14], 00000001
:00446C75 A3F83A4500              mov dword ptr [00453AF8], eax
:00446C7A 8B4508                  mov eax, dword ptr [ebp+08]
:00446C7D A368374700              mov dword ptr [00473768], eax

* Reference To: USER32.DestroyWindow, Ord:0086h
                                  |
:00446C82 FF1564744700            Call dword ptr [00477464]
:00446C88 FF7508                  push [ebp+08]

* Reference To: KERNEL32.ExitProcess, Ord:0062h
                                  |
:00446C8B FF1584734700            Call dword ptr [00477384]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446C63(C)
|
:00446C91 5D                      pop ebp
:00446C92 C3                      ret



* Referenced by a CALL at Address:
|:004467CD   
|
:00446C93 56                      push esi
:00446C94 57                      push edi
:00446C95 6A00                    push 00000000

* Reference To: USER32.GetDC, Ord:00E6h
                                  |
:00446C97 FF15A0744700            Call dword ptr [004774A0]
:00446C9D 8BF8                    mov edi, eax
:00446C9F 57                      push edi

* Reference To: GDI32.CreateCompatibleDC, Ord:001Fh
                                  |
:00446CA0 FF15FC724700            Call dword ptr [004772FC]
:00446CA6 8BF0                    mov esi, eax
:00446CA8 85F6                    test esi, esi
:00446CAA 7409                    je 00446CB5
:00446CAC 6A03                    push 00000003
:00446CAE 56                      push esi

* Reference To: GDI32.SetStretchBltMode, Ord:015Fh
                                  |
:00446CAF FF15D4724700            Call dword ptr [004772D4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446CAA(C)
|
:00446CB5 57                      push edi
:00446CB6 6A00                    push 00000000

* Reference To: USER32.ReleaseDC, Ord:01B9h
                                  |
:00446CB8 FF15A4744700            Call dword ptr [004774A4]
:00446CBE 8BC6                    mov eax, esi
:00446CC0 5F                      pop edi
:00446CC1 5E                      pop esi
:00446CC2 C3                      ret



* Referenced by a CALL at Address:
|:00446768   
|
:00446CC3 53                      push ebx
:00446CC4 33DB                    xor ebx, ebx
:00446CC6 56                      push esi
:00446CC7 53                      push ebx

* Reference To: USER32.GetDC, Ord:00E6h
                                  |
:00446CC8 FF15A0744700            Call dword ptr [004774A0]
:00446CCE 8BF0                    mov esi, eax
:00446CD0 6A0C                    push 0000000C
:00446CD2 56                      push esi

* Reference To: GDI32.GetDeviceCaps, Ord:00BCh
                                  |
:00446CD3 FF15AC724700            Call dword ptr [004772AC]
:00446CD9 56                      push esi
:00446CDA 53                      push ebx

* Reference To: USER32.ReleaseDC, Ord:01B9h
                                  |
:00446CDB FF15A4744700            Call dword ptr [004774A4]
:00446CE1 6A01                    push 00000001
:00446CE3 8B4C2410                mov ecx, dword ptr [esp+10]
:00446CE7 58                      pop eax
:00446CE8 5E                      pop esi
:00446CE9 895910                  mov dword ptr [ecx+10], ebx
:00446CEC 895914                  mov dword ptr [ecx+14], ebx
:00446CEF 895918                  mov dword ptr [ecx+18], ebx
:00446CF2 89591C                  mov dword ptr [ecx+1C], ebx
:00446CF5 895920                  mov dword ptr [ecx+20], ebx
:00446CF8 895924                  mov dword ptr [ecx+24], ebx
:00446CFB 885928                  mov byte ptr [ecx+28], bl
:00446CFE 88592A                  mov byte ptr [ecx+2A], bl
:00446D01 885929                  mov byte ptr [ecx+29], bl
:00446D04 88592B                  mov byte ptr [ecx+2B], bl
:00446D07 C70128000000            mov dword ptr [ecx], 00000028
:00446D0D 894104                  mov dword ptr [ecx+04], eax
:00446D10 894108                  mov dword ptr [ecx+08], eax
:00446D13 6689410C                mov word ptr [ecx+0C], ax
:00446D17 66C7410E0800            mov [ecx+0E], 0008
:00446D1D 5B                      pop ebx
:00446D1E C20400                  ret 0004



* Referenced by a CALL at Address:
|:004467E4   
|
:00446D21 33C0                    xor eax, eax
:00446D23 50                      push eax
:00446D24 50                      push eax
:00446D25 FF742414                push [esp+14]
:00446D29 50                      push eax
:00446D2A FF742418                push [esp+18]
:00446D2E FF742418                push [esp+18]

* Reference To: GDI32.CreateDIBSection, Ord:0024h
                                  |
:00446D32 FF15D0724700            Call dword ptr [004772D0]
:00446D38 C20C00                  ret 000C



* Referenced by a CALL at Addresses:
|:00444650   , :004446DB   
|
:00446D3B 55                      push ebp
:00446D3C 8BEC                    mov ebp, esp
:00446D3E 83EC18                  sub esp, 00000018
:00446D41 8D45E8                  lea eax, dword ptr [ebp-18]
:00446D44 50                      push eax
:00446D45 6A18                    push 00000018
:00446D47 FF7508                  push [ebp+08]

* Reference To: GDI32.GetObjectA, Ord:00DEh
                                  |
:00446D4A FF15CC724700            Call dword ptr [004772CC]
:00446D50 8B45FC                  mov eax, dword ptr [ebp-04]
:00446D53 C9                      leave
:00446D54 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:00444343   , :00444562   , :00444706   , :00446070   , :00446B0C   
|
:00446D57 FF742410                push [esp+10]
:00446D5B FF742410                push [esp+10]
:00446D5F FF742410                push [esp+10]
:00446D63 FF742410                push [esp+10]

* Reference To: GDI32.SetDIBColorTable, Ord:0148h
                                  |
:00446D67 FF15C8724700            Call dword ptr [004772C8]
:00446D6D C21000                  ret 0010



* Referenced by a CALL at Address:
|:004445BE   
|
:00446D70 55                      push ebp
:00446D71 8BEC                    mov ebp, esp
:00446D73 682000CC00              push 00CC0020
:00446D78 FF7524                  push [ebp+24]
:00446D7B FF7520                  push [ebp+20]
:00446D7E FF751C                  push [ebp+1C]
:00446D81 FF7518                  push [ebp+18]
:00446D84 FF7514                  push [ebp+14]
:00446D87 FF7510                  push [ebp+10]
:00446D8A FF750C                  push [ebp+0C]
:00446D8D FF7508                  push [ebp+08]

* Reference To: GDI32.BitBlt, Ord:000Ah
                                  |
:00446D90 FF15F0724700            Call dword ptr [004772F0]
:00446D96 5D                      pop ebp
:00446D97 C22000                  ret 0020



* Referenced by a CALL at Addresses:
|:004442CD   , :00444A1E   
|
:00446D9A 55                      push ebp
:00446D9B 8BEC                    mov ebp, esp
:00446D9D 81EC08040000            sub esp, 00000408
:00446DA3 53                      push ebx
:00446DA4 56                      push esi
:00446DA5 BB00010000              mov ebx, 00000100
:00446DAA 57                      push edi
:00446DAB 8BCB                    mov ecx, ebx
:00446DAD 33C0                    xor eax, eax
:00446DAF 8DBDFCFBFFFF            lea edi, dword ptr [ebp+FFFFFBFC]
:00446DB5 66C785F8FBFFFF0003      mov word ptr [ebp+FFFFFBF8], 0300
:00446DBE 66899DFAFBFFFF          mov word ptr [ebp+FFFFFBFA], bx
:00446DC5 50                      push eax
:00446DC6 F3                      repz
:00446DC7 AB                      stosd

* Reference To: USER32.GetDC, Ord:00E6h
                                  |
:00446DC8 FF15A0744700            Call dword ptr [004774A0]
:00446DCE 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00446DD1 8B5508                  mov edx, dword ptr [ebp+08]
:00446DD4 6A18                    push 00000018
:00446DD6 50                      push eax
:00446DD7 8945FC                  mov dword ptr [ebp-04], eax
:00446DDA 8D7411FF                lea esi, dword ptr [ecx+edx-01]

* Reference To: GDI32.GetDeviceCaps, Ord:00BCh
                                  |
:00446DDE FF15AC724700            Call dword ptr [004772AC]
:00446DE4 99                      cdq
:00446DE5 2BC2                    sub eax, edx
:00446DE7 8BF8                    mov edi, eax
:00446DE9 8D85FCFBFFFF            lea eax, dword ptr [ebp+FFFFFBFC]
:00446DEF 50                      push eax
:00446DF0 53                      push ebx
:00446DF1 6A00                    push 00000000
:00446DF3 FF75FC                  push [ebp-04]
:00446DF6 D1FF                    sar edi, 1

* Reference To: GDI32.GetSystemPaletteEntries, Ord:00F0h
                                  |
:00446DF8 FF15C0724700            Call dword ptr [004772C0]
:00446DFE 397D08                  cmp dword ptr [ebp+08], edi
:00446E01 7D03                    jge 00446E06
:00446E03 897D08                  mov dword ptr [ebp+08], edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446E01(C)
|
:00446E06 B8FF000000              mov eax, 000000FF
:00446E0B 2BC7                    sub eax, edi
:00446E0D 3BF0                    cmp esi, eax
:00446E0F 7E02                    jle 00446E13
:00446E11 8BF0                    mov esi, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446E0F(C)
|
:00446E13 8B4D08                  mov ecx, dword ptr [ebp+08]
:00446E16 33D2                    xor edx, edx
:00446E18 85C9                    test ecx, ecx
:00446E1A 7E11                    jle 00446E2D
:00446E1C 8D85FFFBFFFF            lea eax, dword ptr [ebp+FFFFFBFF]
:00446E22 8BD1                    mov edx, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446E2B(C)
|
:00446E24 802000                  and byte ptr [eax], 00
:00446E27 83C004                  add eax, 00000004
:00446E2A 49                      dec ecx
:00446E2B 75F7                    jne 00446E24

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446E1A(C)
|
:00446E2D 3BD6                    cmp edx, esi
:00446E2F 7F5D                    jg 00446E8E
:00446E31 8B4D10                  mov ecx, dword ptr [ebp+10]
:00446E34 8D9DFCFBFFFF            lea ebx, dword ptr [ebp+FFFFFBFC]
:00446E3A 2BD9                    sub ebx, ecx
:00446E3C 8DBDFBFBFFFF            lea edi, dword ptr [ebp+FFFFFBFB]
:00446E42 895D0C                  mov dword ptr [ebp+0C], ebx
:00446E45 8D9DFDFBFFFF            lea ebx, dword ptr [ebp+FFFFFBFD]
:00446E4B 2BD9                    sub ebx, ecx
:00446E4D 2BF2                    sub esi, edx
:00446E4F 895D10                  mov dword ptr [ebp+10], ebx
:00446E52 8D9DFEFBFFFF            lea ebx, dword ptr [ebp+FFFFFBFE]
:00446E58 2BF9                    sub edi, ecx
:00446E5A 2BD9                    sub ebx, ecx
:00446E5C 46                      inc esi
:00446E5D 8D449101                lea eax, dword ptr [ecx+4*edx+01]
:00446E61 897508                  mov dword ptr [ebp+08], esi
:00446E64 03D6                    add edx, esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446E87(C)
|
:00446E66 8A4801                  mov cl, byte ptr [eax+01]
:00446E69 8B750C                  mov esi, dword ptr [ebp+0C]
:00446E6C 880C07                  mov byte ptr [edi+eax], cl
:00446E6F 8A08                    mov cl, byte ptr [eax]
:00446E71 880C06                  mov byte ptr [esi+eax], cl
:00446E74 8B7510                  mov esi, dword ptr [ebp+10]
:00446E77 8A48FF                  mov cl, byte ptr [eax-01]
:00446E7A 880C06                  mov byte ptr [esi+eax], cl
:00446E7D C6040301                mov byte ptr [ebx+eax], 01
:00446E81 83C004                  add eax, 00000004
:00446E84 FF4D08                  dec [ebp+08]
:00446E87 75DD                    jne 00446E66
:00446E89 BB00010000              mov ebx, 00000100

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446E2F(C)
|
:00446E8E 3BD3                    cmp edx, ebx
:00446E90 7D12                    jge 00446EA4
:00446E92 8D8495FFFBFFFF          lea eax, dword ptr [ebp+4*edx-00000401]
:00446E99 2BDA                    sub ebx, edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446EA2(C)
|
:00446E9B 802000                  and byte ptr [eax], 00
:00446E9E 83C004                  add eax, 00000004
:00446EA1 4B                      dec ebx
:00446EA2 75F7                    jne 00446E9B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446E90(C)
|
:00446EA4 FF75FC                  push [ebp-04]
:00446EA7 6A00                    push 00000000

* Reference To: USER32.ReleaseDC, Ord:01B9h
                                  |
:00446EA9 FF15A4744700            Call dword ptr [004774A4]
:00446EAF 8D85F8FBFFFF            lea eax, dword ptr [ebp+FFFFFBF8]
:00446EB5 50                      push eax

* Reference To: GDI32.CreatePalette, Ord:0035h
                                  |
:00446EB6 FF15C4724700            Call dword ptr [004772C4]
:00446EBC 5F                      pop edi
:00446EBD 5E                      pop esi
:00446EBE 5B                      pop ebx
:00446EBF C9                      leave
:00446EC0 C3                      ret



* Referenced by a CALL at Addresses:
|:004442BD   , :00444A12   
|
:00446EC1 55                      push ebp
:00446EC2 8BEC                    mov ebp, esp
:00446EC4 81EC08040000            sub esp, 00000408
:00446ECA 53                      push ebx
:00446ECB 56                      push esi
:00446ECC BA00010000              mov edx, 00000100
:00446ED1 57                      push edi
:00446ED2 8BCA                    mov ecx, edx
:00446ED4 33C0                    xor eax, eax
:00446ED6 8DBDFCFBFFFF            lea edi, dword ptr [ebp+FFFFFBFC]
:00446EDC 66C785F8FBFFFF0003      mov word ptr [ebp+FFFFFBF8], 0300
:00446EE5 668995FAFBFFFF          mov word ptr [ebp+FFFFFBFA], dx
:00446EEC 33DB                    xor ebx, ebx
:00446EEE F3                      repz
:00446EEF AB                      stosd
:00446EF0 8D85FDFBFFFF            lea eax, dword ptr [ebp+FFFFFBFD]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446F06(C)
|
:00446EF6 8858FF                  mov byte ptr [eax-01], bl
:00446EF9 8818                    mov byte ptr [eax], bl
:00446EFB 885801                  mov byte ptr [eax+01], bl
:00446EFE C6400204                mov [eax+02], 04
:00446F02 83C004                  add eax, 00000004
:00446F05 4A                      dec edx
:00446F06 75EE                    jne 00446EF6
:00446F08 53                      push ebx

* Reference To: USER32.GetDC, Ord:00E6h
                                  |
:00446F09 FF15A0744700            Call dword ptr [004774A0]
:00446F0F 8BF8                    mov edi, eax
:00446F11 8D85F8FBFFFF            lea eax, dword ptr [ebp+FFFFFBF8]
:00446F17 50                      push eax

* Reference To: GDI32.CreatePalette, Ord:0035h
                                  |
:00446F18 FF15C4724700            Call dword ptr [004772C4]

* Reference To: GDI32.SelectPalette, Ord:013Dh
                                  |
:00446F1E 8B35B8724700            mov esi, dword ptr [004772B8]
:00446F24 53                      push ebx
:00446F25 50                      push eax
:00446F26 57                      push edi
:00446F27 FFD6                    call esi
:00446F29 57                      push edi
:00446F2A 8945FC                  mov dword ptr [ebp-04], eax

* Reference To: GDI32.RealizePalette, Ord:0129h
                                  |
:00446F2D FF15B4724700            Call dword ptr [004772B4]
:00446F33 53                      push ebx
:00446F34 FF75FC                  push [ebp-04]
:00446F37 57                      push edi
:00446F38 FFD6                    call esi
:00446F3A 50                      push eax

* Reference To: GDI32.DeleteObject, Ord:0046h
                                  |
:00446F3B FF15BC724700            Call dword ptr [004772BC]
:00446F41 57                      push edi
:00446F42 53                      push ebx

* Reference To: USER32.ReleaseDC, Ord:01B9h
                                  |
:00446F43 FF15A4744700            Call dword ptr [004774A4]
:00446F49 5F                      pop edi
:00446F4A 5E                      pop esi
:00446F4B 5B                      pop ebx
:00446F4C C9                      leave
:00446F4D C3                      ret



* Referenced by a CALL at Address:
|:00444E82   
|
:00446F4E 55                      push ebp
:00446F4F 8BEC                    mov ebp, esp
:00446F51 8B450C                  mov eax, dword ptr [ebp+0C]
:00446F54 0FAF4508                imul eax, dword ptr [ebp+08]
:00446F58 837D1407                cmp dword ptr [ebp+14], 00000007
:00446F5C 50                      push eax
:00446F5D 7504                    jne 00446F63
:00446F5F 6A00                    push 00000000
:00446F61 EB02                    jmp 00446F65

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446F5D(C)
|
:00446F63 6A10                    push 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446F61(U)
|
:00446F65 FF7510                  push [ebp+10]
:00446F68 E8C3160000              call 00448630
:00446F6D 83C40C                  add esp, 0000000C
:00446F70 5D                      pop ebp
:00446F71 C3                      ret



* Referenced by a CALL at Address:
|:00445455   
|
:00446F72 55                      push ebp
:00446F73 8BEC                    mov ebp, esp
:00446F75 53                      push ebx
:00446F76 8B5D0C                  mov ebx, dword ptr [ebp+0C]
:00446F79 85DB                    test ebx, ebx
:00446F7B 7E1E                    jle 00446F9B
:00446F7D 57                      push edi
:00446F7E 8B7D18                  mov edi, dword ptr [ebp+18]
:00446F81 56                      push esi
:00446F82 0FB67514                movzx esi, byte ptr [ebp+14]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446F97(C)
|
:00446F86 FF7508                  push [ebp+08]
:00446F89 56                      push esi
:00446F8A 57                      push edi
:00446F8B E8A0160000              call 00448630
:00446F90 037D10                  add edi, dword ptr [ebp+10]
:00446F93 83C40C                  add esp, 0000000C
:00446F96 4B                      dec ebx
:00446F97 75ED                    jne 00446F86
:00446F99 5E                      pop esi
:00446F9A 5F                      pop edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446F7B(C)
|
:00446F9B 5B                      pop ebx
:00446F9C 5D                      pop ebp
:00446F9D C3                      ret



* Referenced by a CALL at Addresses:
|:004458B2   , :00445C7B   
|
:00446F9E 55                      push ebp
:00446F9F 8BEC                    mov ebp, esp
:00446FA1 53                      push ebx
:00446FA2 8B5D0C                  mov ebx, dword ptr [ebp+0C]
:00446FA5 85DB                    test ebx, ebx
:00446FA7 7E20                    jle 00446FC9
:00446FA9 57                      push edi
:00446FAA 8B7D18                  mov edi, dword ptr [ebp+18]
:00446FAD 56                      push esi
:00446FAE 8B751C                  mov esi, dword ptr [ebp+1C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446FC5(C)
|
:00446FB1 FF7508                  push [ebp+08]
:00446FB4 57                      push edi
:00446FB5 56                      push esi
:00446FB6 E8D5160000              call 00448690
:00446FBB 037510                  add esi, dword ptr [ebp+10]
:00446FBE 037D14                  add edi, dword ptr [ebp+14]
:00446FC1 83C40C                  add esp, 0000000C
:00446FC4 4B                      dec ebx
:00446FC5 75EA                    jne 00446FB1
:00446FC7 5E                      pop esi
:00446FC8 5F                      pop edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446FA7(C)
|
:00446FC9 5B                      pop ebx
:00446FCA 5D                      pop ebp
:00446FCB C3                      ret



* Referenced by a CALL at Addresses:
|:004458E6   , :00445CBC   
|
:00446FCC 55                      push ebp
:00446FCD 8BEC                    mov ebp, esp
:00446FCF 8B4510                  mov eax, dword ptr [ebp+10]
:00446FD2 8B4D14                  mov ecx, dword ptr [ebp+14]
:00446FD5 8B550C                  mov edx, dword ptr [ebp+0C]
:00446FD8 2B4508                  sub eax, dword ptr [ebp+08]
:00446FDB 2B4D08                  sub ecx, dword ptr [ebp+08]
:00446FDE 85D2                    test edx, edx
:00446FE0 7E28                    jle 0044700A
:00446FE2 57                      push edi
:00446FE3 8B7D18                  mov edi, dword ptr [ebp+18]
:00446FE6 56                      push esi
:00446FE7 8B751C                  mov esi, dword ptr [ebp+1C]
:00446FEA 53                      push ebx
:00446FEB 895510                  mov dword ptr [ebp+10], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447005(C)
|
:00446FEE 8B5508                  mov edx, dword ptr [ebp+08]
:00446FF1 85D2                    test edx, edx
:00446FF3 7E09                    jle 00446FFE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446FFC(C)
|
:00446FF5 8A1F                    mov bl, byte ptr [edi]
:00446FF7 201E                    and byte ptr [esi], bl
:00446FF9 47                      inc edi
:00446FFA 46                      inc esi
:00446FFB 4A                      dec edx
:00446FFC 75F7                    jne 00446FF5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446FF3(C)
|
:00446FFE 03F0                    add esi, eax
:00447000 03F9                    add edi, ecx
:00447002 FF4D10                  dec [ebp+10]
:00447005 75E7                    jne 00446FEE
:00447007 5B                      pop ebx
:00447008 5E                      pop esi
:00447009 5F                      pop edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446FE0(C)
|
:0044700A 5D                      pop ebp
:0044700B C3                      ret



* Referenced by a CALL at Addresses:
|:00445900   , :00445CDB   
|
:0044700C 55                      push ebp
:0044700D 8BEC                    mov ebp, esp
:0044700F 8B4510                  mov eax, dword ptr [ebp+10]
:00447012 8B4D14                  mov ecx, dword ptr [ebp+14]
:00447015 8B550C                  mov edx, dword ptr [ebp+0C]
:00447018 2B4508                  sub eax, dword ptr [ebp+08]
:0044701B 2B4D08                  sub ecx, dword ptr [ebp+08]
:0044701E 85D2                    test edx, edx
:00447020 7E28                    jle 0044704A
:00447022 57                      push edi
:00447023 8B7D18                  mov edi, dword ptr [ebp+18]
:00447026 56                      push esi
:00447027 8B751C                  mov esi, dword ptr [ebp+1C]
:0044702A 53                      push ebx
:0044702B 895510                  mov dword ptr [ebp+10], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447045(C)
|
:0044702E 8B5508                  mov edx, dword ptr [ebp+08]
:00447031 85D2                    test edx, edx
:00447033 7E09                    jle 0044703E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044703C(C)
|
:00447035 8A1F                    mov bl, byte ptr [edi]
:00447037 081E                    or byte ptr [esi], bl
:00447039 47                      inc edi
:0044703A 46                      inc esi
:0044703B 4A                      dec edx
:0044703C 75F7                    jne 00447035

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447033(C)
|
:0044703E 03F0                    add esi, eax
:00447040 03F9                    add edi, ecx
:00447042 FF4D10                  dec [ebp+10]
:00447045 75E7                    jne 0044702E
:00447047 5B                      pop ebx
:00447048 5E                      pop esi
:00447049 5F                      pop edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447020(C)
|
:0044704A 5D                      pop ebp
:0044704B C3                      ret



* Referenced by a CALL at Addresses:
|:004458CC   , :00445C9D   
|
:0044704C 55                      push ebp
:0044704D 8BEC                    mov ebp, esp
:0044704F 8B4510                  mov eax, dword ptr [ebp+10]
:00447052 8B4D14                  mov ecx, dword ptr [ebp+14]
:00447055 8B550C                  mov edx, dword ptr [ebp+0C]
:00447058 2B4508                  sub eax, dword ptr [ebp+08]
:0044705B 2B4D08                  sub ecx, dword ptr [ebp+08]
:0044705E 85D2                    test edx, edx
:00447060 7E31                    jle 00447093
:00447062 57                      push edi
:00447063 8B7D18                  mov edi, dword ptr [ebp+18]
:00447066 56                      push esi
:00447067 8B751C                  mov esi, dword ptr [ebp+1C]
:0044706A 53                      push ebx
:0044706B 895510                  mov dword ptr [ebp+10], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044708E(C)
|
:0044706E 8B5508                  mov edx, dword ptr [ebp+08]
:00447071 85D2                    test edx, edx
:00447073 7E12                    jle 00447087

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447085(C)
|
:00447075 837D2007                cmp dword ptr [ebp+20], 00000007
:00447079 7403                    je 0044707E
:0044707B 80260F                  and byte ptr [esi], 0F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447079(C)
|
:0044707E 8A1F                    mov bl, byte ptr [edi]
:00447080 301E                    xor byte ptr [esi], bl
:00447082 47                      inc edi
:00447083 46                      inc esi
:00447084 4A                      dec edx
:00447085 75EE                    jne 00447075

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447073(C)
|
:00447087 03F0                    add esi, eax
:00447089 03F9                    add edi, ecx
:0044708B FF4D10                  dec [ebp+10]
:0044708E 75DE                    jne 0044706E
:00447090 5B                      pop ebx
:00447091 5E                      pop esi
:00447092 5F                      pop edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447060(C)
|
:00447093 5D                      pop ebp
:00447094 C3                      ret



* Referenced by a CALL at Address:
|:0044591A   
|
:00447095 55                      push ebp
:00447096 8BEC                    mov ebp, esp
:00447098 8B4510                  mov eax, dword ptr [ebp+10]
:0044709B 8B4D14                  mov ecx, dword ptr [ebp+14]
:0044709E 8B550C                  mov edx, dword ptr [ebp+0C]
:004470A1 2B4508                  sub eax, dword ptr [ebp+08]
:004470A4 2B4D08                  sub ecx, dword ptr [ebp+08]
:004470A7 85D2                    test edx, edx
:004470A9 7E3C                    jle 004470E7
:004470AB 57                      push edi
:004470AC 8B7D1C                  mov edi, dword ptr [ebp+1C]
:004470AF 56                      push esi
:004470B0 8B7518                  mov esi, dword ptr [ebp+18]
:004470B3 53                      push ebx
:004470B4 895514                  mov dword ptr [ebp+14], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004470E2(C)
|
:004470B7 8B5508                  mov edx, dword ptr [ebp+08]
:004470BA 85D2                    test edx, edx
:004470BC 7E1D                    jle 004470DB
:004470BE 895510                  mov dword ptr [ebp+10], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004470D9(C)
|
:004470C1 8A16                    mov dl, byte ptr [esi]
:004470C3 837D2007                cmp dword ptr [ebp+20], 00000007
:004470C7 8ADA                    mov bl, dl
:004470C9 7403                    je 004470CE
:004470CB 80E30F                  and bl, 0F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004470C9(C)
|
:004470CE 84DB                    test bl, bl
:004470D0 7402                    je 004470D4
:004470D2 8817                    mov byte ptr [edi], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004470D0(C)
|
:004470D4 47                      inc edi
:004470D5 46                      inc esi
:004470D6 FF4D10                  dec [ebp+10]
:004470D9 75E6                    jne 004470C1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004470BC(C)
|
:004470DB 03F8                    add edi, eax
:004470DD 03F1                    add esi, ecx
:004470DF FF4D14                  dec [ebp+14]
:004470E2 75D3                    jne 004470B7
:004470E4 5B                      pop ebx
:004470E5 5E                      pop esi
:004470E6 5F                      pop edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004470A9(C)
|
:004470E7 5D                      pop ebp
:004470E8 C3                      ret



* Referenced by a CALL at Addresses:
|:00445A34   , :00445A83   
|
:004470E9 55                      push ebp
:004470EA 8BEC                    mov ebp, esp
:004470EC 53                      push ebx
:004470ED 8B5D0C                  mov ebx, dword ptr [ebp+0C]
:004470F0 85DB                    test ebx, ebx
:004470F2 7E20                    jle 00447114
:004470F4 57                      push edi
:004470F5 8B7D18                  mov edi, dword ptr [ebp+18]
:004470F8 56                      push esi
:004470F9 8B751C                  mov esi, dword ptr [ebp+1C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447110(C)
|
:004470FC FF7508                  push [ebp+08]
:004470FF 57                      push edi
:00447100 56                      push esi
:00447101 E88A150000              call 00448690
:00447106 037514                  add esi, dword ptr [ebp+14]
:00447109 037D10                  add edi, dword ptr [ebp+10]
:0044710C 83C40C                  add esp, 0000000C
:0044710F 4B                      dec ebx
:00447110 75EA                    jne 004470FC
:00447112 5E                      pop esi
:00447113 5F                      pop edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004470F2(C)
|
:00447114 5B                      pop ebx
:00447115 5D                      pop ebp
:00447116 C3                      ret



* Referenced by a CALL at Address:
|:00445BC5   
|
:00447117 55                      push ebp
:00447118 8BEC                    mov ebp, esp
:0044711A 51                      push ecx
:0044711B 8B450C                  mov eax, dword ptr [ebp+0C]
:0044711E 85C0                    test eax, eax
:00447120 7E6C                    jle 0044718E
:00447122 57                      push edi
:00447123 8B7D1C                  mov edi, dword ptr [ebp+1C]
:00447126 56                      push esi
:00447127 53                      push ebx
:00447128 8B5D08                  mov ebx, dword ptr [ebp+08]
:0044712B 89450C                  mov dword ptr [ebp+0C], eax
:0044712E C1FB03                  sar ebx, 03
:00447131 895DFC                  mov dword ptr [ebp-04], ebx
:00447134 EB03                    jmp 00447139

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447189(C)
|
:00447136 8B5DFC                  mov ebx, dword ptr [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447134(U)
|
:00447139 8B7520                  mov esi, dword ptr [ebp+20]
:0044713C 85DB                    test ebx, ebx
:0044713E 741E                    je 0044715E
:00447140 7E1C                    jle 0044715E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044715C(C)
|
:00447142 8A0F                    mov cl, byte ptr [edi]
:00447144 6A08                    push 00000008
:00447146 47                      inc edi
:00447147 5A                      pop edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447159(C)
|
:00447148 8B4514                  mov eax, dword ptr [ebp+14]
:0044714B F6C180                  test cl, 80
:0044714E 7503                    jne 00447153
:00447150 8B4518                  mov eax, dword ptr [ebp+18]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044714E(C)
|
:00447153 8806                    mov byte ptr [esi], al
:00447155 46                      inc esi
:00447156 D0E1                    shl cl, 1
:00447158 4A                      dec edx
:00447159 75ED                    jne 00447148
:0044715B 4B                      dec ebx
:0044715C 75E4                    jne 00447142

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044713E(C), :00447140(C)
|
:0044715E 8B4508                  mov eax, dword ptr [ebp+08]
:00447161 83E007                  and eax, 00000007
:00447164 741A                    je 00447180
:00447166 8A17                    mov dl, byte ptr [edi]
:00447168 47                      inc edi
:00447169 85C0                    test eax, eax
:0044716B 7E13                    jle 00447180

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044717E(C)
|
:0044716D 8B4D14                  mov ecx, dword ptr [ebp+14]
:00447170 F6C280                  test dl, 80
:00447173 7503                    jne 00447178
:00447175 8B4D18                  mov ecx, dword ptr [ebp+18]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447173(C)
|
:00447178 880E                    mov byte ptr [esi], cl
:0044717A 46                      inc esi
:0044717B D0E2                    shl dl, 1
:0044717D 48                      dec eax
:0044717E 75ED                    jne 0044716D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00447164(C), :0044716B(C)
|
:00447180 8B4510                  mov eax, dword ptr [ebp+10]
:00447183 014520                  add dword ptr [ebp+20], eax
:00447186 FF4D0C                  dec [ebp+0C]
:00447189 75AB                    jne 00447136
:0044718B 5B                      pop ebx
:0044718C 5E                      pop esi
:0044718D 5F                      pop edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447120(C)
|
:0044718E C9                      leave
:0044718F C3                      ret



* Referenced by a CALL at Address:
|:00445BE0   
|
:00447190 55                      push ebp
:00447191 8BEC                    mov ebp, esp
:00447193 51                      push ecx
:00447194 8B450C                  mov eax, dword ptr [ebp+0C]
:00447197 85C0                    test eax, eax
:00447199 7E64                    jle 004471FF
:0044719B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044719E 57                      push edi
:0044719F 8B7D1C                  mov edi, dword ptr [ebp+1C]
:004471A2 56                      push esi
:004471A3 C1F903                  sar ecx, 03
:004471A6 53                      push ebx
:004471A7 8A5D14                  mov bl, byte ptr [ebp+14]
:004471AA 894DFC                  mov dword ptr [ebp-04], ecx
:004471AD 89450C                  mov dword ptr [ebp+0C], eax
:004471B0 EB03                    jmp 004471B5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004471FA(C)
|
:004471B2 8B4DFC                  mov ecx, dword ptr [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004471B0(U)
|
:004471B5 8B5520                  mov edx, dword ptr [ebp+20]
:004471B8 85C9                    test ecx, ecx
:004471BA 7417                    je 004471D3
:004471BC 7E15                    jle 004471D3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004471D1(C)
|
:004471BE 8A07                    mov al, byte ptr [edi]
:004471C0 6A08                    push 00000008
:004471C2 47                      inc edi
:004471C3 5E                      pop esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004471CE(C)
|
:004471C4 A880                    test al, 80
:004471C6 7402                    je 004471CA
:004471C8 881A                    mov byte ptr [edx], bl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004471C6(C)
|
:004471CA 42                      inc edx
:004471CB D0E0                    shl al, 1
:004471CD 4E                      dec esi
:004471CE 75F4                    jne 004471C4
:004471D0 49                      dec ecx
:004471D1 75EB                    jne 004471BE

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004471BA(C), :004471BC(C)
|
:004471D3 8B4508                  mov eax, dword ptr [ebp+08]
:004471D6 83E007                  and eax, 00000007
:004471D9 7416                    je 004471F1
:004471DB 8A0F                    mov cl, byte ptr [edi]
:004471DD 47                      inc edi
:004471DE 85C0                    test eax, eax
:004471E0 7E0F                    jle 004471F1
:004471E2 8BF0                    mov esi, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004471EF(C)
|
:004471E4 F6C180                  test cl, 80
:004471E7 7402                    je 004471EB
:004471E9 881A                    mov byte ptr [edx], bl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004471E7(C)
|
:004471EB 42                      inc edx
:004471EC D0E1                    shl cl, 1
:004471EE 4E                      dec esi
:004471EF 75F3                    jne 004471E4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004471D9(C), :004471E0(C)
|
:004471F1 8B4510                  mov eax, dword ptr [ebp+10]
:004471F4 014520                  add dword ptr [ebp+20], eax
:004471F7 FF4D0C                  dec [ebp+0C]
:004471FA 75B6                    jne 004471B2
:004471FC 5B                      pop ebx
:004471FD 5E                      pop esi
:004471FE 5F                      pop edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447199(C)
|
:004471FF C9                      leave
:00447200 C3                      ret



* Referenced by a CALL at Address:
|:00445A46   
|
:00447201 55                      push ebp
:00447202 8BEC                    mov ebp, esp
:00447204 51                      push ecx
:00447205 8B4508                  mov eax, dword ptr [ebp+08]
:00447208 56                      push esi
:00447209 8BF0                    mov esi, eax
:0044720B 83E001                  and eax, 00000001
:0044720E 8945FC                  mov dword ptr [ebp-04], eax
:00447211 8B450C                  mov eax, dword ptr [ebp+0C]
:00447214 D1FE                    sar esi, 1
:00447216 85C0                    test eax, eax
:00447218 7E3D                    jle 00447257
:0044721A 8B5510                  mov edx, dword ptr [ebp+10]
:0044721D 57                      push edi
:0044721E 8B7D14                  mov edi, dword ptr [ebp+14]
:00447221 53                      push ebx
:00447222 894508                  mov dword ptr [ebp+08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447253(C)
|
:00447225 85F6                    test esi, esi
:00447227 7418                    je 00447241
:00447229 7E16                    jle 00447241
:0044722B 8BDE                    mov ebx, esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044723F(C)
|
:0044722D 8A0A                    mov cl, byte ptr [edx]
:0044722F 8A4201                  mov al, byte ptr [edx+01]
:00447232 42                      inc edx
:00447233 240F                    and al, 0F
:00447235 C0E104                  shl cl, 04
:00447238 02C1                    add al, cl
:0044723A 42                      inc edx
:0044723B 8807                    mov byte ptr [edi], al
:0044723D 47                      inc edi
:0044723E 4B                      dec ebx
:0044723F 75EC                    jne 0044722D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00447227(C), :00447229(C)
|
:00447241 837DFC00                cmp dword ptr [ebp-04], 00000000
:00447245 7409                    je 00447250
:00447247 8A02                    mov al, byte ptr [edx]
:00447249 42                      inc edx
:0044724A C0E004                  shl al, 04
:0044724D 8807                    mov byte ptr [edi], al
:0044724F 47                      inc edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447245(C)
|
:00447250 FF4D08                  dec [ebp+08]
:00447253 75D0                    jne 00447225
:00447255 5B                      pop ebx
:00447256 5F                      pop edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447218(C)
|
:00447257 5E                      pop esi
:00447258 C9                      leave
:00447259 C3                      ret



* Referenced by a CALL at Address:
|:00445839   
|
:0044725A 55                      push ebp
:0044725B 8BEC                    mov ebp, esp
:0044725D 8B4508                  mov eax, dword ptr [ebp+08]
:00447260 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00447263 56                      push esi
:00447264 8BF0                    mov esi, eax
:00447266 D1FE                    sar esi, 1
:00447268 83E001                  and eax, 00000001
:0044726B 85C9                    test ecx, ecx
:0044726D 7E44                    jle 004472B3
:0044726F 8B5510                  mov edx, dword ptr [ebp+10]
:00447272 57                      push edi
:00447273 894D08                  mov dword ptr [ebp+08], ecx
:00447276 8B4D14                  mov ecx, dword ptr [ebp+14]
:00447279 53                      push ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004472AF(C)
|
:0044727A 85F6                    test esi, esi
:0044727C 741E                    je 0044729C
:0044727E 7E1C                    jle 0044729C
:00447280 8BFE                    mov edi, esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044729A(C)
|
:00447282 8A1A                    mov bl, byte ptr [edx]
:00447284 C0EB04                  shr bl, 04
:00447287 80CB10                  or bl, 10
:0044728A 8819                    mov byte ptr [ecx], bl
:0044728C 8A1A                    mov bl, byte ptr [edx]
:0044728E 80E30F                  and bl, 0F
:00447291 41                      inc ecx
:00447292 80CB10                  or bl, 10
:00447295 8819                    mov byte ptr [ecx], bl
:00447297 41                      inc ecx
:00447298 42                      inc edx
:00447299 4F                      dec edi
:0044729A 75E6                    jne 00447282

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044727C(C), :0044727E(C)
|
:0044729C 85C0                    test eax, eax
:0044729E 740C                    je 004472AC
:004472A0 8A1A                    mov bl, byte ptr [edx]
:004472A2 C0EB04                  shr bl, 04
:004472A5 80CB10                  or bl, 10
:004472A8 8819                    mov byte ptr [ecx], bl
:004472AA 41                      inc ecx
:004472AB 42                      inc edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044729E(C)
|
:004472AC FF4D08                  dec [ebp+08]
:004472AF 75C9                    jne 0044727A
:004472B1 5B                      pop ebx
:004472B2 5F                      pop edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044726D(C)
|
:004472B3 5E                      pop esi
:004472B4 5D                      pop ebp
:004472B5 C3                      ret



* Referenced by a CALL at Addresses:
|:0040C00A   , :0040C03C   , :0040C06E   , :0040C09C   , :0040C0CE   
|:0040CB9A   , :0040CBDB   , :0041EC99   , :0041ECDF   , :0041F062   
|
:004472B6 55                      push ebp
:004472B7 8B442408                mov eax, dword ptr [esp+08]
:004472BB 8BEC                    mov ebp, esp
:004472BD 0344240C                add eax, dword ptr [esp+0C]
:004472C1 3B4510                  cmp eax, dword ptr [ebp+10]
:004472C4 7E03                    jle 004472C9
:004472C6 8B4510                  mov eax, dword ptr [ebp+10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004472C4(C)
|
:004472C9 5D                      pop ebp
:004472CA C3                      ret



* Referenced by a CALL at Addresses:
|:0040889F   , :0041EC53   , :00423AB3   , :00435DB7   
|
:004472CB 55                      push ebp
:004472CC 8B442408                mov eax, dword ptr [esp+08]
:004472D0 8BEC                    mov ebp, esp
:004472D2 3944240C                cmp dword ptr [esp+0C], eax
:004472D6 7305                    jnb 004472DD
:004472D8 2B450C                  sub eax, dword ptr [ebp+0C]
:004472DB EB02                    jmp 004472DF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004472D6(C)
|
:004472DD 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004472DB(U)
|
:004472DF 5D                      pop ebp
:004472E0 C3                      ret



* Referenced by a CALL at Address:
|:0040CC1A   
|
:004472E1 55                      push ebp
:004472E2 0FB644240C              movzx eax, byte ptr [esp+0C]
:004472E7 0FB64C2408              movzx ecx, byte ptr [esp+08]
:004472EC 8BEC                    mov ebp, esp
:004472EE 03C1                    add eax, ecx
:004472F0 0FB64D10                movzx ecx, byte ptr [ebp+10]
:004472F4 3BC1                    cmp eax, ecx
:004472F6 7202                    jb 004472FA
:004472F8 8BC1                    mov eax, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004472F6(C)
|
:004472FA 5D                      pop ebp
:004472FB C3                      ret



* Referenced by a CALL at Address:
|:00447337   
|
:004472FC A1203B4500              mov eax, dword ptr [00453B20]
:00447301 69C06D4EC641            imul eax, 41C64E6D
:00447307 0539300000              add eax, 00003039
:0044730C A3203B4500              mov dword ptr [00453B20], eax
:00447311 250000FF7F              and eax, 7FFF0000
:00447316 C1E810                  shr eax, 10
:00447319 C3                      ret



* Referenced by a CALL at Addresses:
|:0041680A   , :00425551   , :004256A7   
|
:0044731A 55                      push ebp
:0044731B 8B442408                mov eax, dword ptr [esp+08]
:0044731F 8BEC                    mov ebp, esp
:00447321 A3203B4500              mov dword ptr [00453B20], eax
:00447326 5D                      pop ebp
:00447327 C3                      ret



* Referenced by a CALL at Addresses:
|:004022EE   , :00404293   , :004042A8   , :0040531D   , :00407DA8   
|:00407DBD   , :00407DFB   , :00407E10   , :00408831   , :0040897E   
|:00408993   , :004089A8   , :0040C85E   , :0040C879   , :0040C898   
|:0040C9B2   , :00414E0F   , :00414FBF   , :00414FCF   , :00415808   
|:00416196   , :004162A5   , :00416AB4   , :00416EB4   , :00416EC5   
|:00422ADB   , :00422AEA   , :00422B02   , :00422B11   , :00422B29   
|:00422B38   , :00422B50   , :00422B5F   , :0042398E   , :00423A39   
|:00423A50   , :00423A77   , :00423A9D   , :004249BF   , :00428856   
|:0042A56D   , :0042ABB1   , :0042ABC3   , :0042ABD5   , :0042ABE7   
|:0042ABF9   , :0042AE62   , :0042AEE3   , :00443C8C   
|
:00447328 55                      push ebp
:00447329 B800000000              mov eax, 00000000
:0044732E 8BEC                    mov ebp, esp
:00447330 837C240802              cmp dword ptr [esp+08], 00000002
:00447335 720C                    jb 00447343
:00447337 E8C0FFFFFF              call 004472FC
:0044733C 2BD2                    sub edx, edx
:0044733E F77508                  div [ebp+08]
:00447341 8BC2                    mov eax, edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447335(C)
|
:00447343 5D                      pop ebp
:00447344 C3                      ret



* Referenced by a CALL at Address:
|:00447B55   
|
:00447345 55                      push ebp
:00447346 8B442408                mov eax, dword ptr [esp+08]
:0044734A 8BEC                    mov ebp, esp
:0044734C 3D81000000              cmp eax, 00000081
:00447351 7207                    jb 0044735A
:00447353 3D9F000000              cmp eax, 0000009F
:00447358 760E                    jbe 00447368

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447351(C)
|
:0044735A 3DE0000000              cmp eax, 000000E0
:0044735F 720E                    jb 0044736F
:00447361 3DFC000000              cmp eax, 000000FC
:00447366 7707                    ja 0044736F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447358(C)
|
:00447368 B801000000              mov eax, 00000001
:0044736D EB02                    jmp 00447371

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044735F(C), :00447366(C)
|
:0044736F 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044736D(U)
|
:00447371 5D                      pop ebp
:00447372 C3                      ret



* Referenced by a CALL at Address:
|:00447B62   
|
:00447373 55                      push ebp
:00447374 8B4C2408                mov ecx, dword ptr [esp+08]
:00447378 8BEC                    mov ebp, esp
:0044737A 8BC1                    mov eax, ecx
:0044737C C1E808                  shr eax, 08
:0044737F 80E91F                  sub cl, 1F
:00447382 02C0                    add al, al
:00447384 F6C180                  test cl, 80
:00447387 750A                    jne 00447393
:00447389 80F961                  cmp cl, 61
:0044738C 7302                    jnb 00447390
:0044738E FEC1                    inc cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044738C(C)
|
:00447390 80E922                  sub cl, 22

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447387(C)
|
:00447393 0FB6C0                  movzx eax, al
:00447396 0FB6C9                  movzx ecx, cl
:00447399 C1E008                  shl eax, 08
:0044739C 5D                      pop ebp
:0044739D 03C1                    add eax, ecx
:0044739F 05A11F0000              add eax, 00001FA1
:004473A4 257F7F0000              and eax, 00007F7F
:004473A9 C3                      ret



* Referenced by a CALL at Addresses:
|:004011AD   , :0040124D   , :00402934   , :00402A30   , :004032E6   
|:00403458   , :0040B263   , :0040CF1A   , :0040D01A   , :0040F601   
|:0040FA3F   , :00416CB4   , :0041F7C1   , :00420ABE   , :00421699   
|:00426786   , :0042C96C   , :00434392   , :004359B9   , :0043790F   
|:00438318   , :004388BA   , :00438CAD   , :00438D5D   , :00438DC1   
|:00438E7A   , :00439BCF   , :0043AED7   , :0043CC67   , :0043E69F   
|:0043F320   , :0043F35E   , :0043F65C   , :00440195   , :004405BF   
|:00443C39   , :004473FB   
|
:004473AA 55                      push ebp
:004473AB 8B542408                mov edx, dword ptr [esp+08]
:004473AF 8BEC                    mov ebp, esp
:004473B1 85D2                    test edx, edx
:004473B3 7504                    jne 004473B9
:004473B5 33C0                    xor eax, eax
:004473B7 EB12                    jmp 004473CB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004473B3(C)
|
:004473B9 33C0                    xor eax, eax
:004473BB 8BCA                    mov ecx, edx
:004473BD 42                      inc edx
:004473BE 3801                    cmp byte ptr [ecx], al
:004473C0 7409                    je 004473CB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004473C9(C)
|
:004473C2 40                      inc eax
:004473C3 8BCA                    mov ecx, edx
:004473C5 42                      inc edx
:004473C6 803900                  cmp byte ptr [ecx], 00
:004473C9 75F7                    jne 004473C2

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004473B7(U), :004473C0(C)
|
:004473CB 5D                      pop ebp
:004473CC C3                      ret



* Referenced by a CALL at Addresses:
|:004011F7   , :0040297E   , :00409993   , :00409F65   , :00409FEB   
|:0040A016   , :0040A12D   , :0040A1F7   , :0040A2BF   , :0040AF8A   
|:0040B1AE   , :0040B22C   , :0040B254   , :0040B4DE   , :00426959   
|:00426998   , :0042946A   , :00429597   , :004296D4   , :00434DA8   
|:00434E98   , :00434F58   , :00434F73   , :00434FC7   , :0043500A   
|:00438DB5   , :0043CC99   , :0043CCC5   , :00447406   , :004475D2   
|
:004473CD 55                      push ebp
:004473CE 8B4C2408                mov ecx, dword ptr [esp+08]
:004473D2 8BEC                    mov ebp, esp
:004473D4 8BC1                    mov eax, ecx
:004473D6 53                      push ebx
:004473D7 8B550C                  mov edx, dword ptr [ebp+0C]
:004473DA 803A00                  cmp byte ptr [edx], 00
:004473DD 740B                    je 004473EA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004473E8(C)
|
:004473DF 8A1A                    mov bl, byte ptr [edx]
:004473E1 42                      inc edx
:004473E2 8819                    mov byte ptr [ecx], bl
:004473E4 41                      inc ecx
:004473E5 803A00                  cmp byte ptr [edx], 00
:004473E8 75F5                    jne 004473DF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004473DD(C)
|
:004473EA 5B                      pop ebx
:004473EB C60100                  mov byte ptr [ecx], 00
:004473EE 5D                      pop ebp
:004473EF C3                      ret



* Referenced by a CALL at Addresses:
|:00402117   , :00402188   , :004021A6   , :004021F2   , :004029A9   
|:004029DA   , :004029FA   , :00402A59   , :00402A7B   , :0040D3EA   
|:0040D407   , :0040D41B   , :00429492   , :004294A3   , :004294CC   
|:004294DD   , :004295D8   , :0042963C   , :00429684   , :004296B7   
|:00434E08   , :00434E19   , :00434EB1   , :00434F96   , :00434FA7   
|:00434FEA   , :0043502D   , :00438C9F   , :0043CD08   , :0043CD34   
|:0043CD52   
|
:004473F0 55                      push ebp
:004473F1 8BEC                    mov ebp, esp
:004473F3 56                      push esi
:004473F4 FF750C                  push [ebp+0C]
:004473F7 8B7508                  mov esi, dword ptr [ebp+08]
:004473FA 56                      push esi
:004473FB E8AAFFFFFF              call 004473AA
:00447400 83C404                  add esp, 00000004
:00447403 03C6                    add eax, esi
:00447405 50                      push eax
:00447406 E8C2FFFFFF              call 004473CD
:0044740B 83C408                  add esp, 00000008
:0044740E 8BC6                    mov eax, esi
:00447410 5E                      pop esi
:00447411 5D                      pop ebp
:00447412 C3                      ret



* Referenced by a CALL at Addresses:
|:004161D9   , :004162D3   
|
:00447413 55                      push ebp
:00447414 8B442408                mov eax, dword ptr [esp+08]
:00447418 8BEC                    mov ebp, esp
:0044741A 53                      push ebx
:0044741B 803800                  cmp byte ptr [eax], 00
:0044741E 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00447421 7421                    je 00447444

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447432(C)
|
:00447423 8A19                    mov bl, byte ptr [ecx]
:00447425 8A10                    mov dl, byte ptr [eax]
:00447427 3ADA                    cmp bl, dl
:00447429 770B                    ja 00447436
:0044742B 7210                    jb 0044743D
:0044742D 40                      inc eax
:0044742E 41                      inc ecx
:0044742F 803800                  cmp byte ptr [eax], 00
:00447432 75EF                    jne 00447423
:00447434 EB0E                    jmp 00447444

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447429(C)
|
:00447436 B8FFFFFFFF              mov eax, FFFFFFFF
:0044743B EB0D                    jmp 0044744A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044742B(C)
|
:0044743D B801000000              mov eax, 00000001
:00447442 EB06                    jmp 0044744A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00447421(C), :00447434(U)
|
:00447444 803901                  cmp byte ptr [ecx], 01
:00447447 1BC0                    sbb eax, eax
:00447449 40                      inc eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044743B(U), :00447442(U)
|
:0044744A 5B                      pop ebx
:0044744B 5D                      pop ebp
:0044744C C3                      ret



* Referenced by a CALL at Addresses:
|:00401F62   , :00401FA8   , :00409FD7   , :0040A0FD   , :0040A2A9   
|:0040A352   , :0040AF74   , :0040B021   , :0040B27E   , :0040D91C   
|:0040DA4F   , :0040DB3C   , :0041E866   , :0041E87F   , :0041E9DF   
|:0041E9F8   , :0042046D   , :00420794   , :00422474   , :00422588   
|:0042366C   , :00423755   , :00426DAD   , :004281F8   , :004282CC   
|:00428326   , :0042B4F0   , :0042B598   , :0042B7E5   , :0042B8FD   
|:0042EC14   , :0042EC2D   , :0042EC46   , :0042EC5F   , :0042EC78   
|:0042EC91   , :0042ECAC   , :0042ECC7   , :0042ECE3   , :0042ED01   
|:0042ED1F   , :0042ED3B   , :0042ED56   , :0042ED74   , :0042ED92   
|:0042EDAC   , :0042EDDC   , :0042EDF5   , :0042EE0E   , :0042EE27   
|:0042EE40   , :0042EE59   , :0042EE74   , :0042EE8F   , :0042EEAB   
|:0042EEC9   , :0042EEE7   , :0042EF03   , :0042EF1E   , :0042EF3C   
|:0042EF5A   , :0042EF74   , :0043381E   , :0043DCE7   , :004404D5   
|:0044052F   
|
:0044744D 55                      push ebp
:0044744E 8BEC                    mov ebp, esp
:00447450 FF742410                push [esp+10]
:00447454 FF7508                  push [ebp+08]
:00447457 FF750C                  push [ebp+0C]
:0044745A E8910E0000              call 004482F0
:0044745F 8BE5                    mov esp, ebp
:00447461 5D                      pop ebp
:00447462 C3                      ret



* Referenced by a CALL at Addresses:
|:00401E31   , :00408E5D   , :0040B7F5   , :0040CD57   , :0040FE60   
|:0040FF4C   , :0041001C   , :004100C1   , :00410157   , :004103CB   
|:0041055A   , :00419F86   , :0041A072   , :0041A757   , :0041AFF3   
|:0041B5C6   , :0041FB5F   , :00426CB1   , :00427256   , :0042C0D9   
|:0042E4DD   , :0042E4F2   , :0042FFA7   , :00433C60   , :00433D26   
|:00433D6D   , :00433E58   , :00435E24   , :00438D3F   , :0043A4DD   
|:0043A610   , :0043A636   , :0043CF4F   , :004407FA   
|
:00447463 55                      push ebp
:00447464 8B54240C                mov edx, dword ptr [esp+0C]
:00447468 0FB6442410              movzx eax, byte ptr [esp+10]
:0044746D 8BEC                    mov ebp, esp
:0044746F 8AC8                    mov cl, al
:00447471 57                      push edi
:00447472 8AE9                    mov ch, cl
:00447474 8AC8                    mov cl, al
:00447476 8B7D08                  mov edi, dword ptr [ebp+08]
:00447479 8BC1                    mov eax, ecx
:0044747B C1E010                  shl eax, 10
:0044747E 668BC1                  mov ax, cx
:00447481 8BCA                    mov ecx, edx
:00447483 C1E902                  shr ecx, 02
:00447486 F3                      repz
:00447487 AB                      stosd
:00447488 8BCA                    mov ecx, edx
:0044748A 83E103                  and ecx, 00000003
:0044748D F3                      repz
:0044748E AA                      stosb
:0044748F 5F                      pop edi
:00447490 5D                      pop ebp
:00447491 C3                      ret


:00447492 E900000000              jmp 00447497

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447492(U)
|
:00447497 6A00                    push 00000000
:00447499 B9C8524700              mov ecx, 004752C8
:0044749E E8BB020000              call 0044775E
:004474A3 C3                      ret



* Referenced by a CALL at Address:
|:00401CA5   
|
:004474A4 833D243B450000          cmp dword ptr [00453B24], 00000000
:004474AB 7E0D                    jle 004474BA
:004474AD FF0D243B4500            dec dword ptr [00453B24]
:004474B3 7505                    jne 004474BA
:004474B5 E9BE000000              jmp 00447578

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004474AB(C), :004474B3(C)
|
:004474BA C3                      ret

* Referenced by a CALL at Address:
|:00401CDA   
|
:004474BB A1243B4500              mov eax, dword ptr [00453B24]
:004474C0 FF05243B4500            inc dword ptr [00453B24]
:004474C6 85C0                    test eax, eax
:004474C8 7505                    jne 004474CF
:004474CA E9AC000000              jmp 0044757B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004474C8(C)
|
:004474CF C3                      ret

* Referenced by a CALL at Address:
|:00447514   
|
:004474D0 55                      push ebp
:004474D1 8BEC                    mov ebp, esp
:004474D3 56                      push esi
:004474D4 57                      push edi
:004474D5 8B750C                  mov esi, dword ptr [ebp+0C]
:004474D8 FF7514                  push [ebp+14]
:004474DB FF7510                  push [ebp+10]
:004474DE 56                      push esi
:004474DF 8B7D08                  mov edi, dword ptr [ebp+08]
:004474E2 57                      push edi
:004474E3 E896000000              call 0044757E
:004474E8 83C410                  add esp, 00000010
:004474EB A1C8524700              mov eax, dword ptr [004752C8]
:004474F0 2907                    sub dword ptr [edi], eax
:004474F2 5F                      pop edi
:004474F3 8B0DCC524700            mov ecx, dword ptr [004752CC]
:004474F9 290E                    sub dword ptr [esi], ecx
:004474FB 5E                      pop esi
:004474FC 5D                      pop ebp
:004474FD C21000                  ret 0010



* Referenced by a CALL at Address:
|:00401D0B   
|
:00447500 55                      push ebp
:00447501 8BEC                    mov ebp, esp
:00447503 83EC08                  sub esp, 00000008
:00447506 8D45FC                  lea eax, dword ptr [ebp-04]
:00447509 8D55F8                  lea edx, dword ptr [ebp-08]
:0044750C 50                      push eax
:0044750D 52                      push edx
:0044750E FF750C                  push [ebp+0C]
:00447511 FF7508                  push [ebp+08]
:00447514 E8B7FFFFFF              call 004474D0
:00447519 8BE5                    mov esp, ebp
:0044751B 5D                      pop ebp
:0044751C C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:00401D8D   , :00426A7C   , :004355E8   , :00435643   , :004356DE   
|:0043574A   , :00435CD4   
|
:0044751F 55                      push ebp
:00447520 8BEC                    mov ebp, esp
:00447522 83EC10                  sub esp, 00000010
:00447525 8D45F8                  lea eax, dword ptr [ebp-08]
:00447528 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0044752B 50                      push eax
:0044752C 8D55F4                  lea edx, dword ptr [ebp-0C]
:0044752F 51                      push ecx
:00447530 8D45F0                  lea eax, dword ptr [ebp-10]
:00447533 52                      push edx
:00447534 50                      push eax
:00447535 E844000000              call 0044757E
:0044753A 83C410                  add esp, 00000010
:0044753D 8B45FC                  mov eax, dword ptr [ebp-04]
:00447540 8BE5                    mov esp, ebp
:00447542 5D                      pop ebp
:00447543 C3                      ret



* Referenced by a CALL at Addresses:
|:00401DAD   , :00426A8E   , :004355A6   
|
:00447544 55                      push ebp
:00447545 8BEC                    mov ebp, esp
:00447547 83EC10                  sub esp, 00000010
:0044754A 8D45FC                  lea eax, dword ptr [ebp-04]
:0044754D 8D4DF8                  lea ecx, dword ptr [ebp-08]
:00447550 50                      push eax
:00447551 8D55F4                  lea edx, dword ptr [ebp-0C]
:00447554 51                      push ecx
:00447555 8D45F0                  lea eax, dword ptr [ebp-10]
:00447558 52                      push edx
:00447559 50                      push eax
:0044755A E81F000000              call 0044757E
:0044755F 83C410                  add esp, 00000010
:00447562 8B45FC                  mov eax, dword ptr [ebp-04]
:00447565 8BE5                    mov esp, ebp
:00447567 5D                      pop ebp
:00447568 C3                      ret


:00447569 E900000000              jmp 0044756E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447569(U)
|
:0044756E C3                      ret

* Referenced by a CALL at Addresses:
|:0040205C   , :00447934   
|
:0044756F B8FFFFFFFF              mov eax, FFFFFFFF
:00447574 C3                      ret



* Referenced by a CALL at Address:
|:00447A27   
|
:00447575 33C0                    xor eax, eax
:00447577 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004474B5(U)
|
:00447578 33C0                    xor eax, eax
:0044757A C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004474CA(U)
|
:0044757B 33C0                    xor eax, eax
:0044757D C3                      ret



* Referenced by a CALL at Addresses:
|:004474E3   , :00447535   , :0044755A   
|
:0044757E 55                      push ebp
:0044757F 8BEC                    mov ebp, esp
:00447581 83EC04                  sub esp, 00000004
:00447584 8D45FC                  lea eax, dword ptr [ebp-04]
:00447587 50                      push eax
:00447588 FF750C                  push [ebp+0C]
:0044758B FF7508                  push [ebp+08]
:0044758E E838EEFFFF              call 004463CB
:00447593 83C40C                  add esp, 0000000C
:00447596 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00447599 83E101                  and ecx, 00000001
:0044759C 8B4510                  mov eax, dword ptr [ebp+10]
:0044759F 8908                    mov dword ptr [eax], ecx
:004475A1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004475A4 83E102                  and ecx, 00000002
:004475A7 8B4514                  mov eax, dword ptr [ebp+14]
:004475AA D1E9                    shr ecx, 1
:004475AC 8908                    mov dword ptr [eax], ecx
:004475AE 33C0                    xor eax, eax
:004475B0 8BE5                    mov esp, ebp
:004475B2 5D                      pop ebp
:004475B3 C3                      ret



* Referenced by a CALL at Address:
|:00402084   
|
:004475B4 33C0                    xor eax, eax
:004475B6 C3                      ret



* Referenced by a CALL at Addresses:
|:00402F36   , :0040A141   , :0040A21A   , :0040A271   , :0040A2E5   
|:0040A310   , :0040AD6F   , :0040ADFA   , :0040AF3C   , :0040AFB4   
|:0040AFDF   , :0040B13F   , :0040B162   , :0040B430   , :00424BCF   
|:00424F9A   , :004250F0   , :004253DA   , :00425468   , :00426D40   
|:00426DE7   , :00427524   , :00427587   , :0042E215   , :0042E2A0   
|:004340FA   , :004406BA   , :00440D74   
|
:004475B7 55                      push ebp
:004475B8 8B442408                mov eax, dword ptr [esp+08]
:004475BC 8BEC                    mov ebp, esp
:004475BE 83C002                  add eax, 00000002
:004475C1 81EC04010000            sub esp, 00000104
:004475C7 56                      push esi
:004475C8 50                      push eax
:004475C9 8BF1                    mov esi, ecx
:004475CB 8D8DFCFEFFFF            lea ecx, dword ptr [ebp+FFFFFEFC]
:004475D1 51                      push ecx
:004475D2 E8F6FDFFFF              call 004473CD
:004475D7 83C408                  add esp, 00000008
:004475DA 8B450C                  mov eax, dword ptr [ebp+0C]
:004475DD 83E0FB                  and eax, FFFFFFFB
:004475E0 7C0A                    jl 004475EC
:004475E2 83F802                  cmp eax, 00000002
:004475E5 7E11                    jle 004475F8
:004475E7 83F803                  cmp eax, 00000003
:004475EA 7427                    je 00447613

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004475E0(C), :0044760D(C), :00447627(C)
|
:004475EC B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00447611(U), :0044762B(U)
|
:004475F1 5E                      pop esi
:004475F2 8BE5                    mov esp, ebp
:004475F4 5D                      pop ebp
:004475F5 C20800                  ret 0008



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004475E5(C)
|
:004475F8 50                      push eax
:004475F9 8D8DFCFEFFFF            lea ecx, dword ptr [ebp+FFFFFEFC]
:004475FF 51                      push ecx
:00447600 E8FB010000              call 00447800
:00447605 83C408                  add esp, 00000008
:00447608 8906                    mov dword ptr [esi], eax
:0044760A 83F8FF                  cmp eax, FFFFFFFF
:0044760D 75DD                    jne 004475EC
:0044760F 33C0                    xor eax, eax
:00447611 EBDE                    jmp 004475F1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004475EA(C)
|
:00447613 8D85FCFEFFFF            lea eax, dword ptr [ebp+FFFFFEFC]
:00447619 50                      push eax
:0044761A E890010000              call 004477AF
:0044761F 83C404                  add esp, 00000004
:00447622 8906                    mov dword ptr [esi], eax
:00447624 83F8FF                  cmp eax, FFFFFFFF
:00447627 75C3                    jne 004475EC
:00447629 33C0                    xor eax, eax
:0044762B EBC4                    jmp 004475F1

* Referenced by a CALL at Address:
|:00447954   
|
:0044762D C705E052470000000000    mov dword ptr [004752E0], 00000000
:00447637 33C0                    xor eax, eax
:00447639 C3                      ret



* Referenced by a CALL at Address:
|:0044770E   
|
:0044763A 33C0                    xor eax, eax
:0044763C C3                      ret



* Referenced by a CALL at Address:
|:004476B2   
|
:0044763D C3                      ret

* Referenced by a CALL at Address:
|:004476FE   
|
:0044763E 33C0                    xor eax, eax
:00447640 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:00424D18   , :00424D3E   , :00424D64   , :00424D8A   , :00424DB0   
|:00424DD6   , :00424DFC   , :00424E2F   , :00424E55   , :00424E7B   
|:00424EA1   , :00424EC7   , :00424EED   , :00425FA6   
|
:00447643 55                      push ebp
:00447644 8BEC                    mov ebp, esp
:00447646 56                      push esi
:00447647 80791000                cmp byte ptr [ecx+10], 00
:0044764B 8BF1                    mov esi, ecx
:0044764D 7533                    jne 00447682
:0044764F 8B4508                  mov eax, dword ptr [ebp+08]
:00447652 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00447655 F6C107                  test cl, 07
:00447658 894604                  mov dword ptr [esi+04], eax
:0044765B 7425                    je 00447682
:0044765D 50                      push eax
:0044765E 6A00                    push 00000000

* Reference To: KERNEL32.GlobalAlloc, Ord:0140h
                                  |
:00447660 FF157C734700            Call dword ptr [0047737C]
:00447666 894608                  mov dword ptr [esi+08], eax
:00447669 85C0                    test eax, eax
:0044766B 7415                    je 00447682
:0044766D 50                      push eax

* Reference To: KERNEL32.GlobalLock, Ord:014Bh
                                  |
:0044766E FF1578734700            Call dword ptr [00477378]
:00447674 C6461001                mov [esi+10], 01
:00447678 89460C                  mov dword ptr [esi+0C], eax
:0044767B B801000000              mov eax, 00000001
:00447680 EB02                    jmp 00447684

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044764D(C), :0044765B(C), :0044766B(C)
|
:00447682 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447680(U)
|
:00447684 5E                      pop esi
:00447685 5D                      pop ebp
:00447686 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:00424C0B   , :00424C15   , :00424C1F   , :00424C29   , :00424C33   
|:00424C3D   , :00424C57   , :00424C61   , :00424C6B   , :00424C75   
|:00424C7F   , :00424C89   , :00432A2F   
|
:00447689 56                      push esi
:0044768A 8BF1                    mov esi, ecx
:0044768C 0FB64610                movzx eax, byte ptr [esi+10]
:00447690 83F801                  cmp eax, 00000001
:00447693 7407                    je 0044769C
:00447695 83F802                  cmp eax, 00000002
:00447698 7416                    je 004476B0
:0044769A EB1B                    jmp 004476B7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447693(C)
|
:0044769C FF7608                  push [esi+08]

* Reference To: KERNEL32.GlobalUnlock, Ord:0151h
                                  |
:0044769F FF1574734700            Call dword ptr [00477374]
:004476A5 FF7608                  push [esi+08]

* Reference To: KERNEL32.GlobalFree, Ord:0147h
                                  |
:004476A8 FF1570734700            Call dword ptr [00477370]
:004476AE EB07                    jmp 004476B7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447698(C)
|
:004476B0 8BCE                    mov ecx, esi
:004476B2 E886FFFFFF              call 0044763D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044769A(U), :004476AE(U)
|
:004476B7 C6461000                mov [esi+10], 00
:004476BB 5E                      pop esi
:004476BC C3                      ret



* Referenced by a CALL at Address:
|:00447755   
|
:004476BD 55                      push ebp
:004476BE 8BEC                    mov ebp, esp
:004476C0 53                      push ebx
:004476C1 56                      push esi
:004476C2 33DB                    xor ebx, ebx
:004476C4 57                      push edi
:004476C5 8BF1                    mov esi, ecx
:004476C7 817D0800400000          cmp dword ptr [ebp+08], 00004000
:004476CE 8B7D0C                  mov edi, dword ptr [ebp+0C]
:004476D1 720E                    jb 004476E1
:004476D3 8B5D08                  mov ebx, dword ptr [ebp+08]
:004476D6 C1EB0E                  shr ebx, 0E
:004476D9 8BC3                    mov eax, ebx
:004476DB C1E00E                  shl eax, 0E
:004476DE 294508                  sub dword ptr [ebp+08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004476D1(C)
|
:004476E1 8B4510                  mov eax, dword ptr [ebp+10]
:004476E4 FF4D10                  dec [ebp+10]
:004476E7 85C0                    test eax, eax
:004476E9 7422                    je 0044770D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044770B(C)
|
:004476EB 837D0C04                cmp dword ptr [ebp+0C], 00000004
:004476EF 7D1C                    jge 0044770D
:004476F1 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004476F4 8BC3                    mov eax, ebx
:004476F6 43                      inc ebx
:004476F7 51                      push ecx
:004476F8 50                      push eax
:004476F9 8BCE                    mov ecx, esi
:004476FB FF450C                  inc [ebp+0C]
:004476FE E83BFFFFFF              call 0044763E
:00447703 8B4D10                  mov ecx, dword ptr [ebp+10]
:00447706 FF4D10                  dec [ebp+10]
:00447709 85C9                    test ecx, ecx
:0044770B 75DE                    jne 004476EB

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004476E9(C), :004476EF(C)
|
:0044770D 57                      push edi
:0044770E E827FFFFFF              call 0044763A
:00447713 83C404                  add esp, 00000004
:00447716 034508                  add eax, dword ptr [ebp+08]
:00447719 5F                      pop edi
:0044771A 5E                      pop esi
:0044771B 5B                      pop ebx
:0044771C 5D                      pop ebp
:0044771D C20C00                  ret 000C



* Referenced by a CALL at Addresses:
|:00401E2B   , :00401E6C   , :00401F21   , :00401F5C   , :00401F9D   
|:00402111   , :00402182   , :004021A0   , :004021EC   , :00402F20   
|:00403017   , :00404BC4   , :00404C07   , :00404DF3   , :00404E61   
|:00408E57   , :004090F5   , :0040A34C   , :0040B01B   , :0040B7E2   
|:0040F00E   , :0040F1D0   , :0040F1EE   , :0040F223   , :00410895   
|:00411732   , :004118F8   , :00411A96   , :00411BFD   , :00411C5A   
|:00411C80   , :00411F03   , :00411FFF   , :00412ADA   , :00412B64   
|:00412C81   , :00412D29   , :00412DBF   , :00413BF5   , :00413D8B   
|:00414343   , :004149AE   , :00414A1C   , :0041571B   , :0041596D   
|:00416F7D   , :0041756D   , :004175C8   , :0041959C   , :00419633   
|:00419796   , :00419D06   , :00419D3D   , :00419D80   , :0041A067   
|:0041A110   , :0041A751   , :0041A7AC   , :0041AA89   , :0041AB09   
|:0041ABC5   , :0041ADCF   , :0041AF60   , :0041B006   , :0041B319   
|:0041B337   , :0041B484   , :0041B4AA   , :0041B4DF   , :0041B5BB   
|:0041D17A   , :0041D216   , :0041DCA1   , :00420F38   , :0042103B   
|:004214B6   , :0042158A   , :00421600   , :0042163D   , :00421742   
|:00421791   , :004217C6   , :00421806   , :00421838   , :004219CC   
|:00421A27   , :00421A5C   , :00422026   , :004220CF   , :004220E7   
|:004222B6   , :0042243D   , :00422469   , :00422520   , :0042255F   
|:00422575   , :0042264E   , :004226A1   , :00422723   , :00422894   
|:00422C61   , :00422C7E   , :00422D09   , :00422D5D   , :00422DE2   
|:00422DFF   , :00422E8A   , :00422EDE   , :00422FB5   , :00423104   
|:0042318C   , :00423471   , :0042352D   , :004235C1   , :0042365D   
|:004236FB   , :00423730   , :0042374F   , :00426BB6   , :00426C32   
|:0042728C   , :00427F8D   , :00428070   , :0042809E   , :00428177   
|:004282C3   , :004282F5   , :0042831B   , :00428461   , :00429591   
|:004295D2   , :00429636   , :0042967E   , :004296B1   , :004296CA   
|:0042B4A8   , :0042B4DA   , :0042B523   , :0042B579   , :0042B644   
|:0042B711   , :0042B7C8   , :0042B860   , :0042B8EE   , :0042C0CE   
|:0042C292   , :0042C2E9   , :0042D0FE   , :0042D132   , :0042D196   
|:0042D2CF   , :0042D303   , :0042D367   , :0042D676   , :0042D9E0   
|:0042DCFA   , :00432DC7   , :0043409F   , :004340E4   , :0043414B   
|:00434357   , :0043487E   , :004349AA   , :00435328   , :0043536C   
|:00435397   , :004357D6   , :00435AC5   , :00435ADB   , :00436435   
|:00439ED1   , :0043A107   , :0043A13B   , :0043A23F   , :0043A60A   
|:0043A630   , :0043AB09   , :0043B932   , :0043B9C3   , :0043C530   
|:0043C6DC   , :0043CF49   , :0043D069   , :0043D47F   , :0043D4D4   
|:0043D4EF   , :0043D50D   , :0043D565   , :0043D905   , :0043D93C   
|:0043D95C   , :0043DAAC   , :0043DBBB   , :0043DBFF   , :0043DC55   
|:0043DC94   , :0043E65A   , :0043ECAA   , :0043F133   , :0043F27F   
|:0043F438   , :0043F54B   , :0043F9BA   , :0044033F   , :004403EC   
|:00440463   , :00440487   , :004404CC   , :004404FE   , :00440524   
|:0044056A   , :004406CD   , :0044072D   , :004407F4   , :00440D8C   
|:00440E4A   , :00443D6F   , :00443E87   
|
:00447720 55                      push ebp
:00447721 8B4104                  mov eax, dword ptr [ecx+04]
:00447724 8BEC                    mov ebp, esp
:00447726 8B542408                mov edx, dword ptr [esp+08]
:0044772A 3BD0                    cmp edx, eax
:0044772C 7602                    jbe 00447730
:0044772E 8BD0                    mov edx, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044772C(C)
|
:00447730 0FB64110                movzx eax, byte ptr [ecx+10]
:00447734 83F801                  cmp eax, 00000001
:00447737 740E                    je 00447747
:00447739 83F802                  cmp eax, 00000002
:0044773C 7410                    je 0044774E
:0044773E 83F804                  cmp eax, 00000004
:00447741 7404                    je 00447747
:00447743 33C0                    xor eax, eax
:00447745 EB13                    jmp 0044775A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00447737(C), :00447741(C)
|
:00447747 8B410C                  mov eax, dword ptr [ecx+0C]
:0044774A 03C2                    add eax, edx
:0044774C EB0C                    jmp 0044775A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044773C(C)
|
:0044774E FF7510                  push [ebp+10]
:00447751 FF750C                  push [ebp+0C]
:00447754 52                      push edx
:00447755 E863FFFFFF              call 004476BD

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00447745(U), :0044774C(U)
|
:0044775A 5D                      pop ebp
:0044775B C20C00                  ret 000C



* Referenced by a CALL at Address:
|:0044749E   
|
:0044775E 55                      push ebp
:0044775F 8B442408                mov eax, dword ptr [esp+08]
:00447763 8BEC                    mov ebp, esp
:00447765 8901                    mov dword ptr [ecx], eax
:00447767 5D                      pop ebp
:00447768 894104                  mov dword ptr [ecx+04], eax
:0044776B 8BC1                    mov eax, ecx
:0044776D C20400                  ret 0004



* Referenced by a CALL at Address:
|:00447AB7   
|
:00447770 55                      push ebp
:00447771 8B442408                mov eax, dword ptr [esp+08]
:00447775 8BEC                    mov ebp, esp
:00447777 8901                    mov dword ptr [ecx], eax
:00447779 5D                      pop ebp
:0044777A 894104                  mov dword ptr [ecx+04], eax
:0044777D 8BC1                    mov eax, ecx
:0044777F C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:004187C9   , :004479A4   
|
:00447782 55                      push ebp
:00447783 8BEC                    mov ebp, esp
:00447785 81EC00010000            sub esp, 00000100
:0044778B 8D8500FFFFFF            lea eax, dword ptr [ebp+FFFFFF00]
:00447791 50                      push eax
:00447792 6800010000              push 00000100

* Reference To: KERNEL32.GetCurrentDirectoryA, Ord:00C2h
                                  |
:00447797 FF1588734700            Call dword ptr [00477388]
:0044779D 8A8500FFFFFF            mov al, byte ptr [ebp+FFFFFF00]
:004477A3 8BE5                    mov esp, ebp
:004477A5 0C20                    or al, 20
:004477A7 5D                      pop ebp
:004477A8 0FB6C0                  movzx eax, al
:004477AB 83E860                  sub eax, 00000060
:004477AE C3                      ret



* Referenced by a CALL at Address:
|:0044761A   
|
:004477AF 55                      push ebp
:004477B0 8BEC                    mov ebp, esp
:004477B2 53                      push ebx
:004477B3 56                      push esi
:004477B4 57                      push edi
:004477B5 33F6                    xor esi, esi
:004477B7 BF000000C0              mov edi, C0000000
:004477BC 56                      push esi
:004477BD 6880000000              push 00000080
:004477C2 6A01                    push 00000001
:004477C4 56                      push esi
:004477C5 56                      push esi
:004477C6 57                      push edi
:004477C7 FF7508                  push [ebp+08]

* Reference To: KERNEL32.CreateFileA, Ord:002Bh
                                  |
:004477CA FF158C734700            Call dword ptr [0047738C]
:004477D0 8BD8                    mov ebx, eax

* Reference To: KERNEL32.GetLastError, Ord:00E1h
                                  |
:004477D2 FF1594734700            Call dword ptr [00477394]
:004477D8 3DB7000000              cmp eax, 000000B7
:004477DD 751A                    jne 004477F9
:004477DF 53                      push ebx

* Reference To: KERNEL32.CloseHandle, Ord:0016h
                                  |
:004477E0 FF1590734700            Call dword ptr [00477390]
:004477E6 56                      push esi
:004477E7 6A20                    push 00000020
:004477E9 6A05                    push 00000005
:004477EB 56                      push esi
:004477EC 56                      push esi
:004477ED 57                      push edi
:004477EE FF7508                  push [ebp+08]

* Reference To: KERNEL32.CreateFileA, Ord:002Bh
                                  |
:004477F1 FF158C734700            Call dword ptr [0047738C]
:004477F7 8BD8                    mov ebx, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004477DD(C)
|
:004477F9 8BC3                    mov eax, ebx
:004477FB 5F                      pop edi
:004477FC 5E                      pop esi
:004477FD 5B                      pop ebx
:004477FE 5D                      pop ebp
:004477FF C3                      ret



* Referenced by a CALL at Address:
|:00447600   
|
:00447800 55                      push ebp
:00447801 8B44240C                mov eax, dword ptr [esp+0C]
:00447805 8BEC                    mov ebp, esp
:00447807 83EC04                  sub esp, 00000004
:0044780A 85C0                    test eax, eax
:0044780C 7427                    je 00447835
:0044780E 83F801                  cmp eax, 00000001
:00447811 7429                    je 0044783C
:00447813 83F802                  cmp eax, 00000002
:00447816 742B                    je 00447843
:00447818 8B45FC                  mov eax, dword ptr [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044783A(U), :00447841(U), :00447848(U)
|
:0044781B 33C9                    xor ecx, ecx
:0044781D 51                      push ecx
:0044781E 6880000000              push 00000080
:00447823 6A03                    push 00000003
:00447825 51                      push ecx
:00447826 51                      push ecx
:00447827 50                      push eax
:00447828 FF7508                  push [ebp+08]

* Reference To: KERNEL32.CreateFileA, Ord:002Bh
                                  |
:0044782B FF158C734700            Call dword ptr [0047738C]
:00447831 8BE5                    mov esp, ebp
:00447833 5D                      pop ebp
:00447834 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044780C(C)
|
:00447835 B800000080              mov eax, 80000000
:0044783A EBDF                    jmp 0044781B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447811(C)
|
:0044783C B800000040              mov eax, 40000000
:00447841 EBD8                    jmp 0044781B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447816(C)
|
:00447843 B8000000C0              mov eax, C0000000
:00447848 EBD1                    jmp 0044781B

* Referenced by a CALL at Address:
|:00409432   
|
:0044784A 55                      push ebp
:0044784B 8BEC                    mov ebp, esp
:0044784D FF742408                push [esp+08]

* Reference To: KERNEL32.CloseHandle, Ord:0016h
                                  |
:00447851 FF1590734700            Call dword ptr [00477390]
:00447857 5D                      pop ebp
:00447858 C3                      ret



* Referenced by a CALL at Addresses:
|:0040947E   , :0042733A   
|
:00447859 55                      push ebp
:0044785A 8BEC                    mov ebp, esp
:0044785C 83EC04                  sub esp, 00000004
:0044785F 6A00                    push 00000000
:00447861 8D45FC                  lea eax, dword ptr [ebp-04]
:00447864 50                      push eax
:00447865 FF7510                  push [ebp+10]
:00447868 FF750C                  push [ebp+0C]
:0044786B FF7508                  push [ebp+08]

* Reference To: KERNEL32.ReadFile, Ord:01B8h
                                  |
:0044786E FF1548734700            Call dword ptr [00477348]
:00447874 8B45FC                  mov eax, dword ptr [ebp-04]
:00447877 8BE5                    mov esp, ebp
:00447879 5D                      pop ebp
:0044787A C3                      ret



* Referenced by a CALL at Addresses:
|:0040BB9E   , :00432C8A   
|
:0044787B 55                      push ebp
:0044787C 8BEC                    mov ebp, esp
:0044787E 83EC04                  sub esp, 00000004
:00447881 6A00                    push 00000000
:00447883 8D45FC                  lea eax, dword ptr [ebp-04]
:00447886 50                      push eax
:00447887 FF7510                  push [ebp+10]
:0044788A FF750C                  push [ebp+0C]
:0044788D FF7508                  push [ebp+08]

* Reference To: KERNEL32.WriteFile, Ord:024Fh
                                  |
:00447890 FF152C734700            Call dword ptr [0047732C]
:00447896 8B45FC                  mov eax, dword ptr [ebp-04]
:00447899 8BE5                    mov esp, ebp
:0044789B 5D                      pop ebp
:0044789C C3                      ret



* Referenced by a CALL at Addresses:
|:00409468   , :0040BB88   , :0042783A   
|
:0044789D 55                      push ebp
:0044789E 8BEC                    mov ebp, esp
:004478A0 FF742410                push [esp+10]
:004478A4 6A00                    push 00000000
:004478A6 FF750C                  push [ebp+0C]
:004478A9 FF7508                  push [ebp+08]

* Reference To: KERNEL32.SetFilePointer, Ord:01F8h
                                  |
:004478AC FF15A4734700            Call dword ptr [004773A4]
:004478B2 5D                      pop ebp
:004478B3 C3                      ret



* Referenced by a CALL at Address:
|:0044797B   
|
:004478B4 55                      push ebp
:004478B5 8BEC                    mov ebp, esp
:004478B7 83EC04                  sub esp, 00000004
:004478BA 56                      push esi
:004478BB 57                      push edi

* Possible StringData Ref from Data Obj ->"@:\"
                                  |
:004478BC BE303B4500              mov esi, 00453B30
:004478C1 8D7DFC                  lea edi, dword ptr [ebp-04]
:004478C4 A5                      movsd
:004478C5 8B4508                  mov eax, dword ptr [ebp+08]
:004478C8 83F801                  cmp eax, 00000001
:004478CB 8D4840                  lea ecx, dword ptr [eax+40]
:004478CE B800000000              mov eax, 00000000
:004478D3 884DFC                  mov byte ptr [ebp-04], cl
:004478D6 83D0FF                  adc eax, FFFFFFFF
:004478D9 8D4DFC                  lea ecx, dword ptr [ebp-04]
:004478DC 23C1                    and eax, ecx
:004478DE 50                      push eax

* Reference To: KERNEL32.GetDriveTypeA, Ord:00CEh
                                  |
:004478DF FF1514734700            Call dword ptr [00477314]
:004478E5 83F802                  cmp eax, 00000002
:004478E8 7416                    je 00447900
:004478EA 83F803                  cmp eax, 00000003
:004478ED 7415                    je 00447904
:004478EF 83F805                  cmp eax, 00000005
:004478F2 7205                    jb 004478F9
:004478F4 83F806                  cmp eax, 00000006
:004478F7 760B                    jbe 00447904

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004478F2(C)
|
:004478F9 B8FFFFFFFF              mov eax, FFFFFFFF
:004478FE EB09                    jmp 00447909

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004478E8(C)
|
:00447900 33C0                    xor eax, eax
:00447902 EB05                    jmp 00447909

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004478ED(C), :004478F7(C)
|
:00447904 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004478FE(U), :00447902(U)
|
:00447909 5F                      pop edi
:0044790A 5E                      pop esi
:0044790B 8BE5                    mov esp, ebp
:0044790D 5D                      pop ebp
:0044790E C3                      ret



* Referenced by a CALL at Address:
|:0042550E   
|
:0044790F C7050853470006000000    mov dword ptr [00475308], 00000006
:00447919 56                      push esi
:0044791A E842CDFFFF              call 00444661
:0044791F 85C0                    test eax, eax
:00447921 7511                    jne 00447934
:00447923 B978534700              mov ecx, 00475378
:00447928 E860010000              call 00447A8D
:0044792D 800D0953470008          or byte ptr [00475309], 08

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447921(C)
|
:00447934 E836FCFFFF              call 0044756F
:00447939 85C0                    test eax, eax
:0044793B 7407                    je 00447944
:0044793D 800D0953470004          or byte ptr [00475309], 04

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044793B(C)
|
:00447944 E818CDFFFF              call 00444661
:00447949 85C0                    test eax, eax
:0044794B 7507                    jne 00447954
:0044794D 800D0953470002          or byte ptr [00475309], 02

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044794B(C)
|
:00447954 E8D4FCFFFF              call 0044762D
:00447959 85C0                    test eax, eax
:0044795B 7407                    je 00447964
:0044795D 800D0953470010          or byte ptr [00475309], 10

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044795B(C)
|
:00447964 800D0853470010          or byte ptr [00475308], 10
:0044796B C7053453470000000000    mov dword ptr [00475334], 00000000
:00447975 BE01000000              mov esi, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004479A0(C)
|
:0044797A 56                      push esi
:0044797B E834FFFFFF              call 004478B4
:00447980 83C404                  add esp, 00000004
:00447983 833D3453470000          cmp dword ptr [00475334], 00000000
:0044798A 750A                    jne 00447996
:0044798C 85C0                    test eax, eax
:0044798E 7506                    jne 00447996
:00447990 893534534700            mov dword ptr [00475334], esi

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044798A(C), :0044798E(C)
|
:00447996 888610534700            mov byte ptr [esi+00475310], al
:0044799C 46                      inc esi
:0044799D 83FE1A                  cmp esi, 0000001A
:004479A0 7ED8                    jle 0044797A
:004479A2 33F6                    xor esi, esi
:004479A4 E8D9FDFFFF              call 00447782
:004479A9 8A8010534700            mov al, byte ptr [eax+00475310]

* Possible StringData Ref from Code Obj ->"<SG"
                                  |
:004479AF 68537A4400              push 00447A53
:004479B4 A210534700              mov byte ptr [00475310], al
:004479B9 89353C534700            mov dword ptr [0047533C], esi
:004479BF E81C0E0000              call 004487E0
:004479C4 83C404                  add esp, 00000004
:004479C7 A30C534700              mov dword ptr [0047530C], eax
:004479CC 893530534700            mov dword ptr [00475330], esi
:004479D2 89352C534700            mov dword ptr [0047532C], esi
:004479D8 68647A4400              push 00447A64
:004479DD E88F000000              call 00447A71
:004479E2 83C404                  add esp, 00000004
:004479E5 85C0                    test eax, eax
:004479E7 7407                    je 004479F0
:004479E9 800D0953470020          or byte ptr [00475309], 20

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004479E7(C)
|
:004479F0 A108534700              mov eax, dword ptr [00475308]
:004479F5 5E                      pop esi
:004479F6 25000E0000              and eax, 00000E00
:004479FB 2D000E0000              sub eax, 00000E00
:00447A00 83F801                  cmp eax, 00000001
:00447A03 1BC0                    sbb eax, eax
:00447A05 F7D8                    neg eax
:00447A07 C3                      ret



* Referenced by a CALL at Addresses:
|:00424CF7   , :004251E3   
|
:00447A08 55                      push ebp
:00447A09 8BEC                    mov ebp, esp
:00447A0B E864000000              call 00447A74
:00447A10 A10C534700              mov eax, dword ptr [0047530C]
:00447A15 50                      push eax
:00447A16 E8C50D0000              call 004487E0
:00447A1B 83C404                  add esp, 00000004
:00447A1E F6050953470004          test byte ptr [00475309], 04
:00447A25 7405                    je 00447A2C
:00447A27 E849FBFFFF              call 00447575

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447A25(C)
|
:00447A2C F6050953470008          test byte ptr [00475309], 08
:00447A33 7410                    je 00447A45
:00447A35 E823D4FFFF              call 00444E5D
:00447A3A 837D0C00                cmp dword ptr [ebp+0C], 00000000
:00447A3E 7405                    je 00447A45
:00447A40 E8C7D1FFFF              call 00444C0C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00447A33(C), :00447A3E(C)
|
:00447A45 FF7508                  push [ebp+08]
:00447A48 E80BF2FFFF              call 00446C58
:00447A4D 8BE5                    mov esp, ebp
:00447A4F 5D                      pop ebp
:00447A50 C20800                  ret 0008


:00447A53 A13C534700              mov eax, dword ptr [0047533C]
:00447A58 85C0                    test eax, eax
:00447A5A 7402                    je 00447A5E
:00447A5C FFD0                    call eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447A5A(C)
|
:00447A5E B801000000              mov eax, 00000001
:00447A63 C3                      ret


:00447A64 FF052C534700            inc dword ptr [0047532C]
:00447A6A C3                      ret


:00447A6B E900000000              jmp 00447A70

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447A6B(U)
|
:00447A70 C3                      ret

* Referenced by a CALL at Address:
|:004479DD   
|
:00447A71 33C0                    xor eax, eax
:00447A73 C3                      ret



* Referenced by a CALL at Address:
|:00447A0B   
|
:00447A74 C3                      ret
:00447A75 E900000000              jmp 00447A7A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447A75(U)
|
:00447A7A C3                      ret
:00447A7B E900000000              jmp 00447A80

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447A7B(U)
|
:00447A80 C3                      ret
:00447A81 E900000000              jmp 00447A86

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447A81(U)
|
:00447A86 C3                      ret
:00447A87 E900000000              jmp 00447A8C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447A87(U)
|
:00447A8C C3                      ret

* Referenced by a CALL at Address:
|:00447928   
|
:00447A8D 56                      push esi
:00447A8E E8F3CFFFFF              call 00444A86
:00447A93 684C534700              push 0047534C
:00447A98 33F6                    xor esi, esi
:00447A9A 6848534700              push 00475348
:00447A9F E80CD2FFFF              call 00444CB0
:00447AA4 83C408                  add esp, 00000008
:00447AA7 B940534700              mov ecx, 00475340
:00447AAC C7056053470008000000    mov dword ptr [00475360], 00000008
:00447AB6 56                      push esi
:00447AB7 E8B4FCFFFF              call 00447770
:00447ABC A140534700              mov eax, dword ptr [00475340]
:00447AC1 8B0D44534700            mov ecx, dword ptr [00475344]
:00447AC7 8B1548534700            mov edx, dword ptr [00475348]
:00447ACD A368534700              mov dword ptr [00475368], eax
:00447AD2 A14C534700              mov eax, dword ptr [0047534C]
:00447AD7 890D6C534700            mov dword ptr [0047536C], ecx
:00447ADD 6A03                    push 00000003
:00447ADF 891570534700            mov dword ptr [00475370], edx
:00447AE5 A374534700              mov dword ptr [00475374], eax
:00447AEA 893554534700            mov dword ptr [00475354], esi
:00447AF0 C705383B450003000000    mov dword ptr [00453B38], 00000003
:00447AFA 893550534700            mov dword ptr [00475350], esi
:00447B00 E8D0D1FFFF              call 00444CD5
:00447B05 83C404                  add esp, 00000004
:00447B08 89353C3B4500            mov dword ptr [00453B3C], esi
:00447B0E 89355C534700            mov dword ptr [0047535C], esi
:00447B14 893558534700            mov dword ptr [00475358], esi
:00447B1A 5E                      pop esi
:00447B1B C3                      ret



* Referenced by a CALL at Address:
|:00447BD9   
|
:00447B1C 833D583B450000          cmp dword ptr [00453B58], 00000000
:00447B23 55                      push ebp
:00447B24 8BEC                    mov ebp, esp
:00447B26 7414                    je 00447B3C
:00447B28 FF7518                  push [ebp+18]
:00447B2B FF7514                  push [ebp+14]
:00447B2E FF7510                  push [ebp+10]
:00447B31 FF750C                  push [ebp+0C]
:00447B34 FF7508                  push [ebp+08]
:00447B37 E856DFFFFF              call 00445A92

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447B26(C)
|
:00447B3C 8BE5                    mov esp, ebp
:00447B3E 5D                      pop ebp
:00447B3F C21400                  ret 0014


:00447B42 55                      push ebp
:00447B43 8BEC                    mov ebp, esp
:00447B45 83EC20                  sub esp, 00000020
:00447B48 56                      push esi
:00447B49 57                      push edi
:00447B4A 8BF1                    mov esi, ecx
:00447B4C 8B7D10                  mov edi, dword ptr [ebp+10]
:00447B4F 8BC7                    mov eax, edi
:00447B51 C1E808                  shr eax, 08
:00447B54 50                      push eax
:00447B55 E8EBF7FFFF              call 00447345
:00447B5A 83C404                  add esp, 00000004
:00447B5D 85C0                    test eax, eax
:00447B5F 742A                    je 00447B8B
:00447B61 57                      push edi
:00447B62 E80CF8FFFF              call 00447373
:00447B67 83C404                  add esp, 00000004
:00447B6A 8D4DE0                  lea ecx, dword ptr [ebp-20]
:00447B6D 51                      push ecx
:00447B6E 50                      push eax
:00447B6F E864E2FFFF              call 00445DD8
:00447B74 83C408                  add esp, 00000008
:00447B77 8D4DE0                  lea ecx, dword ptr [ebp-20]
:00447B7A BF10000000              mov edi, 00000010
:00447B7F 6A00                    push 00000000
:00447B81 51                      push ecx
:00447B82 8BCE                    mov ecx, esi
:00447B84 E85D000000              call 00447BE6
:00447B89 EB25                    jmp 00447BB0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447B5F(C)
|
:00447B8B 8D45E0                  lea eax, dword ptr [ebp-20]
:00447B8E 81E7FF000000            and edi, 000000FF
:00447B94 50                      push eax
:00447B95 57                      push edi
:00447B96 E851E3FFFF              call 00445EEC
:00447B9B 83C408                  add esp, 00000008
:00447B9E 8D45E0                  lea eax, dword ptr [ebp-20]
:00447BA1 8BCE                    mov ecx, esi
:00447BA3 BF08000000              mov edi, 00000008
:00447BA8 6A01                    push 00000001
:00447BAA 50                      push eax
:00447BAB E836000000              call 00447BE6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447B89(U)
|
:00447BB0 A14C3B4500              mov eax, dword ptr [00453B4C]
:00447BB5 50                      push eax
:00447BB6 FF35483B4500            push dword ptr [00453B48]
:00447BBC FF35503B4500            push dword ptr [00453B50]
:00447BC2 E887D1FFFF              call 00444D4E
:00447BC7 83C40C                  add esp, 0000000C
:00447BCA 8D4DE0                  lea ecx, dword ptr [ebp-20]
:00447BCD 51                      push ecx
:00447BCE 6A10                    push 00000010
:00447BD0 57                      push edi
:00447BD1 8BCE                    mov ecx, esi
:00447BD3 FF750C                  push [ebp+0C]
:00447BD6 FF7508                  push [ebp+08]
:00447BD9 E83EFFFFFF              call 00447B1C
:00447BDE 5F                      pop edi
:00447BDF 5E                      pop esi
:00447BE0 8BE5                    mov esp, ebp
:00447BE2 5D                      pop ebp
:00447BE3 C20C00                  ret 000C



* Referenced by a CALL at Addresses:
|:00447B84   , :00447BAB   
|
:00447BE6 833D3C3B450001          cmp dword ptr [00453B3C], 00000001
:00447BED 55                      push ebp
:00447BEE 8BEC                    mov ebp, esp
:00447BF0 53                      push ebx
:00447BF1 56                      push esi
:00447BF2 57                      push edi
:00447BF3 7550                    jne 00447C45
:00447BF5 837D0C00                cmp dword ptr [ebp+0C], 00000000
:00447BF9 8B4D08                  mov ecx, dword ptr [ebp+08]
:00447BFC 7418                    je 00447C16
:00447BFE B810000000              mov eax, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447C12(C)
|
:00447C03 8A11                    mov dl, byte ptr [ecx]
:00447C05 8D1C5500000000          lea ebx, dword ptr [2*edx+00000000]
:00447C0C 0ADA                    or bl, dl
:00447C0E 8819                    mov byte ptr [ecx], bl
:00447C10 41                      inc ecx
:00447C11 48                      dec eax
:00447C12 75EF                    jne 00447C03
:00447C14 EB2F                    jmp 00447C45

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447BFC(C)
|
:00447C16 BE10000000              mov esi, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447C43(C)
|
:00447C1B 8A11                    mov dl, byte ptr [ecx]
:00447C1D 8D7901                  lea edi, dword ptr [ecx+01]
:00447C20 660FB6C2                movzx ax, dl
:00447C24 66C1E008                shl ax, 08
:00447C28 660FB61F                movzx bx, byte ptr [edi]
:00447C2C 6603C3                  add ax, bx
:00447C2F 6603C0                  add ax, ax
:00447C32 668BD8                  mov bx, ax
:00447C35 66C1EB08                shr bx, 08
:00447C39 0ADA                    or bl, dl
:00447C3B 8819                    mov byte ptr [ecx], bl
:00447C3D 8D4F01                  lea ecx, dword ptr [edi+01]
:00447C40 0807                    or byte ptr [edi], al
:00447C42 4E                      dec esi
:00447C43 75D6                    jne 00447C1B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00447BF3(C), :00447C14(U)
|
:00447C45 5F                      pop edi
:00447C46 5E                      pop esi
:00447C47 5B                      pop ebx
:00447C48 5D                      pop ebp
:00447C49 C20800                  ret 0008


:00447C4C E900000000              jmp 00447C51

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447C4C(U)
|
:00447C51 C7057853470000C04400    mov dword ptr [00475378], 0044C000
:00447C5B C3                      ret


:00447C5C CC                      int 03
:00447C5D CC                      int 03
:00447C5E CC                      int 03
:00447C5F CC                      int 03

* Referenced by a CALL at Address:
|:00447CE5   
|
:00447C60 A1B86C4700              mov eax, dword ptr [00476CB8]
:00447C65 50                      push eax
:00447C66 E8350D0000              call 004489A0
:00447C6B 83C404                  add esp, 00000004
:00447C6E 8B0DB06C4700            mov ecx, dword ptr [00476CB0]
:00447C74 2B0DB86C4700            sub ecx, dword ptr [00476CB8]
:00447C7A 83C104                  add ecx, 00000004
:00447C7D 3BC1                    cmp eax, ecx
:00447C7F 7344                    jnb 00447CC5
:00447C81 A1B86C4700              mov eax, dword ptr [00476CB8]
:00447C86 50                      push eax
:00447C87 E8140D0000              call 004489A0
:00447C8C 83C404                  add esp, 00000004
:00447C8F 83C010                  add eax, 00000010
:00447C92 8B0DB86C4700            mov ecx, dword ptr [00476CB8]
:00447C98 50                      push eax
:00447C99 51                      push ecx
:00447C9A E8910C0000              call 00448930
:00447C9F 83C408                  add esp, 00000008
:00447CA2 85C0                    test eax, eax
:00447CA4 7503                    jne 00447CA9
:00447CA6 33C0                    xor eax, eax
:00447CA8 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447CA4(C)
|
:00447CA9 8B0DB06C4700            mov ecx, dword ptr [00476CB0]
:00447CAF 2B0DB86C4700            sub ecx, dword ptr [00476CB8]
:00447CB5 83E1FC                  and ecx, FFFFFFFC
:00447CB8 A3B86C4700              mov dword ptr [00476CB8], eax
:00447CBD 03C8                    add ecx, eax
:00447CBF 890DB06C4700            mov dword ptr [00476CB0], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447C7F(C)
|
:00447CC5 8B0DB06C4700            mov ecx, dword ptr [00476CB0]
:00447CCB 8B442404                mov eax, dword ptr [esp+04]
:00447CCF 8901                    mov dword ptr [ecx], eax
:00447CD1 8305B06C470004          add dword ptr [00476CB0], 00000004
:00447CD8 C3                      ret


:00447CD9 CC                      int 03
:00447CDA CC                      int 03
:00447CDB CC                      int 03
:00447CDC CC                      int 03
:00447CDD CC                      int 03
:00447CDE CC                      int 03
:00447CDF CC                      int 03

* Referenced by a CALL at Addresses:
|:0040A411   , :0040BDB0   , :0040DC4C   , :00410EED   , :00410F61   
|:00410FDD   , :00419687   , :0041E39D   , :0041E411   , :0041E48D   
|:0041E512   , :00421F7F   , :00428FFD   , :0042E0AF   , :00439ABF   
|:00439B37   , :0043A7B2   , :0043A8F9   , :0043AC69   , :0043C3E0   
|:0043EE6F   , :0044A515   
|
:00447CE0 8B442404                mov eax, dword ptr [esp+04]
:00447CE4 50                      push eax
:00447CE5 E876FFFFFF              call 00447C60
:00447CEA 83C404                  add esp, 00000004
:00447CED 83F801                  cmp eax, 00000001
:00447CF0 1BC0                    sbb eax, eax
:00447CF2 C3                      ret


:00447CF3 CC                      int 03
:00447CF4 CC                      int 03
:00447CF5 CC                      int 03
:00447CF6 CC                      int 03
:00447CF7 CC                      int 03
:00447CF8 CC                      int 03
:00447CF9 CC                      int 03
:00447CFA CC                      int 03
:00447CFB CC                      int 03
:00447CFC CC                      int 03
:00447CFD CC                      int 03
:00447CFE CC                      int 03
:00447CFF CC                      int 03
:00447D00 6880000000              push 00000080
:00447D05 E8B60C0000              call 004489C0
:00447D0A 83C404                  add esp, 00000004
:00447D0D A3B86C4700              mov dword ptr [00476CB8], eax
:00447D12 85C0                    test eax, eax
:00447D14 750A                    jne 00447D20
:00447D16 6A18                    push 00000018
:00447D18 E8E3080000              call 00448600
:00447D1D 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447D14(C)
|
:00447D20 A1B86C4700              mov eax, dword ptr [00476CB8]
:00447D25 C70000000000            mov dword ptr [eax], 00000000
:00447D2B A1B86C4700              mov eax, dword ptr [00476CB8]
:00447D30 A3B06C4700              mov dword ptr [00476CB0], eax
:00447D35 C3                      ret


:00447D36 CC                      int 03
:00447D37 CC                      int 03
:00447D38 CC                      int 03
:00447D39 CC                      int 03
:00447D3A CC                      int 03
:00447D3B CC                      int 03
:00447D3C CC                      int 03
:00447D3D CC                      int 03
:00447D3E CC                      int 03
:00447D3F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040A407   , :0040BD96   , :0040DC32   , :00410ED3   , :00410FC3   
|:0041E383   , :0041E473   , :0041E4F8   , :00428FE3   , :004398B6   
|
:00447D40 64A100000000            mov eax, dword ptr fs:[00000000]
:00447D46 55                      push ebp
:00447D47 8BEC                    mov ebp, esp
:00447D49 6AFF                    push FFFFFFFF
:00447D4B 6808C04400              push 0044C008
:00447D50 68408A4400              push 00448A40
:00447D55 50                      push eax
:00447D56 33C0                    xor eax, eax
:00447D58 64892500000000          mov dword ptr fs:[00000000], esp
:00447D5F 83EC10                  sub esp, 00000010
:00447D62 8945E0                  mov dword ptr [ebp-20], eax
:00447D65 53                      push ebx
:00447D66 56                      push esi
:00447D67 57                      push edi
:00447D68 8945FC                  mov dword ptr [ebp-04], eax
:00447D6B 8945E4                  mov dword ptr [ebp-1C], eax
:00447D6E 8B7510                  mov esi, dword ptr [ebp+10]
:00447D71 3BC6                    cmp eax, esi
:00447D73 7D16                    jge 00447D8B
:00447D75 8B7D14                  mov edi, dword ptr [ebp+14]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447D89(C)
|
:00447D78 8B4D08                  mov ecx, dword ptr [ebp+08]
:00447D7B FFD7                    call edi
:00447D7D 8B450C                  mov eax, dword ptr [ebp+0C]
:00447D80 014508                  add dword ptr [ebp+08], eax
:00447D83 FF45E4                  inc [ebp-1C]
:00447D86 3975E4                  cmp dword ptr [ebp-1C], esi
:00447D89 7CED                    jl 00447D78

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447D73(C)
|
:00447D8B C745E001000000          mov [ebp-20], 00000001
:00447D92 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00447D99 68BA7D4400              push 00447DBA
:00447D9E 837DE000                cmp dword ptr [ebp-20], 00000000
:00447DA2 7515                    jne 00447DB9
:00447DA4 8B4518                  mov eax, dword ptr [ebp+18]
:00447DA7 50                      push eax
:00447DA8 8B45E4                  mov eax, dword ptr [ebp-1C]
:00447DAB 50                      push eax
:00447DAC 8B450C                  mov eax, dword ptr [ebp+0C]
:00447DAF 50                      push eax
:00447DB0 8B4508                  mov eax, dword ptr [ebp+08]
:00447DB3 50                      push eax
:00447DB4 E8A7000000              call 00447E60

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447DA2(C)
|
:00447DB9 C3                      ret
:00447DBA 8B45F0                  mov eax, dword ptr [ebp-10]
:00447DBD 5F                      pop edi
:00447DBE 64A300000000            mov dword ptr fs:[00000000], eax
:00447DC4 5E                      pop esi
:00447DC5 5B                      pop ebx
:00447DC6 8BE5                    mov esp, ebp
:00447DC8 5D                      pop ebp
:00447DC9 C21400                  ret 0014


:00447DCC CC                      int 03
:00447DCD CC                      int 03
:00447DCE CC                      int 03
:00447DCF CC                      int 03

* Referenced by a CALL at Addresses:
|:0040ADAC   , :0040BDD9   , :0040DC75   , :00410F13   , :00411006   
|:0041E3C3   , :0041E4B6   , :0041E538   , :00429023   , :004399ED   
|:00439A5E   
|
:00447DD0 64A100000000            mov eax, dword ptr fs:[00000000]
:00447DD6 55                      push ebp
:00447DD7 8BEC                    mov ebp, esp
:00447DD9 6AFF                    push FFFFFFFF
:00447DDB 6818C04400              push 0044C018
:00447DE0 68408A4400              push 00448A40
:00447DE5 50                      push eax
:00447DE6 33C0                    xor eax, eax
:00447DE8 64892500000000          mov dword ptr fs:[00000000], esp
:00447DEF 8B4D10                  mov ecx, dword ptr [ebp+10]
:00447DF2 0FAF4D0C                imul ecx, dword ptr [ebp+0C]
:00447DF6 83EC0C                  sub esp, 0000000C
:00447DF9 014D08                  add dword ptr [ebp+08], ecx
:00447DFC 8945E4                  mov dword ptr [ebp-1C], eax
:00447DFF 53                      push ebx
:00447E00 56                      push esi
:00447E01 57                      push edi
:00447E02 8945FC                  mov dword ptr [ebp-04], eax
:00447E05 FF4D10                  dec [ebp+10]
:00447E08 7811                    js 00447E1B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447E19(C)
|
:00447E0A 8B450C                  mov eax, dword ptr [ebp+0C]
:00447E0D 294508                  sub dword ptr [ebp+08], eax
:00447E10 8B4D08                  mov ecx, dword ptr [ebp+08]
:00447E13 FF5514                  call [ebp+14]
:00447E16 FF4D10                  dec [ebp+10]
:00447E19 79EF                    jns 00447E0A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447E08(C)
|
:00447E1B C745E401000000          mov [ebp-1C], 00000001
:00447E22 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00447E29 684A7E4400              push 00447E4A
:00447E2E 837DE400                cmp dword ptr [ebp-1C], 00000000
:00447E32 7515                    jne 00447E49
:00447E34 8B4514                  mov eax, dword ptr [ebp+14]
:00447E37 50                      push eax
:00447E38 8B4510                  mov eax, dword ptr [ebp+10]
:00447E3B 50                      push eax
:00447E3C 8B450C                  mov eax, dword ptr [ebp+0C]
:00447E3F 50                      push eax
:00447E40 8B4508                  mov eax, dword ptr [ebp+08]
:00447E43 50                      push eax
:00447E44 E817000000              call 00447E60

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447E32(C)
|
:00447E49 C3                      ret
:00447E4A 8B45F0                  mov eax, dword ptr [ebp-10]
:00447E4D 5F                      pop edi
:00447E4E 64A300000000            mov dword ptr fs:[00000000], eax
:00447E54 5E                      pop esi
:00447E55 5B                      pop ebx
:00447E56 8BE5                    mov esp, ebp
:00447E58 5D                      pop ebp
:00447E59 C21000                  ret 0010


:00447E5C CC                      int 03
:00447E5D CC                      int 03
:00447E5E CC                      int 03
:00447E5F CC                      int 03

* Referenced by a CALL at Addresses:
|:00447DB4   , :00447E44   
|
:00447E60 64A100000000            mov eax, dword ptr fs:[00000000]
:00447E66 55                      push ebp
:00447E67 8BEC                    mov ebp, esp
:00447E69 6AFF                    push FFFFFFFF
:00447E6B 6828C04400              push 0044C028
:00447E70 68408A4400              push 00448A40
:00447E75 50                      push eax
:00447E76 64892500000000          mov dword ptr fs:[00000000], esp
:00447E7D 83EC08                  sub esp, 00000008
:00447E80 53                      push ebx
:00447E81 56                      push esi
:00447E82 57                      push edi
:00447E83 8965E8                  mov dword ptr [ebp-18], esp
:00447E86 C745FC00000000          mov [ebp-04], 00000000
:00447E8D 8B5D10                  mov ebx, dword ptr [ebp+10]
:00447E90 4B                      dec ebx
:00447E91 895D10                  mov dword ptr [ebp+10], ebx
:00447E94 7828                    js 00447EBE
:00447E96 8B7508                  mov esi, dword ptr [ebp+08]
:00447E99 8B7D0C                  mov edi, dword ptr [ebp+0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447EAA(C)
|
:00447E9C 2BF7                    sub esi, edi
:00447E9E 897508                  mov dword ptr [ebp+08], esi
:00447EA1 8BCE                    mov ecx, esi
:00447EA3 FF5514                  call [ebp+14]
:00447EA6 4B                      dec ebx
:00447EA7 895D10                  mov dword ptr [ebp+10], ebx
:00447EAA 79F0                    jns 00447E9C
:00447EAC EB10                    jmp 00447EBE
:00447EAE 8B45EC                  mov eax, dword ptr [ebp-14]
:00447EB1 50                      push eax
:00447EB2 E829000000              call 00447EE0
:00447EB7 83C404                  add esp, 00000004
:00447EBA C3                      ret


:00447EBB 8B65E8                  mov esp, dword ptr [ebp-18]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00447E94(C), :00447EAC(U)
|
:00447EBE C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00447EC5 8B45F0                  mov eax, dword ptr [ebp-10]
:00447EC8 5F                      pop edi
:00447EC9 64A300000000            mov dword ptr fs:[00000000], eax
:00447ECF 5E                      pop esi
:00447ED0 5B                      pop ebx
:00447ED1 8BE5                    mov esp, ebp
:00447ED3 5D                      pop ebp
:00447ED4 C21000                  ret 0010


:00447ED7 CC                      int 03
:00447ED8 CC                      int 03
:00447ED9 CC                      int 03
:00447EDA CC                      int 03
:00447EDB CC                      int 03
:00447EDC CC                      int 03
:00447EDD CC                      int 03
:00447EDE CC                      int 03
:00447EDF CC                      int 03

* Referenced by a CALL at Address:
|:00447EB2   
|
:00447EE0 8B442404                mov eax, dword ptr [esp+04]
:00447EE4 8B08                    mov ecx, dword ptr [eax]
:00447EE6 813963736DE0            cmp dword ptr [ecx], E06D7363
:00447EEC 7505                    jne 00447EF3
:00447EEE E82D0C0000              call 00448B20

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447EEC(C)
|
:00447EF3 33C0                    xor eax, eax
:00447EF5 C3                      ret


:00447EF6 CC                      int 03
:00447EF7 CC                      int 03

* Referenced by a CALL at Address:
|:00448A9A   
|
:00447EF8 55                      push ebp
:00447EF9 8BEC                    mov ebp, esp
:00447EFB 53                      push ebx
:00447EFC 56                      push esi
:00447EFD 57                      push edi
:00447EFE 55                      push ebp
:00447EFF 6A00                    push 00000000
:00447F01 6A00                    push 00000000

* Possible StringData Ref from Code Obj ->"]_^[]ËL$A"
                                  |
:00447F03 68107F4400              push 00447F10
:00447F08 FF7508                  push [ebp+08]

* Reference To: KERNEL32.RtlUnwind, Ord:01C7h
                                  |
:00447F0B E80C340000              Call 0044B31C
:00447F10 5D                      pop ebp
:00447F11 5F                      pop edi
:00447F12 5E                      pop esi
:00447F13 5B                      pop ebx
:00447F14 8BE5                    mov esp, ebp
:00447F16 5D                      pop ebp
:00447F17 C3                      ret


:00447F18 8B4C2404                mov ecx, dword ptr [esp+04]
:00447F1C F7410406000000          test [ecx+04], 00000006
:00447F23 B801000000              mov eax, 00000001
:00447F28 740F                    je 00447F39
:00447F2A 8B442408                mov eax, dword ptr [esp+08]
:00447F2E 8B542410                mov edx, dword ptr [esp+10]
:00447F32 8902                    mov dword ptr [edx], eax
:00447F34 B803000000              mov eax, 00000003

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447F28(C)
|
:00447F39 C3                      ret

* Referenced by a CALL at Addresses:
|:00448AA7   , :00448AE7   , :00448B0C   , :00449380   
|
:00447F3A 53                      push ebx
:00447F3B 56                      push esi
:00447F3C 57                      push edi
:00447F3D 8B442410                mov eax, dword ptr [esp+10]
:00447F41 50                      push eax
:00447F42 6AFE                    push FFFFFFFE
:00447F44 68187F4400              push 00447F18
:00447F49 64FF3500000000          push dword ptr fs:[00000000]
:00447F50 64892500000000          mov dword ptr fs:[00000000], esp

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447F92(U)
|
:00447F57 8B442420                mov eax, dword ptr [esp+20]
:00447F5B 8B5808                  mov ebx, dword ptr [eax+08]
:00447F5E 8B700C                  mov esi, dword ptr [eax+0C]
:00447F61 83FEFF                  cmp esi, FFFFFFFF
:00447F64 742E                    je 00447F94
:00447F66 3B742424                cmp esi, dword ptr [esp+24]
:00447F6A 7428                    je 00447F94
:00447F6C 8D3476                  lea esi, dword ptr [esi+2*esi]
:00447F6F 8B0CB3                  mov ecx, dword ptr [ebx+4*esi]
:00447F72 894C2408                mov dword ptr [esp+08], ecx
:00447F76 89480C                  mov dword ptr [eax+0C], ecx
:00447F79 837CB30400              cmp dword ptr [ebx+4*esi+04], 00000000
:00447F7E 7512                    jne 00447F92
:00447F80 6801010000              push 00000101
:00447F85 8B44B308                mov eax, dword ptr [ebx+4*esi+08]
:00447F89 E840000000              call 00447FCE
:00447F8E FF54B308                call [ebx+4*esi+08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447F7E(C)
|
:00447F92 EBC3                    jmp 00447F57

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00447F64(C), :00447F6A(C)
|
:00447F94 648F0500000000          pop dword ptr fs:[00000000]
:00447F9B 83C40C                  add esp, 0000000C
:00447F9E 5F                      pop edi
:00447F9F 5E                      pop esi
:00447FA0 5B                      pop ebx
:00447FA1 C3                      ret



* Referenced by a CALL at Address:
|:00449352   
|
:00447FA2 33C0                    xor eax, eax
:00447FA4 648B0D00000000          mov ecx, dword ptr fs:[00000000]
:00447FAB 817904187F4400          cmp dword ptr [ecx+04], 00447F18
:00447FB2 7510                    jne 00447FC4
:00447FB4 8B510C                  mov edx, dword ptr [ecx+0C]
:00447FB7 8B520C                  mov edx, dword ptr [edx+0C]
:00447FBA 395108                  cmp dword ptr [ecx+08], edx
:00447FBD 7505                    jne 00447FC4
:00447FBF B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00447FB2(C), :00447FBD(C)
|
:00447FC4 C3                      ret

* Referenced by a CALL at Addresses:
|:0044969E   , :004496BC   
|
:00447FC5 53                      push ebx
:00447FC6 51                      push ecx

* Possible StringData Ref from Data Obj ->" "
                                  |
:00447FC7 BB603B4500              mov ebx, 00453B60
:00447FCC EB0A                    jmp 00447FD8

* Referenced by a CALL at Addresses:
|:00447F89   , :00448AB8   
|
:00447FCE 53                      push ebx
:00447FCF 51                      push ecx

* Possible StringData Ref from Data Obj ->" "
                                  |
:00447FD0 BB603B4500              mov ebx, 00453B60
:00447FD5 8B4D08                  mov ecx, dword ptr [ebp+08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447FCC(U)
|
:00447FD8 894B08                  mov dword ptr [ebx+08], ecx
:00447FDB 894304                  mov dword ptr [ebx+04], eax
:00447FDE 896B0C                  mov dword ptr [ebx+0C], ebp
:00447FE1 59                      pop ecx
:00447FE2 5B                      pop ebx
:00447FE3 C20400                  ret 0004


:00447FE6 CC                      int 03
:00447FE7 CC                      int 03
:00447FE8 CC                      int 03
:00447FE9 CC                      int 03
:00447FEA CC                      int 03
:00447FEB CC                      int 03
:00447FEC CC                      int 03
:00447FED CC                      int 03
:00447FEE CC                      int 03
:00447FEF CC                      int 03

* Referenced by a CALL at Address:
|:0044927A   
|
:00447FF0 55                      push ebp
:00447FF1 8B44240C                mov eax, dword ptr [esp+0C]
:00447FF5 8BEC                    mov ebp, esp
:00447FF7 83C00C                  add eax, 0000000C
:00447FFA 83EC04                  sub esp, 00000004
:00447FFD 8945FC                  mov dword ptr [ebp-04], eax
:00448000 53                      push ebx
:00448001 648B1D00000000          mov ebx, dword ptr fs:[00000000]
:00448008 8B03                    mov eax, dword ptr [ebx]
:0044800A 64A300000000            mov dword ptr fs:[00000000], eax
:00448010 8B4508                  mov eax, dword ptr [ebp+08]
:00448013 8B5D0C                  mov ebx, dword ptr [ebp+0C]
:00448016 8B63FC                  mov esp, dword ptr [ebx-04]
:00448019 8B6DFC                  mov ebp, dword ptr [ebp-04]
:0044801C FFE0                    jmp eax
:0044801E 5B                      pop ebx
:0044801F 8BE5                    mov esp, ebp
:00448021 5D                      pop ebp
:00448022 C20800                  ret 0008


:00448025 CC                      int 03
:00448026 CC                      int 03
:00448027 CC                      int 03
:00448028 CC                      int 03
:00448029 CC                      int 03
:0044802A CC                      int 03
:0044802B CC                      int 03
:0044802C CC                      int 03
:0044802D CC                      int 03
:0044802E CC                      int 03
:0044802F CC                      int 03

* Referenced by a CALL at Address:
|:00449613   
|
:00448030 58                      pop eax
:00448031 59                      pop ecx
:00448032 870424                  xchg dword ptr [esp], eax
:00448035 FFE0                    jmp eax
:00448037 CC                      int 03
:00448038 CC                      int 03
:00448039 CC                      int 03
:0044803A CC                      int 03
:0044803B CC                      int 03
:0044803C CC                      int 03
:0044803D CC                      int 03
:0044803E CC                      int 03
:0044803F CC                      int 03

* Referenced by a CALL at Address:
|:0044959B   
|
:00448040 58                      pop eax
:00448041 59                      pop ecx
:00448042 870424                  xchg dword ptr [esp], eax
:00448045 FFE0                    jmp eax
:00448047 CC                      int 03
:00448048 CC                      int 03
:00448049 CC                      int 03
:0044804A CC                      int 03
:0044804B CC                      int 03
:0044804C CC                      int 03
:0044804D CC                      int 03
:0044804E CC                      int 03
:0044804F CC                      int 03

* Referenced by a CALL at Address:
|:0044957E   
|
:00448050 58                      pop eax
:00448051 59                      pop ecx
:00448052 870424                  xchg dword ptr [esp], eax
:00448055 FFE0                    jmp eax
:00448057 CC                      int 03
:00448058 CC                      int 03
:00448059 CC                      int 03
:0044805A CC                      int 03
:0044805B CC                      int 03
:0044805C CC                      int 03
:0044805D CC                      int 03
:0044805E CC                      int 03
:0044805F CC                      int 03

* Referenced by a CALL at Addresses:
|:004482D1   , :0044922B   
|
:00448060 55                      push ebp
:00448061 8BEC                    mov ebp, esp
:00448063 83EC08                  sub esp, 00000008
:00448066 53                      push ebx
:00448067 56                      push esi
:00448068 57                      push edi
:00448069 64A100000000            mov eax, dword ptr fs:[00000000]
:0044806F 8945FC                  mov dword ptr [ebp-04], eax

* Possible StringData Ref from Code Obj ->"E`d"
                                  |
:00448072 C745F88C804400          mov [ebp-08], 0044808C
:00448079 6A00                    push 00000000
:0044807B 8B450C                  mov eax, dword ptr [ebp+0C]
:0044807E 50                      push eax
:0044807F 8B45F8                  mov eax, dword ptr [ebp-08]
:00448082 50                      push eax
:00448083 8B4508                  mov eax, dword ptr [ebp+08]
:00448086 50                      push eax

* Reference To: KERNEL32.RtlUnwind, Ord:01C7h
                                  |
:00448087 E890320000              Call 0044B31C
:0044808C 8B450C                  mov eax, dword ptr [ebp+0C]
:0044808F 836004FD                and dword ptr [eax+04], FFFFFFFD
:00448093 64A100000000            mov eax, dword ptr fs:[00000000]
:00448099 8B5DFC                  mov ebx, dword ptr [ebp-04]
:0044809C 8903                    mov dword ptr [ebx], eax
:0044809E 64891D00000000          mov dword ptr fs:[00000000], ebx
:004480A5 E900000000              jmp 004480AA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004480A5(U)
|
:004480AA 5F                      pop edi
:004480AB 5E                      pop esi
:004480AC 5B                      pop ebx
:004480AD C9                      leave
:004480AE C20800                  ret 0008


:004480B1 CC                      int 03
:004480B2 CC                      int 03
:004480B3 CC                      int 03
:004480B4 CC                      int 03
:004480B5 CC                      int 03
:004480B6 CC                      int 03
:004480B7 CC                      int 03
:004480B8 CC                      int 03
:004480B9 CC                      int 03
:004480BA CC                      int 03
:004480BB CC                      int 03
:004480BC CC                      int 03
:004480BD CC                      int 03
:004480BE CC                      int 03
:004480BF CC                      int 03

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040DCF0(U), :0040DDAC(U), :0040DF49(U), :0040DFAC(U), :00417971(U)
|:004179DC(U), :00438AD6(U), :0043954A(U), :00439641(U), :004399F8(U)
|:00439A69(U), :0043FD66(U), :00444043(U)
|
:004480C0 55                      push ebp
:004480C1 8BEC                    mov ebp, esp
:004480C3 83EC08                  sub esp, 00000008
:004480C6 53                      push ebx
:004480C7 56                      push esi
:004480C8 57                      push edi
:004480C9 FC                      cld
:004480CA 8945F8                  mov dword ptr [ebp-08], eax
:004480CD 6A00                    push 00000000
:004480CF 8B45F8                  mov eax, dword ptr [ebp-08]
:004480D2 6A00                    push 00000000
:004480D4 8B4D14                  mov ecx, dword ptr [ebp+14]
:004480D7 6A00                    push 00000000
:004480D9 8B5510                  mov edx, dword ptr [ebp+10]
:004480DC 50                      push eax
:004480DD 51                      push ecx
:004480DE 52                      push edx
:004480DF 8B450C                  mov eax, dword ptr [ebp+0C]
:004480E2 50                      push eax
:004480E3 8B4D08                  mov ecx, dword ptr [ebp+08]
:004480E6 51                      push ecx
:004480E7 E8340B0000              call 00448C20
:004480EC 83C420                  add esp, 00000020
:004480EF 8945FC                  mov dword ptr [ebp-04], eax
:004480F2 5F                      pop edi
:004480F3 5E                      pop esi
:004480F4 5B                      pop ebx
:004480F5 8B45FC                  mov eax, dword ptr [ebp-04]
:004480F8 8BE5                    mov esp, ebp
:004480FA 5D                      pop ebp
:004480FB C3                      ret


:004480FC CC                      int 03
:004480FD CC                      int 03
:004480FE CC                      int 03
:004480FF CC                      int 03

* Referenced by a CALL at Address:
|:00449303   
|
:00448100 8B442408                mov eax, dword ptr [esp+08]
:00448104 8B4C2404                mov ecx, dword ptr [esp+04]
:00448108 83EC14                  sub esp, 00000014
:0044810B 89442408                mov dword ptr [esp+08], eax
:0044810F 894C240C                mov dword ptr [esp+0C], ecx
:00448113 C744240000000000        mov [esp], 00000000
:0044811B C744240470814400        mov [esp+04], 00448170
:00448123 8B442424                mov eax, dword ptr [esp+24]
:00448127 40                      inc eax
:00448128 89442410                mov dword ptr [esp+10], eax
:0044812C 64A100000000            mov eax, dword ptr fs:[00000000]
:00448132 89442400                mov dword ptr [esp], eax
:00448136 8D442400                lea eax, dword ptr [esp]
:0044813A 64A300000000            mov dword ptr fs:[00000000], eax
:00448140 8B442428                mov eax, dword ptr [esp+28]
:00448144 50                      push eax
:00448145 51                      push ecx
:00448146 8B4C2428                mov ecx, dword ptr [esp+28]
:0044814A 51                      push ecx
:0044814B E830150000              call 00449680
:00448150 8BC8                    mov ecx, eax
:00448152 8B442400                mov eax, dword ptr [esp]
:00448156 64A300000000            mov dword ptr fs:[00000000], eax
:0044815C 8BC1                    mov eax, ecx
:0044815E 83C414                  add esp, 00000014
:00448161 C3                      ret


:00448162 CC                      int 03
:00448163 CC                      int 03
:00448164 CC                      int 03
:00448165 CC                      int 03
:00448166 CC                      int 03
:00448167 CC                      int 03
:00448168 CC                      int 03
:00448169 CC                      int 03
:0044816A CC                      int 03
:0044816B CC                      int 03
:0044816C CC                      int 03
:0044816D CC                      int 03
:0044816E CC                      int 03
:0044816F CC                      int 03
:00448170 FC                      cld
:00448171 8B4C2408                mov ecx, dword ptr [esp+08]
:00448175 6A00                    push 00000000
:00448177 51                      push ecx
:00448178 8B4110                  mov eax, dword ptr [ecx+10]
:0044817B 50                      push eax
:0044817C 8B5108                  mov edx, dword ptr [ecx+08]
:0044817F 8B442418                mov eax, dword ptr [esp+18]
:00448183 52                      push edx
:00448184 6A00                    push 00000000
:00448186 8B490C                  mov ecx, dword ptr [ecx+0C]
:00448189 8B542418                mov edx, dword ptr [esp+18]
:0044818D 50                      push eax
:0044818E 51                      push ecx
:0044818F 52                      push edx
:00448190 E88B0A0000              call 00448C20
:00448195 83C420                  add esp, 00000020
:00448198 C3                      ret


:00448199 CC                      int 03
:0044819A CC                      int 03
:0044819B CC                      int 03
:0044819C CC                      int 03
:0044819D CC                      int 03
:0044819E CC                      int 03
:0044819F CC                      int 03

* Referenced by a CALL at Address:
|:00448FB3   
|
:004481A0 55                      push ebp
:004481A1 8BEC                    mov ebp, esp
:004481A3 83EC34                  sub esp, 00000034
:004481A6 53                      push ebx
:004481A7 56                      push esi
:004481A8 57                      push edi
:004481A9 C745CC00000000          mov [ebp-34], 00000000
:004481B0 C745D080824400          mov [ebp-30], 00448280
:004481B7 8B4518                  mov eax, dword ptr [ebp+18]
:004481BA 8945D4                  mov dword ptr [ebp-2C], eax
:004481BD 8B450C                  mov eax, dword ptr [ebp+0C]
:004481C0 8945D8                  mov dword ptr [ebp-28], eax
:004481C3 8B451C                  mov eax, dword ptr [ebp+1C]
:004481C6 8945DC                  mov dword ptr [ebp-24], eax
:004481C9 8B4520                  mov eax, dword ptr [ebp+20]
:004481CC 8945E0                  mov dword ptr [ebp-20], eax
:004481CF C745E400000000          mov [ebp-1C], 00000000
:004481D6 C745E800000000          mov [ebp-18], 00000000
:004481DD C745EC00000000          mov [ebp-14], 00000000
:004481E4 C745F000000000          mov [ebp-10], 00000000

* Possible StringData Ref from Code Obj ->"}"
                                  |
:004481EB C745E437824400          mov [ebp-1C], 00448237
:004481F2 8965E8                  mov dword ptr [ebp-18], esp
:004481F5 896DEC                  mov dword ptr [ebp-14], ebp
:004481F8 64A100000000            mov eax, dword ptr fs:[00000000]
:004481FE 8945CC                  mov dword ptr [ebp-34], eax
:00448201 8D45CC                  lea eax, dword ptr [ebp-34]
:00448204 64A300000000            mov dword ptr fs:[00000000], eax
:0044820A C745FC01000000          mov [ebp-04], 00000001
:00448211 8B4508                  mov eax, dword ptr [ebp+08]
:00448214 8945F4                  mov dword ptr [ebp-0C], eax
:00448217 8B4510                  mov eax, dword ptr [ebp+10]
:0044821A 8945F8                  mov dword ptr [ebp-08], eax
:0044821D 8D45F4                  lea eax, dword ptr [ebp-0C]
:00448220 50                      push eax
:00448221 8B4508                  mov eax, dword ptr [ebp+08]
:00448224 8B00                    mov eax, dword ptr [eax]
:00448226 50                      push eax
:00448227 FF15CC3B4500            call dword ptr [00453BCC]
:0044822D 83C408                  add esp, 00000008
:00448230 C745FC00000000          mov [ebp-04], 00000000
:00448237 837DF000                cmp dword ptr [ebp-10], 00000000
:0044823B 0F841A000000            je 0044825B
:00448241 648B1D00000000          mov ebx, dword ptr fs:[00000000]
:00448248 8B03                    mov eax, dword ptr [ebx]
:0044824A 8B5DCC                  mov ebx, dword ptr [ebp-34]
:0044824D 8903                    mov dword ptr [ebx], eax
:0044824F 64891D00000000          mov dword ptr fs:[00000000], ebx
:00448256 E909000000              jmp 00448264

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044823B(C)
|
:0044825B 8B45CC                  mov eax, dword ptr [ebp-34]
:0044825E 64A300000000            mov dword ptr fs:[00000000], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448256(U)
|
:00448264 8B45FC                  mov eax, dword ptr [ebp-04]
:00448267 E900000000              jmp 0044826C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448267(U)
|
:0044826C 5F                      pop edi
:0044826D 5E                      pop esi
:0044826E 5B                      pop ebx
:0044826F C9                      leave
:00448270 C3                      ret


:00448271 CC                      int 03
:00448272 CC                      int 03
:00448273 CC                      int 03
:00448274 CC                      int 03
:00448275 CC                      int 03
:00448276 CC                      int 03
:00448277 CC                      int 03
:00448278 CC                      int 03
:00448279 CC                      int 03
:0044827A CC                      int 03
:0044827B CC                      int 03
:0044827C CC                      int 03
:0044827D CC                      int 03
:0044827E CC                      int 03
:0044827F CC                      int 03
:00448280 55                      push ebp
:00448281 8BEC                    mov ebp, esp
:00448283 53                      push ebx
:00448284 56                      push esi
:00448285 FC                      cld
:00448286 8B7508                  mov esi, dword ptr [ebp+08]
:00448289 F6460466                test [esi+04], 66
:0044828D 7413                    je 004482A2
:0044828F 8B450C                  mov eax, dword ptr [ebp+0C]
:00448292 5E                      pop esi
:00448293 5B                      pop ebx
:00448294 5D                      pop ebp
:00448295 C7402401000000          mov [eax+24], 00000001
:0044829C B801000000              mov eax, 00000001
:004482A1 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044828D(C)
|
:004482A2 6A01                    push 00000001
:004482A4 8B450C                  mov eax, dword ptr [ebp+0C]
:004482A7 8B4814                  mov ecx, dword ptr [eax+14]
:004482AA 8B5010                  mov edx, dword ptr [eax+10]
:004482AD 51                      push ecx
:004482AE 52                      push edx
:004482AF 8B4808                  mov ecx, dword ptr [eax+08]
:004482B2 8B5510                  mov edx, dword ptr [ebp+10]
:004482B5 51                      push ecx
:004482B6 6A00                    push 00000000
:004482B8 52                      push edx
:004482B9 8B480C                  mov ecx, dword ptr [eax+0C]
:004482BC 51                      push ecx
:004482BD 56                      push esi
:004482BE E85D090000              call 00448C20
:004482C3 83C420                  add esp, 00000020
:004482C6 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004482C9 83792400                cmp dword ptr [ecx+24], 00000000
:004482CD 7507                    jne 004482D6
:004482CF 56                      push esi
:004482D0 51                      push ecx
:004482D1 E88AFDFFFF              call 00448060

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004482CD(C)
|
:004482D6 8B5D0C                  mov ebx, dword ptr [ebp+0C]
:004482D9 8B631C                  mov esp, dword ptr [ebx+1C]
:004482DC 8B6B20                  mov ebp, dword ptr [ebx+20]
:004482DF FF6318                  jmp [ebx+18]
:004482E2 B801000000              mov eax, 00000001
:004482E7 5E                      pop esi
:004482E8 5B                      pop ebx
:004482E9 5D                      pop ebp
:004482EA C3                      ret


:004482EB CC                      int 03
:004482EC CC                      int 03
:004482ED CC                      int 03
:004482EE CC                      int 03
:004482EF CC                      int 03

* Referenced by a CALL at Addresses:
|:004119D2   , :0044745A   , :004494B1   , :00449529   
|
:004482F0 55                      push ebp
:004482F1 8BEC                    mov ebp, esp
:004482F3 57                      push edi
:004482F4 56                      push esi
:004482F5 8B750C                  mov esi, dword ptr [ebp+0C]
:004482F8 8B7D08                  mov edi, dword ptr [ebp+08]
:004482FB 8B4D10                  mov ecx, dword ptr [ebp+10]
:004482FE 3BFE                    cmp edi, esi
:00448300 760C                    jbe 0044830E
:00448302 8BC6                    mov eax, esi
:00448304 03C1                    add eax, ecx
:00448306 3BF8                    cmp edi, eax
:00448308 0F828E000000            jb 0044839C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448300(C)
|
:0044830E F7C703000000            test edi, 00000003
:00448314 7552                    jne 00448368
:00448316 8BD1                    mov edx, ecx
:00448318 83E203                  and edx, 00000003
:0044831B C1E902                  shr ecx, 02
:0044831E F3                      repz
:0044831F A5                      movsd
:00448320 FF249528834400          jmp dword ptr [4*edx+00448328]
:00448327 90                      nop

:00448328 60834400                DWORD 00448360
:0044832C 5C834400                DWORD 0044835C
:00448330 4C834400                DWORD 0044834C
:00448334 38834400                DWORD 00448338


:00448338 668B06                  mov ax, word ptr [esi]
:0044833B 668907                  mov word ptr [edi], ax
:0044833E 8A4602                  mov al, byte ptr [esi+02]
:00448341 884702                  mov byte ptr [edi+02], al
:00448344 8B4508                  mov eax, dword ptr [ebp+08]
:00448347 5E                      pop esi
:00448348 5F                      pop edi
:00448349 C9                      leave
:0044834A C3                      ret


:0044834B 90                      nop
:0044834C 668B06                  mov ax, word ptr [esi]
:0044834F 668907                  mov word ptr [edi], ax
:00448352 8B4508                  mov eax, dword ptr [ebp+08]
:00448355 5E                      pop esi
:00448356 5F                      pop edi
:00448357 C9                      leave
:00448358 C3                      ret


:00448359 2E8BC0                  mov eax, eax
:0044835C 8A06                    mov al, byte ptr [esi]
:0044835E 8807                    mov byte ptr [edi], al
:00448360 8B4508                  mov eax, dword ptr [ebp+08]
:00448363 5E                      pop esi
:00448364 5F                      pop edi
:00448365 C9                      leave
:00448366 C3                      ret


:00448367 90                      nop

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448314(C)
|
:00448368 83F90C                  cmp ecx, 0000000C
:0044836B 7623                    jbe 00448390
:0044836D 8BD7                    mov edx, edi
:0044836F F7DA                    neg edx
:00448371 83E203                  and edx, 00000003
:00448374 2BCA                    sub ecx, edx
:00448376 8BC1                    mov eax, ecx
:00448378 8BCA                    mov ecx, edx
:0044837A F3                      repz
:0044837B A4                      movsb
:0044837C 8BC8                    mov ecx, eax
:0044837E 83E003                  and eax, 00000003
:00448381 C1E902                  shr ecx, 02
:00448384 F3                      repz
:00448385 A5                      movsd
:00448386 FF248528834400          jmp dword ptr [4*eax+00448328]
:0044838D 2E8BC0                  mov eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044836B(C)
|
:00448390 F3                      repz
:00448391 A4                      movsb
:00448392 8B4508                  mov eax, dword ptr [ebp+08]
:00448395 5E                      pop esi
:00448396 5F                      pop edi
:00448397 C9                      leave
:00448398 C3                      ret


:00448399 2E8BC0                  mov eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448308(C)
|
:0044839C FD                      std
:0044839D 03F1                    add esi, ecx
:0044839F 03F9                    add edi, ecx
:004483A1 F7C703000000            test edi, 00000003
:004483A7 755F                    jne 00448408
:004483A9 8BD1                    mov edx, ecx
:004483AB 83E203                  and edx, 00000003
:004483AE 83EE04                  sub esi, 00000004
:004483B1 83EF04                  sub edi, 00000004
:004483B4 C1E902                  shr ecx, 02
:004483B7 F3                      repz
:004483B8 A5                      movsd
:004483B9 FF2495C0834400          jmp dword ptr [4*edx+004483C0]

:004483C0 FE834400                DWORD 004483FE
:004483C4 F8834400                DWORD 004483F8
:004483C8 E8834400                DWORD 004483E8
:004483CC D0834400                DWORD 004483D0


:004483D0 668B4602                mov ax, word ptr [esi+02]
:004483D4 66894702                mov word ptr [edi+02], ax
:004483D8 8A4601                  mov al, byte ptr [esi+01]
:004483DB 884701                  mov byte ptr [edi+01], al
:004483DE FC                      cld
:004483DF 8B4508                  mov eax, dword ptr [ebp+08]
:004483E2 5E                      pop esi
:004483E3 5F                      pop edi
:004483E4 C9                      leave
:004483E5 C3                      ret


:004483E6 8BC0                    mov eax, eax
:004483E8 668B4602                mov ax, word ptr [esi+02]
:004483EC 66894702                mov word ptr [edi+02], ax
:004483F0 FC                      cld
:004483F1 8B4508                  mov eax, dword ptr [ebp+08]
:004483F4 5E                      pop esi
:004483F5 5F                      pop edi
:004483F6 C9                      leave
:004483F7 C3                      ret


:004483F8 8A4603                  mov al, byte ptr [esi+03]
:004483FB 884703                  mov byte ptr [edi+03], al
:004483FE FC                      cld
:004483FF 8B4508                  mov eax, dword ptr [ebp+08]
:00448402 5E                      pop esi
:00448403 5F                      pop edi
:00448404 C9                      leave
:00448405 C3                      ret


:00448406 8BC0                    mov eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004483A7(C)
|
:00448408 4E                      dec esi
:00448409 4F                      dec edi
:0044840A 83F90C                  cmp ecx, 0000000C
:0044840D 7625                    jbe 00448434
:0044840F F7DA                    neg edx
:00448411 83E203                  and edx, 00000003
:00448414 2BCA                    sub ecx, edx
:00448416 8BC1                    mov eax, ecx
:00448418 8BCA                    mov ecx, edx
:0044841A F3                      repz
:0044841B A4                      movsb
:0044841C 8BC8                    mov ecx, eax
:0044841E 83E003                  and eax, 00000003
:00448421 83EE03                  sub esi, 00000003
:00448424 83EF03                  sub edi, 00000003
:00448427 C1E902                  shr ecx, 02
:0044842A F3                      repz
:0044842B A5                      movsd
:0044842C FF2485C0834400          jmp dword ptr [4*eax+004483C0]
:00448433 90                      nop

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044840D(C)
|
:00448434 F3                      repz
:00448435 A4                      movsb
:00448436 FC                      cld
:00448437 8B4508                  mov eax, dword ptr [ebp+08]
:0044843A 5E                      pop esi
:0044843B 5F                      pop edi
:0044843C C9                      leave
:0044843D C3                      ret


:0044843E CC                      int 03
:0044843F CC                      int 03

* Referenced by a CALL at Addresses:
|:004234D2   , :0042FB90   
|
:00448440 51                      push ecx
:00448441 3D00100000              cmp eax, 00001000
:00448446 8D4C2408                lea ecx, dword ptr [esp+08]
:0044844A 7214                    jb 00448460

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044845E(C)
|
:0044844C 81E900100000            sub ecx, 00001000
:00448452 2D00100000              sub eax, 00001000
:00448457 8501                    test dword ptr [ecx], eax
:00448459 3D00100000              cmp eax, 00001000
:0044845E 73EC                    jnb 0044844C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044844A(C)
|
:00448460 2BC8                    sub ecx, eax
:00448462 8BC4                    mov eax, esp
:00448464 8501                    test dword ptr [ecx], eax
:00448466 8BE1                    mov esp, ecx
:00448468 8B08                    mov ecx, dword ptr [eax]
:0044846A 8B4004                  mov eax, dword ptr [eax+04]
:0044846D 50                      push eax
:0044846E C3                      ret


:0044846F CC                      int 03

//******************** Program Entry Point ********
:00448470 64A100000000            mov eax, dword ptr fs:[00000000]
:00448476 55                      push ebp
:00448477 8BEC                    mov ebp, esp
:00448479 6AFF                    push FFFFFFFF
:0044847B 6838C04400              push 0044C038
:00448480 68408A4400              push 00448A40
:00448485 50                      push eax
:00448486 64892500000000          mov dword ptr fs:[00000000], esp
:0044848D 83EC60                  sub esp, 00000060
:00448490 53                      push ebx
:00448491 56                      push esi
:00448492 57                      push edi
:00448493 8965E8                  mov dword ptr [ebp-18], esp

* Reference To: KERNEL32.GetVersion, Ord:0137h
                                  |
:00448496 FF15B8734700            Call dword ptr [004773B8]
:0044849C A3903B4500              mov dword ptr [00453B90], eax
:004484A1 33C0                    xor eax, eax
:004484A3 A0913B4500              mov al, byte ptr [00453B91]
:004484A8 A39C3B4500              mov dword ptr [00453B9C], eax
:004484AD A1903B4500              mov eax, dword ptr [00453B90]
:004484B2 C12D903B450010          shr dword ptr [00453B90], 10
:004484B9 25FF000000              and eax, 000000FF
:004484BE A3983B4500              mov dword ptr [00453B98], eax
:004484C3 C1E008                  shl eax, 08
:004484C6 03059C3B4500            add eax, dword ptr [00453B9C]
:004484CC A3943B4500              mov dword ptr [00453B94], eax
:004484D1 E89A1D0000              call 0044A270
:004484D6 C745FC00000000          mov [ebp-04], 00000000
:004484DD E8AE1B0000              call 0044A090
:004484E2 E8991B0000              call 0044A080

* Reference To: KERNEL32.GetCommandLineA, Ord:009Fh
                                  |
:004484E7 FF15B4734700            Call dword ptr [004773B4]
:004484ED A3BC6C4700              mov dword ptr [00476CBC], eax
:004484F2 E829170000              call 00449C20
:004484F7 A3703B4500              mov dword ptr [00453B70], eax
:004484FC 85C0                    test eax, eax
:004484FE 7409                    je 00448509
:00448500 833DBC6C470000          cmp dword ptr [00476CBC], 00000000
:00448507 750A                    jne 00448513

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004484FE(C)
|
:00448509 6AFF                    push FFFFFFFF
:0044850B E840030000              call 00448850
:00448510 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448507(C)
|
:00448513 E888140000              call 004499A0
:00448518 E8A3130000              call 004498C0
:0044851D E8FE020000              call 00448820
:00448522 8B35BC6C4700            mov esi, dword ptr [00476CBC]
:00448528 8A06                    mov al, byte ptr [esi]
:0044852A 3C22                    cmp al, 22
:0044852C 740C                    je 0044853A
:0044852E 3C20                    cmp al, 20
:00448530 7635                    jbe 00448567

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448536(C)
|
:00448532 46                      inc esi
:00448533 803E20                  cmp byte ptr [esi], 20
:00448536 77FA                    ja 00448532
:00448538 EB2D                    jmp 00448567

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044852C(C)
|
:0044853A 46                      inc esi
:0044853B 803E22                  cmp byte ptr [esi], 22
:0044853E 7426                    je 00448566
:00448540 8A5DD8                  mov bl, byte ptr [ebp-28]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044855F(C)
|
:00448543 8A1E                    mov bl, byte ptr [esi]
:00448545 84DB                    test bl, bl
:00448547 7418                    je 00448561
:00448549 33C0                    xor eax, eax
:0044854B 8AC3                    mov al, bl
:0044854D 50                      push eax
:0044854E E80D130000              call 00449860
:00448553 83C404                  add esp, 00000004
:00448556 85C0                    test eax, eax
:00448558 7401                    je 0044855B
:0044855A 46                      inc esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448558(C)
|
:0044855B 46                      inc esi
:0044855C 803E22                  cmp byte ptr [esi], 22
:0044855F 75E2                    jne 00448543

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448547(C)
|
:00448561 803E22                  cmp byte ptr [esi], 22
:00448564 7501                    jne 00448567

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044853E(C)
|
:00448566 46                      inc esi

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00448530(C), :00448538(U), :00448564(C)
|
:00448567 803E00                  cmp byte ptr [esi], 00
:0044856A 740B                    je 00448577

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448575(C)
|
:0044856C 803E20                  cmp byte ptr [esi], 20
:0044856F 7706                    ja 00448577
:00448571 46                      inc esi
:00448572 803E00                  cmp byte ptr [esi], 00
:00448575 75F5                    jne 0044856C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044856A(C), :0044856F(C)
|
:00448577 C745BC00000000          mov [ebp-44], 00000000
:0044857E 8D4590                  lea eax, dword ptr [ebp-70]
:00448581 50                      push eax

* Reference To: KERNEL32.GetStartupInfoA, Ord:0114h
                                  |
:00448582 FF15B0734700            Call dword ptr [004773B0]
:00448588 F645BC01                test [ebp-44], 01
:0044858C B80A000000              mov eax, 0000000A
:00448591 7408                    je 0044859B
:00448593 8B45C0                  mov eax, dword ptr [ebp-40]
:00448596 25FFFF0000              and eax, 0000FFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448591(C)
|
:0044859B 50                      push eax
:0044859C 56                      push esi
:0044859D 6A00                    push 00000000
:0044859F 6A00                    push 00000000

* Reference To: KERNEL32.GetModuleHandleA, Ord:00EBh
                                  |
:004485A1 FF1524734700            Call dword ptr [00477324]
:004485A7 50                      push eax
:004485A8 E82565FCFF              call 0040EAD2
:004485AD 50                      push eax
:004485AE E89D020000              call 00448850
:004485B3 EB27                    jmp 004485DC
:004485B5 8B45EC                  mov eax, dword ptr [ebp-14]
:004485B8 8B00                    mov eax, dword ptr [eax]
:004485BA 8B00                    mov eax, dword ptr [eax]
:004485BC 8945E0                  mov dword ptr [ebp-20], eax
:004485BF 8B45EC                  mov eax, dword ptr [ebp-14]
:004485C2 50                      push eax
:004485C3 8B45E0                  mov eax, dword ptr [ebp-20]
:004485C6 50                      push eax
:004485C7 E804110000              call 004496D0
:004485CC 83C408                  add esp, 00000008
:004485CF C3                      ret


:004485D0 8B65E8                  mov esp, dword ptr [ebp-18]
:004485D3 8B45E0                  mov eax, dword ptr [ebp-20]
:004485D6 50                      push eax
:004485D7 E894020000              call 00448870

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004485B3(U)
|
:004485DC 83C404                  add esp, 00000004
:004485DF C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:004485E6 8B45F0                  mov eax, dword ptr [ebp-10]
:004485E9 5F                      pop edi
:004485EA 64A300000000            mov dword ptr fs:[00000000], eax
:004485F0 5E                      pop esi
:004485F1 5B                      pop ebx
:004485F2 8BE5                    mov esp, ebp
:004485F4 5D                      pop ebp
:004485F5 C3                      ret


:004485F6 CC                      int 03
:004485F7 CC                      int 03
:004485F8 CC                      int 03
:004485F9 CC                      int 03
:004485FA CC                      int 03
:004485FB CC                      int 03
:004485FC CC                      int 03
:004485FD CC                      int 03
:004485FE CC                      int 03
:004485FF CC                      int 03

* Referenced by a CALL at Addresses:
|:00447D18   , :0044990B   , :00449949   , :00449A01   , :0044A0AC   
|:0044A873   , :0044B312   
|
:00448600 833D7C3B450001          cmp dword ptr [00453B7C], 00000001
:00448607 7505                    jne 0044860E
:00448609 E8821C0000              call 0044A290

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448607(C)
|
:0044860E 8B442404                mov eax, dword ptr [esp+04]
:00448612 50                      push eax
:00448613 E8B81C0000              call 0044A2D0
:00448618 83C404                  add esp, 00000004
:0044861B 68FF000000              push 000000FF
:00448620 FF15783B4500            call dword ptr [00453B78]
:00448626 83C404                  add esp, 00000004
:00448629 C3                      ret


:0044862A CC                      int 03
:0044862B CC                      int 03
:0044862C CC                      int 03
:0044862D CC                      int 03
:0044862E CC                      int 03
:0044862F CC                      int 03

* Referenced by a CALL at Addresses:
|:004447BF   , :00445DFA   , :00445EFD   , :00446F68   , :00446F8B   
|
:00448630 8B54240C                mov edx, dword ptr [esp+0C]
:00448634 8B4C2404                mov ecx, dword ptr [esp+04]
:00448638 85D2                    test edx, edx
:0044863A 7447                    je 00448683
:0044863C 33C0                    xor eax, eax
:0044863E 8A442408                mov al, byte ptr [esp+08]
:00448642 57                      push edi
:00448643 8BF9                    mov edi, ecx
:00448645 83FA04                  cmp edx, 00000004
:00448648 722D                    jb 00448677
:0044864A F7D9                    neg ecx
:0044864C 83E103                  and ecx, 00000003
:0044864F 7408                    je 00448659
:00448651 2BD1                    sub edx, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448657(C)
|
:00448653 8807                    mov byte ptr [edi], al
:00448655 47                      inc edi
:00448656 49                      dec ecx
:00448657 75FA                    jne 00448653

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044864F(C)
|
:00448659 8BC8                    mov ecx, eax
:0044865B C1E008                  shl eax, 08
:0044865E 03C1                    add eax, ecx
:00448660 8BC8                    mov ecx, eax
:00448662 C1E010                  shl eax, 10
:00448665 03C1                    add eax, ecx
:00448667 8BCA                    mov ecx, edx
:00448669 83E203                  and edx, 00000003
:0044866C C1E902                  shr ecx, 02
:0044866F 7406                    je 00448677
:00448671 F3                      repz
:00448672 AB                      stosd
:00448673 85D2                    test edx, edx
:00448675 7406                    je 0044867D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00448648(C), :0044866F(C), :0044867B(C)
|
:00448677 8807                    mov byte ptr [edi], al
:00448679 47                      inc edi
:0044867A 4A                      dec edx
:0044867B 75FA                    jne 00448677

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448675(C)
|
:0044867D 8B442408                mov eax, dword ptr [esp+08]
:00448681 5F                      pop edi
:00448682 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044863A(C)
|
:00448683 8B442404                mov eax, dword ptr [esp+04]
:00448687 C3                      ret


:00448688 CC                      int 03
:00448689 CC                      int 03
:0044868A CC                      int 03
:0044868B CC                      int 03
:0044868C CC                      int 03
:0044868D CC                      int 03
:0044868E CC                      int 03
:0044868F CC                      int 03

* Referenced by a CALL at Addresses:
|:00444ED5   , :00445EE3   , :00446FB6   , :00447101   
|
:00448690 55                      push ebp
:00448691 8BEC                    mov ebp, esp
:00448693 57                      push edi
:00448694 56                      push esi
:00448695 8B750C                  mov esi, dword ptr [ebp+0C]
:00448698 8B7D08                  mov edi, dword ptr [ebp+08]
:0044869B 8B4D10                  mov ecx, dword ptr [ebp+10]
:0044869E 3BFE                    cmp edi, esi
:004486A0 760C                    jbe 004486AE
:004486A2 8BC6                    mov eax, esi
:004486A4 03C1                    add eax, ecx
:004486A6 3BF8                    cmp edi, eax
:004486A8 0F828E000000            jb 0044873C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004486A0(C)
|
:004486AE F7C703000000            test edi, 00000003
:004486B4 7552                    jne 00448708
:004486B6 8BD1                    mov edx, ecx
:004486B8 83E203                  and edx, 00000003
:004486BB C1E902                  shr ecx, 02
:004486BE F3                      repz
:004486BF A5                      movsd
:004486C0 FF2495C8864400          jmp dword ptr [4*edx+004486C8]
:004486C7 90                      nop

:004486C8 00874400                DWORD 00448700
:004486CC FC864400                DWORD 004486FC
:004486D0 EC864400                DWORD 004486EC
:004486D4 D8864400                DWORD 004486D8


:004486D8 668B06                  mov ax, word ptr [esi]
:004486DB 668907                  mov word ptr [edi], ax
:004486DE 8A4602                  mov al, byte ptr [esi+02]
:004486E1 884702                  mov byte ptr [edi+02], al
:004486E4 8B4508                  mov eax, dword ptr [ebp+08]
:004486E7 5E                      pop esi
:004486E8 5F                      pop edi
:004486E9 C9                      leave
:004486EA C3                      ret


:004486EB 90                      nop
:004486EC 668B06                  mov ax, word ptr [esi]
:004486EF 668907                  mov word ptr [edi], ax
:004486F2 8B4508                  mov eax, dword ptr [ebp+08]
:004486F5 5E                      pop esi
:004486F6 5F                      pop edi
:004486F7 C9                      leave
:004486F8 C3                      ret


:004486F9 2E8BC0                  mov eax, eax
:004486FC 8A06                    mov al, byte ptr [esi]
:004486FE 8807                    mov byte ptr [edi], al
:00448700 8B4508                  mov eax, dword ptr [ebp+08]
:00448703 5E                      pop esi
:00448704 5F                      pop edi
:00448705 C9                      leave
:00448706 C3                      ret


:00448707 90                      nop

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004486B4(C)
|
:00448708 83F90C                  cmp ecx, 0000000C
:0044870B 7623                    jbe 00448730
:0044870D 8BD7                    mov edx, edi
:0044870F F7DA                    neg edx
:00448711 83E203                  and edx, 00000003
:00448714 2BCA                    sub ecx, edx
:00448716 8BC1                    mov eax, ecx
:00448718 8BCA                    mov ecx, edx
:0044871A F3                      repz
:0044871B A4                      movsb
:0044871C 8BC8                    mov ecx, eax
:0044871E 83E003                  and eax, 00000003
:00448721 C1E902                  shr ecx, 02
:00448724 F3                      repz
:00448725 A5                      movsd
:00448726 FF2485C8864400          jmp dword ptr [4*eax+004486C8]
:0044872D 2E8BC0                  mov eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044870B(C)
|
:00448730 F3                      repz
:00448731 A4                      movsb
:00448732 8B4508                  mov eax, dword ptr [ebp+08]
:00448735 5E                      pop esi
:00448736 5F                      pop edi
:00448737 C9                      leave
:00448738 C3                      ret


:00448739 2E8BC0                  mov eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004486A8(C)
|
:0044873C FD                      std
:0044873D 03F1                    add esi, ecx
:0044873F 03F9                    add edi, ecx
:00448741 F7C703000000            test edi, 00000003
:00448747 755F                    jne 004487A8
:00448749 8BD1                    mov edx, ecx
:0044874B 83E203                  and edx, 00000003
:0044874E 83EE04                  sub esi, 00000004
:00448751 83EF04                  sub edi, 00000004
:00448754 C1E902                  shr ecx, 02
:00448757 F3                      repz
:00448758 A5                      movsd
:00448759 FF249560874400          jmp dword ptr [4*edx+00448760]

:00448760 9E874400                DWORD 0044879E
:00448764 98874400                DWORD 00448798
:00448768 88874400                DWORD 00448788
:0044876C 70874400                DWORD 00448770


:00448770 668B4602                mov ax, word ptr [esi+02]
:00448774 66894702                mov word ptr [edi+02], ax
:00448778 8A4601                  mov al, byte ptr [esi+01]
:0044877B 884701                  mov byte ptr [edi+01], al
:0044877E FC                      cld
:0044877F 8B4508                  mov eax, dword ptr [ebp+08]
:00448782 5E                      pop esi
:00448783 5F                      pop edi
:00448784 C9                      leave
:00448785 C3                      ret


:00448786 8BC0                    mov eax, eax
:00448788 668B4602                mov ax, word ptr [esi+02]
:0044878C 66894702                mov word ptr [edi+02], ax
:00448790 FC                      cld
:00448791 8B4508                  mov eax, dword ptr [ebp+08]
:00448794 5E                      pop esi
:00448795 5F                      pop edi
:00448796 C9                      leave
:00448797 C3                      ret


:00448798 8A4603                  mov al, byte ptr [esi+03]
:0044879B 884703                  mov byte ptr [edi+03], al
:0044879E FC                      cld
:0044879F 8B4508                  mov eax, dword ptr [ebp+08]
:004487A2 5E                      pop esi
:004487A3 5F                      pop edi
:004487A4 C9                      leave
:004487A5 C3                      ret


:004487A6 8BC0                    mov eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448747(C)
|
:004487A8 4E                      dec esi
:004487A9 4F                      dec edi
:004487AA 83F90C                  cmp ecx, 0000000C
:004487AD 7625                    jbe 004487D4
:004487AF F7DA                    neg edx
:004487B1 83E203                  and edx, 00000003
:004487B4 2BCA                    sub ecx, edx
:004487B6 8BC1                    mov eax, ecx
:004487B8 8BCA                    mov ecx, edx
:004487BA F3                      repz
:004487BB A4                      movsb
:004487BC 8BC8                    mov ecx, eax
:004487BE 83E003                  and eax, 00000003
:004487C1 83EE03                  sub esi, 00000003
:004487C4 83EF03                  sub edi, 00000003
:004487C7 C1E902                  shr ecx, 02
:004487CA F3                      repz
:004487CB A5                      movsd
:004487CC FF248560874400          jmp dword ptr [4*eax+00448760]
:004487D3 90                      nop

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004487AD(C)
|
:004487D4 F3                      repz
:004487D5 A4                      movsb
:004487D6 FC                      cld
:004487D7 8B4508                  mov eax, dword ptr [ebp+08]
:004487DA 5E                      pop esi
:004487DB 5F                      pop edi
:004487DC C9                      leave
:004487DD C3                      ret


:004487DE CC                      int 03
:004487DF CC                      int 03

* Referenced by a CALL at Addresses:
|:004479BF   , :00447A16   
|
:004487E0 A17C534700              mov eax, dword ptr [0047537C]
:004487E5 8B4C2404                mov ecx, dword ptr [esp+04]
:004487E9 890D7C534700            mov dword ptr [0047537C], ecx
:004487EF C3                      ret



* Referenced by a CALL at Addresses:
|:00448988   , :00448A0F   , :0044ADEC   
|
:004487F0 8B0D7C534700            mov ecx, dword ptr [0047537C]
:004487F6 85C9                    test ecx, ecx
:004487F8 7414                    je 0044880E
:004487FA 8B442404                mov eax, dword ptr [esp+04]
:004487FE 50                      push eax
:004487FF FFD1                    call ecx
:00448801 83C404                  add esp, 00000004
:00448804 85C0                    test eax, eax
:00448806 7406                    je 0044880E
:00448808 B801000000              mov eax, 00000001
:0044880D C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004487F8(C), :00448806(C)
|
:0044880E 33C0                    xor eax, eax
:00448810 C3                      ret


:00448811 CC                      int 03
:00448812 CC                      int 03
:00448813 CC                      int 03
:00448814 CC                      int 03
:00448815 CC                      int 03
:00448816 CC                      int 03
:00448817 CC                      int 03
:00448818 CC                      int 03
:00448819 CC                      int 03
:0044881A CC                      int 03
:0044881B CC                      int 03
:0044881C CC                      int 03
:0044881D CC                      int 03
:0044881E CC                      int 03
:0044881F CC                      int 03

* Referenced by a CALL at Address:
|:0044851D   
|
:00448820 A1B46C4700              mov eax, dword ptr [00476CB4]
:00448825 85C0                    test eax, eax
:00448827 7402                    je 0044882B
:00448829 FFD0                    call eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448827(C)
|
:0044882B 68ECD04400              push 0044D0EC
:00448830 68E0D04400              push 0044D0E0
:00448835 E8D6000000              call 00448910
:0044883A 83C408                  add esp, 00000008
:0044883D 68DCD04400              push 0044D0DC
:00448842 6800D04400              push 0044D000
:00448847 E8C4000000              call 00448910
:0044884C 83C408                  add esp, 00000008
:0044884F C3                      ret



* Referenced by a CALL at Addresses:
|:0044850B   , :004485AE   
|
:00448850 8B442404                mov eax, dword ptr [esp+04]
:00448854 6A00                    push 00000000
:00448856 6A00                    push 00000000
:00448858 50                      push eax
:00448859 E832000000              call 00448890
:0044885E 83C40C                  add esp, 0000000C
:00448861 C3                      ret


:00448862 CC                      int 03
:00448863 CC                      int 03
:00448864 CC                      int 03
:00448865 CC                      int 03
:00448866 CC                      int 03
:00448867 CC                      int 03
:00448868 CC                      int 03
:00448869 CC                      int 03
:0044886A CC                      int 03
:0044886B CC                      int 03
:0044886C CC                      int 03
:0044886D CC                      int 03
:0044886E CC                      int 03
:0044886F CC                      int 03

* Referenced by a CALL at Addresses:
|:004485D7   , :0044A4F6   , :0044A987   
|
:00448870 8B442404                mov eax, dword ptr [esp+04]
:00448874 6A00                    push 00000000
:00448876 6A01                    push 00000001
:00448878 50                      push eax
:00448879 E812000000              call 00448890
:0044887E 83C40C                  add esp, 0000000C
:00448881 C3                      ret


:00448882 CC                      int 03
:00448883 CC                      int 03
:00448884 CC                      int 03
:00448885 CC                      int 03
:00448886 CC                      int 03
:00448887 CC                      int 03
:00448888 CC                      int 03
:00448889 CC                      int 03
:0044888A CC                      int 03
:0044888B CC                      int 03
:0044888C CC                      int 03
:0044888D CC                      int 03
:0044888E CC                      int 03
:0044888F CC                      int 03

* Referenced by a CALL at Addresses:
|:00448859   , :00448879   
|
:00448890 C705C83B450001000000    mov dword ptr [00453BC8], 00000001
:0044889A 837C240800              cmp dword ptr [esp+08], 00000000
:0044889F 53                      push ebx
:004488A0 56                      push esi
:004488A1 8B5C2414                mov ebx, dword ptr [esp+14]
:004488A5 881DC43B4500            mov byte ptr [00453BC4], bl
:004488AB 753F                    jne 004488EC
:004488AD 833DB86C470000          cmp dword ptr [00476CB8], 00000000
:004488B4 7424                    je 004488DA
:004488B6 8B35B06C4700            mov esi, dword ptr [00476CB0]
:004488BC 83EE04                  sub esi, 00000004
:004488BF 3B35B86C4700            cmp esi, dword ptr [00476CB8]
:004488C5 7213                    jb 004488DA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004488D8(C)
|
:004488C7 8B06                    mov eax, dword ptr [esi]
:004488C9 85C0                    test eax, eax
:004488CB 7402                    je 004488CF
:004488CD FFD0                    call eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004488CB(C)
|
:004488CF 83EE04                  sub esi, 00000004
:004488D2 3B35B86C4700            cmp esi, dword ptr [00476CB8]
:004488D8 73ED                    jnb 004488C7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004488B4(C), :004488C5(C)
|
:004488DA 68F8D04400              push 0044D0F8
:004488DF 68F0D04400              push 0044D0F0
:004488E4 E827000000              call 00448910
:004488E9 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004488AB(C)
|
:004488EC 6800D14400              push 0044D100
:004488F1 68FCD04400              push 0044D0FC
:004488F6 E815000000              call 00448910
:004488FB 83C408                  add esp, 00000008
:004488FE 85DB                    test ebx, ebx
:00448900 750B                    jne 0044890D
:00448902 8B44240C                mov eax, dword ptr [esp+0C]
:00448906 50                      push eax

* Reference To: KERNEL32.ExitProcess, Ord:0062h
                                  |
:00448907 FF1584734700            Call dword ptr [00477384]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448900(C)
|
:0044890D 5E                      pop esi
:0044890E 5B                      pop ebx
:0044890F C3                      ret



* Referenced by a CALL at Addresses:
|:00448835   , :00448847   , :004488E4   , :004488F6   
|
:00448910 56                      push esi
:00448911 57                      push edi
:00448912 8B742410                mov esi, dword ptr [esp+10]
:00448916 8B7C240C                mov edi, dword ptr [esp+0C]
:0044891A 3BF7                    cmp esi, edi
:0044891C 760F                    jbe 0044892D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044892B(C)
|
:0044891E 8B07                    mov eax, dword ptr [edi]
:00448920 85C0                    test eax, eax
:00448922 7402                    je 00448926
:00448924 FFD0                    call eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448922(C)
|
:00448926 83C704                  add edi, 00000004
:00448929 3BF7                    cmp esi, edi
:0044892B 77F1                    ja 0044891E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044891C(C)
|
:0044892D 5F                      pop edi
:0044892E 5E                      pop esi
:0044892F C3                      ret



* Referenced by a CALL at Address:
|:00447C9A   
|
:00448930 53                      push ebx
:00448931 56                      push esi
:00448932 8B74240C                mov esi, dword ptr [esp+0C]
:00448936 57                      push edi
:00448937 8B7C2414                mov edi, dword ptr [esp+14]
:0044893B 85F6                    test esi, esi
:0044893D 750D                    jne 0044894C
:0044893F 57                      push edi
:00448940 E87B000000              call 004489C0
:00448945 83C404                  add esp, 00000004
:00448948 5F                      pop edi
:00448949 5E                      pop esi
:0044894A 5B                      pop ebx
:0044894B C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044893D(C)
|
:0044894C 85FF                    test edi, edi
:0044894E 750F                    jne 0044895F
:00448950 56                      push esi
:00448951 E86A1B0000              call 0044A4C0
:00448956 83C404                  add esp, 00000004
:00448959 33C0                    xor eax, eax
:0044895B 5F                      pop edi
:0044895C 5E                      pop esi
:0044895D 5B                      pop ebx
:0044895E C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044894E(C)
|

* Reference To: KERNEL32.HeapReAlloc, Ord:015Ch
                                  |
:0044895F 8B1D9C734700            mov ebx, dword ptr [0047739C]
:00448965 A1A06B4700              mov eax, dword ptr [00476BA0]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448997(C)
|
:0044896A 83FFE0                  cmp edi, FFFFFFE0
:0044896D 7604                    jbe 00448973
:0044896F 33C0                    xor eax, eax
:00448971 EB07                    jmp 0044897A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044896D(C)
|
:00448973 57                      push edi
:00448974 56                      push esi
:00448975 6A00                    push 00000000
:00448977 50                      push eax
:00448978 FFD3                    call ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448971(U)
|
:0044897A 85C0                    test eax, eax
:0044897C 751D                    jne 0044899B
:0044897E 833D3442450000          cmp dword ptr [00454234], 00000000
:00448985 7414                    je 0044899B
:00448987 57                      push edi
:00448988 E863FEFFFF              call 004487F0
:0044898D 83C404                  add esp, 00000004
:00448990 85C0                    test eax, eax
:00448992 A1A06B4700              mov eax, dword ptr [00476BA0]
:00448997 75D1                    jne 0044896A
:00448999 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044897C(C), :00448985(C)
|
:0044899B 5F                      pop edi
:0044899C 5E                      pop esi
:0044899D 5B                      pop ebx
:0044899E C3                      ret


:0044899F CC                      int 03

* Referenced by a CALL at Addresses:
|:00447C66   , :00447C87   
|
:004489A0 8B442404                mov eax, dword ptr [esp+04]
:004489A4 8B0DA06B4700            mov ecx, dword ptr [00476BA0]
:004489AA 50                      push eax
:004489AB 6A00                    push 00000000
:004489AD 51                      push ecx

* Reference To: KERNEL32.HeapSize, Ord:015Dh
                                  |
:004489AE FF15C0734700            Call dword ptr [004773C0]
:004489B4 C3                      ret


:004489B5 CC                      int 03
:004489B6 CC                      int 03
:004489B7 CC                      int 03
:004489B8 CC                      int 03
:004489B9 CC                      int 03
:004489BA CC                      int 03
:004489BB CC                      int 03
:004489BC CC                      int 03
:004489BD CC                      int 03
:004489BE CC                      int 03
:004489BF CC                      int 03

* Referenced by a CALL at Addresses:
|:00447D05   , :00448940   , :004498F6   , :00449939   , :004499F1   
|:00449CDC   , :00449D69   , :0044A09C   , :0044A140   
|
:004489C0 A134424500              mov eax, dword ptr [00454234]
:004489C5 8B4C2404                mov ecx, dword ptr [esp+04]
:004489C9 50                      push eax
:004489CA 51                      push ecx
:004489CB E810000000              call 004489E0
:004489D0 83C408                  add esp, 00000008
:004489D3 C3                      ret


:004489D4 CC                      int 03
:004489D5 CC                      int 03
:004489D6 CC                      int 03
:004489D7 CC                      int 03
:004489D8 CC                      int 03
:004489D9 CC                      int 03
:004489DA CC                      int 03
:004489DB CC                      int 03
:004489DC CC                      int 03
:004489DD CC                      int 03
:004489DE CC                      int 03
:004489DF CC                      int 03

* Referenced by a CALL at Address:
|:004489CB   
|
:004489E0 56                      push esi
:004489E1 57                      push edi
:004489E2 8B74240C                mov esi, dword ptr [esp+0C]
:004489E6 83FEE0                  cmp esi, FFFFFFE0
:004489E9 7605                    jbe 004489F0
:004489EB 33C0                    xor eax, eax
:004489ED 5F                      pop edi
:004489EE 5E                      pop esi
:004489EF C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004489E9(C)
|
:004489F0 85F6                    test esi, esi
:004489F2 7505                    jne 004489F9
:004489F4 BE01000000              mov esi, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004489F2(C)
|
:004489F9 8B7C2410                mov edi, dword ptr [esp+10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448A19(C)
|
:004489FD 56                      push esi
:004489FE E81D000000              call 00448A20
:00448A03 83C404                  add esp, 00000004
:00448A06 85C0                    test eax, eax
:00448A08 7513                    jne 00448A1D
:00448A0A 85FF                    test edi, edi
:00448A0C 740F                    je 00448A1D
:00448A0E 56                      push esi
:00448A0F E8DCFDFFFF              call 004487F0
:00448A14 83C404                  add esp, 00000004
:00448A17 85C0                    test eax, eax
:00448A19 75E2                    jne 004489FD
:00448A1B 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00448A08(C), :00448A0C(C)
|
:00448A1D 5F                      pop edi
:00448A1E 5E                      pop esi
:00448A1F C3                      ret



* Referenced by a CALL at Address:
|:004489FE   
|
:00448A20 8B442404                mov eax, dword ptr [esp+04]
:00448A24 8B0DA06B4700            mov ecx, dword ptr [00476BA0]
:00448A2A 50                      push eax
:00448A2B 6A00                    push 00000000
:00448A2D 51                      push ecx

* Reference To: KERNEL32.HeapAlloc, Ord:0153h
                                  |
:00448A2E FF15C4734700            Call dword ptr [004773C4]
:00448A34 C3                      ret


:00448A35 CC                      int 03
:00448A36 CC                      int 03
:00448A37 CC                      int 03
:00448A38 56                      push esi
:00448A39 43                      inc ebx
:00448A3A 3230                    xor dh, byte ptr [eax]
:00448A3C 58                      pop eax
:00448A3D 43                      inc ebx
:00448A3E 3030                    xor byte ptr [eax], dh
:00448A40 55                      push ebp
:00448A41 8BEC                    mov ebp, esp
:00448A43 83EC08                  sub esp, 00000008
:00448A46 53                      push ebx
:00448A47 56                      push esi
:00448A48 57                      push edi
:00448A49 55                      push ebp
:00448A4A FC                      cld
:00448A4B 8B5D0C                  mov ebx, dword ptr [ebp+0C]
:00448A4E 8B4508                  mov eax, dword ptr [ebp+08]
:00448A51 F7400406000000          test [eax+04], 00000006
:00448A58 0F8582000000            jne 00448AE0
:00448A5E 8945F8                  mov dword ptr [ebp-08], eax
:00448A61 8B4510                  mov eax, dword ptr [ebp+10]
:00448A64 8945FC                  mov dword ptr [ebp-04], eax
:00448A67 8D45F8                  lea eax, dword ptr [ebp-08]
:00448A6A 8943FC                  mov dword ptr [ebx-04], eax
:00448A6D 8B730C                  mov esi, dword ptr [ebx+0C]
:00448A70 8B7B08                  mov edi, dword ptr [ebx+08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448AD0(U)
|
:00448A73 83FEFF                  cmp esi, FFFFFFFF
:00448A76 7461                    je 00448AD9
:00448A78 8D0C76                  lea ecx, dword ptr [esi+2*esi]
:00448A7B 837C8F0400              cmp dword ptr [edi+4*ecx+04], 00000000
:00448A80 7445                    je 00448AC7
:00448A82 56                      push esi
:00448A83 55                      push ebp
:00448A84 8D6B10                  lea ebp, dword ptr [ebx+10]
:00448A87 FF548F04                call [edi+4*ecx+04]
:00448A8B 5D                      pop ebp
:00448A8C 5E                      pop esi
:00448A8D 8B5D0C                  mov ebx, dword ptr [ebp+0C]
:00448A90 0BC0                    or eax, eax
:00448A92 7433                    je 00448AC7
:00448A94 783C                    js 00448AD2
:00448A96 8B7B08                  mov edi, dword ptr [ebx+08]
:00448A99 53                      push ebx
:00448A9A E859F4FFFF              call 00447EF8
:00448A9F 83C404                  add esp, 00000004
:00448AA2 8D6B10                  lea ebp, dword ptr [ebx+10]
:00448AA5 56                      push esi
:00448AA6 53                      push ebx
:00448AA7 E88EF4FFFF              call 00447F3A
:00448AAC 83C408                  add esp, 00000008
:00448AAF 8D0C76                  lea ecx, dword ptr [esi+2*esi]
:00448AB2 6A01                    push 00000001
:00448AB4 8B448F08                mov eax, dword ptr [edi+4*ecx+08]
:00448AB8 E811F5FFFF              call 00447FCE
:00448ABD 8B048F                  mov eax, dword ptr [edi+4*ecx]
:00448AC0 89430C                  mov dword ptr [ebx+0C], eax
:00448AC3 FF548F08                call [edi+4*ecx+08]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00448A80(C), :00448A92(C)
|
:00448AC7 8B7B08                  mov edi, dword ptr [ebx+08]
:00448ACA 8D0C76                  lea ecx, dword ptr [esi+2*esi]
:00448ACD 8B348F                  mov esi, dword ptr [edi+4*ecx]
:00448AD0 EBA1                    jmp 00448A73

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448A94(C)
|
:00448AD2 B800000000              mov eax, 00000000
:00448AD7 EB1C                    jmp 00448AF5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448A76(C)
|
:00448AD9 B801000000              mov eax, 00000001
:00448ADE EB15                    jmp 00448AF5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448A58(C)
|
:00448AE0 55                      push ebp
:00448AE1 8D6B10                  lea ebp, dword ptr [ebx+10]
:00448AE4 6AFF                    push FFFFFFFF
:00448AE6 53                      push ebx
:00448AE7 E84EF4FFFF              call 00447F3A
:00448AEC 83C408                  add esp, 00000008
:00448AEF 5D                      pop ebp
:00448AF0 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00448AD7(U), :00448ADE(U)
|
:00448AF5 5D                      pop ebp
:00448AF6 5F                      pop edi
:00448AF7 5E                      pop esi
:00448AF8 5B                      pop ebx
:00448AF9 8BE5                    mov esp, ebp
:00448AFB 5D                      pop ebp
:00448AFC C3                      ret


:00448AFD 55                      push ebp
:00448AFE 8B4C2408                mov ecx, dword ptr [esp+08]
:00448B02 8B29                    mov ebp, dword ptr [ecx]
:00448B04 8B411C                  mov eax, dword ptr [ecx+1C]
:00448B07 50                      push eax
:00448B08 8B4118                  mov eax, dword ptr [ecx+18]
:00448B0B 50                      push eax
:00448B0C E829F4FFFF              call 00447F3A
:00448B11 83C408                  add esp, 00000008
:00448B14 5D                      pop ebp
:00448B15 C20400                  ret 0004


:00448B18 CC                      int 03
:00448B19 CC                      int 03
:00448B1A CC                      int 03
:00448B1B CC                      int 03
:00448B1C CC                      int 03
:00448B1D CC                      int 03
:00448B1E CC                      int 03
:00448B1F CC                      int 03

* Referenced by a CALL at Addresses:
|:00447EEE   , :00448F66   , :004491DE   , :004495B2   , :00449625   
|:0044A54E   
|

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448C0D(U)
|
:00448B20 64A100000000            mov eax, dword ptr fs:[00000000]
:00448B26 55                      push ebp
:00448B27 8BEC                    mov ebp, esp
:00448B29 6AFF                    push FFFFFFFF
:00448B2B 6848C04400              push 0044C048
:00448B30 68408A4400              push 00448A40
:00448B35 50                      push eax
:00448B36 64892500000000          mov dword ptr fs:[00000000], esp
:00448B3D 83EC08                  sub esp, 00000008
:00448B40 53                      push ebx
:00448B41 56                      push esi
:00448B42 57                      push edi
:00448B43 8965E8                  mov dword ptr [ebp-18], esp
:00448B46 C745FC00000000          mov [ebp-04], 00000000
:00448B4D A1D03B4500              mov eax, dword ptr [00453BD0]
:00448B52 85C0                    test eax, eax
:00448B54 742B                    je 00448B81
:00448B56 C745FC01000000          mov [ebp-04], 00000001
:00448B5D FFD0                    call eax
:00448B5F EB19                    jmp 00448B7A
:00448B61 B801000000              mov eax, 00000001
:00448B66 C3                      ret


:00448B67 8B45F0                  mov eax, dword ptr [ebp-10]
:00448B6A 5F                      pop edi
:00448B6B 64A300000000            mov dword ptr fs:[00000000], eax
:00448B71 5E                      pop esi
:00448B72 5B                      pop ebx
:00448B73 8BE5                    mov esp, ebp
:00448B75 5D                      pop ebp
:00448B76 C3                      ret


:00448B77 8B65E8                  mov esp, dword ptr [ebp-18]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448B5F(U)
|
:00448B7A C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448B54(C)
|
:00448B81 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00448B88 68678B4400              push 00448B67
:00448B8D E94E190000              jmp 0044A4E0
:00448B92 C3                      ret


:00448B93 CC                      int 03
:00448B94 CC                      int 03
:00448B95 CC                      int 03
:00448B96 CC                      int 03
:00448B97 CC                      int 03
:00448B98 CC                      int 03
:00448B99 CC                      int 03
:00448B9A CC                      int 03
:00448B9B CC                      int 03
:00448B9C CC                      int 03
:00448B9D CC                      int 03
:00448B9E CC                      int 03
:00448B9F CC                      int 03

* Referenced by a CALL at Addresses:
|:00448C2D   , :00448D00   , :00448D55   , :00448D7B   , :004490A0   
|:004490E6   , :0044914A   , :004491B1   , :004495A2   
|
:00448BA0 64A100000000            mov eax, dword ptr fs:[00000000]
:00448BA6 55                      push ebp
:00448BA7 8BEC                    mov ebp, esp
:00448BA9 6AFF                    push FFFFFFFF
:00448BAB 6860C04400              push 0044C060
:00448BB0 68408A4400              push 00448A40
:00448BB5 50                      push eax
:00448BB6 64892500000000          mov dword ptr fs:[00000000], esp
:00448BBD 83EC08                  sub esp, 00000008
:00448BC0 53                      push ebx
:00448BC1 56                      push esi
:00448BC2 57                      push edi
:00448BC3 8965E8                  mov dword ptr [ebp-18], esp
:00448BC6 C745FC00000000          mov [ebp-04], 00000000
:00448BCD A1D83B4500              mov eax, dword ptr [00453BD8]
:00448BD2 85C0                    test eax, eax
:00448BD4 742B                    je 00448C01
:00448BD6 C745FC01000000          mov [ebp-04], 00000001
:00448BDD FFD0                    call eax
:00448BDF EB19                    jmp 00448BFA
:00448BE1 B801000000              mov eax, 00000001
:00448BE6 C3                      ret


:00448BE7 8B45F0                  mov eax, dword ptr [ebp-10]
:00448BEA 5F                      pop edi
:00448BEB 64A300000000            mov dword ptr fs:[00000000], eax
:00448BF1 5E                      pop esi
:00448BF2 5B                      pop ebx
:00448BF3 8BE5                    mov esp, ebp
:00448BF5 5D                      pop ebp
:00448BF6 C3                      ret


:00448BF7 8B65E8                  mov esp, dword ptr [ebp-18]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448BDF(U)
|
:00448BFA C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448BD4(C)
|
:00448C01 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00448C08 68E78B4400              push 00448BE7
:00448C0D E90EFFFFFF              jmp 00448B20
:00448C12 C3                      ret


:00448C13 CC                      int 03
:00448C14 CC                      int 03
:00448C15 CC                      int 03
:00448C16 CC                      int 03
:00448C17 CC                      int 03
:00448C18 CC                      int 03
:00448C19 CC                      int 03
:00448C1A CC                      int 03
:00448C1B CC                      int 03
:00448C1C CC                      int 03
:00448C1D CC                      int 03
:00448C1E CC                      int 03
:00448C1F CC                      int 03

* Referenced by a CALL at Addresses:
|:004480E7   , :00448190   , :004482BE   
|
:00448C20 56                      push esi
:00448C21 8B742418                mov esi, dword ptr [esp+18]
:00448C25 813E20059319            cmp dword ptr [esi], 19930520
:00448C2B 7405                    je 00448C32
:00448C2D E86EFFFFFF              call 00448BA0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448C2B(C)
|
:00448C32 8B4C2408                mov ecx, dword ptr [esp+08]
:00448C36 F6410466                test [ecx+04], 66
:00448C3A 7429                    je 00448C65
:00448C3C 837E0400                cmp dword ptr [esi+04], 00000000
:00448C40 741C                    je 00448C5E
:00448C42 837C241C00              cmp dword ptr [esp+1C], 00000000
:00448C47 7515                    jne 00448C5E
:00448C49 8B442414                mov eax, dword ptr [esp+14]
:00448C4D 6AFF                    push FFFFFFFF
:00448C4F 8B4C2410                mov ecx, dword ptr [esp+10]
:00448C53 56                      push esi
:00448C54 50                      push eax
:00448C55 51                      push ecx
:00448C56 E8A5040000              call 00449100
:00448C5B 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00448C40(C), :00448C47(C)
|
:00448C5E B801000000              mov eax, 00000001
:00448C63 5E                      pop esi
:00448C64 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448C3A(C)
|
:00448C65 837E0C00                cmp dword ptr [esi+0C], 00000000
:00448C69 746A                    je 00448CD5
:00448C6B 813963736DE0            cmp dword ptr [ecx], E06D7363
:00448C71 753A                    jne 00448CAD
:00448C73 81791420059319          cmp dword ptr [ecx+14], 19930520
:00448C7A 7631                    jbe 00448CAD
:00448C7C 8B411C                  mov eax, dword ptr [ecx+1C]
:00448C7F 8B5008                  mov edx, dword ptr [eax+08]
:00448C82 85D2                    test edx, edx
:00448C84 7427                    je 00448CAD
:00448C86 8B442424                mov eax, dword ptr [esp+24]
:00448C8A 50                      push eax
:00448C8B 8B442424                mov eax, dword ptr [esp+24]
:00448C8F 50                      push eax
:00448C90 8B442424                mov eax, dword ptr [esp+24]
:00448C94 50                      push eax
:00448C95 56                      push esi
:00448C96 8B742424                mov esi, dword ptr [esp+24]
:00448C9A 8B442420                mov eax, dword ptr [esp+20]
:00448C9E 56                      push esi
:00448C9F 50                      push eax
:00448CA0 8B742424                mov esi, dword ptr [esp+24]
:00448CA4 56                      push esi
:00448CA5 51                      push ecx
:00448CA6 FFD2                    call edx
:00448CA8 83C420                  add esp, 00000020
:00448CAB 5E                      pop esi
:00448CAC C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00448C71(C), :00448C7A(C), :00448C84(C)
|
:00448CAD 8B442420                mov eax, dword ptr [esp+20]
:00448CB1 8B54241C                mov edx, dword ptr [esp+1C]
:00448CB5 50                      push eax
:00448CB6 52                      push edx
:00448CB7 8B44242C                mov eax, dword ptr [esp+2C]
:00448CBB 8B542418                mov edx, dword ptr [esp+18]
:00448CBF 50                      push eax
:00448CC0 56                      push esi
:00448CC1 8B742424                mov esi, dword ptr [esp+24]
:00448CC5 8B44241C                mov eax, dword ptr [esp+1C]
:00448CC9 56                      push esi
:00448CCA 52                      push edx
:00448CCB 50                      push eax
:00448CCC 51                      push ecx
:00448CCD E80E000000              call 00448CE0
:00448CD2 83C420                  add esp, 00000020

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448C69(C)
|
:00448CD5 B801000000              mov eax, 00000001
:00448CDA 5E                      pop esi
:00448CDB C3                      ret


:00448CDC CC                      int 03
:00448CDD CC                      int 03
:00448CDE CC                      int 03
:00448CDF CC                      int 03

* Referenced by a CALL at Address:
|:00448CCD   
|
:00448CE0 8B442408                mov eax, dword ptr [esp+08]
:00448CE4 83EC18                  sub esp, 00000018
:00448CE7 53                      push ebx
:00448CE8 8B4808                  mov ecx, dword ptr [eax+08]
:00448CEB 894C2408                mov dword ptr [esp+08], ecx
:00448CEF 56                      push esi
:00448CF0 57                      push edi
:00448CF1 83F9FF                  cmp ecx, FFFFFFFF
:00448CF4 55                      push ebp
:00448CF5 7C09                    jl 00448D00
:00448CF7 8B44243C                mov eax, dword ptr [esp+3C]
:00448CFB 394804                  cmp dword ptr [eax+04], ecx
:00448CFE 7F05                    jg 00448D05

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448CF5(C)
|
:00448D00 E89BFEFFFF              call 00448BA0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448CFE(C)
|
:00448D05 8B44242C                mov eax, dword ptr [esp+2C]
:00448D09 813863736DE0            cmp dword ptr [eax], E06D7363
:00448D0F 756F                    jne 00448D80
:00448D11 83781003                cmp dword ptr [eax+10], 00000003
:00448D15 7569                    jne 00448D80
:00448D17 81781420059319          cmp dword ptr [eax+14], 19930520
:00448D1E 7560                    jne 00448D80
:00448D20 83781C00                cmp dword ptr [eax+1C], 00000000
:00448D24 755A                    jne 00448D80
:00448D26 833DE03B450000          cmp dword ptr [00453BE0], 00000000
:00448D2D 0F8438020000            je 00448F6B
:00448D33 A1E03B4500              mov eax, dword ptr [00453BE0]
:00448D38 8B0DE43B4500            mov ecx, dword ptr [00453BE4]
:00448D3E 8944242C                mov dword ptr [esp+2C], eax
:00448D42 6A01                    push 00000001
:00448D44 894C2438                mov dword ptr [esp+38], ecx
:00448D48 50                      push eax
:00448D49 E852180000              call 0044A5A0
:00448D4E 83C408                  add esp, 00000008
:00448D51 85C0                    test eax, eax
:00448D53 7505                    jne 00448D5A
:00448D55 E846FEFFFF              call 00448BA0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448D53(C)
|
:00448D5A 8B44242C                mov eax, dword ptr [esp+2C]
:00448D5E 813863736DE0            cmp dword ptr [eax], E06D7363
:00448D64 751A                    jne 00448D80
:00448D66 83781003                cmp dword ptr [eax+10], 00000003
:00448D6A 7514                    jne 00448D80
:00448D6C 81781420059319          cmp dword ptr [eax+14], 19930520
:00448D73 750B                    jne 00448D80
:00448D75 83781C00                cmp dword ptr [eax+1C], 00000000
:00448D79 7505                    jne 00448D80
:00448D7B E820FEFFFF              call 00448BA0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00448D0F(C), :00448D15(C), :00448D1E(C), :00448D24(C), :00448D64(C)
|:00448D6A(C), :00448D73(C), :00448D79(C)
|
:00448D80 8B44242C                mov eax, dword ptr [esp+2C]
:00448D84 813863736DE0            cmp dword ptr [eax], E06D7363
:00448D8A 0F8597010000            jne 00448F27
:00448D90 83781003                cmp dword ptr [eax+10], 00000003
:00448D94 0F858D010000            jne 00448F27
:00448D9A 81781420059319          cmp dword ptr [eax+14], 19930520
:00448DA1 0F8580010000            jne 00448F27
:00448DA7 8D442420                lea eax, dword ptr [esp+20]
:00448DAB 8D4C241C                lea ecx, dword ptr [esp+1C]
:00448DAF 8B542414                mov edx, dword ptr [esp+14]
:00448DB3 50                      push eax
:00448DB4 8B442448                mov eax, dword ptr [esp+48]
:00448DB8 51                      push ecx
:00448DB9 8B4C2444                mov ecx, dword ptr [esp+44]
:00448DBD 52                      push edx
:00448DBE 50                      push eax
:00448DBF 51                      push ecx
:00448DC0 E89B020000              call 00449060
:00448DC5 8B4C2430                mov ecx, dword ptr [esp+30]
:00448DC9 89442424                mov dword ptr [esp+24], eax
:00448DCD 83C414                  add esp, 00000014
:00448DD0 394C2420                cmp dword ptr [esp+20], ecx
:00448DD4 0F862F010000            jbe 00448F09

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448F03(C)
|
:00448DDA 8B4C2414                mov ecx, dword ptr [esp+14]
:00448DDE 8B442410                mov eax, dword ptr [esp+10]
:00448DE2 3908                    cmp dword ptr [eax], ecx
:00448DE4 0F8F08010000            jg 00448EF2
:00448DEA 394804                  cmp dword ptr [eax+04], ecx
:00448DED 0F8CFF000000            jl 00448EF2
:00448DF3 8B4810                  mov ecx, dword ptr [eax+10]
:00448DF6 8B500C                  mov edx, dword ptr [eax+0C]
:00448DF9 89542418                mov dword ptr [esp+18], edx
:00448DFD 85D2                    test edx, edx
:00448DFF 0F84ED000000            je 00448EF2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448EB5(C)
|
:00448E05 8B44242C                mov eax, dword ptr [esp+2C]
:00448E09 8B501C                  mov edx, dword ptr [eax+1C]
:00448E0C 8B420C                  mov eax, dword ptr [edx+0C]
:00448E0F 8D6804                  lea ebp, dword ptr [eax+04]
:00448E12 8B10                    mov edx, dword ptr [eax]
:00448E14 85D2                    test edx, edx
:00448E16 0F848D000000            je 00448EA9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448EA3(C)
|
:00448E1C 8B44242C                mov eax, dword ptr [esp+2C]
:00448E20 8B7104                  mov esi, dword ptr [ecx+04]
:00448E23 85F6                    test esi, esi
:00448E25 8B581C                  mov ebx, dword ptr [eax+1C]
:00448E28 8B4500                  mov eax, dword ptr [ebp+00]
:00448E2B 895C2424                mov dword ptr [esp+24], ebx
:00448E2F 7463                    je 00448E94
:00448E31 807E0800                cmp byte ptr [esi+08], 00
:00448E35 745D                    je 00448E94
:00448E37 3B7004                  cmp esi, dword ptr [eax+04]
:00448E3A 7432                    je 00448E6E
:00448E3C 83C608                  add esi, 00000008
:00448E3F 8B7804                  mov edi, dword ptr [eax+04]
:00448E42 83C708                  add edi, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448E5F(C)
|
:00448E45 8A1E                    mov bl, byte ptr [esi]
:00448E47 3A1F                    cmp bl, byte ptr [edi]
:00448E49 751A                    jne 00448E65
:00448E4B 0ADB                    or bl, bl
:00448E4D 7412                    je 00448E61
:00448E4F 8A5E01                  mov bl, byte ptr [esi+01]
:00448E52 3A5F01                  cmp bl, byte ptr [edi+01]
:00448E55 750E                    jne 00448E65
:00448E57 83C602                  add esi, 00000002
:00448E5A 83C702                  add edi, 00000002
:00448E5D 0ADB                    or bl, bl
:00448E5F 75E4                    jne 00448E45

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448E4D(C)
|
:00448E61 33F6                    xor esi, esi
:00448E63 EB05                    jmp 00448E6A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00448E49(C), :00448E55(C)
|
:00448E65 1BF6                    sbb esi, esi
:00448E67 83DEFF                  sbb esi, FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448E63(U)
|
:00448E6A 85F6                    test esi, esi
:00448E6C 7522                    jne 00448E90

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448E3A(C)
|
:00448E6E F60002                  test byte ptr [eax], 02
:00448E71 7405                    je 00448E78
:00448E73 F60108                  test byte ptr [ecx], 08
:00448E76 7418                    je 00448E90

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448E71(C)
|
:00448E78 8B442424                mov eax, dword ptr [esp+24]
:00448E7C 8B00                    mov eax, dword ptr [eax]
:00448E7E A801                    test al, 01
:00448E80 7405                    je 00448E87
:00448E82 F60101                  test byte ptr [ecx], 01
:00448E85 7409                    je 00448E90

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448E80(C)
|
:00448E87 A802                    test al, 02
:00448E89 7409                    je 00448E94
:00448E8B F60102                  test byte ptr [ecx], 02
:00448E8E 7504                    jne 00448E94

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00448E6C(C), :00448E76(C), :00448E85(C)
|
:00448E90 33C0                    xor eax, eax
:00448E92 EB05                    jmp 00448E99

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00448E2F(C), :00448E35(C), :00448E89(C), :00448E8E(C)
|
:00448E94 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448E92(U)
|
:00448E99 85C0                    test eax, eax
:00448E9B 7520                    jne 00448EBD
:00448E9D 4A                      dec edx
:00448E9E 83C504                  add ebp, 00000004
:00448EA1 85D2                    test edx, edx
:00448EA3 0F8573FFFFFF            jne 00448E1C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448E16(C)
|
:00448EA9 83C110                  add ecx, 00000010
:00448EAC FF4C2418                dec [esp+18]
:00448EB0 837C241800              cmp dword ptr [esp+18], 00000000
:00448EB5 0F854AFFFFFF            jne 00448E05
:00448EBB EB35                    jmp 00448EF2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448E9B(C)
|
:00448EBD 8B442448                mov eax, dword ptr [esp+48]
:00448EC1 8B542444                mov edx, dword ptr [esp+44]
:00448EC5 8B5C2410                mov ebx, dword ptr [esp+10]
:00448EC9 50                      push eax
:00448ECA 52                      push edx
:00448ECB 8B4500                  mov eax, dword ptr [ebp+00]
:00448ECE 8B542440                mov edx, dword ptr [esp+40]
:00448ED2 53                      push ebx
:00448ED3 50                      push eax
:00448ED4 51                      push ecx
:00448ED5 8B4C2450                mov ecx, dword ptr [esp+50]
:00448ED9 8B442448                mov eax, dword ptr [esp+48]
:00448EDD 51                      push ecx
:00448EDE 52                      push edx
:00448EDF 8B4C244C                mov ecx, dword ptr [esp+4C]
:00448EE3 50                      push eax
:00448EE4 8B54244C                mov edx, dword ptr [esp+4C]
:00448EE8 51                      push ecx
:00448EE9 52                      push edx
:00448EEA E801030000              call 004491F0
:00448EEF 83C428                  add esp, 00000028

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00448DE4(C), :00448DED(C), :00448DFF(C), :00448EBB(U)
|
:00448EF2 8344241014              add dword ptr [esp+10], 00000014
:00448EF7 FF44241C                inc [esp+1C]
:00448EFB 8B44241C                mov eax, dword ptr [esp+1C]
:00448EFF 39442420                cmp dword ptr [esp+20], eax
:00448F03 0F87D1FEFFFF            ja 00448DDA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448DD4(C)
|
:00448F09 807C244000              cmp byte ptr [esp+40], 00
:00448F0E 745B                    je 00448F6B
:00448F10 8B44242C                mov eax, dword ptr [esp+2C]
:00448F14 6A01                    push 00000001
:00448F16 50                      push eax
:00448F17 E8B4060000              call 004495D0
:00448F1C 83C408                  add esp, 00000008
:00448F1F 5D                      pop ebp
:00448F20 5F                      pop edi
:00448F21 5E                      pop esi
:00448F22 5B                      pop ebx
:00448F23 83C418                  add esp, 00000018
:00448F26 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00448D8A(C), :00448D94(C), :00448DA1(C)
|
:00448F27 807C244000              cmp byte ptr [esp+40], 00
:00448F2C 7538                    jne 00448F66
:00448F2E 8B442448                mov eax, dword ptr [esp+48]
:00448F32 8B4C2444                mov ecx, dword ptr [esp+44]
:00448F36 8B542414                mov edx, dword ptr [esp+14]
:00448F3A 50                      push eax
:00448F3B 8B442440                mov eax, dword ptr [esp+40]
:00448F3F 51                      push ecx
:00448F40 8B4C2440                mov ecx, dword ptr [esp+40]
:00448F44 52                      push edx
:00448F45 8B542440                mov edx, dword ptr [esp+40]
:00448F49 50                      push eax
:00448F4A 8B442440                mov eax, dword ptr [esp+40]
:00448F4E 51                      push ecx
:00448F4F 8B4C2440                mov ecx, dword ptr [esp+40]
:00448F53 52                      push edx
:00448F54 50                      push eax
:00448F55 51                      push ecx
:00448F56 E825000000              call 00448F80
:00448F5B 83C420                  add esp, 00000020
:00448F5E 5D                      pop ebp
:00448F5F 5F                      pop edi
:00448F60 5E                      pop esi
:00448F61 5B                      pop ebx
:00448F62 83C418                  add esp, 00000018
:00448F65 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448F2C(C)
|
:00448F66 E8B5FBFFFF              call 00448B20

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00448D2D(C), :00448F0E(C)
|
:00448F6B 5D                      pop ebp
:00448F6C 5F                      pop edi
:00448F6D 5E                      pop esi
:00448F6E 5B                      pop ebx
:00448F6F 83C418                  add esp, 00000018
:00448F72 C3                      ret


:00448F73 CC                      int 03
:00448F74 CC                      int 03
:00448F75 CC                      int 03
:00448F76 CC                      int 03
:00448F77 CC                      int 03
:00448F78 CC                      int 03
:00448F79 CC                      int 03
:00448F7A CC                      int 03
:00448F7B CC                      int 03
:00448F7C CC                      int 03
:00448F7D CC                      int 03
:00448F7E CC                      int 03
:00448F7F CC                      int 03

* Referenced by a CALL at Address:
|:00448F56   
|
:00448F80 83EC08                  sub esp, 00000008
:00448F83 833DCC3B450000          cmp dword ptr [00453BCC], 00000000
:00448F8A 53                      push ebx
:00448F8B 56                      push esi
:00448F8C 57                      push edi
:00448F8D 55                      push ebp
:00448F8E 7435                    je 00448FC5
:00448F90 8B442438                mov eax, dword ptr [esp+38]
:00448F94 8B7C2434                mov edi, dword ptr [esp+34]
:00448F98 8B74242C                mov esi, dword ptr [esp+2C]
:00448F9C 50                      push eax
:00448F9D 8B44242C                mov eax, dword ptr [esp+2C]
:00448FA1 57                      push edi
:00448FA2 8B4C242C                mov ecx, dword ptr [esp+2C]
:00448FA6 56                      push esi
:00448FA7 8B54242C                mov edx, dword ptr [esp+2C]
:00448FAB 50                      push eax
:00448FAC 8B44242C                mov eax, dword ptr [esp+2C]
:00448FB0 51                      push ecx
:00448FB1 52                      push edx
:00448FB2 50                      push eax
:00448FB3 E8E8F1FFFF              call 004481A0
:00448FB8 83C41C                  add esp, 0000001C
:00448FBB 85C0                    test eax, eax
:00448FBD 0F858A000000            jne 0044904D
:00448FC3 EB08                    jmp 00448FCD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448F8E(C)
|
:00448FC5 8B74242C                mov esi, dword ptr [esp+2C]
:00448FC9 8B7C2434                mov edi, dword ptr [esp+34]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448FC3(U)
|
:00448FCD 8D442414                lea eax, dword ptr [esp+14]
:00448FD1 8D4C2410                lea ecx, dword ptr [esp+10]
:00448FD5 8B5C2430                mov ebx, dword ptr [esp+30]
:00448FD9 50                      push eax
:00448FDA 51                      push ecx
:00448FDB 53                      push ebx
:00448FDC 57                      push edi
:00448FDD 56                      push esi
:00448FDE E87D000000              call 00449060
:00448FE3 83C414                  add esp, 00000014
:00448FE6 8BE8                    mov ebp, eax
:00448FE8 8B442414                mov eax, dword ptr [esp+14]
:00448FEC 39442410                cmp dword ptr [esp+10], eax
:00448FF0 735B                    jnb 0044904D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044904B(C)
|
:00448FF2 395D00                  cmp dword ptr [ebp+00], ebx
:00448FF5 7F45                    jg 0044903C
:00448FF7 395D04                  cmp dword ptr [ebp+04], ebx
:00448FFA 7C40                    jl 0044903C
:00448FFC 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00448FFF C1E104                  shl ecx, 04
:00449002 034D10                  add ecx, dword ptr [ebp+10]
:00449005 8B41F4                  mov eax, dword ptr [ecx-0C]
:00449008 85C0                    test eax, eax
:0044900A 7406                    je 00449012
:0044900C 80780800                cmp byte ptr [eax+08], 00
:00449010 752A                    jne 0044903C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044900A(C)
|
:00449012 8B442438                mov eax, dword ptr [esp+38]
:00449016 83E910                  sub ecx, 00000010
:00449019 8B542428                mov edx, dword ptr [esp+28]
:0044901D 50                      push eax
:0044901E 8B442428                mov eax, dword ptr [esp+28]
:00449022 57                      push edi
:00449023 55                      push ebp
:00449024 6A00                    push 00000000
:00449026 51                      push ecx
:00449027 56                      push esi
:00449028 8B4C2438                mov ecx, dword ptr [esp+38]
:0044902C 52                      push edx
:0044902D 8B542438                mov edx, dword ptr [esp+38]
:00449031 50                      push eax
:00449032 51                      push ecx
:00449033 52                      push edx
:00449034 E8B7010000              call 004491F0
:00449039 83C428                  add esp, 00000028

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00448FF5(C), :00448FFA(C), :00449010(C)
|
:0044903C 83C514                  add ebp, 00000014
:0044903F 8B442414                mov eax, dword ptr [esp+14]
:00449043 FF442410                inc [esp+10]
:00449047 39442410                cmp dword ptr [esp+10], eax
:0044904B 72A5                    jb 00448FF2

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00448FBD(C), :00448FF0(C)
|
:0044904D 5D                      pop ebp
:0044904E 5F                      pop edi
:0044904F 5E                      pop esi
:00449050 5B                      pop ebx
:00449051 83C408                  add esp, 00000008
:00449054 C3                      ret


:00449055 CC                      int 03
:00449056 CC                      int 03
:00449057 CC                      int 03
:00449058 CC                      int 03
:00449059 CC                      int 03
:0044905A CC                      int 03
:0044905B CC                      int 03
:0044905C CC                      int 03
:0044905D CC                      int 03
:0044905E CC                      int 03
:0044905F CC                      int 03

* Referenced by a CALL at Addresses:
|:00448DC0   , :00448FDE   
|
:00449060 8B442404                mov eax, dword ptr [esp+04]
:00449064 83EC0C                  sub esp, 0000000C
:00449067 53                      push ebx
:00449068 8B4810                  mov ecx, dword ptr [eax+10]
:0044906B 894C240C                mov dword ptr [esp+0C], ecx
:0044906F 56                      push esi
:00449070 57                      push edi
:00449071 8B700C                  mov esi, dword ptr [eax+0C]
:00449074 8B7C2420                mov edi, dword ptr [esp+20]
:00449078 55                      push ebp
:00449079 89742410                mov dword ptr [esp+10], esi
:0044907D 89742414                mov dword ptr [esp+14], esi
:00449081 85FF                    test edi, edi
:00449083 7C43                    jl 004490C8
:00449085 8D0CB500000000          lea ecx, dword ptr [4*esi+00000000]
:0044908C 8B442418                mov eax, dword ptr [esp+18]
:00449090 8B6C2428                mov ebp, dword ptr [esp+28]
:00449094 8D1489                  lea edx, dword ptr [ecx+4*ecx]
:00449097 8D5C0204                lea ebx, dword ptr [edx+eax+04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004490C6(C)
|
:0044909B 83FEFF                  cmp esi, FFFFFFFF
:0044909E 7505                    jne 004490A5
:004490A0 E8FBFAFFFF              call 00448BA0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044909E(C)
|
:004490A5 83EB14                  sub ebx, 00000014
:004490A8 4E                      dec esi
:004490A9 392B                    cmp dword ptr [ebx], ebp
:004490AB 7D05                    jge 004490B2
:004490AD 396B04                  cmp dword ptr [ebx+04], ebp
:004490B0 7D05                    jge 004490B7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004490AB(C)
|
:004490B2 83FEFF                  cmp esi, FFFFFFFF
:004490B5 750D                    jne 004490C4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004490B0(C)
|
:004490B7 4F                      dec edi
:004490B8 8B4C2414                mov ecx, dword ptr [esp+14]
:004490BC 894C2410                mov dword ptr [esp+10], ecx
:004490C0 89742414                mov dword ptr [esp+14], esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004490B5(C)
|
:004490C4 85FF                    test edi, edi
:004490C6 7DD3                    jge 0044909B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449083(C)
|
:004490C8 46                      inc esi
:004490C9 8B44242C                mov eax, dword ptr [esp+2C]
:004490CD 8B542430                mov edx, dword ptr [esp+30]
:004490D1 8B4C2410                mov ecx, dword ptr [esp+10]
:004490D5 8930                    mov dword ptr [eax], esi
:004490D7 8B442420                mov eax, dword ptr [esp+20]
:004490DB 890A                    mov dword ptr [edx], ecx
:004490DD 39480C                  cmp dword ptr [eax+0C], ecx
:004490E0 7204                    jb 004490E6
:004490E2 3BCE                    cmp ecx, esi
:004490E4 7305                    jnb 004490EB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004490E0(C)
|
:004490E6 E8B5FAFFFF              call 00448BA0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004490E4(C)
|
:004490EB C1E602                  shl esi, 02
:004490EE 8B442418                mov eax, dword ptr [esp+18]
:004490F2 5D                      pop ebp
:004490F3 5F                      pop edi
:004490F4 8D0CB6                  lea ecx, dword ptr [esi+4*esi]
:004490F7 5E                      pop esi
:004490F8 03C1                    add eax, ecx
:004490FA 5B                      pop ebx
:004490FB 83C40C                  add esp, 0000000C
:004490FE C3                      ret


:004490FF CC                      int 03

* Referenced by a CALL at Addresses:
|:00448C56   , :00449243   
|
:00449100 64A100000000            mov eax, dword ptr fs:[00000000]
:00449106 55                      push ebp
:00449107 8BEC                    mov ebp, esp
:00449109 6AFF                    push FFFFFFFF
:0044910B 6878C04400              push 0044C078
:00449110 68408A4400              push 00448A40
:00449115 50                      push eax
:00449116 8B4508                  mov eax, dword ptr [ebp+08]
:00449119 64892500000000          mov dword ptr fs:[00000000], esp
:00449120 83C008                  add eax, 00000008
:00449123 83EC14                  sub esp, 00000014
:00449126 8B08                    mov ecx, dword ptr [eax]
:00449128 8945E0                  mov dword ptr [ebp-20], eax
:0044912B 894DE4                  mov dword ptr [ebp-1C], ecx
:0044912E 53                      push ebx
:0044912F 3B4D14                  cmp ecx, dword ptr [ebp+14]
:00449132 56                      push esi
:00449133 57                      push edi
:00449134 8965E8                  mov dword ptr [ebp-18], esp
:00449137 7470                    je 004491A9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004491A7(C)
|
:00449139 837DE4FF                cmp dword ptr [ebp-1C], FFFFFFFF
:0044913D 7E0B                    jle 0044914A
:0044913F 8B4510                  mov eax, dword ptr [ebp+10]
:00449142 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00449145 394804                  cmp dword ptr [eax+04], ecx
:00449148 7F05                    jg 0044914F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044913D(C)
|
:0044914A E851FAFFFF              call 00448BA0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449148(C)
|
:0044914F C745FC00000000          mov [ebp-04], 00000000
:00449156 8B4510                  mov eax, dword ptr [ebp+10]
:00449159 8B4008                  mov eax, dword ptr [eax+08]
:0044915C 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0044915F 8B44C804                mov eax, dword ptr [eax+8*ecx+04]
:00449163 8945DC                  mov dword ptr [ebp-24], eax
:00449166 85C0                    test eax, eax
:00449168 7424                    je 0044918E
:0044916A 6803010000              push 00000103
:0044916F 8B4508                  mov eax, dword ptr [ebp+08]
:00449172 50                      push eax
:00449173 8B45DC                  mov eax, dword ptr [ebp-24]
:00449176 50                      push eax
:00449177 E804050000              call 00449680
:0044917C EB10                    jmp 0044918E
:0044917E 8B45EC                  mov eax, dword ptr [ebp-14]
:00449181 50                      push eax
:00449182 E849000000              call 004491D0
:00449187 83C404                  add esp, 00000004
:0044918A C3                      ret


:0044918B 8B65E8                  mov esp, dword ptr [ebp-18]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00449168(C), :0044917C(U)
|
:0044918E C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00449195 8B4510                  mov eax, dword ptr [ebp+10]
:00449198 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0044919B 8B5008                  mov edx, dword ptr [eax+08]
:0044919E 8B04CA                  mov eax, dword ptr [edx+8*ecx]
:004491A1 8945E4                  mov dword ptr [ebp-1C], eax
:004491A4 3B4514                  cmp eax, dword ptr [ebp+14]
:004491A7 7590                    jne 00449139

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449137(C)
|
:004491A9 8B4514                  mov eax, dword ptr [ebp+14]
:004491AC 3945E4                  cmp dword ptr [ebp-1C], eax
:004491AF 7405                    je 004491B6
:004491B1 E8EAF9FFFF              call 00448BA0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004491AF(C)
|
:004491B6 8B45E4                  mov eax, dword ptr [ebp-1C]
:004491B9 8B4DE0                  mov ecx, dword ptr [ebp-20]
:004491BC 5F                      pop edi
:004491BD 5E                      pop esi
:004491BE 5B                      pop ebx
:004491BF 8901                    mov dword ptr [ecx], eax
:004491C1 8B45F0                  mov eax, dword ptr [ebp-10]
:004491C4 8BE5                    mov esp, ebp
:004491C6 64A300000000            mov dword ptr fs:[00000000], eax
:004491CC 5D                      pop ebp
:004491CD C3                      ret


:004491CE CC                      int 03
:004491CF CC                      int 03

* Referenced by a CALL at Address:
|:00449182   
|
:004491D0 8B442404                mov eax, dword ptr [esp+04]
:004491D4 8B08                    mov ecx, dword ptr [eax]
:004491D6 813963736DE0            cmp dword ptr [ecx], E06D7363
:004491DC 7505                    jne 004491E3
:004491DE E83DF9FFFF              call 00448B20

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004491DC(C)
|
:004491E3 33C0                    xor eax, eax
:004491E5 C3                      ret


:004491E6 CC                      int 03
:004491E7 CC                      int 03
:004491E8 CC                      int 03
:004491E9 CC                      int 03
:004491EA CC                      int 03
:004491EB CC                      int 03
:004491EC CC                      int 03
:004491ED CC                      int 03
:004491EE CC                      int 03
:004491EF CC                      int 03

* Referenced by a CALL at Addresses:
|:00448EEA   , :00449034   
|
:004491F0 8B44241C                mov eax, dword ptr [esp+1C]
:004491F4 53                      push ebx
:004491F5 56                      push esi
:004491F6 85C0                    test eax, eax
:004491F8 57                      push edi
:004491F9 55                      push ebp
:004491FA 741A                    je 00449216
:004491FC 8B7C2418                mov edi, dword ptr [esp+18]
:00449200 50                      push eax
:00449201 8B44242C                mov eax, dword ptr [esp+2C]
:00449205 8B742418                mov esi, dword ptr [esp+18]
:00449209 50                      push eax
:0044920A 57                      push edi
:0044920B 56                      push esi
:0044920C E8BF010000              call 004493D0
:00449211 83C410                  add esp, 00000010
:00449214 EB08                    jmp 0044921E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004491FA(C)
|
:00449216 8B742414                mov esi, dword ptr [esp+14]
:0044921A 8B7C2418                mov edi, dword ptr [esp+18]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449214(U)
|
:0044921E 8B442438                mov eax, dword ptr [esp+38]
:00449222 56                      push esi
:00449223 85C0                    test eax, eax
:00449225 7503                    jne 0044922A
:00449227 57                      push edi
:00449228 EB01                    jmp 0044922B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449225(C)
|
:0044922A 50                      push eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449228(U)
|
:0044922B E830EEFFFF              call 00448060
:00449230 8B6C2430                mov ebp, dword ptr [esp+30]
:00449234 8B5C2424                mov ebx, dword ptr [esp+24]
:00449238 8B4C2420                mov ecx, dword ptr [esp+20]
:0044923C 8B4500                  mov eax, dword ptr [ebp+00]
:0044923F 50                      push eax
:00449240 53                      push ebx
:00449241 51                      push ecx
:00449242 57                      push edi
:00449243 E8B8FEFFFF              call 00449100
:00449248 8B4C2444                mov ecx, dword ptr [esp+44]
:0044924C 83C410                  add esp, 00000010
:0044924F 8B4504                  mov eax, dword ptr [ebp+04]
:00449252 6800010000              push 00000100
:00449257 40                      inc eax
:00449258 51                      push ecx
:00449259 8B542430                mov edx, dword ptr [esp+30]
:0044925D 8B4C2424                mov ecx, dword ptr [esp+24]
:00449261 894708                  mov dword ptr [edi+08], eax
:00449264 8B420C                  mov eax, dword ptr [edx+0C]
:00449267 50                      push eax
:00449268 53                      push ebx
:00449269 51                      push ecx
:0044926A 57                      push edi
:0044926B 56                      push esi
:0044926C E81F000000              call 00449290
:00449271 83C41C                  add esp, 0000001C
:00449274 85C0                    test eax, eax
:00449276 7407                    je 0044927F
:00449278 57                      push edi
:00449279 50                      push eax
:0044927A E871EDFFFF              call 00447FF0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449276(C)
|
:0044927F 5D                      pop ebp
:00449280 5F                      pop edi
:00449281 5E                      pop esi
:00449282 5B                      pop ebx
:00449283 C3                      ret


:00449284 CC                      int 03
:00449285 CC                      int 03
:00449286 CC                      int 03
:00449287 CC                      int 03
:00449288 CC                      int 03
:00449289 CC                      int 03
:0044928A CC                      int 03
:0044928B CC                      int 03
:0044928C CC                      int 03
:0044928D CC                      int 03
:0044928E CC                      int 03
:0044928F CC                      int 03

* Referenced by a CALL at Address:
|:0044926C   
|
:00449290 64A100000000            mov eax, dword ptr fs:[00000000]
:00449296 55                      push ebp
:00449297 8BEC                    mov ebp, esp
:00449299 6AFF                    push FFFFFFFF
:0044929B 6888C04400              push 0044C088
:004492A0 68408A4400              push 00448A40
:004492A5 50                      push eax
:004492A6 8B5518                  mov edx, dword ptr [ebp+18]
:004492A9 64892500000000          mov dword ptr fs:[00000000], esp
:004492B0 83EC20                  sub esp, 00000020
:004492B3 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004492B6 8955E4                  mov dword ptr [ebp-1C], edx
:004492B9 53                      push ebx
:004492BA 56                      push esi
:004492BB 57                      push edi
:004492BC 8D41FC                  lea eax, dword ptr [ecx-04]
:004492BF 8965E8                  mov dword ptr [ebp-18], esp
:004492C2 8945E0                  mov dword ptr [ebp-20], eax
:004492C5 8B30                    mov esi, dword ptr [eax]
:004492C7 A1E03B4500              mov eax, dword ptr [00453BE0]
:004492CC 8975D4                  mov dword ptr [ebp-2C], esi
:004492CF 8945D8                  mov dword ptr [ebp-28], eax
:004492D2 8B35E43B4500            mov esi, dword ptr [00453BE4]
:004492D8 8B4508                  mov eax, dword ptr [ebp+08]
:004492DB 8975DC                  mov dword ptr [ebp-24], esi
:004492DE A3E03B4500              mov dword ptr [00453BE0], eax
:004492E3 8B7510                  mov esi, dword ptr [ebp+10]
:004492E6 8935E43B4500            mov dword ptr [00453BE4], esi
:004492EC 33F6                    xor esi, esi
:004492EE C745FC01000000          mov [ebp-04], 00000001
:004492F5 8B4520                  mov eax, dword ptr [ebp+20]
:004492F8 50                      push eax
:004492F9 8B451C                  mov eax, dword ptr [ebp+1C]
:004492FC 50                      push eax
:004492FD 52                      push edx
:004492FE 8B4514                  mov eax, dword ptr [ebp+14]
:00449301 50                      push eax
:00449302 51                      push ecx
:00449303 E8F8EDFFFF              call 00448100
:00449308 83C414                  add esp, 00000014
:0044930B 8945E4                  mov dword ptr [ebp-1C], eax
:0044930E C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00449315 688C934400              push 0044938C
:0044931A 8B45D4                  mov eax, dword ptr [ebp-2C]
:0044931D 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00449320 8901                    mov dword ptr [ecx], eax
:00449322 8B45D8                  mov eax, dword ptr [ebp-28]
:00449325 A3E03B4500              mov dword ptr [00453BE0], eax
:0044932A 8B45DC                  mov eax, dword ptr [ebp-24]
:0044932D A3E43B4500              mov dword ptr [00453BE4], eax
:00449332 8B4508                  mov eax, dword ptr [ebp+08]
:00449335 813863736DE0            cmp dword ptr [eax], E06D7363
:0044933B 7527                    jne 00449364
:0044933D 83781003                cmp dword ptr [eax+10], 00000003
:00449341 7521                    jne 00449364
:00449343 81781420059319          cmp dword ptr [eax+14], 19930520
:0044934A 7518                    jne 00449364
:0044934C 837DE400                cmp dword ptr [ebp-1C], 00000000
:00449350 7412                    je 00449364
:00449352 E84BECFFFF              call 00447FA2
:00449357 50                      push eax
:00449358 8B4508                  mov eax, dword ptr [ebp+08]
:0044935B 50                      push eax
:0044935C E86F020000              call 004495D0
:00449361 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044933B(C), :00449341(C), :0044934A(C), :00449350(C)
|
:00449364 C3                      ret
:00449365 8B45EC                  mov eax, dword ptr [ebp-14]
:00449368 50                      push eax
:00449369 E832000000              call 004493A0
:0044936E 83C404                  add esp, 00000004
:00449371 C3                      ret


:00449372 8B65E8                  mov esp, dword ptr [ebp-18]
:00449375 33F6                    xor esi, esi
:00449377 8975E4                  mov dword ptr [ebp-1C], esi
:0044937A 6AFF                    push FFFFFFFF
:0044937C 8D45F0                  lea eax, dword ptr [ebp-10]
:0044937F 50                      push eax
:00449380 E8B5EBFFFF              call 00447F3A
:00449385 83C408                  add esp, 00000008
:00449388 8BC6                    mov eax, esi
:0044938A EB03                    jmp 0044938F
:0044938C 8B45E4                  mov eax, dword ptr [ebp-1C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044938A(U)
|
:0044938F 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00449392 5F                      pop edi
:00449393 64890D00000000          mov dword ptr fs:[00000000], ecx
:0044939A 5E                      pop esi
:0044939B 5B                      pop ebx
:0044939C 8BE5                    mov esp, ebp
:0044939E 5D                      pop ebp
:0044939F C3                      ret



* Referenced by a CALL at Address:
|:00449369   
|
:004493A0 8B442404                mov eax, dword ptr [esp+04]
:004493A4 8B00                    mov eax, dword ptr [eax]
:004493A6 813863736DE0            cmp dword ptr [eax], E06D7363
:004493AC 751B                    jne 004493C9
:004493AE 83781003                cmp dword ptr [eax+10], 00000003
:004493B2 7515                    jne 004493C9
:004493B4 81781420059319          cmp dword ptr [eax+14], 19930520
:004493BB 750C                    jne 004493C9
:004493BD 83781C00                cmp dword ptr [eax+1C], 00000000
:004493C1 7506                    jne 004493C9
:004493C3 B801000000              mov eax, 00000001
:004493C8 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004493AC(C), :004493B2(C), :004493BB(C), :004493C1(C)
|
:004493C9 33C0                    xor eax, eax
:004493CB C3                      ret


:004493CC CC                      int 03
:004493CD CC                      int 03
:004493CE CC                      int 03
:004493CF CC                      int 03

* Referenced by a CALL at Address:
|:0044920C   
|
:004493D0 64A100000000            mov eax, dword ptr fs:[00000000]
:004493D6 55                      push ebp
:004493D7 8BEC                    mov ebp, esp
:004493D9 6AFF                    push FFFFFFFF
:004493DB 68A0C04400              push 0044C0A0
:004493E0 68408A4400              push 00448A40
:004493E5 50                      push eax
:004493E6 8B5510                  mov edx, dword ptr [ebp+10]
:004493E9 64892500000000          mov dword ptr fs:[00000000], esp
:004493F0 8B4204                  mov eax, dword ptr [edx+04]
:004493F3 83EC08                  sub esp, 00000008
:004493F6 85C0                    test eax, eax
:004493F8 53                      push ebx
:004493F9 56                      push esi
:004493FA 57                      push edi
:004493FB 8965E8                  mov dword ptr [ebp-18], esp
:004493FE 0F84BA010000            je 004495BE
:00449404 80780800                cmp byte ptr [eax+08], 00
:00449408 0F84B0010000            je 004495BE
:0044940E 8B4208                  mov eax, dword ptr [edx+08]
:00449411 85C0                    test eax, eax
:00449413 0F84A5010000            je 004495BE
:00449419 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0044941C 8D74010C                lea esi, dword ptr [ecx+eax+0C]
:00449420 C745FC00000000          mov [ebp-04], 00000000
:00449427 F60208                  test byte ptr [edx], 08
:0044942A 7448                    je 00449474
:0044942C 8B5D08                  mov ebx, dword ptr [ebp+08]
:0044942F 6A01                    push 00000001
:00449431 8B4318                  mov eax, dword ptr [ebx+18]
:00449434 50                      push eax
:00449435 E866110000              call 0044A5A0
:0044943A 83C408                  add esp, 00000008
:0044943D 85C0                    test eax, eax
:0044943F 0F845D010000            je 004495A2
:00449445 6A01                    push 00000001
:00449447 56                      push esi
:00449448 E873110000              call 0044A5C0
:0044944D 83C408                  add esp, 00000008
:00449450 85C0                    test eax, eax
:00449452 0F844A010000            je 004495A2
:00449458 8B4318                  mov eax, dword ptr [ebx+18]
:0044945B 8906                    mov dword ptr [esi], eax
:0044945D 8B7D14                  mov edi, dword ptr [ebp+14]
:00449460 83C708                  add edi, 00000008
:00449463 57                      push edi
:00449464 50                      push eax
:00449465 E8E6010000              call 00449650
:0044946A 83C408                  add esp, 00000008
:0044946D 8906                    mov dword ptr [esi], eax
:0044946F E943010000              jmp 004495B7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044942A(C)
|
:00449474 8B7D14                  mov edi, dword ptr [ebp+14]
:00449477 F60701                  test byte ptr [edi], 01
:0044947A 7465                    je 004494E1
:0044947C 8B5D08                  mov ebx, dword ptr [ebp+08]
:0044947F 6A01                    push 00000001
:00449481 8B4318                  mov eax, dword ptr [ebx+18]
:00449484 50                      push eax
:00449485 E816110000              call 0044A5A0
:0044948A 83C408                  add esp, 00000008
:0044948D 85C0                    test eax, eax
:0044948F 0F840D010000            je 004495A2
:00449495 6A01                    push 00000001
:00449497 56                      push esi
:00449498 E823110000              call 0044A5C0
:0044949D 83C408                  add esp, 00000008
:004494A0 85C0                    test eax, eax
:004494A2 0F84FA000000            je 004495A2
:004494A8 8B4714                  mov eax, dword ptr [edi+14]
:004494AB 50                      push eax
:004494AC 8B4318                  mov eax, dword ptr [ebx+18]
:004494AF 50                      push eax
:004494B0 56                      push esi
:004494B1 E83AEEFFFF              call 004482F0
:004494B6 83C40C                  add esp, 0000000C
:004494B9 837F1404                cmp dword ptr [edi+14], 00000004
:004494BD 0F85F4000000            jne 004495B7
:004494C3 8B06                    mov eax, dword ptr [esi]
:004494C5 85C0                    test eax, eax
:004494C7 0F84EA000000            je 004495B7
:004494CD 83C708                  add edi, 00000008
:004494D0 57                      push edi
:004494D1 50                      push eax
:004494D2 E879010000              call 00449650
:004494D7 83C408                  add esp, 00000008
:004494DA 8906                    mov dword ptr [esi], eax
:004494DC E9D6000000              jmp 004495B7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044947A(C)
|
:004494E1 837F1800                cmp dword ptr [edi+18], 00000000
:004494E5 8B5D08                  mov ebx, dword ptr [ebp+08]
:004494E8 6A01                    push 00000001
:004494EA 8B4318                  mov eax, dword ptr [ebx+18]
:004494ED 50                      push eax
:004494EE 7546                    jne 00449536
:004494F0 E8AB100000              call 0044A5A0
:004494F5 83C408                  add esp, 00000008
:004494F8 85C0                    test eax, eax
:004494FA 0F84A2000000            je 004495A2
:00449500 6A01                    push 00000001
:00449502 56                      push esi
:00449503 E8B8100000              call 0044A5C0
:00449508 83C408                  add esp, 00000008
:0044950B 85C0                    test eax, eax
:0044950D 0F848F000000            je 004495A2
:00449513 8B4714                  mov eax, dword ptr [edi+14]
:00449516 50                      push eax
:00449517 83C708                  add edi, 00000008
:0044951A 57                      push edi
:0044951B 8B4318                  mov eax, dword ptr [ebx+18]
:0044951E 50                      push eax
:0044951F E82C010000              call 00449650
:00449524 83C408                  add esp, 00000008
:00449527 50                      push eax
:00449528 56                      push esi
:00449529 E8C2EDFFFF              call 004482F0
:0044952E 83C40C                  add esp, 0000000C
:00449531 E981000000              jmp 004495B7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004494EE(C)
|
:00449536 E865100000              call 0044A5A0
:0044953B 83C408                  add esp, 00000008
:0044953E 85C0                    test eax, eax
:00449540 7460                    je 004495A2
:00449542 6A01                    push 00000001
:00449544 56                      push esi
:00449545 E876100000              call 0044A5C0
:0044954A 83C408                  add esp, 00000008
:0044954D 85C0                    test eax, eax
:0044954F 7451                    je 004495A2
:00449551 8B4718                  mov eax, dword ptr [edi+18]
:00449554 50                      push eax
:00449555 E886100000              call 0044A5E0
:0044955A 83C404                  add esp, 00000004
:0044955D 85C0                    test eax, eax
:0044955F 7441                    je 004495A2
:00449561 F60704                  test byte ptr [edi], 04
:00449564 741F                    je 00449585
:00449566 6A01                    push 00000001
:00449568 8D4708                  lea eax, dword ptr [edi+08]
:0044956B 50                      push eax
:0044956C 8B4318                  mov eax, dword ptr [ebx+18]
:0044956F 50                      push eax
:00449570 E8DB000000              call 00449650
:00449575 83C408                  add esp, 00000008
:00449578 50                      push eax
:00449579 8B4718                  mov eax, dword ptr [edi+18]
:0044957C 50                      push eax
:0044957D 56                      push esi
:0044957E E8CDEAFFFF              call 00448050
:00449583 EB32                    jmp 004495B7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449564(C)
|
:00449585 8D4708                  lea eax, dword ptr [edi+08]
:00449588 50                      push eax
:00449589 8B4318                  mov eax, dword ptr [ebx+18]
:0044958C 50                      push eax
:0044958D E8BE000000              call 00449650
:00449592 83C408                  add esp, 00000008
:00449595 50                      push eax
:00449596 8B4718                  mov eax, dword ptr [edi+18]
:00449599 50                      push eax
:0044959A 56                      push esi
:0044959B E8A0EAFFFF              call 00448040
:004495A0 EB15                    jmp 004495B7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044943F(C), :00449452(C), :0044948F(C), :004494A2(C), :004494FA(C)
|:0044950D(C), :00449540(C), :0044954F(C), :0044955F(C)
|
:004495A2 E8F9F5FFFF              call 00448BA0
:004495A7 EB0E                    jmp 004495B7
:004495A9 B801000000              mov eax, 00000001
:004495AE C3                      ret


:004495AF 8B65E8                  mov esp, dword ptr [ebp-18]
:004495B2 E869F5FFFF              call 00448B20

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044946F(U), :004494BD(C), :004494C7(C), :004494DC(U), :00449531(U)
|:00449583(U), :004495A0(U), :004495A7(U)
|
:004495B7 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004493FE(C), :00449408(C), :00449413(C)
|
:004495BE 8B45F0                  mov eax, dword ptr [ebp-10]
:004495C1 5F                      pop edi
:004495C2 64A300000000            mov dword ptr fs:[00000000], eax
:004495C8 5E                      pop esi
:004495C9 5B                      pop ebx
:004495CA 8BE5                    mov esp, ebp
:004495CC 5D                      pop ebp
:004495CD C3                      ret


:004495CE CC                      int 03
:004495CF CC                      int 03

* Referenced by a CALL at Addresses:
|:00448F17   , :0044935C   
|
:004495D0 64A100000000            mov eax, dword ptr fs:[00000000]
:004495D6 55                      push ebp
:004495D7 8BEC                    mov ebp, esp
:004495D9 6AFF                    push FFFFFFFF
:004495DB 68B0C04400              push 0044C0B0
:004495E0 68408A4400              push 00448A40
:004495E5 50                      push eax
:004495E6 8B4D08                  mov ecx, dword ptr [ebp+08]
:004495E9 64892500000000          mov dword ptr fs:[00000000], esp
:004495F0 83EC08                  sub esp, 00000008
:004495F3 85C9                    test ecx, ecx
:004495F5 53                      push ebx
:004495F6 56                      push esi
:004495F7 57                      push edi
:004495F8 8965E8                  mov dword ptr [ebp-18], esp
:004495FB 7434                    je 00449631
:004495FD 8B411C                  mov eax, dword ptr [ecx+1C]
:00449600 8B4004                  mov eax, dword ptr [eax+04]
:00449603 85C0                    test eax, eax
:00449605 742A                    je 00449631
:00449607 C745FC00000000          mov [ebp-04], 00000000
:0044960E 50                      push eax
:0044960F 8B4118                  mov eax, dword ptr [ecx+18]
:00449612 50                      push eax
:00449613 E818EAFFFF              call 00448030
:00449618 EB10                    jmp 0044962A
:0044961A 807D0C01                cmp byte ptr [ebp+0C], 01
:0044961E 1BC0                    sbb eax, eax
:00449620 40                      inc eax
:00449621 C3                      ret


:00449622 8B65E8                  mov esp, dword ptr [ebp-18]
:00449625 E8F6F4FFFF              call 00448B20

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449618(U)
|
:0044962A C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004495FB(C), :00449605(C)
|
:00449631 8B45F0                  mov eax, dword ptr [ebp-10]
:00449634 5F                      pop edi
:00449635 64A300000000            mov dword ptr fs:[00000000], eax
:0044963B 5E                      pop esi
:0044963C 5B                      pop ebx
:0044963D 8BE5                    mov esp, ebp
:0044963F 5D                      pop ebp
:00449640 C3                      ret


:00449641 CC                      int 03
:00449642 CC                      int 03
:00449643 CC                      int 03
:00449644 CC                      int 03
:00449645 CC                      int 03
:00449646 CC                      int 03
:00449647 CC                      int 03
:00449648 CC                      int 03
:00449649 CC                      int 03
:0044964A CC                      int 03
:0044964B CC                      int 03
:0044964C CC                      int 03
:0044964D CC                      int 03
:0044964E CC                      int 03
:0044964F CC                      int 03

* Referenced by a CALL at Addresses:
|:00449465   , :004494D2   , :0044951F   , :00449570   , :0044958D   
|
:00449650 8B542408                mov edx, dword ptr [esp+08]
:00449654 56                      push esi
:00449655 8B4C2408                mov ecx, dword ptr [esp+08]
:00449659 8B02                    mov eax, dword ptr [edx]
:0044965B 03C1                    add eax, ecx
:0044965D 8B7204                  mov esi, dword ptr [edx+04]
:00449660 85F6                    test esi, esi
:00449662 7C0B                    jl 0044966F
:00449664 8B0C0E                  mov ecx, dword ptr [esi+ecx]
:00449667 8B5208                  mov edx, dword ptr [edx+08]
:0044966A 030411                  add eax, dword ptr [ecx+edx]
:0044966D 03C6                    add eax, esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449662(C)
|
:0044966F 5E                      pop esi
:00449670 C3                      ret


:00449671 CC                      int 03
:00449672 CC                      int 03
:00449673 CC                      int 03
:00449674 CC                      int 03
:00449675 CC                      int 03
:00449676 CC                      int 03
:00449677 CC                      int 03
:00449678 CC                      int 03
:00449679 CC                      int 03
:0044967A CC                      int 03
:0044967B CC                      int 03
:0044967C CC                      int 03
:0044967D CC                      int 03
:0044967E CC                      int 03
:0044967F CC                      int 03

* Referenced by a CALL at Addresses:
|:0044814B   , :00449177   
|
:00449680 55                      push ebp
:00449681 8BEC                    mov ebp, esp
:00449683 83EC04                  sub esp, 00000004
:00449686 53                      push ebx
:00449687 51                      push ecx
:00449688 8B450C                  mov eax, dword ptr [ebp+0C]
:0044968B 83C00C                  add eax, 0000000C
:0044968E 8945FC                  mov dword ptr [ebp-04], eax
:00449691 8B4508                  mov eax, dword ptr [ebp+08]
:00449694 55                      push ebp
:00449695 FF7510                  push [ebp+10]
:00449698 8B4D10                  mov ecx, dword ptr [ebp+10]
:0044969B 8B6DFC                  mov ebp, dword ptr [ebp-04]
:0044969E E822E9FFFF              call 00447FC5
:004496A3 FFD0                    call eax
:004496A5 8BDD                    mov ebx, ebp
:004496A7 5D                      pop ebp
:004496A8 8B4D10                  mov ecx, dword ptr [ebp+10]
:004496AB 55                      push ebp
:004496AC 8BEB                    mov ebp, ebx
:004496AE 81F900010000            cmp ecx, 00000100
:004496B4 7505                    jne 004496BB
:004496B6 B902000000              mov ecx, 00000002

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004496B4(C)
|
:004496BB 51                      push ecx
:004496BC E804E9FFFF              call 00447FC5
:004496C1 5D                      pop ebp
:004496C2 59                      pop ecx
:004496C3 5B                      pop ebx
:004496C4 C9                      leave
:004496C5 C20C00                  ret 000C


:004496C8 CC                      int 03
:004496C9 CC                      int 03
:004496CA CC                      int 03
:004496CB CC                      int 03
:004496CC CC                      int 03
:004496CD CC                      int 03
:004496CE CC                      int 03
:004496CF CC                      int 03

* Referenced by a CALL at Address:
|:004485C7   
|
:004496D0 8B442404                mov eax, dword ptr [esp+04]
:004496D4 56                      push esi
:004496D5 57                      push edi
:004496D6 50                      push eax
:004496D7 E854010000              call 00449830
:004496DC 83C404                  add esp, 00000004
:004496DF 85C0                    test eax, eax
:004496E1 0F843A010000            je 00449821
:004496E7 8B5008                  mov edx, dword ptr [eax+08]
:004496EA 85D2                    test edx, edx
:004496EC 0F842F010000            je 00449821
:004496F2 83FA05                  cmp edx, 00000005
:004496F5 750F                    jne 00449706
:004496F7 C7400800000000          mov [eax+08], 00000000
:004496FE B801000000              mov eax, 00000001
:00449703 5F                      pop edi
:00449704 5E                      pop esi
:00449705 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004496F5(C)
|
:00449706 83FA01                  cmp edx, 00000001
:00449709 7508                    jne 00449713
:0044970B B8FFFFFFFF              mov eax, FFFFFFFF
:00449710 5F                      pop edi
:00449711 5E                      pop esi
:00449712 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449709(C)
|
:00449713 8B35703C4500            mov esi, dword ptr [00453C70]
:00449719 8B4C2410                mov ecx, dword ptr [esp+10]
:0044971D 890D703C4500            mov dword ptr [00453C70], ecx
:00449723 83780408                cmp dword ptr [eax+04], 00000008
:00449727 0F85D6000000            jne 00449803
:0044972D 8B0D643C4500            mov ecx, dword ptr [00453C64]
:00449733 030D603C4500            add ecx, dword ptr [00453C60]
:00449739 390D603C4500            cmp dword ptr [00453C60], ecx
:0044973F 7D22                    jge 00449763
:00449741 8B0D603C4500            mov ecx, dword ptr [00453C60]
:00449747 8D0C49                  lea ecx, dword ptr [ecx+2*ecx]
:0044974A 8D3C8DF03B4500          lea edi, dword ptr [4*ecx+00453BF0]
:00449751 8B0D643C4500            mov ecx, dword ptr [00453C64]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449761(C)
|
:00449757 C70700000000            mov dword ptr [edi], 00000000
:0044975D 83C70C                  add edi, 0000000C
:00449760 49                      dec ecx
:00449761 75F4                    jne 00449757

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044973F(C)
|
:00449763 8B3D6C3C4500            mov edi, dword ptr [00453C6C]
:00449769 8B00                    mov eax, dword ptr [eax]
:0044976B 3D8E0000C0              cmp eax, C000008E
:00449770 750C                    jne 0044977E
:00449772 C7056C3C450083000000    mov dword ptr [00453C6C], 00000083
:0044977C EB70                    jmp 004497EE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449770(C)
|
:0044977E 3D900000C0              cmp eax, C0000090
:00449783 750C                    jne 00449791
:00449785 C7056C3C450081000000    mov dword ptr [00453C6C], 00000081
:0044978F EB5D                    jmp 004497EE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449783(C)
|
:00449791 3D910000C0              cmp eax, C0000091
:00449796 750C                    jne 004497A4
:00449798 C7056C3C450084000000    mov dword ptr [00453C6C], 00000084
:004497A2 EB4A                    jmp 004497EE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449796(C)
|
:004497A4 3D930000C0              cmp eax, C0000093
:004497A9 750C                    jne 004497B7
:004497AB C7056C3C450085000000    mov dword ptr [00453C6C], 00000085
:004497B5 EB37                    jmp 004497EE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004497A9(C)
|
:004497B7 3D8D0000C0              cmp eax, C000008D
:004497BC 750C                    jne 004497CA
:004497BE C7056C3C450082000000    mov dword ptr [00453C6C], 00000082
:004497C8 EB24                    jmp 004497EE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004497BC(C)
|
:004497CA 3D8F0000C0              cmp eax, C000008F
:004497CF 750C                    jne 004497DD
:004497D1 C7056C3C450086000000    mov dword ptr [00453C6C], 00000086
:004497DB EB11                    jmp 004497EE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004497CF(C)
|
:004497DD 3D920000C0              cmp eax, C0000092
:004497E2 750A                    jne 004497EE
:004497E4 C7056C3C45008A000000    mov dword ptr [00453C6C], 0000008A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044977C(U), :0044978F(U), :004497A2(U), :004497B5(U), :004497C8(U)
|:004497DB(U), :004497E2(C)
|
:004497EE A16C3C4500              mov eax, dword ptr [00453C6C]
:004497F3 50                      push eax
:004497F4 6A08                    push 00000008
:004497F6 FFD2                    call edx
:004497F8 83C408                  add esp, 00000008
:004497FB 893D6C3C4500            mov dword ptr [00453C6C], edi
:00449801 EB10                    jmp 00449813

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449727(C)
|
:00449803 C7400800000000          mov [eax+08], 00000000
:0044980A 8B4004                  mov eax, dword ptr [eax+04]
:0044980D 50                      push eax
:0044980E FFD2                    call edx
:00449810 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449801(U)
|
:00449813 B8FFFFFFFF              mov eax, FFFFFFFF
:00449818 5F                      pop edi
:00449819 8935703C4500            mov dword ptr [00453C70], esi
:0044981F 5E                      pop esi
:00449820 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004496E1(C), :004496EC(C)
|
:00449821 8B4C2410                mov ecx, dword ptr [esp+10]
:00449825 51                      push ecx

* Reference To: KERNEL32.UnhandledExceptionFilter, Ord:0226h
                                  |
:00449826 FF15C8734700            Call dword ptr [004773C8]
:0044982C 5F                      pop edi
:0044982D 5E                      pop esi
:0044982E C3                      ret


:0044982F CC                      int 03

* Referenced by a CALL at Address:
|:004496D7   
|

* Possible StringData Ref from Data Obj ->""
                                  |
:00449830 BAE83B4500              mov edx, 00453BE8
:00449835 8B4C2404                mov ecx, dword ptr [esp+04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449851(C)
|
:00449839 390A                    cmp dword ptr [edx], ecx
:0044983B 7416                    je 00449853
:0044983D 83C20C                  add edx, 0000000C
:00449840 A1683C4500              mov eax, dword ptr [00453C68]
:00449845 8D0440                  lea eax, dword ptr [eax+2*eax]
:00449848 8D0485E83B4500          lea eax, dword ptr [4*eax+00453BE8]
:0044984F 3BC2                    cmp eax, edx
:00449851 77E6                    ja 00449839

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044983B(C)
|
:00449853 8B02                    mov eax, dword ptr [edx]
:00449855 2BC1                    sub eax, ecx
:00449857 83F801                  cmp eax, 00000001
:0044985A 1BC0                    sbb eax, eax
:0044985C 23C2                    and eax, edx
:0044985E C3                      ret


:0044985F CC                      int 03

* Referenced by a CALL at Address:
|:0044854E   
|
:00449860 8B442404                mov eax, dword ptr [esp+04]
:00449864 6A04                    push 00000004
:00449866 6A00                    push 00000000
:00449868 50                      push eax
:00449869 E812000000              call 00449880
:0044986E 83C40C                  add esp, 0000000C
:00449871 C3                      ret


:00449872 CC                      int 03
:00449873 CC                      int 03
:00449874 CC                      int 03
:00449875 CC                      int 03
:00449876 CC                      int 03
:00449877 CC                      int 03
:00449878 CC                      int 03
:00449879 CC                      int 03
:0044987A CC                      int 03
:0044987B CC                      int 03
:0044987C CC                      int 03
:0044987D CC                      int 03
:0044987E CC                      int 03
:0044987F CC                      int 03

* Referenced by a CALL at Address:
|:00449869   
|
:00449880 33D2                    xor edx, edx
:00449882 33C9                    xor ecx, ecx
:00449884 8A542404                mov dl, byte ptr [esp+04]
:00449888 8A8A813C4500            mov cl, byte ptr [edx+00453C81]
:0044988E 854C240C                test dword ptr [esp+0C], ecx
:00449892 7520                    jne 004498B4
:00449894 8B442408                mov eax, dword ptr [esp+08]
:00449898 B900000000              mov ecx, 00000000
:0044989D 85C0                    test eax, eax
:0044989F 740C                    je 004498AD
:004498A1 33C9                    xor ecx, ecx
:004498A3 668B0C5542424500        mov cx, word ptr [2*edx+00454242]
:004498AB 23C8                    and ecx, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044989F(C)
|
:004498AD 85C9                    test ecx, ecx
:004498AF 7503                    jne 004498B4
:004498B1 33C0                    xor eax, eax
:004498B3 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00449892(C), :004498AF(C)
|
:004498B4 B801000000              mov eax, 00000001
:004498B9 C3                      ret


:004498BA CC                      int 03
:004498BB CC                      int 03
:004498BC CC                      int 03
:004498BD CC                      int 03
:004498BE CC                      int 03
:004498BF CC                      int 03

* Referenced by a CALL at Address:
|:00448518   
|
:004498C0 83EC04                  sub esp, 00000004
:004498C3 8B15703B4500            mov edx, dword ptr [00453B70]
:004498C9 53                      push ebx
:004498CA 56                      push esi
:004498CB 57                      push edi
:004498CC 33F6                    xor esi, esi
:004498CE 55                      push ebp
:004498CF 803A00                  cmp byte ptr [edx], 00
:004498D2 741A                    je 004498EE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004498EC(C)
|
:004498D4 803A3D                  cmp byte ptr [edx], 3D
:004498D7 7401                    je 004498DA
:004498D9 46                      inc esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004498D7(C)
|
:004498DA 8BFA                    mov edi, edx
:004498DC B9FFFFFFFF              mov ecx, FFFFFFFF
:004498E1 2BC0                    sub eax, eax
:004498E3 F2                      repnz
:004498E4 AE                      scasb
:004498E5 F7D1                    not ecx
:004498E7 03D1                    add edx, ecx
:004498E9 803A00                  cmp byte ptr [edx], 00
:004498EC 75E6                    jne 004498D4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004498D2(C)
|
:004498EE 8D04B504000000          lea eax, dword ptr [4*esi+00000004]
:004498F5 50                      push eax
:004498F6 E8C5F0FFFF              call 004489C0
:004498FB A3AC3B4500              mov dword ptr [00453BAC], eax
:00449900 83C404                  add esp, 00000004
:00449903 8BD8                    mov ebx, eax
:00449905 85DB                    test ebx, ebx
:00449907 750A                    jne 00449913
:00449909 6A09                    push 00000009
:0044990B E8F0ECFFFF              call 00448600
:00449910 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449907(C)
|
:00449913 8B2D703B4500            mov ebp, dword ptr [00453B70]
:00449919 8BC5                    mov eax, ebp
:0044991B 807D0000                cmp byte ptr [ebp+00], 00
:0044991F 745E                    je 0044997F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044997D(C)
|
:00449921 8BFD                    mov edi, ebp
:00449923 B9FFFFFFFF              mov ecx, FFFFFFFF
:00449928 2BC0                    sub eax, eax
:0044992A F2                      repnz
:0044992B AE                      scasb
:0044992C F7D1                    not ecx
:0044992E 894C2410                mov dword ptr [esp+10], ecx
:00449932 807D003D                cmp byte ptr [ebp+00], 3D
:00449936 743D                    je 00449975
:00449938 51                      push ecx
:00449939 E882F0FFFF              call 004489C0
:0044993E 83C404                  add esp, 00000004
:00449941 8903                    mov dword ptr [ebx], eax
:00449943 85C0                    test eax, eax
:00449945 750A                    jne 00449951
:00449947 6A09                    push 00000009
:00449949 E8B2ECFFFF              call 00448600
:0044994E 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449945(C)
|
:00449951 8BFD                    mov edi, ebp
:00449953 B9FFFFFFFF              mov ecx, FFFFFFFF
:00449958 2BC0                    sub eax, eax
:0044995A F2                      repnz
:0044995B AE                      scasb
:0044995C F7D1                    not ecx
:0044995E 2BF9                    sub edi, ecx
:00449960 8BC1                    mov eax, ecx
:00449962 C1E902                  shr ecx, 02
:00449965 8BF7                    mov esi, edi
:00449967 8B3B                    mov edi, dword ptr [ebx]
:00449969 83C304                  add ebx, 00000004
:0044996C F3                      repz
:0044996D A5                      movsd
:0044996E 8BC8                    mov ecx, eax
:00449970 83E103                  and ecx, 00000003
:00449973 F3                      repz
:00449974 A4                      movsb

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449936(C)
|
:00449975 036C2410                add ebp, dword ptr [esp+10]
:00449979 807D0000                cmp byte ptr [ebp+00], 00
:0044997D 75A2                    jne 00449921

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044991F(C)
|
:0044997F A1703B4500              mov eax, dword ptr [00453B70]
:00449984 50                      push eax
:00449985 E8360B0000              call 0044A4C0
:0044998A 83C404                  add esp, 00000004
:0044998D C70300000000            mov dword ptr [ebx], 00000000
:00449993 5D                      pop ebp
:00449994 5F                      pop edi
:00449995 5E                      pop esi
:00449996 5B                      pop ebx
:00449997 83C404                  add esp, 00000004
:0044999A C3                      ret


:0044999B CC                      int 03
:0044999C CC                      int 03
:0044999D CC                      int 03
:0044999E CC                      int 03
:0044999F CC                      int 03

* Referenced by a CALL at Address:
|:00448513   
|
:004499A0 83EC08                  sub esp, 00000008
:004499A3 56                      push esi
:004499A4 57                      push edi
:004499A5 6804010000              push 00000104
:004499AA BE80534700              mov esi, 00475380
:004499AF 56                      push esi
:004499B0 6A00                    push 00000000

* Reference To: KERNEL32.GetModuleFileNameA, Ord:00E9h
                                  |
:004499B2 FF15CC734700            Call dword ptr [004773CC]
:004499B8 A1BC6C4700              mov eax, dword ptr [00476CBC]
:004499BD 8935BC3B4500            mov dword ptr [00453BBC], esi
:004499C3 803800                  cmp byte ptr [eax], 00
:004499C6 7406                    je 004499CE
:004499C8 8B35BC6C4700            mov esi, dword ptr [00476CBC]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004499C6(C)
|
:004499CE 8D44240C                lea eax, dword ptr [esp+0C]
:004499D2 8D4C2408                lea ecx, dword ptr [esp+08]
:004499D6 50                      push eax
:004499D7 51                      push ecx
:004499D8 6A00                    push 00000000
:004499DA 6A00                    push 00000000
:004499DC 56                      push esi
:004499DD E85E000000              call 00449A40
:004499E2 8B44241C                mov eax, dword ptr [esp+1C]
:004499E6 83C414                  add esp, 00000014
:004499E9 C1E002                  shl eax, 02
:004499EC 0344240C                add eax, dword ptr [esp+0C]
:004499F0 50                      push eax
:004499F1 E8CAEFFFFF              call 004489C0
:004499F6 83C404                  add esp, 00000004
:004499F9 8BF8                    mov edi, eax
:004499FB 85FF                    test edi, edi
:004499FD 750A                    jne 00449A09
:004499FF 6A08                    push 00000008
:00449A01 E8FAEBFFFF              call 00448600
:00449A06 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004499FD(C)
|
:00449A09 8D44240C                lea eax, dword ptr [esp+0C]
:00449A0D 8D4C2408                lea ecx, dword ptr [esp+08]
:00449A11 8B542408                mov edx, dword ptr [esp+08]
:00449A15 50                      push eax
:00449A16 51                      push ecx
:00449A17 8D0497                  lea eax, dword ptr [edi+4*edx]
:00449A1A 50                      push eax
:00449A1B 57                      push edi
:00449A1C 56                      push esi
:00449A1D E81E000000              call 00449A40
:00449A22 8B44241C                mov eax, dword ptr [esp+1C]
:00449A26 83C414                  add esp, 00000014
:00449A29 48                      dec eax
:00449A2A 893DA43B4500            mov dword ptr [00453BA4], edi
:00449A30 5F                      pop edi
:00449A31 A3A03B4500              mov dword ptr [00453BA0], eax
:00449A36 5E                      pop esi
:00449A37 83C408                  add esp, 00000008
:00449A3A C3                      ret


:00449A3B CC                      int 03
:00449A3C CC                      int 03
:00449A3D CC                      int 03
:00449A3E CC                      int 03
:00449A3F CC                      int 03

* Referenced by a CALL at Addresses:
|:004499DD   , :00449A1D   
|
:00449A40 8B4C2414                mov ecx, dword ptr [esp+14]
:00449A44 53                      push ebx
:00449A45 8B542414                mov edx, dword ptr [esp+14]
:00449A49 56                      push esi
:00449A4A 8B74240C                mov esi, dword ptr [esp+0C]
:00449A4E 57                      push edi
:00449A4F 8B442418                mov eax, dword ptr [esp+18]
:00449A53 55                      push ebp
:00449A54 837C241800              cmp dword ptr [esp+18], 00000000
:00449A59 C70100000000            mov dword ptr [ecx], 00000000
:00449A5F C70201000000            mov dword ptr [edx], 00000001
:00449A65 740B                    je 00449A72
:00449A67 8B542418                mov edx, dword ptr [esp+18]
:00449A6B 8344241804              add dword ptr [esp+18], 00000004
:00449A70 8902                    mov dword ptr [edx], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449A65(C)
|
:00449A72 803E22                  cmp byte ptr [esi], 22
:00449A75 7446                    je 00449ABD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449AAA(C)
|
:00449A77 FF01                    inc dword ptr [ecx]
:00449A79 85C0                    test eax, eax
:00449A7B 7405                    je 00449A82
:00449A7D 8A16                    mov dl, byte ptr [esi]
:00449A7F 8810                    mov byte ptr [eax], dl
:00449A81 40                      inc eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449A7B(C)
|
:00449A82 8A16                    mov dl, byte ptr [esi]
:00449A84 46                      inc esi
:00449A85 33DB                    xor ebx, ebx
:00449A87 8ADA                    mov bl, dl
:00449A89 F683813C450004          test byte ptr [ebx+00453C81], 04
:00449A90 740C                    je 00449A9E
:00449A92 FF01                    inc dword ptr [ecx]
:00449A94 85C0                    test eax, eax
:00449A96 7405                    je 00449A9D
:00449A98 8A1E                    mov bl, byte ptr [esi]
:00449A9A 8818                    mov byte ptr [eax], bl
:00449A9C 40                      inc eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449A96(C)
|
:00449A9D 46                      inc esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449A90(C)
|
:00449A9E 80FA20                  cmp dl, 20
:00449AA1 7409                    je 00449AAC
:00449AA3 84D2                    test dl, dl
:00449AA5 7409                    je 00449AB0
:00449AA7 80FA09                  cmp dl, 09
:00449AAA 75CB                    jne 00449A77

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449AA1(C)
|
:00449AAC 84D2                    test dl, dl
:00449AAE 7503                    jne 00449AB3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449AA5(C)
|
:00449AB0 4E                      dec esi
:00449AB1 EB50                    jmp 00449B03

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449AAE(C)
|
:00449AB3 85C0                    test eax, eax
:00449AB5 744C                    je 00449B03
:00449AB7 C640FF00                mov [eax-01], 00
:00449ABB EB46                    jmp 00449B03

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449A75(C)
|
:00449ABD 46                      inc esi
:00449ABE 803E22                  cmp byte ptr [esi], 22
:00449AC1 7430                    je 00449AF3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449AF1(C)
|
:00449AC3 8A1E                    mov bl, byte ptr [esi]
:00449AC5 84DB                    test bl, bl
:00449AC7 742A                    je 00449AF3
:00449AC9 33D2                    xor edx, edx
:00449ACB 8AD3                    mov dl, bl
:00449ACD F682813C450004          test byte ptr [edx+00453C81], 04
:00449AD4 740C                    je 00449AE2
:00449AD6 FF01                    inc dword ptr [ecx]
:00449AD8 85C0                    test eax, eax
:00449ADA 7406                    je 00449AE2
:00449ADC 8A16                    mov dl, byte ptr [esi]
:00449ADE 46                      inc esi
:00449ADF 8810                    mov byte ptr [eax], dl
:00449AE1 40                      inc eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00449AD4(C), :00449ADA(C)
|
:00449AE2 FF01                    inc dword ptr [ecx]
:00449AE4 85C0                    test eax, eax
:00449AE6 7405                    je 00449AED
:00449AE8 8A16                    mov dl, byte ptr [esi]
:00449AEA 8810                    mov byte ptr [eax], dl
:00449AEC 40                      inc eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449AE6(C)
|
:00449AED 46                      inc esi
:00449AEE 803E22                  cmp byte ptr [esi], 22
:00449AF1 75D0                    jne 00449AC3

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00449AC1(C), :00449AC7(C)
|
:00449AF3 FF01                    inc dword ptr [ecx]
:00449AF5 85C0                    test eax, eax
:00449AF7 7404                    je 00449AFD
:00449AF9 C60000                  mov byte ptr [eax], 00
:00449AFC 40                      inc eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449AF7(C)
|
:00449AFD 803E22                  cmp byte ptr [esi], 22
:00449B00 7501                    jne 00449B03
:00449B02 46                      inc esi

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00449AB1(U), :00449AB5(C), :00449ABB(U), :00449B00(C)
|
:00449B03 33FF                    xor edi, edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449BF1(U)
|
:00449B05 803E00                  cmp byte ptr [esi], 00
:00449B08 0F84E8000000            je 00449BF6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449B1B(U)
|
:00449B0E 8A16                    mov dl, byte ptr [esi]
:00449B10 80FA20                  cmp dl, 20
:00449B13 7405                    je 00449B1A
:00449B15 80FA09                  cmp dl, 09
:00449B18 7503                    jne 00449B1D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449B13(C)
|
:00449B1A 46                      inc esi
:00449B1B EBF1                    jmp 00449B0E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449B18(C)
|
:00449B1D 803E00                  cmp byte ptr [esi], 00
:00449B20 0F84D0000000            je 00449BF6
:00449B26 837C241800              cmp dword ptr [esp+18], 00000000
:00449B2B 740B                    je 00449B38
:00449B2D 8B542418                mov edx, dword ptr [esp+18]
:00449B31 8344241804              add dword ptr [esp+18], 00000004
:00449B36 8902                    mov dword ptr [edx], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449B2B(C)
|
:00449B38 8B542420                mov edx, dword ptr [esp+20]
:00449B3C FF02                    inc dword ptr [edx]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00449BCA(U), :00449BE2(U)
|
:00449B3E BB01000000              mov ebx, 00000001
:00449B43 33ED                    xor ebp, ebp
:00449B45 803E5C                  cmp byte ptr [esi], 5C
:00449B48 7507                    jne 00449B51

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449B4F(C)
|
:00449B4A 46                      inc esi
:00449B4B 45                      inc ebp
:00449B4C 803E5C                  cmp byte ptr [esi], 5C
:00449B4F 74F9                    je 00449B4A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449B48(C)
|
:00449B51 803E22                  cmp byte ptr [esi], 22
:00449B54 7524                    jne 00449B7A
:00449B56 F7C501000000            test ebp, 00000001
:00449B5C 7519                    jne 00449B77
:00449B5E 85FF                    test edi, edi
:00449B60 740C                    je 00449B6E
:00449B62 8D5601                  lea edx, dword ptr [esi+01]
:00449B65 803A22                  cmp byte ptr [edx], 22
:00449B68 7504                    jne 00449B6E
:00449B6A 8BF2                    mov esi, edx
:00449B6C EB02                    jmp 00449B70

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00449B60(C), :00449B68(C)
|
:00449B6E 33DB                    xor ebx, ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449B6C(U)
|
:00449B70 83FF01                  cmp edi, 00000001
:00449B73 1BFF                    sbb edi, edi
:00449B75 F7DF                    neg edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449B5C(C)
|
:00449B77 C1ED01                  shr ebp, 01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449B54(C)
|
:00449B7A 8BD5                    mov edx, ebp
:00449B7C 4D                      dec ebp
:00449B7D 85D2                    test edx, edx
:00449B7F 7411                    je 00449B92

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449B90(C)
|
:00449B81 85C0                    test eax, eax
:00449B83 7404                    je 00449B89
:00449B85 C6005C                  mov byte ptr [eax], 5C
:00449B88 40                      inc eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449B83(C)
|
:00449B89 8BD5                    mov edx, ebp
:00449B8B FF01                    inc dword ptr [ecx]
:00449B8D 4D                      dec ebp
:00449B8E 85D2                    test edx, edx
:00449B90 75EF                    jne 00449B81

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449B7F(C)
|
:00449B92 8A16                    mov dl, byte ptr [esi]
:00449B94 84D2                    test dl, dl
:00449B96 744F                    je 00449BE7
:00449B98 85FF                    test edi, edi
:00449B9A 750A                    jne 00449BA6
:00449B9C 80FA20                  cmp dl, 20
:00449B9F 7446                    je 00449BE7
:00449BA1 80FA09                  cmp dl, 09
:00449BA4 7441                    je 00449BE7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449B9A(C)
|
:00449BA6 85DB                    test ebx, ebx
:00449BA8 7437                    je 00449BE1
:00449BAA 85C0                    test eax, eax
:00449BAC 7421                    je 00449BCF
:00449BAE 33DB                    xor ebx, ebx
:00449BB0 8ADA                    mov bl, dl
:00449BB2 F683813C450004          test byte ptr [ebx+00453C81], 04
:00449BB9 7406                    je 00449BC1
:00449BBB 8810                    mov byte ptr [eax], dl
:00449BBD 46                      inc esi
:00449BBE 40                      inc eax
:00449BBF FF01                    inc dword ptr [ecx]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449BB9(C)
|
:00449BC1 8A16                    mov dl, byte ptr [esi]
:00449BC3 40                      inc eax
:00449BC4 46                      inc esi
:00449BC5 8850FF                  mov byte ptr [eax-01], dl
:00449BC8 FF01                    inc dword ptr [ecx]
:00449BCA E96FFFFFFF              jmp 00449B3E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449BAC(C)
|
:00449BCF 33DB                    xor ebx, ebx
:00449BD1 8ADA                    mov bl, dl
:00449BD3 F683813C450004          test byte ptr [ebx+00453C81], 04
:00449BDA 7403                    je 00449BDF
:00449BDC 46                      inc esi
:00449BDD FF01                    inc dword ptr [ecx]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449BDA(C)
|
:00449BDF FF01                    inc dword ptr [ecx]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449BA8(C)
|
:00449BE1 46                      inc esi
:00449BE2 E957FFFFFF              jmp 00449B3E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00449B96(C), :00449B9F(C), :00449BA4(C)
|
:00449BE7 85C0                    test eax, eax
:00449BE9 7404                    je 00449BEF
:00449BEB C60000                  mov byte ptr [eax], 00
:00449BEE 40                      inc eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449BE9(C)
|
:00449BEF FF01                    inc dword ptr [ecx]
:00449BF1 E90FFFFFFF              jmp 00449B05

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00449B08(C), :00449B20(C)
|
:00449BF6 837C241800              cmp dword ptr [esp+18], 00000000
:00449BFB 740A                    je 00449C07
:00449BFD 8B542418                mov edx, dword ptr [esp+18]
:00449C01 C70200000000            mov dword ptr [edx], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449BFB(C)
|
:00449C07 8B542420                mov edx, dword ptr [esp+20]
:00449C0B 5D                      pop ebp
:00449C0C 5F                      pop edi
:00449C0D 5E                      pop esi
:00449C0E 5B                      pop ebx
:00449C0F FF02                    inc dword ptr [edx]
:00449C11 C3                      ret


:00449C12 CC                      int 03
:00449C13 CC                      int 03
:00449C14 CC                      int 03
:00449C15 CC                      int 03
:00449C16 CC                      int 03
:00449C17 CC                      int 03
:00449C18 CC                      int 03
:00449C19 CC                      int 03
:00449C1A CC                      int 03
:00449C1B CC                      int 03
:00449C1C CC                      int 03
:00449C1D CC                      int 03
:00449C1E CC                      int 03
:00449C1F CC                      int 03

* Referenced by a CALL at Address:
|:004484F2   
|
:00449C20 83EC04                  sub esp, 00000004
:00449C23 833D783C450000          cmp dword ptr [00453C78], 00000000
:00449C2A 53                      push ebx
:00449C2B 56                      push esi
:00449C2C 57                      push edi
:00449C2D 55                      push ebp
:00449C2E 7540                    jne 00449C70

* Reference To: KERNEL32.GetEnvironmentStringsW, Ord:00D2h
                                  |
:00449C30 8B35D8734700            mov esi, dword ptr [004773D8]
:00449C36 FFD6                    call esi
:00449C38 8BF8                    mov edi, eax
:00449C3A 85FF                    test edi, edi
:00449C3C 7410                    je 00449C4E
:00449C3E C705783C450001000000    mov dword ptr [00453C78], 00000001
:00449C48 8B5C2410                mov ebx, dword ptr [esp+10]
:00449C4C EB30                    jmp 00449C7E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449C3C(C)
|

* Reference To: KERNEL32.GetEnvironmentStrings, Ord:00D0h
                                  |
:00449C4E FF15D0734700            Call dword ptr [004773D0]
:00449C54 8BD8                    mov ebx, eax
:00449C56 85DB                    test ebx, ebx
:00449C58 740C                    je 00449C66
:00449C5A C705783C450002000000    mov dword ptr [00453C78], 00000002
:00449C64 EB18                    jmp 00449C7E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449C58(C)
|
:00449C66 33C0                    xor eax, eax
:00449C68 5D                      pop ebp
:00449C69 5F                      pop edi
:00449C6A 5E                      pop esi
:00449C6B 5B                      pop ebx
:00449C6C 83C404                  add esp, 00000004
:00449C6F C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449C2E(C)
|
:00449C70 8B7C2410                mov edi, dword ptr [esp+10]
:00449C74 8B5C2410                mov ebx, dword ptr [esp+10]

* Reference To: KERNEL32.GetEnvironmentStringsW, Ord:00D2h
                                  |
:00449C78 8B35D8734700            mov esi, dword ptr [004773D8]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00449C4C(U), :00449C64(U)
|
:00449C7E 833D783C450001          cmp dword ptr [00453C78], 00000001
:00449C85 0F85A2000000            jne 00449D2D
:00449C8B 85FF                    test edi, edi
:00449C8D 7512                    jne 00449CA1
:00449C8F FFD6                    call esi
:00449C91 8BF8                    mov edi, eax
:00449C93 85FF                    test edi, edi
:00449C95 750A                    jne 00449CA1
:00449C97 33C0                    xor eax, eax
:00449C99 5D                      pop ebp
:00449C9A 5F                      pop edi
:00449C9B 5E                      pop esi
:00449C9C 5B                      pop ebx
:00449C9D 83C404                  add esp, 00000004
:00449CA0 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00449C8D(C), :00449C95(C)
|
:00449CA1 66833F00                cmp word ptr [edi], 0000
:00449CA5 8BF7                    mov esi, edi
:00449CA7 7412                    je 00449CBB

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00449CB0(C), :00449CB9(C)
|
:00449CA9 83C602                  add esi, 00000002
:00449CAC 66833E00                cmp word ptr [esi], 0000
:00449CB0 75F7                    jne 00449CA9
:00449CB2 83C602                  add esi, 00000002
:00449CB5 66833E00                cmp word ptr [esi], 0000
:00449CB9 75EE                    jne 00449CA9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449CA7(C)
|
:00449CBB 2BF7                    sub esi, edi
:00449CBD 6A00                    push 00000000
:00449CBF C1FE01                  sar esi, 01
:00449CC2 6A00                    push 00000000
:00449CC4 46                      inc esi
:00449CC5 6A00                    push 00000000
:00449CC7 6A00                    push 00000000
:00449CC9 56                      push esi
:00449CCA 57                      push edi
:00449CCB 6A00                    push 00000000
:00449CCD 6A00                    push 00000000

* Reference To: KERNEL32.WideCharToMultiByte, Ord:0242h
                                  |
:00449CCF FF1598734700            Call dword ptr [00477398]
:00449CD5 8BE8                    mov ebp, eax
:00449CD7 85ED                    test ebp, ebp
:00449CD9 7441                    je 00449D1C
:00449CDB 55                      push ebp
:00449CDC E8DFECFFFF              call 004489C0
:00449CE1 83C404                  add esp, 00000004
:00449CE4 8BD8                    mov ebx, eax
:00449CE6 85DB                    test ebx, ebx
:00449CE8 7432                    je 00449D1C
:00449CEA 6A00                    push 00000000
:00449CEC 6A00                    push 00000000
:00449CEE 55                      push ebp
:00449CEF 53                      push ebx
:00449CF0 56                      push esi
:00449CF1 57                      push edi
:00449CF2 6A00                    push 00000000
:00449CF4 6A00                    push 00000000

* Reference To: KERNEL32.WideCharToMultiByte, Ord:0242h
                                  |
:00449CF6 FF1598734700            Call dword ptr [00477398]
:00449CFC 85C0                    test eax, eax
:00449CFE 750B                    jne 00449D0B
:00449D00 53                      push ebx
:00449D01 E8BA070000              call 0044A4C0
:00449D06 83C404                  add esp, 00000004
:00449D09 33DB                    xor ebx, ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449CFE(C)
|
:00449D0B 57                      push edi

* Reference To: KERNEL32.FreeEnvironmentStringsW, Ord:008Ch
                                  |
:00449D0C FF15D4734700            Call dword ptr [004773D4]
:00449D12 8BC3                    mov eax, ebx
:00449D14 5D                      pop ebp
:00449D15 5F                      pop edi
:00449D16 5E                      pop esi
:00449D17 5B                      pop ebx
:00449D18 83C404                  add esp, 00000004
:00449D1B C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00449CD9(C), :00449CE8(C)
|
:00449D1C 57                      push edi

* Reference To: KERNEL32.FreeEnvironmentStringsW, Ord:008Ch
                                  |
:00449D1D FF15D4734700            Call dword ptr [004773D4]
:00449D23 33C0                    xor eax, eax
:00449D25 5D                      pop ebp
:00449D26 5F                      pop edi
:00449D27 5E                      pop esi
:00449D28 5B                      pop ebx
:00449D29 83C404                  add esp, 00000004
:00449D2C C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449C85(C)
|
:00449D2D 833D783C450002          cmp dword ptr [00453C78], 00000002
:00449D34 757B                    jne 00449DB1
:00449D36 85DB                    test ebx, ebx
:00449D38 7516                    jne 00449D50

* Reference To: KERNEL32.GetEnvironmentStrings, Ord:00D0h
                                  |
:00449D3A FF15D0734700            Call dword ptr [004773D0]
:00449D40 8BD8                    mov ebx, eax
:00449D42 85DB                    test ebx, ebx
:00449D44 750A                    jne 00449D50
:00449D46 33C0                    xor eax, eax
:00449D48 5D                      pop ebp
:00449D49 5F                      pop edi
:00449D4A 5E                      pop esi
:00449D4B 5B                      pop ebx
:00449D4C 83C404                  add esp, 00000004
:00449D4F C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00449D38(C), :00449D44(C)
|
:00449D50 8BEB                    mov ebp, ebx
:00449D52 803B00                  cmp byte ptr [ebx], 00
:00449D55 740E                    je 00449D65

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00449D5C(C), :00449D63(C)
|
:00449D57 45                      inc ebp
:00449D58 807D0000                cmp byte ptr [ebp+00], 00
:00449D5C 75F9                    jne 00449D57
:00449D5E 45                      inc ebp
:00449D5F 807D0000                cmp byte ptr [ebp+00], 00
:00449D63 75F2                    jne 00449D57

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449D55(C)
|
:00449D65 2BEB                    sub ebp, ebx
:00449D67 45                      inc ebp
:00449D68 55                      push ebp
:00449D69 E852ECFFFF              call 004489C0
:00449D6E 89442414                mov dword ptr [esp+14], eax
:00449D72 83C404                  add esp, 00000004
:00449D75 85C0                    test eax, eax
:00449D77 7511                    jne 00449D8A
:00449D79 53                      push ebx

* Reference To: KERNEL32.FreeEnvironmentStringsA, Ord:008Bh
                                  |
:00449D7A FF15BC734700            Call dword ptr [004773BC]
:00449D80 33C0                    xor eax, eax
:00449D82 5D                      pop ebp
:00449D83 5F                      pop edi
:00449D84 5E                      pop esi
:00449D85 5B                      pop ebx
:00449D86 83C404                  add esp, 00000004
:00449D89 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449D77(C)
|
:00449D8A 8B7C2410                mov edi, dword ptr [esp+10]
:00449D8E 8BF3                    mov esi, ebx
:00449D90 8BCD                    mov ecx, ebp
:00449D92 C1E902                  shr ecx, 02
:00449D95 F3                      repz
:00449D96 A5                      movsd
:00449D97 8BCD                    mov ecx, ebp
:00449D99 53                      push ebx
:00449D9A 83E103                  and ecx, 00000003
:00449D9D F3                      repz
:00449D9E A4                      movsb

* Reference To: KERNEL32.FreeEnvironmentStringsA, Ord:008Bh
                                  |
:00449D9F FF15BC734700            Call dword ptr [004773BC]
:00449DA5 8B442410                mov eax, dword ptr [esp+10]
:00449DA9 5D                      pop ebp
:00449DAA 5F                      pop edi
:00449DAB 5E                      pop esi
:00449DAC 5B                      pop ebx
:00449DAD 83C404                  add esp, 00000004
:00449DB0 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449D34(C)
|
:00449DB1 33C0                    xor eax, eax
:00449DB3 5D                      pop ebp
:00449DB4 5F                      pop edi
:00449DB5 5E                      pop esi
:00449DB6 5B                      pop ebx
:00449DB7 83C404                  add esp, 00000004
:00449DBA C3                      ret


:00449DBB CC                      int 03
:00449DBC CC                      int 03
:00449DBD CC                      int 03
:00449DBE CC                      int 03
:00449DBF CC                      int 03

* Referenced by a CALL at Address:
|:0044A082   
|
:00449DC0 8B442404                mov eax, dword ptr [esp+04]
:00449DC4 83EC18                  sub esp, 00000018
:00449DC7 53                      push ebx
:00449DC8 56                      push esi
:00449DC9 57                      push edi
:00449DCA 55                      push ebp
:00449DCB 50                      push eax
:00449DCC E8CF010000              call 00449FA0
:00449DD1 83C404                  add esp, 00000004
:00449DD4 8BE8                    mov ebp, eax
:00449DD6 392D843D4500            cmp dword ptr [00453D84], ebp
:00449DDC 750A                    jne 00449DE8
:00449DDE 33C0                    xor eax, eax
:00449DE0 5D                      pop ebp
:00449DE1 5F                      pop edi
:00449DE2 5E                      pop esi
:00449DE3 5B                      pop ebx
:00449DE4 83C418                  add esp, 00000018
:00449DE7 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449DDC(C)
|
:00449DE8 85ED                    test ebp, ebp
:00449DEA 750F                    jne 00449DFB
:00449DEC E85F020000              call 0044A050
:00449DF1 33C0                    xor eax, eax
:00449DF3 5D                      pop ebp
:00449DF4 5F                      pop edi
:00449DF5 5E                      pop esi
:00449DF6 5B                      pop ebx
:00449DF7 83C418                  add esp, 00000018
:00449DFA C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449DEA(C)
|
:00449DFB C744241000000000        mov [esp+10], 00000000

* Possible StringData Ref from Data Obj ->""
                                  |
:00449E03 B8A83D4500              mov eax, 00453DA8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449E1C(C)
|
:00449E08 3928                    cmp dword ptr [eax], ebp
:00449E0A 0F849B000000            je 00449EAB
:00449E10 83C030                  add eax, 00000030
:00449E13 FF442410                inc [esp+10]
:00449E17 3D983E4500              cmp eax, 00453E98
:00449E1C 72EA                    jb 00449E08
:00449E1E 8D442414                lea eax, dword ptr [esp+14]
:00449E22 50                      push eax
:00449E23 55                      push ebp

* Reference To: KERNEL32.GetCPInfo, Ord:0098h
                                  |
:00449E24 FF1554734700            Call dword ptr [00477354]
:00449E2A 83F801                  cmp eax, 00000001
:00449E2D 0F8543010000            jne 00449F76
:00449E33 BF803C4500              mov edi, 00453C80
:00449E38 33C0                    xor eax, eax
:00449E3A B940000000              mov ecx, 00000040
:00449E3F F3                      repz
:00449E40 AB                      stosd
:00449E41 AA                      stosb
:00449E42 837C241401              cmp dword ptr [esp+14], 00000001
:00449E47 0F8606010000            jbe 00449F53
:00449E4D 8D74241A                lea esi, dword ptr [esp+1A]
:00449E51 3844241A                cmp byte ptr [esp+1A], al
:00449E55 742C                    je 00449E83

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449E81(C)
|
:00449E57 8A4E01                  mov cl, byte ptr [esi+01]
:00449E5A 84C9                    test cl, cl
:00449E5C 7425                    je 00449E83
:00449E5E 33C0                    xor eax, eax
:00449E60 33D2                    xor edx, edx
:00449E62 8A06                    mov al, byte ptr [esi]
:00449E64 8AD1                    mov dl, cl
:00449E66 3BD0                    cmp edx, eax
:00449E68 7211                    jb 00449E7B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449E79(C)
|
:00449E6A 8088813C450004          or byte ptr [eax+00453C81], 04
:00449E71 40                      inc eax
:00449E72 33C9                    xor ecx, ecx
:00449E74 8A4E01                  mov cl, byte ptr [esi+01]
:00449E77 3BC8                    cmp ecx, eax
:00449E79 73EF                    jnb 00449E6A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449E68(C)
|
:00449E7B 83C602                  add esi, 00000002
:00449E7E 803E00                  cmp byte ptr [esi], 00
:00449E81 75D4                    jne 00449E57

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00449E55(C), :00449E5C(C)
|
:00449E83 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449E95(C)
|
:00449E88 8088813C450008          or byte ptr [eax+00453C81], 08
:00449E8F 40                      inc eax
:00449E90 3DFF000000              cmp eax, 000000FF
:00449E95 72F1                    jb 00449E88
:00449E97 55                      push ebp
:00449E98 892D843D4500            mov dword ptr [00453D84], ebp
:00449E9E E84D010000              call 00449FF0
:00449EA3 83C404                  add esp, 00000004
:00449EA6 E9AF000000              jmp 00449F5A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449E0A(C)
|
:00449EAB BF803C4500              mov edi, 00453C80
:00449EB0 33C0                    xor eax, eax
:00449EB2 B940000000              mov ecx, 00000040
:00449EB7 F3                      repz
:00449EB8 AB                      stosd
:00449EB9 AA                      stosb
:00449EBA 8B4C2410                mov ecx, dword ptr [esp+10]
:00449EBE 8D1449                  lea edx, dword ptr [ecx+2*ecx]
:00449EC1 8D3C5500000000          lea edi, dword ptr [2*edx+00000000]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449F0C(C)
|
:00449EC8 8D0C38                  lea ecx, dword ptr [eax+edi]
:00449ECB 8D34CDB83D4500          lea esi, dword ptr [8*ecx+00453DB8]
:00449ED2 803E00                  cmp byte ptr [esi], 00
:00449ED5 7431                    je 00449F08

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449F06(C)
|
:00449ED7 8A4E01                  mov cl, byte ptr [esi+01]
:00449EDA 84C9                    test cl, cl
:00449EDC 742A                    je 00449F08
:00449EDE 33D2                    xor edx, edx
:00449EE0 33DB                    xor ebx, ebx
:00449EE2 8A16                    mov dl, byte ptr [esi]
:00449EE4 8AD9                    mov bl, cl
:00449EE6 3BDA                    cmp ebx, edx
:00449EE8 7216                    jb 00449F00
:00449EEA 8A88A03D4500            mov cl, byte ptr [eax+00453DA0]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449EFE(C)
|
:00449EF0 088A813C4500            or byte ptr [edx+00453C81], cl
:00449EF6 42                      inc edx
:00449EF7 33DB                    xor ebx, ebx
:00449EF9 8A5E01                  mov bl, byte ptr [esi+01]
:00449EFC 3BDA                    cmp ebx, edx
:00449EFE 73F0                    jnb 00449EF0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449EE8(C)
|
:00449F00 83C602                  add esi, 00000002
:00449F03 803E00                  cmp byte ptr [esi], 00
:00449F06 75CF                    jne 00449ED7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00449ED5(C), :00449EDC(C)
|
:00449F08 40                      inc eax
:00449F09 83F804                  cmp eax, 00000004
:00449F0C 72BA                    jb 00449EC8
:00449F0E 55                      push ebp
:00449F0F 892D843D4500            mov dword ptr [00453D84], ebp
:00449F15 E8D6000000              call 00449FF0
:00449F1A A3883D4500              mov dword ptr [00453D88], eax
:00449F1F 8B442414                mov eax, dword ptr [esp+14]
:00449F23 C1E004                  shl eax, 04
:00449F26 8B9C40B03D4500          mov ebx, dword ptr [eax+2*eax+00453DB0]
:00449F2D 83C404                  add esp, 00000004
:00449F30 BA903D4500              mov edx, 00453D90
:00449F35 8D8C40AC3D4500          lea ecx, dword ptr [eax+2*eax+00453DAC]
:00449F3C 5D                      pop ebp
:00449F3D 5F                      pop edi
:00449F3E 5E                      pop esi
:00449F3F 8B01                    mov eax, dword ptr [ecx]
:00449F41 8B4908                  mov ecx, dword ptr [ecx+08]
:00449F44 8902                    mov dword ptr [edx], eax
:00449F46 33C0                    xor eax, eax
:00449F48 895A04                  mov dword ptr [edx+04], ebx
:00449F4B 5B                      pop ebx
:00449F4C 894A08                  mov dword ptr [edx+08], ecx
:00449F4F 83C418                  add esp, 00000018
:00449F52 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449E47(C)
|
:00449F53 33C0                    xor eax, eax
:00449F55 A3843D4500              mov dword ptr [00453D84], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449EA6(U)
|
:00449F5A B9903D4500              mov ecx, 00453D90
:00449F5F 5D                      pop ebp
:00449F60 5F                      pop edi
:00449F61 A3883D4500              mov dword ptr [00453D88], eax
:00449F66 33C0                    xor eax, eax
:00449F68 5E                      pop esi
:00449F69 5B                      pop ebx
:00449F6A 8901                    mov dword ptr [ecx], eax
:00449F6C 894104                  mov dword ptr [ecx+04], eax
:00449F6F 894108                  mov dword ptr [ecx+08], eax
:00449F72 83C418                  add esp, 00000018
:00449F75 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449E2D(C)
|
:00449F76 833D9C3D450000          cmp dword ptr [00453D9C], 00000000
:00449F7D 740F                    je 00449F8E
:00449F7F E8CC000000              call 0044A050
:00449F84 33C0                    xor eax, eax
:00449F86 5D                      pop ebp
:00449F87 5F                      pop edi
:00449F88 5E                      pop esi
:00449F89 5B                      pop ebx
:00449F8A 83C418                  add esp, 00000018
:00449F8D C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449F7D(C)
|
:00449F8E B8FFFFFFFF              mov eax, FFFFFFFF
:00449F93 5D                      pop ebp
:00449F94 5F                      pop edi
:00449F95 5E                      pop esi
:00449F96 5B                      pop ebx
:00449F97 83C418                  add esp, 00000018
:00449F9A C3                      ret


:00449F9B CC                      int 03
:00449F9C CC                      int 03
:00449F9D CC                      int 03
:00449F9E CC                      int 03
:00449F9F CC                      int 03

* Referenced by a CALL at Address:
|:00449DCC   
|
:00449FA0 C7059C3D450000000000    mov dword ptr [00453D9C], 00000000
:00449FAA 8B442404                mov eax, dword ptr [esp+04]
:00449FAE 83F8FE                  cmp eax, FFFFFFFE
:00449FB1 7510                    jne 00449FC3
:00449FB3 C7059C3D450001000000    mov dword ptr [00453D9C], 00000001

* Reference To: KERNEL32.GetOEMCP, Ord:00F6h
                                  |
:00449FBD FF254C734700            Jmp dword ptr [0047734C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449FB1(C)
|
:00449FC3 83F8FD                  cmp eax, FFFFFFFD
:00449FC6 7510                    jne 00449FD8
:00449FC8 C7059C3D450001000000    mov dword ptr [00453D9C], 00000001

* Reference To: KERNEL32.GetACP, Ord:0092h
                                  |
:00449FD2 FF2550734700            Jmp dword ptr [00477350]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449FC6(C)
|
:00449FD8 83F8FC                  cmp eax, FFFFFFFC
:00449FDB 750F                    jne 00449FEC
:00449FDD C7059C3D450001000000    mov dword ptr [00453D9C], 00000001
:00449FE7 A160444500              mov eax, dword ptr [00454460]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449FDB(C)
|
:00449FEC C3                      ret
:00449FED CC                      int 03
:00449FEE CC                      int 03
:00449FEF CC                      int 03

* Referenced by a CALL at Addresses:
|:00449E9E   , :00449F15   
|
:00449FF0 8B442404                mov eax, dword ptr [esp+04]
:00449FF4 2DA4030000              sub eax, 000003A4
:00449FF9 83F812                  cmp eax, 00000012
:00449FFC 770F                    ja 0044A00D
:00449FFE 33C9                    xor ecx, ecx
:0044A000 8A883CA04400            mov cl, byte ptr [eax+0044A03C]
:0044A006 FF248D28A04400          jmp dword ptr [4*ecx+0044A028]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449FFC(C)
|
:0044A00D 33C0                    xor eax, eax
:0044A00F C3                      ret


:0044A010 B811040000              mov eax, 00000411
:0044A015 C3                      ret


:0044A016 B804080000              mov eax, 00000804
:0044A01B C3                      ret


:0044A01C B812040000              mov eax, 00000412
:0044A021 C3                      ret


:0044A022 B804040000              mov eax, 00000404
:0044A027 C3                      ret



:0044A028 10A04400                DWORD 0044A010
:0044A02C 16A04400                DWORD 0044A016
:0044A030 1CA04400                DWORD 0044A01C
:0044A034 22A04400                DWORD 0044A022
:0044A038 0DA04400                DWORD 0044A00D


:0044A03C 000404                  add byte ptr [esp+eax], al
:0044A03F 0401                    add al, 01
:0044A041 0404                    add al, 04
:0044A043 0404                    add al, 04
:0044A045 0404                    add al, 04
:0044A047 0404                    add al, 04
:0044A049 0404                    add al, 04
:0044A04B 0404                    add al, 04
:0044A04D 0203                    add al, byte ptr [ebx]
:0044A04F CC                      int 03

* Referenced by a CALL at Addresses:
|:00449DEC   , :00449F7F   
|
:0044A050 57                      push edi
:0044A051 33C0                    xor eax, eax
:0044A053 BF803C4500              mov edi, 00453C80
:0044A058 B940000000              mov ecx, 00000040
:0044A05D F3                      repz
:0044A05E AB                      stosd
:0044A05F AA                      stosb
:0044A060 A3903D4500              mov dword ptr [00453D90], eax
:0044A065 B9903D4500              mov ecx, 00453D90
:0044A06A 5F                      pop edi
:0044A06B A3843D4500              mov dword ptr [00453D84], eax
:0044A070 A3883D4500              mov dword ptr [00453D88], eax
:0044A075 894104                  mov dword ptr [ecx+04], eax
:0044A078 894108                  mov dword ptr [ecx+08], eax
:0044A07B C3                      ret


:0044A07C CC                      int 03
:0044A07D CC                      int 03
:0044A07E CC                      int 03
:0044A07F CC                      int 03

* Referenced by a CALL at Address:
|:004484E2   
|
:0044A080 6AFD                    push FFFFFFFD
:0044A082 E839FDFFFF              call 00449DC0
:0044A087 83C404                  add esp, 00000004
:0044A08A C3                      ret


:0044A08B CC                      int 03
:0044A08C CC                      int 03
:0044A08D CC                      int 03
:0044A08E CC                      int 03
:0044A08F CC                      int 03

* Referenced by a CALL at Address:
|:004484DD   
|
:0044A090 83EC44                  sub esp, 00000044
:0044A093 53                      push ebx
:0044A094 56                      push esi
:0044A095 57                      push edi
:0044A096 55                      push ebp
:0044A097 6800010000              push 00000100
:0044A09C E81FE9FFFF              call 004489C0
:0044A0A1 83C404                  add esp, 00000004
:0044A0A4 8BF0                    mov esi, eax
:0044A0A6 85F6                    test esi, esi
:0044A0A8 750A                    jne 0044A0B4
:0044A0AA 6A1B                    push 0000001B
:0044A0AC E84FE5FFFF              call 00448600
:0044A0B1 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A0A8(C)
|
:0044A0B4 8D8600010000            lea eax, dword ptr [esi+00000100]
:0044A0BA 8935B06B4700            mov dword ptr [00476BB0], esi
:0044A0C0 C705A46B470020000000    mov dword ptr [00476BA4], 00000020
:0044A0CA 3BC6                    cmp eax, esi
:0044A0CC 7625                    jbe 0044A0F3
:0044A0CE 33C9                    xor ecx, ecx
:0044A0D0 BA0A000000              mov edx, 0000000A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A0F1(C)
|
:0044A0D5 884E04                  mov byte ptr [esi+04], cl
:0044A0D8 83C608                  add esi, 00000008
:0044A0DB C746F8FFFFFFFF          mov [esi-08], FFFFFFFF
:0044A0E2 8856FD                  mov byte ptr [esi-03], dl
:0044A0E5 A1B06B4700              mov eax, dword ptr [00476BB0]
:0044A0EA 0500010000              add eax, 00000100
:0044A0EF 3BC6                    cmp eax, esi
:0044A0F1 77E2                    ja 0044A0D5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A0CC(C)
|
:0044A0F3 8D442410                lea eax, dword ptr [esp+10]
:0044A0F7 50                      push eax

* Reference To: KERNEL32.GetStartupInfoA, Ord:0114h
                                  |
:0044A0F8 FF15B0734700            Call dword ptr [004773B0]
:0044A0FE 66837C244200            cmp word ptr [esp+42], 0000
:0044A104 0F84CE000000            je 0044A1D8
:0044A10A 837C244400              cmp dword ptr [esp+44], 00000000
:0044A10F 0F84C3000000            je 0044A1D8
:0044A115 8B442444                mov eax, dword ptr [esp+44]
:0044A119 8B38                    mov edi, dword ptr [eax]
:0044A11B 8D5804                  lea ebx, dword ptr [eax+04]
:0044A11E 81FF00080000            cmp edi, 00000800
:0044A124 8D341F                  lea esi, dword ptr [edi+ebx]
:0044A127 7C05                    jl 0044A12E
:0044A129 BF00080000              mov edi, 00000800

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A127(C)
|
:0044A12E 3B3DA46B4700            cmp edi, dword ptr [00476BA4]
:0044A134 7E5D                    jle 0044A193
:0044A136 BDB46B4700              mov ebp, 00476BB4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A189(C)
|
:0044A13B 6800010000              push 00000100
:0044A140 E87BE8FFFF              call 004489C0
:0044A145 83C404                  add esp, 00000004
:0044A148 85C0                    test eax, eax
:0044A14A 7441                    je 0044A18D
:0044A14C 8D8800010000            lea ecx, dword ptr [eax+00000100]
:0044A152 894500                  mov dword ptr [ebp+00], eax
:0044A155 8305A46B470020          add dword ptr [00476BA4], 00000020
:0044A15C 3BC8                    cmp ecx, eax
:0044A15E 7620                    jbe 0044A180
:0044A160 33C9                    xor ecx, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A17E(C)
|
:0044A162 884804                  mov byte ptr [eax+04], cl
:0044A165 83C008                  add eax, 00000008
:0044A168 C740F8FFFFFFFF          mov [eax-08], FFFFFFFF
:0044A16F C640FD0A                mov [eax-03], 0A
:0044A173 8B5500                  mov edx, dword ptr [ebp+00]
:0044A176 81C200010000            add edx, 00000100
:0044A17C 3BD0                    cmp edx, eax
:0044A17E 77E2                    ja 0044A162

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A15E(C)
|
:0044A180 83C504                  add ebp, 00000004
:0044A183 3B3DA46B4700            cmp edi, dword ptr [00476BA4]
:0044A189 7FB0                    jg 0044A13B
:0044A18B EB06                    jmp 0044A193

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A14A(C)
|
:0044A18D 8B3DA46B4700            mov edi, dword ptr [00476BA4]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044A134(C), :0044A18B(U)
|
:0044A193 33ED                    xor ebp, ebp
:0044A195 85FF                    test edi, edi
:0044A197 7E3F                    jle 0044A1D8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A1D6(C)
|
:0044A199 8B06                    mov eax, dword ptr [esi]
:0044A19B 83F8FF                  cmp eax, FFFFFFFF
:0044A19E 742F                    je 0044A1CF
:0044A1A0 F60301                  test byte ptr [ebx], 01
:0044A1A3 742A                    je 0044A1CF
:0044A1A5 50                      push eax

* Reference To: KERNEL32.GetFileType, Ord:00DCh
                                  |
:0044A1A6 FF15A0734700            Call dword ptr [004773A0]
:0044A1AC 85C0                    test eax, eax
:0044A1AE 741F                    je 0044A1CF
:0044A1B0 8BC5                    mov eax, ebp
:0044A1B2 8BCD                    mov ecx, ebp
:0044A1B4 83E0E7                  and eax, FFFFFFE7
:0044A1B7 83E11F                  and ecx, 0000001F
:0044A1BA C1F803                  sar eax, 03
:0044A1BD 8B90B06B4700            mov edx, dword ptr [eax+00476BB0]
:0044A1C3 8B06                    mov eax, dword ptr [esi]
:0044A1C5 8D0CCA                  lea ecx, dword ptr [edx+8*ecx]
:0044A1C8 8901                    mov dword ptr [ecx], eax
:0044A1CA 8A13                    mov dl, byte ptr [ebx]
:0044A1CC 885104                  mov byte ptr [ecx+04], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044A19E(C), :0044A1A3(C), :0044A1AE(C)
|
:0044A1CF 45                      inc ebp
:0044A1D0 43                      inc ebx
:0044A1D1 83C604                  add esi, 00000004
:0044A1D4 3BEF                    cmp ebp, edi
:0044A1D6 7CC1                    jl 0044A199

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044A104(C), :0044A10F(C), :0044A197(C)
|
:0044A1D8 33F6                    xor esi, esi

* Reference To: KERNEL32.GetStdHandle, Ord:0116h
                                  |
:0044A1DA 8B3D44734700            mov edi, dword ptr [00477344]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A24D(C)
|
:0044A1E0 8D1CF500000000          lea ebx, dword ptr [8*esi+00000000]
:0044A1E7 031DB06B4700            add ebx, dword ptr [00476BB0]
:0044A1ED 833BFF                  cmp dword ptr [ebx], FFFFFFFF
:0044A1F0 7553                    jne 0044A245
:0044A1F2 B8F6FFFFFF              mov eax, FFFFFFF6
:0044A1F7 85F6                    test esi, esi
:0044A1F9 C6430481                mov [ebx+04], 81
:0044A1FD 740E                    je 0044A20D
:0044A1FF 8D46FF                  lea eax, dword ptr [esi-01]
:0044A202 83F801                  cmp eax, 00000001
:0044A205 B8F5FFFFFF              mov eax, FFFFFFF5
:0044A20A 83D0FF                  adc eax, FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A1FD(C)
|
:0044A20D 50                      push eax
:0044A20E FFD7                    call edi
:0044A210 83F8FF                  cmp eax, FFFFFFFF
:0044A213 8BE8                    mov ebp, eax
:0044A215 7428                    je 0044A23F
:0044A217 55                      push ebp

* Reference To: KERNEL32.GetFileType, Ord:00DCh
                                  |
:0044A218 FF15A0734700            Call dword ptr [004773A0]
:0044A21E 85C0                    test eax, eax
:0044A220 741D                    je 0044A23F
:0044A222 25FF000000              and eax, 000000FF
:0044A227 892B                    mov dword ptr [ebx], ebp
:0044A229 83F802                  cmp eax, 00000002
:0044A22C 7506                    jne 0044A234
:0044A22E 804B0440                or byte ptr [ebx+04], 40
:0044A232 EB15                    jmp 0044A249

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A22C(C)
|
:0044A234 83F803                  cmp eax, 00000003
:0044A237 7510                    jne 0044A249
:0044A239 804B0408                or byte ptr [ebx+04], 08
:0044A23D EB0A                    jmp 0044A249

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044A215(C), :0044A220(C)
|
:0044A23F 804B0440                or byte ptr [ebx+04], 40
:0044A243 EB04                    jmp 0044A249

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A1F0(C)
|
:0044A245 804B0480                or byte ptr [ebx+04], 80

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044A232(U), :0044A237(C), :0044A23D(U), :0044A243(U)
|
:0044A249 46                      inc esi
:0044A24A 83FE03                  cmp esi, 00000003
:0044A24D 7C91                    jl 0044A1E0
:0044A24F A1A46B4700              mov eax, dword ptr [00476BA4]
:0044A254 50                      push eax

* Reference To: KERNEL32.SetHandleCount, Ord:01FAh
                                  |
:0044A255 FF1528734700            Call dword ptr [00477328]
:0044A25B 5D                      pop ebp
:0044A25C 5F                      pop edi
:0044A25D 5E                      pop esi
:0044A25E 5B                      pop ebx
:0044A25F 83C444                  add esp, 00000044
:0044A262 C3                      ret


:0044A263 CC                      int 03
:0044A264 CC                      int 03
:0044A265 CC                      int 03
:0044A266 CC                      int 03
:0044A267 CC                      int 03
:0044A268 CC                      int 03
:0044A269 CC                      int 03
:0044A26A CC                      int 03
:0044A26B CC                      int 03
:0044A26C CC                      int 03
:0044A26D CC                      int 03
:0044A26E CC                      int 03
:0044A26F CC                      int 03

* Referenced by a CALL at Address:
|:004484D1   
|
:0044A270 6A00                    push 00000000
:0044A272 6800100000              push 00001000
:0044A277 6A01                    push 00000001

* Reference To: KERNEL32.HeapCreate, Ord:0155h
                                  |
:0044A279 FF1540734700            Call dword ptr [00477340]
:0044A27F A3A06B4700              mov dword ptr [00476BA0], eax
:0044A284 C3                      ret


:0044A285 CC                      int 03
:0044A286 CC                      int 03
:0044A287 CC                      int 03
:0044A288 CC                      int 03
:0044A289 CC                      int 03
:0044A28A CC                      int 03
:0044A28B CC                      int 03
:0044A28C CC                      int 03
:0044A28D CC                      int 03
:0044A28E CC                      int 03
:0044A28F CC                      int 03

* Referenced by a CALL at Address:
|:00448609   
|
:0044A290 A17C3B4500              mov eax, dword ptr [00453B7C]
:0044A295 83F801                  cmp eax, 00000001
:0044A298 740D                    je 0044A2A7
:0044A29A 85C0                    test eax, eax
:0044A29C 752E                    jne 0044A2CC
:0044A29E 833D803B450001          cmp dword ptr [00453B80], 00000001
:0044A2A5 7525                    jne 0044A2CC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A298(C)
|
:0044A2A7 68FC000000              push 000000FC
:0044A2AC E81F000000              call 0044A2D0
:0044A2B1 83C404                  add esp, 00000004
:0044A2B4 A190414500              mov eax, dword ptr [00454190]
:0044A2B9 85C0                    test eax, eax
:0044A2BB 7402                    je 0044A2BF
:0044A2BD FFD0                    call eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A2BB(C)
|
:0044A2BF 68FF000000              push 000000FF
:0044A2C4 E807000000              call 0044A2D0
:0044A2C9 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044A29C(C), :0044A2A5(C)
|
:0044A2CC C3                      ret
:0044A2CD CC                      int 03
:0044A2CE CC                      int 03
:0044A2CF CC                      int 03

* Referenced by a CALL at Addresses:
|:00448613   , :0044A2AC   , :0044A2C4   , :0044A4E2   
|
:0044A2D0 81ECA8010000            sub esp, 000001A8
:0044A2D6 33C0                    xor eax, eax

* Possible StringData Ref from Data Obj ->""
                                  |
:0044A2D8 B908414500              mov ecx, 00454108
:0044A2DD 53                      push ebx
:0044A2DE 8B9424B0010000          mov edx, dword ptr [esp+000001B0]
:0044A2E5 56                      push esi
:0044A2E6 57                      push edi
:0044A2E7 55                      push ebp

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A2F6(C)
|
:0044A2E8 3911                    cmp dword ptr [ecx], edx
:0044A2EA 740C                    je 0044A2F8
:0044A2EC 83C108                  add ecx, 00000008
:0044A2EF 40                      inc eax
:0044A2F0 81F990414500            cmp ecx, 00454190
:0044A2F6 72F0                    jb 0044A2E8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A2EA(C)
|
:0044A2F8 3914C508414500          cmp dword ptr [8*eax+00454108], edx
:0044A2FF 8D1CC500000000          lea ebx, dword ptr [8*eax+00000000]
:0044A306 0F85A7010000            jne 0044A4B3
:0044A30C 833D7C3B450001          cmp dword ptr [00453B7C], 00000001
:0044A313 0F845F010000            je 0044A478
:0044A319 833D7C3B450000          cmp dword ptr [00453B7C], 00000000
:0044A320 750D                    jne 0044A32F
:0044A322 833D803B450001          cmp dword ptr [00453B80], 00000001
:0044A329 0F8449010000            je 0044A478

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A320(C)
|
:0044A32F 81FAFC000000            cmp edx, 000000FC
:0044A335 0F8478010000            je 0044A4B3
:0044A33B 8D8424B4000000          lea eax, dword ptr [esp+000000B4]
:0044A342 6804010000              push 00000104
:0044A347 50                      push eax

* Reference To: KERNEL32.GetModuleFileNameA, Ord:00E9h
                                  |
:0044A348 8B2DCC734700            mov ebp, dword ptr [004773CC]
:0044A34E 6A00                    push 00000000
:0044A350 FFD5                    call ebp
:0044A352 85C0                    test eax, eax
:0044A354 7516                    jne 0044A36C

* Possible StringData Ref from Data Obj ->"<program name unknown>"
                                  |
:0044A356 BEE0414500              mov esi, 004541E0
:0044A35B 8DBC24B4000000          lea edi, dword ptr [esp+000000B4]
:0044A362 B905000000              mov ecx, 00000005
:0044A367 F3                      repz
:0044A368 A5                      movsd
:0044A369 66A5                    movsw
:0044A36B A4                      movsb

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A354(C)
|
:0044A36C 8DAC24B4000000          lea ebp, dword ptr [esp+000000B4]
:0044A373 8DBC24B4000000          lea edi, dword ptr [esp+000000B4]
:0044A37A B9FFFFFFFF              mov ecx, FFFFFFFF
:0044A37F 2BC0                    sub eax, eax
:0044A381 F2                      repnz
:0044A382 AE                      scasb
:0044A383 F7D1                    not ecx
:0044A385 83F93C                  cmp ecx, 0000003C
:0044A388 7626                    jbe 0044A3B0
:0044A38A 8DBC24B4000000          lea edi, dword ptr [esp+000000B4]
:0044A391 B9FFFFFFFF              mov ecx, FFFFFFFF
:0044A396 2BC0                    sub eax, eax
:0044A398 6A03                    push 00000003
:0044A39A F2                      repnz
:0044A39B AE                      scasb
:0044A39C F7D1                    not ecx
:0044A39E 8D6C0C7C                lea ebp, dword ptr [esp+ecx+7C]

* Possible StringData Ref from Data Obj ->"..."
                                  |
:0044A3A2 68DC414500              push 004541DC
:0044A3A7 55                      push ebp
:0044A3A8 E8F3020000              call 0044A6A0
:0044A3AD 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A388(C)
|

* Possible StringData Ref from Data Obj ->"Runtime Error!

Program: "
                                  |
:0044A3B0 BEC0414500              mov esi, 004541C0
:0044A3B5 8D7C2414                lea edi, dword ptr [esp+14]
:0044A3B9 B906000000              mov ecx, 00000006
:0044A3BE F3                      repz
:0044A3BF A5                      movsd
:0044A3C0 66A5                    movsw
:0044A3C2 8BFD                    mov edi, ebp
:0044A3C4 B9FFFFFFFF              mov ecx, FFFFFFFF
:0044A3C9 2BC0                    sub eax, eax
:0044A3CB F2                      repnz
:0044A3CC AE                      scasb
:0044A3CD F7D1                    not ecx
:0044A3CF 2BF9                    sub edi, ecx
:0044A3D1 8BD1                    mov edx, ecx
:0044A3D3 8BF7                    mov esi, edi
:0044A3D5 B9FFFFFFFF              mov ecx, FFFFFFFF
:0044A3DA 8D7C2414                lea edi, dword ptr [esp+14]
:0044A3DE 2BC0                    sub eax, eax
:0044A3E0 F2                      repnz
:0044A3E1 AE                      scasb
:0044A3E2 4F                      dec edi
:0044A3E3 8BCA                    mov ecx, edx
:0044A3E5 C1E902                  shr ecx, 02
:0044A3E8 F3                      repz
:0044A3E9 A5                      movsd
:0044A3EA 8BCA                    mov ecx, edx
:0044A3EC 83E103                  and ecx, 00000003
:0044A3EF F3                      repz
:0044A3F0 A4                      movsb

* Possible StringData Ref from Data Obj ->"

"
                                  |
:0044A3F1 BFBC414500              mov edi, 004541BC
:0044A3F6 B9FFFFFFFF              mov ecx, FFFFFFFF
:0044A3FB 2BC0                    sub eax, eax
:0044A3FD F2                      repnz
:0044A3FE AE                      scasb
:0044A3FF F7D1                    not ecx
:0044A401 2BF9                    sub edi, ecx
:0044A403 8BD1                    mov edx, ecx
:0044A405 8BF7                    mov esi, edi
:0044A407 B9FFFFFFFF              mov ecx, FFFFFFFF
:0044A40C 8D7C2414                lea edi, dword ptr [esp+14]
:0044A410 2BC0                    sub eax, eax
:0044A412 F2                      repnz
:0044A413 AE                      scasb
:0044A414 4F                      dec edi
:0044A415 8BCA                    mov ecx, edx
:0044A417 C1E902                  shr ecx, 02
:0044A41A F3                      repz
:0044A41B A5                      movsd
:0044A41C 8BCA                    mov ecx, edx
:0044A41E 83E103                  and ecx, 00000003
:0044A421 F3                      repz
:0044A422 A4                      movsb
:0044A423 8BBB0C414500            mov edi, dword ptr [ebx+0045410C]
:0044A429 B9FFFFFFFF              mov ecx, FFFFFFFF
:0044A42E 2BC0                    sub eax, eax
:0044A430 F2                      repnz
:0044A431 AE                      scasb
:0044A432 F7D1                    not ecx
:0044A434 2BF9                    sub edi, ecx
:0044A436 8BF7                    mov esi, edi
:0044A438 8BD1                    mov edx, ecx
:0044A43A 8D7C2414                lea edi, dword ptr [esp+14]
:0044A43E B9FFFFFFFF              mov ecx, FFFFFFFF
:0044A443 2BC0                    sub eax, eax
:0044A445 F2                      repnz
:0044A446 AE                      scasb
:0044A447 4F                      dec edi
:0044A448 8BCA                    mov ecx, edx
:0044A44A C1E902                  shr ecx, 02
:0044A44D F3                      repz
:0044A44E A5                      movsd
:0044A44F 8BCA                    mov ecx, edx
:0044A451 6810200100              push 00012010
:0044A456 83E103                  and ecx, 00000003

* Possible StringData Ref from Data Obj ->"Microsoft Visual C++ Runtime Library"
                                  |
:0044A459 6894414500              push 00454194
:0044A45E F3                      repz
:0044A45F A4                      movsb
:0044A460 8D44241C                lea eax, dword ptr [esp+1C]
:0044A464 50                      push eax
:0044A465 E896010000              call 0044A600
:0044A46A 83C40C                  add esp, 0000000C
:0044A46D 5D                      pop ebp
:0044A46E 5F                      pop edi
:0044A46F 5E                      pop esi
:0044A470 5B                      pop ebx
:0044A471 81C4A8010000            add esp, 000001A8
:0044A477 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044A313(C), :0044A329(C)
|
:0044A478 A1B06B4700              mov eax, dword ptr [00476BB0]
:0044A47D 8B7010                  mov esi, dword ptr [eax+10]
:0044A480 83FEFF                  cmp esi, FFFFFFFF
:0044A483 750A                    jne 0044A48F
:0044A485 6AF4                    push FFFFFFF4

* Reference To: KERNEL32.GetStdHandle, Ord:0116h
                                  |
:0044A487 FF1544734700            Call dword ptr [00477344]
:0044A48D 8BF0                    mov esi, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A483(C)
|
:0044A48F 8B930C414500            mov edx, dword ptr [ebx+0045410C]
:0044A495 6A00                    push 00000000
:0044A497 8D442414                lea eax, dword ptr [esp+14]
:0044A49B 8BFA                    mov edi, edx
:0044A49D 50                      push eax
:0044A49E B9FFFFFFFF              mov ecx, FFFFFFFF
:0044A4A3 2BC0                    sub eax, eax
:0044A4A5 F2                      repnz
:0044A4A6 AE                      scasb
:0044A4A7 F7D1                    not ecx
:0044A4A9 49                      dec ecx
:0044A4AA 51                      push ecx
:0044A4AB 52                      push edx
:0044A4AC 56                      push esi

* Reference To: KERNEL32.WriteFile, Ord:024Fh
                                  |
:0044A4AD FF152C734700            Call dword ptr [0047732C]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044A306(C), :0044A335(C)
|
:0044A4B3 5D                      pop ebp
:0044A4B4 5F                      pop edi
:0044A4B5 5E                      pop esi
:0044A4B6 5B                      pop ebx
:0044A4B7 81C4A8010000            add esp, 000001A8
:0044A4BD C3                      ret


:0044A4BE CC                      int 03
:0044A4BF CC                      int 03

* Referenced by a CALL at Addresses:
|:00448951   , :00449985   , :00449D01   , :0044AE5B   , :0044AEA4   
|:0044B135   
|
:0044A4C0 8B442404                mov eax, dword ptr [esp+04]
:0044A4C4 85C0                    test eax, eax
:0044A4C6 740F                    je 0044A4D7
:0044A4C8 50                      push eax
:0044A4C9 6A00                    push 00000000
:0044A4CB A1A06B4700              mov eax, dword ptr [00476BA0]
:0044A4D0 50                      push eax

* Reference To: KERNEL32.HeapFree, Ord:0159h
                                  |
:0044A4D1 FF1538734700            Call dword ptr [00477338]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A4C6(C)
|
:0044A4D7 C3                      ret
:0044A4D8 CC                      int 03
:0044A4D9 CC                      int 03
:0044A4DA CC                      int 03
:0044A4DB CC                      int 03
:0044A4DC CC                      int 03
:0044A4DD CC                      int 03
:0044A4DE CC                      int 03
:0044A4DF CC                      int 03

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448B8D(U)
|
:0044A4E0 6A0A                    push 0000000A
:0044A4E2 E8E9FDFFFF              call 0044A2D0
:0044A4E7 83C404                  add esp, 00000004
:0044A4EA 6A16                    push 00000016
:0044A4EC E80F040000              call 0044A900
:0044A4F1 83C404                  add esp, 00000004
:0044A4F4 6A03                    push 00000003
:0044A4F6 E875E3FFFF              call 00448870
:0044A4FB 83C404                  add esp, 00000004
:0044A4FE C3                      ret


:0044A4FF CC                      int 03
:0044A500 E90B000000              jmp 0044A510
:0044A505 CC                      int 03
:0044A506 CC                      int 03
:0044A507 CC                      int 03
:0044A508 CC                      int 03
:0044A509 CC                      int 03
:0044A50A CC                      int 03
:0044A50B CC                      int 03
:0044A50C CC                      int 03
:0044A50D CC                      int 03
:0044A50E CC                      int 03
:0044A50F CC                      int 03

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A500(U)
|
:0044A510 6890A54400              push 0044A590
:0044A515 E8C6D7FFFF              call 00447CE0
:0044A51A 83C404                  add esp, 00000004
:0044A51D 6830A54400              push 0044A530

* Reference To: KERNEL32.SetUnhandledExceptionFilter, Ord:0211h
                                  |
:0044A522 FF1534734700            Call dword ptr [00477334]
:0044A528 A384544700              mov dword ptr [00475484], eax
:0044A52D C3                      ret


:0044A52E CC                      int 03
:0044A52F CC                      int 03
:0044A530 56                      push esi
:0044A531 8B742408                mov esi, dword ptr [esp+08]
:0044A535 8B06                    mov eax, dword ptr [esi]
:0044A537 813863736DE0            cmp dword ptr [eax], E06D7363
:0044A53D 751D                    jne 0044A55C
:0044A53F 83781003                cmp dword ptr [eax+10], 00000003
:0044A543 7517                    jne 0044A55C
:0044A545 81781420059319          cmp dword ptr [eax+14], 19930520
:0044A54C 750E                    jne 0044A55C
:0044A54E E8CDE5FFFF              call 00448B20
:0044A553 B801000000              mov eax, 00000001
:0044A558 5E                      pop esi
:0044A559 C20400                  ret 0004



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044A53D(C), :0044A543(C), :0044A54C(C)
|
:0044A55C 833D8454470000          cmp dword ptr [00475484], 00000000
:0044A563 741D                    je 0044A582
:0044A565 A184544700              mov eax, dword ptr [00475484]
:0044A56A 50                      push eax
:0044A56B E870000000              call 0044A5E0
:0044A570 83C404                  add esp, 00000004
:0044A573 85C0                    test eax, eax
:0044A575 740B                    je 0044A582
:0044A577 56                      push esi
:0044A578 FF1584544700            call dword ptr [00475484]
:0044A57E 5E                      pop esi
:0044A57F C20400                  ret 0004



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044A563(C), :0044A575(C)
|
:0044A582 33C0                    xor eax, eax
:0044A584 5E                      pop esi
:0044A585 C20400                  ret 0004


:0044A588 CC                      int 03
:0044A589 CC                      int 03
:0044A58A CC                      int 03
:0044A58B CC                      int 03
:0044A58C CC                      int 03
:0044A58D CC                      int 03
:0044A58E CC                      int 03
:0044A58F CC                      int 03
:0044A590 A184544700              mov eax, dword ptr [00475484]
:0044A595 50                      push eax

* Reference To: KERNEL32.SetUnhandledExceptionFilter, Ord:0211h
                                  |
:0044A596 FF1534734700            Call dword ptr [00477334]
:0044A59C C3                      ret


:0044A59D CC                      int 03
:0044A59E CC                      int 03
:0044A59F CC                      int 03

* Referenced by a CALL at Addresses:
|:00448D49   , :00449435   , :00449485   , :004494F0   , :00449536   
|
:0044A5A0 8B442408                mov eax, dword ptr [esp+08]
:0044A5A4 56                      push esi
:0044A5A5 BE01000000              mov esi, 00000001
:0044A5AA 50                      push eax
:0044A5AB 8B4C240C                mov ecx, dword ptr [esp+0C]
:0044A5AF 51                      push ecx

* Reference To: KERNEL32.IsBadReadPtr, Ord:016Ch
                                  |
:0044A5B0 FF153C734700            Call dword ptr [0047733C]
:0044A5B6 85C0                    test eax, eax
:0044A5B8 7402                    je 0044A5BC
:0044A5BA 33F6                    xor esi, esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A5B8(C)
|
:0044A5BC 8BC6                    mov eax, esi
:0044A5BE 5E                      pop esi
:0044A5BF C3                      ret



* Referenced by a CALL at Addresses:
|:00449448   , :00449498   , :00449503   , :00449545   
|
:0044A5C0 8B442408                mov eax, dword ptr [esp+08]
:0044A5C4 56                      push esi
:0044A5C5 BE01000000              mov esi, 00000001
:0044A5CA 50                      push eax
:0044A5CB 8B4C240C                mov ecx, dword ptr [esp+0C]
:0044A5CF 51                      push ecx

* Reference To: KERNEL32.IsBadWritePtr, Ord:016Fh
                                  |
:0044A5D0 FF1530734700            Call dword ptr [00477330]
:0044A5D6 85C0                    test eax, eax
:0044A5D8 7402                    je 0044A5DC
:0044A5DA 33F6                    xor esi, esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A5D8(C)
|
:0044A5DC 8BC6                    mov eax, esi
:0044A5DE 5E                      pop esi
:0044A5DF C3                      ret



* Referenced by a CALL at Addresses:
|:00449555   , :0044A56B   
|
:0044A5E0 8B442404                mov eax, dword ptr [esp+04]
:0044A5E4 56                      push esi
:0044A5E5 BE01000000              mov esi, 00000001
:0044A5EA 50                      push eax

* Reference To: KERNEL32.IsBadCodePtr, Ord:0169h
                                  |
:0044A5EB FF1568734700            Call dword ptr [00477368]
:0044A5F1 85C0                    test eax, eax
:0044A5F3 7402                    je 0044A5F7
:0044A5F5 33F6                    xor esi, esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A5F3(C)
|
:0044A5F7 8BC6                    mov eax, esi
:0044A5F9 5E                      pop esi
:0044A5FA C3                      ret


:0044A5FB CC                      int 03
:0044A5FC CC                      int 03
:0044A5FD CC                      int 03
:0044A5FE CC                      int 03
:0044A5FF CC                      int 03

* Referenced by a CALL at Address:
|:0044A465   
|
:0044A600 53                      push ebx
:0044A601 56                      push esi
:0044A602 57                      push edi
:0044A603 33F6                    xor esi, esi
:0044A605 393564444500            cmp dword ptr [00454464], esi
:0044A60B 7542                    jne 0044A64F

* Possible StringData Ref from Data Obj ->"user32.dll"
                                  |
:0044A60D 68A0444500              push 004544A0

* Reference To: KERNEL32.LoadLibraryA, Ord:0178h
                                  |
:0044A612 FF1560734700            Call dword ptr [00477360]
:0044A618 8BD8                    mov ebx, eax
:0044A61A 85DB                    test ebx, ebx
:0044A61C 746E                    je 0044A68C

* Possible StringData Ref from Data Obj ->"MessageBoxA"
                                  |
:0044A61E 6894444500              push 00454494

* Reference To: KERNEL32.GetProcAddress, Ord:0103h
                                  |
:0044A623 8B3D64734700            mov edi, dword ptr [00477364]
:0044A629 53                      push ebx
:0044A62A FFD7                    call edi
:0044A62C A364444500              mov dword ptr [00454464], eax
:0044A631 85C0                    test eax, eax
:0044A633 7457                    je 0044A68C

* Possible StringData Ref from Data Obj ->"GetActiveWindow"
                                  |
:0044A635 6884444500              push 00454484
:0044A63A 53                      push ebx
:0044A63B FFD7                    call edi

* Possible StringData Ref from Data Obj ->"GetLastActivePopup"
                                  |
:0044A63D 6870444500              push 00454470
:0044A642 A368444500              mov dword ptr [00454468], eax
:0044A647 53                      push ebx
:0044A648 FFD7                    call edi
:0044A64A A36C444500              mov dword ptr [0045446C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A60B(C)
|
:0044A64F A168444500              mov eax, dword ptr [00454468]
:0044A654 85C0                    test eax, eax
:0044A656 7404                    je 0044A65C
:0044A658 FFD0                    call eax
:0044A65A 8BF0                    mov esi, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A656(C)
|
:0044A65C 85F6                    test esi, esi
:0044A65E 7412                    je 0044A672
:0044A660 833D6C44450000          cmp dword ptr [0045446C], 00000000
:0044A667 7409                    je 0044A672
:0044A669 56                      push esi
:0044A66A FF156C444500            call dword ptr [0045446C]
:0044A670 8BF0                    mov esi, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044A65E(C), :0044A667(C)
|
:0044A672 8B442418                mov eax, dword ptr [esp+18]
:0044A676 8B4C2414                mov ecx, dword ptr [esp+14]
:0044A67A 8B542410                mov edx, dword ptr [esp+10]
:0044A67E 50                      push eax
:0044A67F 51                      push ecx
:0044A680 52                      push edx
:0044A681 56                      push esi
:0044A682 FF1564444500            call dword ptr [00454464]
:0044A688 5F                      pop edi
:0044A689 5E                      pop esi
:0044A68A 5B                      pop ebx
:0044A68B C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044A61C(C), :0044A633(C)
|
:0044A68C 33C0                    xor eax, eax
:0044A68E 5F                      pop edi
:0044A68F 5E                      pop esi
:0044A690 5B                      pop ebx
:0044A691 C3                      ret


:0044A692 CC                      int 03
:0044A693 CC                      int 03
:0044A694 CC                      int 03
:0044A695 CC                      int 03
:0044A696 CC                      int 03
:0044A697 CC                      int 03
:0044A698 CC                      int 03
:0044A699 CC                      int 03
:0044A69A CC                      int 03
:0044A69B CC                      int 03
:0044A69C CC                      int 03
:0044A69D CC                      int 03
:0044A69E CC                      int 03
:0044A69F CC                      int 03

* Referenced by a CALL at Address:
|:0044A3A8   
|
:0044A6A0 55                      push ebp
:0044A6A1 8BEC                    mov ebp, esp
:0044A6A3 57                      push edi
:0044A6A4 56                      push esi
:0044A6A5 8B7D08                  mov edi, dword ptr [ebp+08]
:0044A6A8 8B750C                  mov esi, dword ptr [ebp+0C]
:0044A6AB 8BD7                    mov edx, edi
:0044A6AD 8B4D10                  mov ecx, dword ptr [ebp+10]
:0044A6B0 E30C                    jcxz 0044A6BE
:0044A6B2 AC                      lodsb
:0044A6B3 0AC0                    or al, al
:0044A6B5 7403                    je 0044A6BA
:0044A6B7 AA                      stosb
:0044A6B8 E2F8                    loop 0044A6B2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A6B5(C)
|
:0044A6BA 32C0                    xor al, al
:0044A6BC F3                      repz
:0044A6BD AA                      stosb
:0044A6BE 8BC2                    mov eax, edx
:0044A6C0 5E                      pop esi
:0044A6C1 5F                      pop edi
:0044A6C2 C9                      leave
:0044A6C3 C3                      ret


:0044A6C4 CC                      int 03
:0044A6C5 CC                      int 03
:0044A6C6 CC                      int 03
:0044A6C7 CC                      int 03
:0044A6C8 CC                      int 03
:0044A6C9 CC                      int 03
:0044A6CA CC                      int 03
:0044A6CB CC                      int 03
:0044A6CC CC                      int 03
:0044A6CD CC                      int 03
:0044A6CE CC                      int 03
:0044A6CF CC                      int 03

* Referenced by a CALL at Addresses:
|:0044A7C7   , :0044A7E0   
|
:0044A6D0 56                      push esi
:0044A6D1 8B742408                mov esi, dword ptr [esp+08]
:0044A6D5 85F6                    test esi, esi
:0044A6D7 750C                    jne 0044A6E5
:0044A6D9 6A00                    push 00000000
:0044A6DB E8C0000000              call 0044A7A0
:0044A6E0 83C404                  add esp, 00000004
:0044A6E3 5E                      pop esi
:0044A6E4 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A6D7(C)
|
:0044A6E5 56                      push esi
:0044A6E6 E835000000              call 0044A720
:0044A6EB 83C404                  add esp, 00000004
:0044A6EE 85C0                    test eax, eax
:0044A6F0 7407                    je 0044A6F9
:0044A6F2 B8FFFFFFFF              mov eax, FFFFFFFF
:0044A6F7 5E                      pop esi
:0044A6F8 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A6F0(C)
|
:0044A6F9 F6460D40                test [esi+0D], 40
:0044A6FD 7419                    je 0044A718
:0044A6FF 8B4610                  mov eax, dword ptr [esi+10]
:0044A702 50                      push eax
:0044A703 E808040000              call 0044AB10
:0044A708 83C404                  add esp, 00000004
:0044A70B 83F801                  cmp eax, 00000001
:0044A70E B800000000              mov eax, 00000000
:0044A713 5E                      pop esi
:0044A714 83D0FF                  adc eax, FFFFFFFF
:0044A717 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A6FD(C)
|
:0044A718 33C0                    xor eax, eax
:0044A71A 5E                      pop esi
:0044A71B C3                      ret


:0044A71C CC                      int 03
:0044A71D CC                      int 03
:0044A71E CC                      int 03
:0044A71F CC                      int 03

* Referenced by a CALL at Addresses:
|:0044A6E6   , :0044B103   
|
:0044A720 53                      push ebx
:0044A721 56                      push esi
:0044A722 8B74240C                mov esi, dword ptr [esp+0C]
:0044A726 57                      push edi
:0044A727 33FF                    xor edi, edi
:0044A729 8B460C                  mov eax, dword ptr [esi+0C]
:0044A72C 8BC8                    mov ecx, eax
:0044A72E 80E103                  and cl, 03
:0044A731 80F902                  cmp cl, 02
:0044A734 753C                    jne 0044A772
:0044A736 A908010000              test eax, 00000108
:0044A73B 7435                    je 0044A772
:0044A73D 8B4608                  mov eax, dword ptr [esi+08]
:0044A740 8B1E                    mov ebx, dword ptr [esi]
:0044A742 2BD8                    sub ebx, eax
:0044A744 85DB                    test ebx, ebx
:0044A746 7E2A                    jle 0044A772
:0044A748 53                      push ebx
:0044A749 50                      push eax
:0044A74A 8B4610                  mov eax, dword ptr [esi+10]
:0044A74D 50                      push eax
:0044A74E E82D040000              call 0044AB80
:0044A753 83C40C                  add esp, 0000000C
:0044A756 3BC3                    cmp eax, ebx
:0044A758 750F                    jne 0044A769
:0044A75A 8B460C                  mov eax, dword ptr [esi+0C]
:0044A75D A880                    test al, 80
:0044A75F 7411                    je 0044A772
:0044A761 83E0FD                  and eax, FFFFFFFD
:0044A764 89460C                  mov dword ptr [esi+0C], eax
:0044A767 EB09                    jmp 0044A772

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A758(C)
|
:0044A769 834E0C20                or dword ptr [esi+0C], 00000020
:0044A76D BFFFFFFFFF              mov edi, FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044A734(C), :0044A73B(C), :0044A746(C), :0044A75F(C), :0044A767(U)
|
:0044A772 8B4608                  mov eax, dword ptr [esi+08]
:0044A775 8906                    mov dword ptr [esi], eax
:0044A777 8BC7                    mov eax, edi
:0044A779 C7460400000000          mov [esi+04], 00000000
:0044A780 5F                      pop edi
:0044A781 5E                      pop esi
:0044A782 5B                      pop ebx
:0044A783 C3                      ret


:0044A784 CC                      int 03
:0044A785 CC                      int 03
:0044A786 CC                      int 03
:0044A787 CC                      int 03
:0044A788 CC                      int 03
:0044A789 CC                      int 03
:0044A78A CC                      int 03
:0044A78B CC                      int 03
:0044A78C CC                      int 03
:0044A78D CC                      int 03
:0044A78E CC                      int 03
:0044A78F CC                      int 03

* Referenced by a CALL at Address:
|:0044A8E0   
|
:0044A790 6A01                    push 00000001
:0044A792 E809000000              call 0044A7A0
:0044A797 83C404                  add esp, 00000004
:0044A79A C3                      ret


:0044A79B CC                      int 03
:0044A79C CC                      int 03
:0044A79D CC                      int 03
:0044A79E CC                      int 03
:0044A79F CC                      int 03

* Referenced by a CALL at Addresses:
|:0044A6DB   , :0044A792   
|
:0044A7A0 53                      push ebx
:0044A7A1 56                      push esi
:0044A7A2 57                      push edi
:0044A7A3 33DB                    xor ebx, ebx
:0044A7A5 55                      push ebp
:0044A7A6 33F6                    xor esi, esi
:0044A7A8 33ED                    xor ebp, ebp
:0044A7AA 8B7C2414                mov edi, dword ptr [esp+14]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A7FB(C)
|
:0044A7AE A1945B4700              mov eax, dword ptr [00475B94]
:0044A7B3 8B0C30                  mov ecx, dword ptr [eax+esi]
:0044A7B6 85C9                    test ecx, ecx
:0044A7B8 7438                    je 0044A7F2
:0044A7BA 8B410C                  mov eax, dword ptr [ecx+0C]
:0044A7BD A883                    test al, 83
:0044A7BF 7431                    je 0044A7F2
:0044A7C1 83FF01                  cmp edi, 00000001
:0044A7C4 7511                    jne 0044A7D7
:0044A7C6 51                      push ecx
:0044A7C7 E804FFFFFF              call 0044A6D0
:0044A7CC 83C404                  add esp, 00000004
:0044A7CF 83F8FF                  cmp eax, FFFFFFFF
:0044A7D2 741E                    je 0044A7F2
:0044A7D4 43                      inc ebx
:0044A7D5 EB1B                    jmp 0044A7F2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A7C4(C)
|
:0044A7D7 85FF                    test edi, edi
:0044A7D9 7517                    jne 0044A7F2
:0044A7DB A802                    test al, 02
:0044A7DD 7413                    je 0044A7F2
:0044A7DF 51                      push ecx
:0044A7E0 E8EBFEFFFF              call 0044A6D0
:0044A7E5 83C404                  add esp, 00000004
:0044A7E8 83F8FF                  cmp eax, FFFFFFFF
:0044A7EB 7505                    jne 0044A7F2
:0044A7ED BDFFFFFFFF              mov ebp, FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044A7B8(C), :0044A7BF(C), :0044A7D2(C), :0044A7D5(U), :0044A7D9(C)
|:0044A7DD(C), :0044A7EB(C)
|
:0044A7F2 83C604                  add esi, 00000004
:0044A7F5 81FE00080000            cmp esi, 00000800
:0044A7FB 7CB1                    jl 0044A7AE
:0044A7FD 8BC3                    mov eax, ebx
:0044A7FF 83FF01                  cmp edi, 00000001
:0044A802 7402                    je 0044A806
:0044A804 8BC5                    mov eax, ebp

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A802(C)
|
:0044A806 5D                      pop ebp
:0044A807 5F                      pop edi
:0044A808 5E                      pop esi
:0044A809 5B                      pop ebx
:0044A80A C3                      ret


:0044A80B CC                      int 03
:0044A80C CC                      int 03
:0044A80D CC                      int 03
:0044A80E CC                      int 03
:0044A80F CC                      int 03
:0044A810 833D905B470000          cmp dword ptr [00475B90], 00000000
:0044A817 56                      push esi
:0044A818 750C                    jne 0044A826
:0044A81A C705905B470000020000    mov dword ptr [00475B90], 00000200
:0044A824 EB13                    jmp 0044A839

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A818(C)
|
:0044A826 833D905B470014          cmp dword ptr [00475B90], 00000014
:0044A82D 7D0A                    jge 0044A839
:0044A82F C705905B470014000000    mov dword ptr [00475B90], 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044A824(U), :0044A82D(C)
|
:0044A839 6A04                    push 00000004
:0044A83B A1905B4700              mov eax, dword ptr [00475B90]
:0044A840 50                      push eax
:0044A841 E86A050000              call 0044ADB0
:0044A846 83C408                  add esp, 00000008
:0044A849 A3945B4700              mov dword ptr [00475B94], eax
:0044A84E 85C0                    test eax, eax
:0044A850 7529                    jne 0044A87B
:0044A852 C705905B470014000000    mov dword ptr [00475B90], 00000014
:0044A85C 6A04                    push 00000004
:0044A85E 6A14                    push 00000014
:0044A860 E84B050000              call 0044ADB0
:0044A865 83C408                  add esp, 00000008
:0044A868 A3945B4700              mov dword ptr [00475B94], eax
:0044A86D 85C0                    test eax, eax
:0044A86F 750A                    jne 0044A87B
:0044A871 6A1A                    push 0000001A
:0044A873 E888DDFFFF              call 00448600
:0044A878 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044A850(C), :0044A86F(C)
|

* Possible StringData Ref from Data Obj ->"[G"
                                  |
:0044A87B B9B0444500              mov ecx, 004544B0
:0044A880 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A895(C)
|
:0044A882 8B15945B4700            mov edx, dword ptr [00475B94]
:0044A888 83C004                  add eax, 00000004
:0044A88B 894C02FC                mov dword ptr [edx+eax-04], ecx
:0044A88F 83C120                  add ecx, 00000020
:0044A892 83F850                  cmp eax, 00000050
:0044A895 7CEB                    jl 0044A882
:0044A897 33F6                    xor esi, esi
:0044A899 BAC0444500              mov edx, 004544C0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A8CD(C)
|
:0044A89E 8BC6                    mov eax, esi
:0044A8A0 8BCE                    mov ecx, esi
:0044A8A2 83E0E7                  and eax, FFFFFFE7
:0044A8A5 83E11F                  and ecx, 0000001F
:0044A8A8 C1F803                  sar eax, 03
:0044A8AB 8B80B06B4700            mov eax, dword ptr [eax+00476BB0]
:0044A8B1 8B04C8                  mov eax, dword ptr [eax+8*ecx]
:0044A8B4 83F8FF                  cmp eax, FFFFFFFF
:0044A8B7 7404                    je 0044A8BD
:0044A8B9 85C0                    test eax, eax
:0044A8BB 7506                    jne 0044A8C3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A8B7(C)
|
:0044A8BD C702FFFFFFFF            mov dword ptr [edx], FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A8BB(C)
|
:0044A8C3 83C220                  add edx, 00000020
:0044A8C6 46                      inc esi
:0044A8C7 81FA20454500            cmp edx, 00454520
:0044A8CD 72CF                    jb 0044A89E
:0044A8CF 5E                      pop esi
:0044A8D0 C3                      ret


:0044A8D1 CC                      int 03
:0044A8D2 CC                      int 03
:0044A8D3 CC                      int 03
:0044A8D4 CC                      int 03
:0044A8D5 CC                      int 03
:0044A8D6 CC                      int 03
:0044A8D7 CC                      int 03
:0044A8D8 CC                      int 03
:0044A8D9 CC                      int 03
:0044A8DA CC                      int 03
:0044A8DB CC                      int 03
:0044A8DC CC                      int 03
:0044A8DD CC                      int 03
:0044A8DE CC                      int 03
:0044A8DF CC                      int 03
:0044A8E0 E8ABFEFFFF              call 0044A790
:0044A8E5 803DC43B450000          cmp byte ptr [00453BC4], 00
:0044A8EC 7405                    je 0044A8F3
:0044A8EE E91D050000              jmp 0044AE10

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A8EC(C)
|
:0044A8F3 C3                      ret
:0044A8F4 CC                      int 03
:0044A8F5 CC                      int 03
:0044A8F6 CC                      int 03
:0044A8F7 CC                      int 03
:0044A8F8 CC                      int 03
:0044A8F9 CC                      int 03
:0044A8FA CC                      int 03
:0044A8FB CC                      int 03
:0044A8FC CC                      int 03
:0044A8FD CC                      int 03
:0044A8FE CC                      int 03
:0044A8FF CC                      int 03

* Referenced by a CALL at Address:
|:0044A4EC   
|
:0044A900 83EC04                  sub esp, 00000004
:0044A903 53                      push ebx
:0044A904 56                      push esi
:0044A905 57                      push edi
:0044A906 55                      push ebp
:0044A907 8B7C2418                mov edi, dword ptr [esp+18]
:0044A90B 8D47FE                  lea eax, dword ptr [edi-02]
:0044A90E 83F814                  cmp eax, 00000014
:0044A911 770F                    ja 0044A922
:0044A913 33C9                    xor ecx, ecx
:0044A915 8A8874AA4400            mov cl, byte ptr [eax+0044AA74]
:0044A91B FF248D54AA4400          jmp dword ptr [4*ecx+0044AA54]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A911(C)
|
:0044A922 B8FFFFFFFF              mov eax, FFFFFFFF
:0044A927 5D                      pop ebp
:0044A928 5F                      pop edi
:0044A929 5E                      pop esi
:0044A92A 5B                      pop ebx
:0044A92B 83C404                  add esp, 00000004
:0044A92E C3                      ret


:0044A92F BD34474500              mov ebp, 00454734
:0044A934 8B3534474500            mov esi, dword ptr [00454734]
:0044A93A EB36                    jmp 0044A972
:0044A93C 57                      push edi
:0044A93D E84E010000              call 0044AA90
:0044A942 83C404                  add esp, 00000004
:0044A945 8D6808                  lea ebp, dword ptr [eax+08]
:0044A948 8B7500                  mov esi, dword ptr [ebp+00]
:0044A94B EB25                    jmp 0044A972
:0044A94D BD40474500              mov ebp, 00454740
:0044A952 8B3540474500            mov esi, dword ptr [00454740]
:0044A958 EB18                    jmp 0044A972
:0044A95A BD38474500              mov ebp, 00454738
:0044A95F 8B3538474500            mov esi, dword ptr [00454738]
:0044A965 EB0B                    jmp 0044A972
:0044A967 BD3C474500              mov ebp, 0045473C
:0044A96C 8B353C474500            mov esi, dword ptr [0045473C]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044A93A(U), :0044A94B(U), :0044A958(U), :0044A965(U)
|
:0044A972 83FE01                  cmp esi, 00000001
:0044A975 750A                    jne 0044A981
:0044A977 33C0                    xor eax, eax
:0044A979 5D                      pop ebp
:0044A97A 5F                      pop edi
:0044A97B 5E                      pop esi
:0044A97C 5B                      pop ebx
:0044A97D 83C404                  add esp, 00000004
:0044A980 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A975(C)
|
:0044A981 85F6                    test esi, esi
:0044A983 750A                    jne 0044A98F
:0044A985 6A03                    push 00000003
:0044A987 E8E4DEFFFF              call 00448870
:0044A98C 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A983(C)
|
:0044A98F 83FF08                  cmp edi, 00000008
:0044A992 740A                    je 0044A99E
:0044A994 83FF0B                  cmp edi, 0000000B
:0044A997 7405                    je 0044A99E
:0044A999 83FF04                  cmp edi, 00000004
:0044A99C 752A                    jne 0044A9C8

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044A992(C), :0044A997(C)
|
:0044A99E 8B1D703C4500            mov ebx, dword ptr [00453C70]
:0044A9A4 83FF08                  cmp edi, 00000008
:0044A9A7 C705703C450000000000    mov dword ptr [00453C70], 00000000
:0044A9B1 7553                    jne 0044AA06
:0044A9B3 A16C3C4500              mov eax, dword ptr [00453C6C]
:0044A9B8 C7056C3C45008C000000    mov dword ptr [00453C6C], 0000008C
:0044A9C2 89442410                mov dword ptr [esp+10], eax
:0044A9C6 EB04                    jmp 0044A9CC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A99C(C)
|
:0044A9C8 8B5C2410                mov ebx, dword ptr [esp+10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A9C6(U)
|
:0044A9CC 83FF08                  cmp edi, 00000008
:0044A9CF 7535                    jne 0044AA06
:0044A9D1 A1643C4500              mov eax, dword ptr [00453C64]
:0044A9D6 0305603C4500            add eax, dword ptr [00453C60]
:0044A9DC 3905603C4500            cmp dword ptr [00453C60], eax
:0044A9E2 7D29                    jge 0044AA0D
:0044A9E4 A1603C4500              mov eax, dword ptr [00453C60]
:0044A9E9 8D1440                  lea edx, dword ptr [eax+2*eax]
:0044A9EC A1643C4500              mov eax, dword ptr [00453C64]
:0044A9F1 8D0C95F03B4500          lea ecx, dword ptr [4*edx+00453BF0]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044AA02(C)
|
:0044A9F8 C70100000000            mov dword ptr [ecx], 00000000
:0044A9FE 83C10C                  add ecx, 0000000C
:0044AA01 48                      dec eax
:0044AA02 75F4                    jne 0044A9F8
:0044AA04 EB07                    jmp 0044AA0D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044A9B1(C), :0044A9CF(C)
|
:0044AA06 C7450000000000          mov [ebp+00], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044A9E2(C), :0044AA04(U)
|
:0044AA0D 83FF08                  cmp edi, 00000008
:0044AA10 750F                    jne 0044AA21
:0044AA12 A16C3C4500              mov eax, dword ptr [00453C6C]
:0044AA17 50                      push eax
:0044AA18 6A08                    push 00000008
:0044AA1A FFD6                    call esi
:0044AA1C 83C408                  add esp, 00000008
:0044AA1F EB06                    jmp 0044AA27

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044AA10(C)
|
:0044AA21 57                      push edi
:0044AA22 FFD6                    call esi
:0044AA24 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044AA1F(U)
|
:0044AA27 83FF08                  cmp edi, 00000008
:0044AA2A 740A                    je 0044AA36
:0044AA2C 83FF0B                  cmp edi, 0000000B
:0044AA2F 7405                    je 0044AA36
:0044AA31 83FF04                  cmp edi, 00000004
:0044AA34 7514                    jne 0044AA4A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044AA2A(C), :0044AA2F(C)
|
:0044AA36 891D703C4500            mov dword ptr [00453C70], ebx
:0044AA3C 83FF08                  cmp edi, 00000008
:0044AA3F 7509                    jne 0044AA4A
:0044AA41 8B442410                mov eax, dword ptr [esp+10]
:0044AA45 A36C3C4500              mov dword ptr [00453C6C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044AA34(C), :0044AA3F(C)
|
:0044AA4A 33C0                    xor eax, eax
:0044AA4C 5D                      pop ebp
:0044AA4D 5F                      pop edi
:0044AA4E 5E                      pop esi
:0044AA4F 5B                      pop ebx
:0044AA50 83C404                  add esp, 00000004
:0044AA53 C3                      ret



:0044AA54 2FA94400                DWORD 0044A92F
:0044AA58 3CA94400                DWORD 0044A93C
:0044AA5C 3CA94400                DWORD 0044A93C
:0044AA60 3CA94400                DWORD 0044A93C
:0044AA64 4DA94400                DWORD 0044A94D
:0044AA68 5AA94400                DWORD 0044A95A
:0044AA6C 67A94400                DWORD 0044A967
:0044AA70 22A94400                DWORD 0044A922


:0044AA74 0007                    add byte ptr [edi], al
:0044AA76 0107                    add dword ptr [edi], eax
:0044AA78 07                      pop es
:0044AA79 07                      pop es
:0044AA7A 0207                    add al, byte ptr [edi]
:0044AA7C 07                      pop es
:0044AA7D 0307                    add eax, dword ptr [edi]
:0044AA7F 07                      pop es
:0044AA80 07                      pop es
:0044AA81 0407                    add al, 07
:0044AA83 07                      pop es
:0044AA84 07                      pop es
:0044AA85 07                      pop es
:0044AA86 07                      pop es
:0044AA87 0506CCCCCC              add eax, CCCCCC06
:0044AA8C CC                      int 03
:0044AA8D CC                      int 03
:0044AA8E CC                      int 03
:0044AA8F CC                      int 03

* Referenced by a CALL at Address:
|:0044A93D   
|

* Possible StringData Ref from Data Obj ->""
                                  |
:0044AA90 BAE83B4500              mov edx, 00453BE8
:0044AA95 8B4C2404                mov ecx, dword ptr [esp+04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044AAB2(C)
|
:0044AA99 394A04                  cmp dword ptr [edx+04], ecx
:0044AA9C 7416                    je 0044AAB4
:0044AA9E 83C20C                  add edx, 0000000C
:0044AAA1 A1683C4500              mov eax, dword ptr [00453C68]
:0044AAA6 8D0440                  lea eax, dword ptr [eax+2*eax]
:0044AAA9 8D0485E83B4500          lea eax, dword ptr [4*eax+00453BE8]
:0044AAB0 3BC2                    cmp eax, edx
:0044AAB2 77E5                    ja 0044AA99

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044AA9C(C)
|
:0044AAB4 8B4204                  mov eax, dword ptr [edx+04]
:0044AAB7 2BC1                    sub eax, ecx
:0044AAB9 83F801                  cmp eax, 00000001
:0044AABC 1BC0                    sbb eax, eax
:0044AABE 23C2                    and eax, edx
:0044AAC0 C3                      ret


:0044AAC1 CC                      int 03
:0044AAC2 CC                      int 03
:0044AAC3 CC                      int 03
:0044AAC4 CC                      int 03
:0044AAC5 CC                      int 03
:0044AAC6 CC                      int 03
:0044AAC7 CC                      int 03
:0044AAC8 CC                      int 03
:0044AAC9 CC                      int 03
:0044AACA CC                      int 03
:0044AACB CC                      int 03
:0044AACC CC                      int 03
:0044AACD CC                      int 03
:0044AACE CC                      int 03
:0044AACF CC                      int 03
:0044AAD0 55                      push ebp
:0044AAD1 8BEC                    mov ebp, esp
:0044AAD3 57                      push edi
:0044AAD4 56                      push esi
:0044AAD5 8B7D08                  mov edi, dword ptr [ebp+08]
:0044AAD8 8BD7                    mov edx, edi
:0044AADA 33C0                    xor eax, eax
:0044AADC 83C9FF                  or ecx, FFFFFFFF
:0044AADF F2                      repnz
:0044AAE0 AE                      scasb
:0044AAE1 4F                      dec edi
:0044AAE2 8BF7                    mov esi, edi
:0044AAE4 8B7D0C                  mov edi, dword ptr [ebp+0C]
:0044AAE7 57                      push edi
:0044AAE8 8B4D10                  mov ecx, dword ptr [ebp+10]
:0044AAEB F2                      repnz
:0044AAEC AE                      scasb
:0044AAED 7501                    jne 0044AAF0
:0044AAEF 41                      inc ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044AAED(C)
|
:0044AAF0 2B4D10                  sub ecx, dword ptr [ebp+10]
:0044AAF3 F7D9                    neg ecx
:0044AAF5 8BFE                    mov edi, esi
:0044AAF7 5E                      pop esi
:0044AAF8 F3                      repz
:0044AAF9 A4                      movsb
:0044AAFA AA                      stosb
:0044AAFB 8BC2                    mov eax, edx
:0044AAFD 5E                      pop esi
:0044AAFE 5F                      pop edi
:0044AAFF C9                      leave
:0044AB00 C3                      ret


:0044AB01 CC                      int 03
:0044AB02 CC                      int 03
:0044AB03 CC                      int 03
:0044AB04 CC                      int 03
:0044AB05 CC                      int 03
:0044AB06 CC                      int 03
:0044AB07 CC                      int 03
:0044AB08 CC                      int 03
:0044AB09 CC                      int 03
:0044AB0A CC                      int 03
:0044AB0B CC                      int 03
:0044AB0C CC                      int 03
:0044AB0D CC                      int 03
:0044AB0E CC                      int 03
:0044AB0F CC                      int 03

* Referenced by a CALL at Address:
|:0044A703   
|
:0044AB10 8B542404                mov edx, dword ptr [esp+04]
:0044AB14 3B15A46B4700            cmp edx, dword ptr [00476BA4]
:0044AB1A 7353                    jnb 0044AB6F
:0044AB1C 8BC2                    mov eax, edx
:0044AB1E 8BCA                    mov ecx, edx
:0044AB20 83E0E7                  and eax, FFFFFFE7
:0044AB23 83E11F                  and ecx, 0000001F
:0044AB26 C1F803                  sar eax, 03
:0044AB29 8B80B06B4700            mov eax, dword ptr [eax+00476BB0]
:0044AB2F 8A44C804                mov al, byte ptr [eax+8*ecx+04]
:0044AB33 2401                    and al, 01
:0044AB35 7438                    je 0044AB6F
:0044AB37 52                      push edx
:0044AB38 E823040000              call 0044AF60
:0044AB3D 83C404                  add esp, 00000004
:0044AB40 50                      push eax

* Reference To: KERNEL32.FlushFileBuffers, Ord:0083h
                                  |
:0044AB41 FF155C734700            Call dword ptr [0047735C]
:0044AB47 85C0                    test eax, eax
:0044AB49 B800000000              mov eax, 00000000
:0044AB4E 7506                    jne 0044AB56

* Reference To: KERNEL32.GetLastError, Ord:00E1h
                                  |
:0044AB50 FF1594734700            Call dword ptr [00477394]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044AB4E(C)
|
:0044AB56 85C0                    test eax, eax
:0044AB58 7424                    je 0044AB7E
:0044AB5A C705843B450009000000    mov dword ptr [00453B84], 00000009
:0044AB64 A3883B4500              mov dword ptr [00453B88], eax
:0044AB69 B8FFFFFFFF              mov eax, FFFFFFFF
:0044AB6E C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044AB1A(C), :0044AB35(C)
|
:0044AB6F C705843B450009000000    mov dword ptr [00453B84], 00000009
:0044AB79 B8FFFFFFFF              mov eax, FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044AB58(C)
|
:0044AB7E C3                      ret
:0044AB7F CC                      int 03

* Referenced by a CALL at Address:
|:0044A74E   
|
:0044AB80 8B542404                mov edx, dword ptr [esp+04]
:0044AB84 81EC18040000            sub esp, 00000418
:0044AB8A 3915A46B4700            cmp dword ptr [00476BA4], edx
:0044AB90 53                      push ebx
:0044AB91 56                      push esi
:0044AB92 57                      push edi
:0044AB93 55                      push ebp
:0044AB94 0F86ED010000            jbe 0044AD87
:0044AB9A 8BC2                    mov eax, edx
:0044AB9C 83E0E7                  and eax, FFFFFFE7
:0044AB9F C1F803                  sar eax, 03
:0044ABA2 05B06B4700              add eax, 00476BB0
:0044ABA7 89442418                mov dword ptr [esp+18], eax
:0044ABAB 8BC2                    mov eax, edx
:0044ABAD 83E01F                  and eax, 0000001F
:0044ABB0 8B4C2418                mov ecx, dword ptr [esp+18]
:0044ABB4 C1E003                  shl eax, 03
:0044ABB7 8B19                    mov ebx, dword ptr [ecx]
:0044ABB9 8BE8                    mov ebp, eax
:0044ABBB 8944241C                mov dword ptr [esp+1C], eax
:0044ABBF 8A442B04                mov al, byte ptr [ebx+ebp+04]
:0044ABC3 A801                    test al, 01
:0044ABC5 0F84BC010000            je 0044AD87
:0044ABCB 33F6                    xor esi, esi
:0044ABCD 8BAC2434040000          mov ebp, dword ptr [esp+00000434]
:0044ABD4 89742420                mov dword ptr [esp+20], esi
:0044ABD8 3BEE                    cmp ebp, esi
:0044ABDA 750D                    jne 0044ABE9
:0044ABDC 33C0                    xor eax, eax
:0044ABDE 5D                      pop ebp
:0044ABDF 5F                      pop edi
:0044ABE0 5E                      pop esi
:0044ABE1 5B                      pop ebx
:0044ABE2 81C418040000            add esp, 00000418
:0044ABE8 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044ABDA(C)
|
:0044ABE9 A820                    test al, 20
:0044ABEB 740D                    je 0044ABFA
:0044ABED 6A02                    push 00000002
:0044ABEF 6A00                    push 00000000
:0044ABF1 52                      push edx
:0044ABF2 E829040000              call 0044B020
:0044ABF7 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044ABEB(C)
|
:0044ABFA 8B442418                mov eax, dword ptr [esp+18]
:0044ABFE 8B4C241C                mov ecx, dword ptr [esp+1C]
:0044AC02 0308                    add ecx, dword ptr [eax]
:0044AC04 F6410480                test [ecx+04], 80
:0044AC08 0F8488000000            je 0044AC96
:0044AC0E C744241000000000        mov [esp+10], 00000000
:0044AC16 8BBC2430040000          mov edi, dword ptr [esp+00000430]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044AC92(C)
|
:0044AC1D 8BC7                    mov eax, edi
:0044AC1F 2B842430040000          sub eax, dword ptr [esp+00000430]
:0044AC26 3BC5                    cmp eax, ebp
:0044AC28 0F83A1000000            jnb 0044ACCF
:0044AC2E 8D5C2424                lea ebx, dword ptr [esp+24]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044AC5B(C)
|
:0044AC32 8BC7                    mov eax, edi
:0044AC34 2B842430040000          sub eax, dword ptr [esp+00000430]
:0044AC3B 3BC5                    cmp eax, ebp
:0044AC3D 731E                    jnb 0044AC5D
:0044AC3F 8A07                    mov al, byte ptr [edi]
:0044AC41 47                      inc edi
:0044AC42 3C0A                    cmp al, 0A
:0044AC44 7505                    jne 0044AC4B
:0044AC46 C6030D                  mov byte ptr [ebx], 0D
:0044AC49 46                      inc esi
:0044AC4A 43                      inc ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044AC44(C)
|
:0044AC4B 8803                    mov byte ptr [ebx], al
:0044AC4D 43                      inc ebx
:0044AC4E 8BC3                    mov eax, ebx
:0044AC50 8D4C2424                lea ecx, dword ptr [esp+24]
:0044AC54 2BC1                    sub eax, ecx
:0044AC56 3D00040000              cmp eax, 00000400
:0044AC5B 7CD5                    jl 0044AC32

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044AC3D(C)
|
:0044AC5D 8D442424                lea eax, dword ptr [esp+24]
:0044AC61 6A00                    push 00000000
:0044AC63 2BD8                    sub ebx, eax
:0044AC65 8D4C2428                lea ecx, dword ptr [esp+28]
:0044AC69 8D442418                lea eax, dword ptr [esp+18]
:0044AC6D 8B54241C                mov edx, dword ptr [esp+1C]
:0044AC71 50                      push eax
:0044AC72 53                      push ebx
:0044AC73 51                      push ecx
:0044AC74 8B02                    mov eax, dword ptr [edx]
:0044AC76 8B4C242C                mov ecx, dword ptr [esp+2C]
:0044AC7A 8B1408                  mov edx, dword ptr [eax+ecx]
:0044AC7D 52                      push edx

* Reference To: KERNEL32.WriteFile, Ord:024Fh
                                  |
:0044AC7E FF152C734700            Call dword ptr [0047732C]
:0044AC84 85C0                    test eax, eax
:0044AC86 743D                    je 0044ACC5
:0044AC88 8B442414                mov eax, dword ptr [esp+14]
:0044AC8C 01442420                add dword ptr [esp+20], eax
:0044AC90 3BC3                    cmp eax, ebx
:0044AC92 7D89                    jge 0044AC1D
:0044AC94 EB39                    jmp 0044ACCF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044AC08(C)
|
:0044AC96 8D442414                lea eax, dword ptr [esp+14]
:0044AC9A 6A00                    push 00000000
:0044AC9C 8B942434040000          mov edx, dword ptr [esp+00000434]
:0044ACA3 50                      push eax
:0044ACA4 55                      push ebp
:0044ACA5 8B09                    mov ecx, dword ptr [ecx]
:0044ACA7 52                      push edx
:0044ACA8 51                      push ecx

* Reference To: KERNEL32.WriteFile, Ord:024Fh
                                  |
:0044ACA9 FF152C734700            Call dword ptr [0047732C]
:0044ACAF 85C0                    test eax, eax
:0044ACB1 7412                    je 0044ACC5
:0044ACB3 C744241000000000        mov [esp+10], 00000000
:0044ACBB 8B442414                mov eax, dword ptr [esp+14]
:0044ACBF 89442420                mov dword ptr [esp+20], eax
:0044ACC3 EB0A                    jmp 0044ACCF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044AC86(C), :0044ACB1(C)
|

* Reference To: KERNEL32.GetLastError, Ord:00E1h
                                  |
:0044ACC5 FF1594734700            Call dword ptr [00477394]
:0044ACCB 89442410                mov dword ptr [esp+10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044AC28(C), :0044AC94(U), :0044ACC3(U)
|
:0044ACCF 837C242000              cmp dword ptr [esp+20], 00000000
:0044ACD4 0F859C000000            jne 0044AD76
:0044ACDA 837C241000              cmp dword ptr [esp+10], 00000000
:0044ACDF 7447                    je 0044AD28
:0044ACE1 837C241005              cmp dword ptr [esp+10], 00000005
:0044ACE6 7523                    jne 0044AD0B
:0044ACE8 C705843B450009000000    mov dword ptr [00453B84], 00000009
:0044ACF2 8B442410                mov eax, dword ptr [esp+10]
:0044ACF6 5D                      pop ebp
:0044ACF7 5F                      pop edi
:0044ACF8 A3883B4500              mov dword ptr [00453B88], eax
:0044ACFD B8FFFFFFFF              mov eax, FFFFFFFF
:0044AD02 5E                      pop esi
:0044AD03 5B                      pop ebx
:0044AD04 81C418040000            add esp, 00000418
:0044AD0A C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044ACE6(C)
|
:0044AD0B 8B442410                mov eax, dword ptr [esp+10]
:0044AD0F 50                      push eax
:0044AD10 E89B020000              call 0044AFB0
:0044AD15 83C404                  add esp, 00000004
:0044AD18 B8FFFFFFFF              mov eax, FFFFFFFF
:0044AD1D 5D                      pop ebp
:0044AD1E 5F                      pop edi
:0044AD1F 5E                      pop esi
:0044AD20 5B                      pop ebx
:0044AD21 81C418040000            add esp, 00000418
:0044AD27 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044ACDF(C)
|
:0044AD28 8B442418                mov eax, dword ptr [esp+18]
:0044AD2C 8B4C241C                mov ecx, dword ptr [esp+1C]
:0044AD30 8B10                    mov edx, dword ptr [eax]
:0044AD32 F6440A0440              test [edx+ecx+04], 40
:0044AD37 7419                    je 0044AD52
:0044AD39 8B842430040000          mov eax, dword ptr [esp+00000430]
:0044AD40 80381A                  cmp byte ptr [eax], 1A
:0044AD43 750D                    jne 0044AD52
:0044AD45 33C0                    xor eax, eax
:0044AD47 5D                      pop ebp
:0044AD48 5F                      pop edi
:0044AD49 5E                      pop esi
:0044AD4A 5B                      pop ebx
:0044AD4B 81C418040000            add esp, 00000418
:0044AD51 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044AD37(C), :0044AD43(C)
|
:0044AD52 B8FFFFFFFF              mov eax, FFFFFFFF
:0044AD57 5D                      pop ebp
:0044AD58 C705843B45001C000000    mov dword ptr [00453B84], 0000001C
:0044AD62 C705883B450000000000    mov dword ptr [00453B88], 00000000
:0044AD6C 5F                      pop edi
:0044AD6D 5E                      pop esi
:0044AD6E 5B                      pop ebx
:0044AD6F 81C418040000            add esp, 00000418
:0044AD75 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044ACD4(C)
|
:0044AD76 8B442420                mov eax, dword ptr [esp+20]
:0044AD7A 5D                      pop ebp
:0044AD7B 2BC6                    sub eax, esi
:0044AD7D 5F                      pop edi
:0044AD7E 5E                      pop esi
:0044AD7F 5B                      pop ebx
:0044AD80 81C418040000            add esp, 00000418
:0044AD86 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044AB94(C), :0044ABC5(C)
|
:0044AD87 B8FFFFFFFF              mov eax, FFFFFFFF
:0044AD8C 5D                      pop ebp
:0044AD8D C705843B450009000000    mov dword ptr [00453B84], 00000009
:0044AD97 C705883B450000000000    mov dword ptr [00453B88], 00000000
:0044ADA1 5F                      pop edi
:0044ADA2 5E                      pop esi
:0044ADA3 5B                      pop ebx
:0044ADA4 81C418040000            add esp, 00000418
:0044ADAA C3                      ret


:0044ADAB CC                      int 03
:0044ADAC CC                      int 03
:0044ADAD CC                      int 03
:0044ADAE CC                      int 03
:0044ADAF CC                      int 03

* Referenced by a CALL at Addresses:
|:0044A841   , :0044A860   
|
:0044ADB0 56                      push esi
:0044ADB1 57                      push edi
:0044ADB2 8B7C240C                mov edi, dword ptr [esp+0C]
:0044ADB6 0FAF7C2410              imul edi, dword ptr [esp+10]
:0044ADBB 85FF                    test edi, edi
:0044ADBD 7505                    jne 0044ADC4
:0044ADBF BF01000000              mov edi, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044ADBD(C)
|

* Reference To: KERNEL32.HeapAlloc, Ord:0153h
                                  |
:0044ADC4 8B35C4734700            mov esi, dword ptr [004773C4]
:0044ADCA A1A06B4700              mov eax, dword ptr [00476BA0]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044ADFB(C)
|
:0044ADCF 83FFE0                  cmp edi, FFFFFFE0
:0044ADD2 7604                    jbe 0044ADD8
:0044ADD4 33C0                    xor eax, eax
:0044ADD6 EB06                    jmp 0044ADDE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044ADD2(C)
|
:0044ADD8 57                      push edi
:0044ADD9 6A08                    push 00000008
:0044ADDB 50                      push eax
:0044ADDC FFD6                    call esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044ADD6(U)
|
:0044ADDE 85C0                    test eax, eax
:0044ADE0 751D                    jne 0044ADFF
:0044ADE2 833D3442450000          cmp dword ptr [00454234], 00000000
:0044ADE9 7414                    je 0044ADFF
:0044ADEB 57                      push edi
:0044ADEC E8FFD9FFFF              call 004487F0
:0044ADF1 83C404                  add esp, 00000004
:0044ADF4 85C0                    test eax, eax
:0044ADF6 A1A06B4700              mov eax, dword ptr [00476BA0]
:0044ADFB 75D2                    jne 0044ADCF
:0044ADFD 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044ADE0(C), :0044ADE9(C)
|
:0044ADFF 5F                      pop edi
:0044AE00 5E                      pop esi
:0044AE01 C3                      ret


:0044AE02 CC                      int 03
:0044AE03 CC                      int 03
:0044AE04 CC                      int 03
:0044AE05 CC                      int 03
:0044AE06 CC                      int 03
:0044AE07 CC                      int 03
:0044AE08 CC                      int 03
:0044AE09 CC                      int 03
:0044AE0A CC                      int 03
:0044AE0B CC                      int 03
:0044AE0C CC                      int 03
:0044AE0D CC                      int 03
:0044AE0E CC                      int 03
:0044AE0F CC                      int 03

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A8EE(U)
|
:0044AE10 53                      push ebx
:0044AE11 56                      push esi
:0044AE12 57                      push edi
:0044AE13 33F6                    xor esi, esi
:0044AE15 55                      push ebp
:0044AE16 BF03000000              mov edi, 00000003
:0044AE1B 393D905B4700            cmp dword ptr [00475B90], edi
:0044AE21 7E59                    jle 0044AE7C
:0044AE23 BB0C000000              mov ebx, 0000000C
:0044AE28 BD83000000              mov ebp, 00000083

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044AE7A(C)
|
:0044AE2D A1945B4700              mov eax, dword ptr [00475B94]
:0044AE32 8B0418                  mov eax, dword ptr [eax+ebx]
:0044AE35 85C0                    test eax, eax
:0044AE37 7437                    je 0044AE70
:0044AE39 85680C                  test dword ptr [eax+0C], ebp
:0044AE3C 740F                    je 0044AE4D
:0044AE3E 50                      push eax
:0044AE3F E89C020000              call 0044B0E0
:0044AE44 83C404                  add esp, 00000004
:0044AE47 83F8FF                  cmp eax, FFFFFFFF
:0044AE4A 7401                    je 0044AE4D
:0044AE4C 46                      inc esi

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044AE3C(C), :0044AE4A(C)
|
:0044AE4D 83FB50                  cmp ebx, 00000050
:0044AE50 7C1E                    jl 0044AE70
:0044AE52 A1945B4700              mov eax, dword ptr [00475B94]
:0044AE57 8B0C18                  mov ecx, dword ptr [eax+ebx]
:0044AE5A 51                      push ecx
:0044AE5B E860F6FFFF              call 0044A4C0
:0044AE60 83C404                  add esp, 00000004
:0044AE63 8B0D945B4700            mov ecx, dword ptr [00475B94]
:0044AE69 C7041900000000          mov dword ptr [ecx+ebx], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044AE37(C), :0044AE50(C)
|
:0044AE70 83C304                  add ebx, 00000004
:0044AE73 47                      inc edi
:0044AE74 393D905B4700            cmp dword ptr [00475B90], edi
:0044AE7A 7FB1                    jg 0044AE2D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044AE21(C)
|
:0044AE7C 8BC6                    mov eax, esi
:0044AE7E 5D                      pop ebp
:0044AE7F 5F                      pop edi
:0044AE80 5E                      pop esi
:0044AE81 5B                      pop ebx
:0044AE82 C3                      ret


:0044AE83 CC                      int 03
:0044AE84 CC                      int 03
:0044AE85 CC                      int 03
:0044AE86 CC                      int 03
:0044AE87 CC                      int 03
:0044AE88 CC                      int 03
:0044AE89 CC                      int 03
:0044AE8A CC                      int 03
:0044AE8B CC                      int 03
:0044AE8C CC                      int 03
:0044AE8D CC                      int 03
:0044AE8E CC                      int 03
:0044AE8F CC                      int 03

* Referenced by a CALL at Address:
|:0044B10E   
|
:0044AE90 56                      push esi
:0044AE91 8B742408                mov esi, dword ptr [esp+08]
:0044AE95 8B460C                  mov eax, dword ptr [esi+0C]
:0044AE98 A883                    test al, 83
:0044AE9A 742B                    je 0044AEC7
:0044AE9C A808                    test al, 08
:0044AE9E 7427                    je 0044AEC7
:0044AEA0 8B4608                  mov eax, dword ptr [esi+08]
:0044AEA3 50                      push eax
:0044AEA4 E817F6FFFF              call 0044A4C0
:0044AEA9 83C404                  add esp, 00000004
:0044AEAC C70600000000            mov dword ptr [esi], 00000000
:0044AEB2 81660CF7FBFFFF          and dword ptr [esi+0C], FFFFFBF7
:0044AEB9 C7460800000000          mov [esi+08], 00000000
:0044AEC0 C7460400000000          mov [esi+04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044AE9A(C), :0044AE9E(C)
|
:0044AEC7 5E                      pop esi
:0044AEC8 C3                      ret


:0044AEC9 CC                      int 03
:0044AECA CC                      int 03
:0044AECB CC                      int 03
:0044AECC CC                      int 03
:0044AECD CC                      int 03
:0044AECE CC                      int 03
:0044AECF CC                      int 03

* Referenced by a CALL at Address:
|:0044B2BC   
|
:0044AED0 8B4C2404                mov ecx, dword ptr [esp+04]
:0044AED4 56                      push esi
:0044AED5 57                      push edi
:0044AED6 390DA46B4700            cmp dword ptr [00476BA4], ecx
:0044AEDC 7666                    jbe 0044AF44
:0044AEDE 8BC1                    mov eax, ecx
:0044AEE0 83E0E7                  and eax, FFFFFFE7
:0044AEE3 C1F803                  sar eax, 03
:0044AEE6 8DB8B06B4700            lea edi, dword ptr [eax+00476BB0]
:0044AEEC 8BC1                    mov eax, ecx
:0044AEEE 83E01F                  and eax, 0000001F
:0044AEF1 8D34C500000000          lea esi, dword ptr [8*eax+00000000]
:0044AEF8 8B07                    mov eax, dword ptr [edi]
:0044AEFA 03C6                    add eax, esi
:0044AEFC F6400401                test [eax+04], 01
:0044AF00 7442                    je 0044AF44
:0044AF02 8338FF                  cmp dword ptr [eax], FFFFFFFF
:0044AF05 743D                    je 0044AF44
:0044AF07 833D803B450001          cmp dword ptr [00453B80], 00000001
:0044AF0E 7526                    jne 0044AF36
:0044AF10 85C9                    test ecx, ecx
:0044AF12 740C                    je 0044AF20
:0044AF14 83F901                  cmp ecx, 00000001
:0044AF17 740D                    je 0044AF26
:0044AF19 83F902                  cmp ecx, 00000002
:0044AF1C 740E                    je 0044AF2C
:0044AF1E EB16                    jmp 0044AF36

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044AF12(C)
|
:0044AF20 6A00                    push 00000000
:0044AF22 6AF6                    push FFFFFFF6
:0044AF24 EB0A                    jmp 0044AF30

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044AF17(C)
|
:0044AF26 6A00                    push 00000000
:0044AF28 6AF5                    push FFFFFFF5
:0044AF2A EB04                    jmp 0044AF30

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044AF1C(C)
|
:0044AF2C 6A00                    push 00000000
:0044AF2E 6AF4                    push FFFFFFF4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044AF24(U), :0044AF2A(U)
|

* Reference To: KERNEL32.SetStdHandle, Ord:0206h
                                  |
:0044AF30 FF1558734700            Call dword ptr [00477358]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044AF0E(C), :0044AF1E(U)
|
:0044AF36 8B07                    mov eax, dword ptr [edi]
:0044AF38 5F                      pop edi
:0044AF39 C70430FFFFFFFF          mov dword ptr [eax+esi], FFFFFFFF
:0044AF40 33C0                    xor eax, eax
:0044AF42 5E                      pop esi
:0044AF43 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044AEDC(C), :0044AF00(C), :0044AF05(C)
|
:0044AF44 B8FFFFFFFF              mov eax, FFFFFFFF
:0044AF49 5F                      pop edi
:0044AF4A C705843B450009000000    mov dword ptr [00453B84], 00000009
:0044AF54 C705883B450000000000    mov dword ptr [00453B88], 00000000
:0044AF5E 5E                      pop esi
:0044AF5F C3                      ret



* Referenced by a CALL at Addresses:
|:0044AB38   , :0044B057   , :0044B283   , :0044B28F   , :0044B29C   
|
:0044AF60 8B4C2404                mov ecx, dword ptr [esp+04]
:0044AF64 390DA46B4700            cmp dword ptr [00476BA4], ecx
:0044AF6A 761D                    jbe 0044AF89
:0044AF6C 8BC1                    mov eax, ecx
:0044AF6E 83E11F                  and ecx, 0000001F
:0044AF71 83E0E7                  and eax, FFFFFFE7
:0044AF74 C1F803                  sar eax, 03
:0044AF77 8B90B06B4700            mov edx, dword ptr [eax+00476BB0]
:0044AF7D 8D04CA                  lea eax, dword ptr [edx+8*ecx]
:0044AF80 F6400401                test [eax+04], 01
:0044AF84 7403                    je 0044AF89
:0044AF86 8B00                    mov eax, dword ptr [eax]
:0044AF88 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044AF6A(C), :0044AF84(C)
|
:0044AF89 C705843B450009000000    mov dword ptr [00453B84], 00000009
:0044AF93 C705883B450000000000    mov dword ptr [00453B88], 00000000
:0044AF9D B8FFFFFFFF              mov eax, FFFFFFFF
:0044AFA2 C3                      ret


:0044AFA3 CC                      int 03
:0044AFA4 CC                      int 03
:0044AFA5 CC                      int 03
:0044AFA6 CC                      int 03
:0044AFA7 CC                      int 03
:0044AFA8 CC                      int 03
:0044AFA9 CC                      int 03
:0044AFAA CC                      int 03
:0044AFAB CC                      int 03
:0044AFAC CC                      int 03
:0044AFAD CC                      int 03
:0044AFAE CC                      int 03
:0044AFAF CC                      int 03

* Referenced by a CALL at Addresses:
|:0044AD10   , :0044B0A1   , :0044B2C9   
|
:0044AFB0 8B442404                mov eax, dword ptr [esp+04]
:0044AFB4 33C9                    xor ecx, ecx

* Possible StringData Ref from Data Obj ->""
                                  |
:0044AFB6 BA70474500              mov edx, 00454770
:0044AFBB A3883B4500              mov dword ptr [00453B88], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044AFCE(C)
|
:0044AFC0 3902                    cmp dword ptr [edx], eax
:0044AFC2 7421                    je 0044AFE5
:0044AFC4 83C208                  add edx, 00000008
:0044AFC7 41                      inc ecx
:0044AFC8 81FAD8484500            cmp edx, 004548D8
:0044AFCE 72F0                    jb 0044AFC0
:0044AFD0 83F813                  cmp eax, 00000013
:0044AFD3 721D                    jb 0044AFF2
:0044AFD5 83F824                  cmp eax, 00000024
:0044AFD8 7718                    ja 0044AFF2
:0044AFDA C705843B45000D000000    mov dword ptr [00453B84], 0000000D
:0044AFE4 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044AFC2(C)
|
:0044AFE5 8B04CD74474500          mov eax, dword ptr [8*ecx+00454774]
:0044AFEC A3843B4500              mov dword ptr [00453B84], eax
:0044AFF1 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044AFD3(C), :0044AFD8(C)
|
:0044AFF2 3DBC000000              cmp eax, 000000BC
:0044AFF7 7212                    jb 0044B00B
:0044AFF9 3DCA000000              cmp eax, 000000CA
:0044AFFE 770B                    ja 0044B00B
:0044B000 C705843B450008000000    mov dword ptr [00453B84], 00000008
:0044B00A C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044AFF7(C), :0044AFFE(C)
|
:0044B00B C705843B450016000000    mov dword ptr [00453B84], 00000016
:0044B015 C3                      ret


:0044B016 CC                      int 03
:0044B017 CC                      int 03
:0044B018 CC                      int 03
:0044B019 CC                      int 03
:0044B01A CC                      int 03
:0044B01B CC                      int 03
:0044B01C CC                      int 03
:0044B01D CC                      int 03
:0044B01E CC                      int 03
:0044B01F CC                      int 03

* Referenced by a CALL at Address:
|:0044ABF2   
|
:0044B020 8B4C2404                mov ecx, dword ptr [esp+04]
:0044B024 53                      push ebx
:0044B025 56                      push esi
:0044B026 3B0DA46B4700            cmp ecx, dword ptr [00476BA4]
:0044B02C 57                      push edi
:0044B02D 0F838C000000            jnb 0044B0BF
:0044B033 8BC1                    mov eax, ecx
:0044B035 83E0E7                  and eax, FFFFFFE7
:0044B038 C1F803                  sar eax, 03
:0044B03B 8DB8B06B4700            lea edi, dword ptr [eax+00476BB0]
:0044B041 8BC1                    mov eax, ecx
:0044B043 83E01F                  and eax, 0000001F
:0044B046 8B17                    mov edx, dword ptr [edi]
:0044B048 8D34C500000000          lea esi, dword ptr [8*eax+00000000]
:0044B04F F644320401              test [edx+esi+04], 01
:0044B054 7469                    je 0044B0BF
:0044B056 51                      push ecx
:0044B057 E804FFFFFF              call 0044AF60
:0044B05C 83C404                  add esp, 00000004
:0044B05F 83F8FF                  cmp eax, FFFFFFFF
:0044B062 7513                    jne 0044B077
:0044B064 B8FFFFFFFF              mov eax, FFFFFFFF
:0044B069 5F                      pop edi
:0044B06A C705843B450009000000    mov dword ptr [00453B84], 00000009
:0044B074 5E                      pop esi
:0044B075 5B                      pop ebx
:0044B076 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B062(C)
|
:0044B077 8B4C2418                mov ecx, dword ptr [esp+18]
:0044B07B 8B542414                mov edx, dword ptr [esp+14]
:0044B07F 51                      push ecx
:0044B080 6A00                    push 00000000
:0044B082 52                      push edx
:0044B083 50                      push eax

* Reference To: KERNEL32.SetFilePointer, Ord:01F8h
                                  |
:0044B084 FF15A4734700            Call dword ptr [004773A4]
:0044B08A 83F8FF                  cmp eax, FFFFFFFF
:0044B08D 8BD8                    mov ebx, eax
:0044B08F B800000000              mov eax, 00000000
:0044B094 7506                    jne 0044B09C

* Reference To: KERNEL32.GetLastError, Ord:00E1h
                                  |
:0044B096 FF1594734700            Call dword ptr [00477394]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B094(C)
|
:0044B09C 85C0                    test eax, eax
:0044B09E 7412                    je 0044B0B2
:0044B0A0 50                      push eax
:0044B0A1 E80AFFFFFF              call 0044AFB0
:0044B0A6 83C404                  add esp, 00000004
:0044B0A9 B8FFFFFFFF              mov eax, FFFFFFFF
:0044B0AE 5F                      pop edi
:0044B0AF 5E                      pop esi
:0044B0B0 5B                      pop ebx
:0044B0B1 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B09E(C)
|
:0044B0B2 8B07                    mov eax, dword ptr [edi]
:0044B0B4 5F                      pop edi
:0044B0B5 80643004FD              and byte ptr [eax+esi+04], FD
:0044B0BA 8BC3                    mov eax, ebx
:0044B0BC 5E                      pop esi
:0044B0BD 5B                      pop ebx
:0044B0BE C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044B02D(C), :0044B054(C)
|
:0044B0BF B8FFFFFFFF              mov eax, FFFFFFFF
:0044B0C4 5F                      pop edi
:0044B0C5 C705843B450009000000    mov dword ptr [00453B84], 00000009
:0044B0CF C705883B450000000000    mov dword ptr [00453B88], 00000000
:0044B0D9 5E                      pop esi
:0044B0DA 5B                      pop ebx
:0044B0DB C3                      ret


:0044B0DC CC                      int 03
:0044B0DD CC                      int 03
:0044B0DE CC                      int 03
:0044B0DF CC                      int 03

* Referenced by a CALL at Address:
|:0044AE3F   
|
:0044B0E0 56                      push esi
:0044B0E1 57                      push edi
:0044B0E2 BFFFFFFFFF              mov edi, FFFFFFFF
:0044B0E7 8B74240C                mov esi, dword ptr [esp+0C]
:0044B0EB 8B460C                  mov eax, dword ptr [esi+0C]
:0044B0EE A840                    test al, 40
:0044B0F0 740C                    je 0044B0FE
:0044B0F2 C7460C00000000          mov [esi+0C], 00000000
:0044B0F9 8BC7                    mov eax, edi
:0044B0FB 5F                      pop edi
:0044B0FC 5E                      pop esi
:0044B0FD C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B0F0(C)
|
:0044B0FE A883                    test al, 83
:0044B100 7442                    je 0044B144
:0044B102 56                      push esi
:0044B103 E818F6FFFF              call 0044A720
:0044B108 83C404                  add esp, 00000004
:0044B10B 8BF8                    mov edi, eax
:0044B10D 56                      push esi
:0044B10E E87DFDFFFF              call 0044AE90
:0044B113 83C404                  add esp, 00000004
:0044B116 8B4610                  mov eax, dword ptr [esi+10]
:0044B119 50                      push eax
:0044B11A E821010000              call 0044B240
:0044B11F 83C404                  add esp, 00000004
:0044B122 85C0                    test eax, eax
:0044B124 7D07                    jge 0044B12D
:0044B126 BFFFFFFFFF              mov edi, FFFFFFFF
:0044B12B EB17                    jmp 0044B144

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B124(C)
|
:0044B12D 8B461C                  mov eax, dword ptr [esi+1C]
:0044B130 85C0                    test eax, eax
:0044B132 7410                    je 0044B144
:0044B134 50                      push eax
:0044B135 E886F3FFFF              call 0044A4C0
:0044B13A C7461C00000000          mov [esi+1C], 00000000
:0044B141 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044B100(C), :0044B12B(U), :0044B132(C)
|
:0044B144 C7460C00000000          mov [esi+0C], 00000000
:0044B14B 8BC7                    mov eax, edi
:0044B14D 5F                      pop edi
:0044B14E 5E                      pop esi
:0044B14F C3                      ret


:0044B150 53                      push ebx
:0044B151 56                      push esi
:0044B152 8B442418                mov eax, dword ptr [esp+18]
:0044B156 0BC0                    or eax, eax
:0044B158 7518                    jne 0044B172
:0044B15A 8B4C2414                mov ecx, dword ptr [esp+14]
:0044B15E 8B442410                mov eax, dword ptr [esp+10]
:0044B162 33D2                    xor edx, edx
:0044B164 F7F1                    div ecx
:0044B166 8BD8                    mov ebx, eax
:0044B168 8B44240C                mov eax, dword ptr [esp+0C]
:0044B16C F7F1                    div ecx
:0044B16E 8BD3                    mov edx, ebx
:0044B170 EB41                    jmp 0044B1B3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B158(C)
|
:0044B172 8BC8                    mov ecx, eax
:0044B174 8B5C2414                mov ebx, dword ptr [esp+14]
:0044B178 8B542410                mov edx, dword ptr [esp+10]
:0044B17C 8B44240C                mov eax, dword ptr [esp+0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B18A(C)
|
:0044B180 D1E9                    shr ecx, 1
:0044B182 D1DB                    rcr ebx, 1
:0044B184 D1EA                    shr edx, 1
:0044B186 D1D8                    rcr eax, 1
:0044B188 0BC9                    or ecx, ecx
:0044B18A 75F4                    jne 0044B180
:0044B18C F7F3                    div ebx
:0044B18E 8BF0                    mov esi, eax
:0044B190 F7642418                mul [esp+18]
:0044B194 8BC8                    mov ecx, eax
:0044B196 8B442414                mov eax, dword ptr [esp+14]
:0044B19A F7E6                    mul esi
:0044B19C 03D1                    add edx, ecx
:0044B19E 720E                    jb 0044B1AE
:0044B1A0 3B542410                cmp edx, dword ptr [esp+10]
:0044B1A4 7708                    ja 0044B1AE
:0044B1A6 7207                    jb 0044B1AF
:0044B1A8 3B44240C                cmp eax, dword ptr [esp+0C]
:0044B1AC 7601                    jbe 0044B1AF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044B19E(C), :0044B1A4(C)
|
:0044B1AE 4E                      dec esi

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044B1A6(C), :0044B1AC(C)
|
:0044B1AF 33D2                    xor edx, edx
:0044B1B1 8BC6                    mov eax, esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B170(U)
|
:0044B1B3 5E                      pop esi
:0044B1B4 5B                      pop ebx
:0044B1B5 C21000                  ret 0010


:0044B1B8 CC                      int 03
:0044B1B9 CC                      int 03
:0044B1BA CC                      int 03
:0044B1BB CC                      int 03
:0044B1BC CC                      int 03
:0044B1BD CC                      int 03
:0044B1BE CC                      int 03
:0044B1BF CC                      int 03
:0044B1C0 53                      push ebx
:0044B1C1 8B442414                mov eax, dword ptr [esp+14]
:0044B1C5 0BC0                    or eax, eax
:0044B1C7 7518                    jne 0044B1E1
:0044B1C9 8B4C2410                mov ecx, dword ptr [esp+10]
:0044B1CD 8B44240C                mov eax, dword ptr [esp+0C]
:0044B1D1 33D2                    xor edx, edx
:0044B1D3 F7F1                    div ecx
:0044B1D5 8B442408                mov eax, dword ptr [esp+08]
:0044B1D9 F7F1                    div ecx
:0044B1DB 8BC2                    mov eax, edx
:0044B1DD 33D2                    xor edx, edx
:0044B1DF EB50                    jmp 0044B231

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B1C7(C)
|
:0044B1E1 8BC8                    mov ecx, eax
:0044B1E3 8B5C2410                mov ebx, dword ptr [esp+10]
:0044B1E7 8B54240C                mov edx, dword ptr [esp+0C]
:0044B1EB 8B442408                mov eax, dword ptr [esp+08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B1F9(C)
|
:0044B1EF D1E9                    shr ecx, 1
:0044B1F1 D1DB                    rcr ebx, 1
:0044B1F3 D1EA                    shr edx, 1
:0044B1F5 D1D8                    rcr eax, 1
:0044B1F7 0BC9                    or ecx, ecx
:0044B1F9 75F4                    jne 0044B1EF
:0044B1FB F7F3                    div ebx
:0044B1FD 8BC8                    mov ecx, eax
:0044B1FF F7642414                mul [esp+14]
:0044B203 91                      xchg eax,ecx
:0044B204 F7642410                mul [esp+10]
:0044B208 03D1                    add edx, ecx
:0044B20A 720E                    jb 0044B21A
:0044B20C 3B54240C                cmp edx, dword ptr [esp+0C]
:0044B210 7708                    ja 0044B21A
:0044B212 720E                    jb 0044B222
:0044B214 3B442408                cmp eax, dword ptr [esp+08]
:0044B218 7608                    jbe 0044B222

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044B20A(C), :0044B210(C)
|
:0044B21A 2B442410                sub eax, dword ptr [esp+10]
:0044B21E 1B542414                sbb edx, dword ptr [esp+14]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044B212(C), :0044B218(C)
|
:0044B222 2B442408                sub eax, dword ptr [esp+08]
:0044B226 1B54240C                sbb edx, dword ptr [esp+0C]
:0044B22A F7DA                    neg edx
:0044B22C F7D8                    neg eax
:0044B22E 83DA00                  sbb edx, 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B1DF(U)
|
:0044B231 5B                      pop ebx
:0044B232 C21000                  ret 0010


:0044B235 CC                      int 03
:0044B236 CC                      int 03
:0044B237 CC                      int 03
:0044B238 CC                      int 03
:0044B239 CC                      int 03
:0044B23A CC                      int 03
:0044B23B CC                      int 03
:0044B23C CC                      int 03
:0044B23D CC                      int 03
:0044B23E CC                      int 03
:0044B23F CC                      int 03

* Referenced by a CALL at Address:
|:0044B11A   
|
:0044B240 53                      push ebx
:0044B241 56                      push esi
:0044B242 57                      push edi
:0044B243 55                      push ebp
:0044B244 8B7C2414                mov edi, dword ptr [esp+14]
:0044B248 393DA46B4700            cmp dword ptr [00476BA4], edi
:0044B24E 0F8695000000            jbe 0044B2E9
:0044B254 8BC7                    mov eax, edi
:0044B256 83E0E7                  and eax, FFFFFFE7
:0044B259 C1F803                  sar eax, 03
:0044B25C 8D98B06B4700            lea ebx, dword ptr [eax+00476BB0]
:0044B262 8BC7                    mov eax, edi
:0044B264 83E01F                  and eax, 0000001F
:0044B267 8B0B                    mov ecx, dword ptr [ebx]
:0044B269 8D34C500000000          lea esi, dword ptr [8*eax+00000000]
:0044B270 F644310401              test [ecx+esi+04], 01
:0044B275 7472                    je 0044B2E9
:0044B277 83FF01                  cmp edi, 00000001
:0044B27A 7405                    je 0044B281
:0044B27C 83FF02                  cmp edi, 00000002
:0044B27F 751A                    jne 0044B29B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B27A(C)
|
:0044B281 6A01                    push 00000001
:0044B283 E8D8FCFFFF              call 0044AF60
:0044B288 83C404                  add esp, 00000004
:0044B28B 8BE8                    mov ebp, eax
:0044B28D 6A02                    push 00000002
:0044B28F E8CCFCFFFF              call 0044AF60
:0044B294 83C404                  add esp, 00000004
:0044B297 3BE8                    cmp ebp, eax
:0044B299 741E                    je 0044B2B9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B27F(C)
|
:0044B29B 57                      push edi
:0044B29C E8BFFCFFFF              call 0044AF60
:0044B2A1 83C404                  add esp, 00000004
:0044B2A4 50                      push eax

* Reference To: KERNEL32.CloseHandle, Ord:0016h
                                  |
:0044B2A5 FF1590734700            Call dword ptr [00477390]
:0044B2AB 85C0                    test eax, eax
:0044B2AD 750A                    jne 0044B2B9

* Reference To: KERNEL32.GetLastError, Ord:00E1h
                                  |
:0044B2AF FF1594734700            Call dword ptr [00477394]
:0044B2B5 8BE8                    mov ebp, eax
:0044B2B7 EB02                    jmp 0044B2BB

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044B299(C), :0044B2AD(C)
|
:0044B2B9 33ED                    xor ebp, ebp

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B2B7(U)
|
:0044B2BB 57                      push edi
:0044B2BC E80FFCFFFF              call 0044AED0
:0044B2C1 83C404                  add esp, 00000004
:0044B2C4 85ED                    test ebp, ebp
:0044B2C6 7413                    je 0044B2DB
:0044B2C8 55                      push ebp
:0044B2C9 E8E2FCFFFF              call 0044AFB0
:0044B2CE 83C404                  add esp, 00000004
:0044B2D1 B8FFFFFFFF              mov eax, FFFFFFFF
:0044B2D6 5D                      pop ebp
:0044B2D7 5F                      pop edi
:0044B2D8 5E                      pop esi
:0044B2D9 5B                      pop ebx
:0044B2DA C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B2C6(C)
|
:0044B2DB 8B03                    mov eax, dword ptr [ebx]
:0044B2DD 5D                      pop ebp
:0044B2DE 5F                      pop edi
:0044B2DF C644300400              mov [eax+esi+04], 00
:0044B2E4 33C0                    xor eax, eax
:0044B2E6 5E                      pop esi
:0044B2E7 5B                      pop ebx
:0044B2E8 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044B24E(C), :0044B275(C)
|
:0044B2E9 B8FFFFFFFF              mov eax, FFFFFFFF
:0044B2EE 5D                      pop ebp
:0044B2EF C705843B450009000000    mov dword ptr [00453B84], 00000009
:0044B2F9 C705883B450000000000    mov dword ptr [00453B88], 00000000
:0044B303 5F                      pop edi
:0044B304 5E                      pop esi
:0044B305 5B                      pop ebx
:0044B306 C3                      ret


:0044B307 CC                      int 03
:0044B308 CC                      int 03
:0044B309 CC                      int 03
:0044B30A CC                      int 03
:0044B30B CC                      int 03
:0044B30C CC                      int 03
:0044B30D CC                      int 03
:0044B30E CC                      int 03
:0044B30F CC                      int 03
:0044B310 6A02                    push 00000002
:0044B312 E8E9D2FFFF              call 00448600
:0044B317 83C404                  add esp, 00000004
:0044B31A C3                      ret


:0044B31B CC                      int 03

* Referenced by a CALL at Addresses:
|:00447F0B   , :00448087   
|

* Reference To: KERNEL32.RtlUnwind, Ord:01C7h
                                  |
:0044B31C FF25A8734700            Jmp dword ptr [004773A8]
:0044B322 00000000000000000000    BYTE 10 DUP(0)
:0044B32C 00000000000000000000    BYTE 10 DUP(0)
:0044B336 00000000000000000000    BYTE 10 DUP(0)
:0044B340 00000000000000000000    BYTE 10 DUP(0)
:0044B34A 00000000000000000000    BYTE 10 DUP(0)
:0044B354 00000000000000000000    BYTE 10 DUP(0)
:0044B35E 00000000000000000000    BYTE 10 DUP(0)
:0044B368 00000000000000000000    BYTE 10 DUP(0)
:0044B372 00000000000000000000    BYTE 10 DUP(0)
:0044B37C 00000000000000000000    BYTE 10 DUP(0)
:0044B386 00000000000000000000    BYTE 10 DUP(0)
:0044B390 00000000000000000000    BYTE 10 DUP(0)
:0044B39A 00000000000000000000    BYTE 10 DUP(0)
:0044B3A4 00000000000000000000    BYTE 10 DUP(0)
:0044B3AE 00000000000000000000    BYTE 10 DUP(0)
:0044B3B8 00000000000000000000    BYTE 10 DUP(0)
:0044B3C2 00000000000000000000    BYTE 10 DUP(0)
:0044B3CC 00000000000000000000    BYTE 10 DUP(0)
:0044B3D6 00000000000000000000    BYTE 10 DUP(0)
:0044B3E0 00000000000000000000    BYTE 10 DUP(0)
:0044B3EA 00000000000000000000    BYTE 10 DUP(0)
:0044B3F4 00000000000000000000    BYTE 10 DUP(0)
:0044B3FE 0000427B440000000000    BYTE 10 DUP(0)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
:FFFFFFFF    End Of Listing
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
